Meeting of the Parliament

Meeting date: Tuesday, March 10, 2020

Official Report 1009KB pdf

---

Scottish Biometrics Commissioner Bill: Stage 3

We turn to stage 3 proceedings on the Scottish Biometrics Commissioner Bill. Members should have with them the bill as amended at stage 2, the marshalled list and the groupings of amendments.

As normal, the division bell will sound and proceedings will be suspended for five minutes for the first division of the afternoon. The period of voting for the first division will be 30 seconds. Thereafter, the period of voting for the first division after a debate will be one minute.

Members who wish to speak in the debate on any group of amendments should press their request-to-speak buttons as soon as I call the group.

I turn to the bill and the marshalled list.

Section 2—Functions

Amendment 19, in the name of John Finnie, is grouped with amendments 23 to 26.

As we know, the pace of technological change in the field of biometric technologies is rapid. That is why it is vital that biometric technologies are expressly mentioned in the bill.

I thank the Cabinet Secretary for Justice for working with me to refine my stage 2 amendments. My amendments now make it clear that biometric technologies are as much a part of the commissioner’s scrutiny arrangements as biometric data, as I shall explain.

Amendment 19 requires that, when reviewing the law, policy and practice relating to biometric data, or promoting public awareness of powers and duties that relevant policing bodies have in relation to biometric data,

“the Commissioner is to have regard to the technology used or capable of being used for the purpose of acquiring, retaining, using or destroying biometric data.”

The phrase “capable of being used” is very important, as it includes technology that is available for use but not yet deployed, such as facial recognition technology. The legal and ethical use of technology by Police Scotland is, of course, a matter that I and other members view as being of great importance, given its impact on human rights, such as the right to privacy. It is therefore important that the new commissioner is able to provide views on such matters through reviews, the code of practice, reports and recommendations.

With that in mind, amendment 23 makes it explicit that, in a report that is issued under section 15, the commissioner may make a recommendation in relation to technologies that are used or are capable of being used to collect, retain, use or destroy biometric data.

Amendment 24 provides that, where such a recommendation is made, the commissioner “must” rather than “may” impose a requirement to respond on the relevant policing body. That is important for promoting transparency and accountability.

The amendments work with the existing provisions in section 16 so that the person on whom a requirement to respond is imposed must provide a written statement to the commissioner that sets out the action that they are taking or not taking in response to the recommendation. Thereafter, the commissioner is required to publish the written statement and lay it before Parliament, as is already provided for in section 17.

Amendment 25 clarifies that, where a recommendation that is issued under section 15 does not relate to biometric technologies, the commissioner can choose whether to impose a requirement to respond.

Amendment 26 is a minor consequential amendment associated with amendment 24.

Taken together, the package of amendments will make for stronger scrutiny arrangements and greater transparency around the use and potential use of biometric technologies.

I move amendment 19.

At stage 2, John Finnie agreed to work with me to refine his intended amendments, which aimed to make explicit reference in the bill to biometric technologies. I am pleased that we have been able to build on Mr Finnie’s original amendment to make it even more effective in its coverage and relevance as far as the commissioner’s general functions are concerned. I particularly highlight the fact that, as Mr Finnie has just explained, amendment 19 now covers both technology that is in use and—this is important—technology that is capable of being used. Mr Finnie has already referred to facial recognition technology, which is not currently deployed by Police Scotland but certainly will be available for use and could be deployed by it in the future. The commissioner could include guidance on facial recognition technology in the code of practice or carry out a review of the law that relates to the use of that technology.

I very much support this group of amendments and I urge other members to support them, too.

Does John Finnie wish to add anything further?

I have nothing to add.

Amendment 19 agreed to.

Group 2 is on minor and technical amendments. Amendment 20, in the name of the cabinet secretary, is grouped with amendments 21, 9, 22, 12, 27 and 28.

The amendments in the group in my name make minor and technical changes to the bill. Amendments 20 and 21 adjust section 2(7), to move the definition of “children and young persons” from after the definition of “vulnerable persons” to before it. That simply allows the list to be arranged alphabetically—we know that civil servants love ordering lists alphabetically. The definition itself remains unchanged, and the amendments are for tidying-up purposes.

In a similar vein, amendments 22 and 27 make minor adjustments to references to the code of practice at various points in the bill.

Amendment 28 adjusts paragraph 11 of schedule 1 so that the commissioner must obtain the consent of the Scottish Parliamentary Corporate Body in relation to the number of staff that the commissioner may appoint. The amendment provides a means for the SPCB to manage staff numbers to assure the efficiency of the commissioner’s office.

Amendments 9 and 12, in the name of Liam Kerr, are technical amendments that I am happy to support. Section 6A lists a number of issues that the commissioner is to have regard to in preparing the code of practice. Those matters are currently termed “principles”, but they are not framed as principles. Therefore, amendments 9 and 12 replace the reference to “principles” while ensuring that regard is to be had to the importance of those matters. The amendments also remove the reference to revised codes of practice so that revised codes are dealt with in a consistent way in the bill, as provided for by my amendments 22 and 27.

I thank Liam Kerr for agreeing at stage 2 to work with me and my officials on the amendments and for getting to a very constructive space in that regard.

I move amendment 20.

I call Liam Kerr to speak to amendment 9 and the other amendments in the group.

16:30  

I thank the cabinet secretary for indicating his support for amendments 9 and 12 in my name. As the group title suggests, they are technical amendments that refine my stage 2 amendments to section 6A.

At stage 2, I inserted a requirement for the commissioner to “have regard to” certain important, high-level principles when preparing a code of practice. New section 6A was inserted into the bill as a result. Through amendment 12, I propose to change the opening words in section 6A so that it provides that, when preparing

“a draft code of practice, the Commissioner must have regard to the importance of”

the matters that are listed in that section—instead of referring to those matters as “principles”. That is because I recognise, as the cabinet secretary has said, that the matters that are listed in that section are not actually framed as principles.

Amendment 12 preserves the importance of the matters that are listed, including

“promoting and protecting human rights”

and

“ensuring the safety of individuals and communities”,

and it still requires the commissioner to “have regard to” them when preparing a code of practice.

The member will recall that at stage 2 we amended the bill to replace the phrase “have regard to” with the phrase “comply with”. He will remember all the arguments about strengthening the bill in that regard.

I am not persuaded that moving to a situation where we have

“regard to the importance of”

matters is anything other than a downgrading of a principle. It might just be about semantics, and I do not mean to be pedantic with the member on the issue. However, it seems to me that protecting human rights and the individual’s right to privacy are core principles, rather than matters that someone should simply have regard to. Will the member clarify that, please?

Yes, of course. Section 6A, as originally drafted, spoke to “principles”; it stated that the commissioner had to

“have regard to the following principles”.

However, the items on the list of matters that were designated as principles were not in fact framed as principles. Amendment 12, which redrafts the section, sets out that what follows are not to be considered to be principles—because they are not. It is a semantic point. They are, in fact, statements of what must be complied with. Does that make sense to Mr Finnie? Have I explained that reasonably well?

Yes—to a point. However, surely it is a sound principle that we should all be promoting and protecting human rights, rather than having

“regard to the importance of”

them. I am genuinely trying to understand this, because I want the process to be consensual.

I am grateful to Mr Finnie, because this is an important point. Section 6A originally referred to the commissioner having

“regard to the following principles”,

but the matters referred to in subsections 6A(a) to (d) are not in fact principles; they are not in the form of principles as such. It would, therefore, be semantically wrong to keep referring to them as “the following principles”, because they are not principles. It is entirely a semantic point. Amendment 12 tidies that up so that, in preparing

“a draft code of practice, the Commissioner must have regard to the importance of”

the following things, which are not principles, because they have not been drafted as principles. I guess that I am asking Mr Finnie to trust me on this one.

The reason for the change is a semantic one. As drafted at stage 2, the provision referred to “principles”, which are not principles. We will see whether Mr Finnie goes with me on this one.

Amendment 12 also deletes the specific mention of revised codes in order to allow them to be dealt with in a uniform way across the bill, as the cabinet secretary proposes. Crucially, however, it remains the case that regard must be had to the importance of matters that are set out in section 6A when a revised code of practice is being prepared.

Amendment 9, on the other hand, is a consequential change. Because the reference to “principles” would be removed from section 6A, the reference to “principles” in section 6(1) would also be removed.

I thank the cabinet secretary for working with me to refine the provisions. I ask members to support amendments 9 and 12.

I call the cabinet secretary to wind up on this group.

I have no further comments.

Amendment 20 agreed to.

Amendment 21 moved—[Humza Yousaf]—and agreed to.

Section 5—Duty to comply with directions

Group 3 is on an advisory group. Amendment 6, in the name of Liam McArthur, is grouped with amendment 18.

I hope to continue the generally consensual tone of previous contributions. Amendments 6 and 18 seek to put the advisory group on a statutory footing. The recommendation to do so was unanimously supported by the committee, as well as by many of the stakeholders and witnesses who gave evidence, yet it appeared nowhere in the bill as it was originally drafted—an omission that the Scottish Human Rights Commission described as “regrettable”. At stage 2, the cabinet secretary committed in principle to putting the advisory group on a statutory footing if work could be done to revise the relevant wording. I accepted that proposal, and amendments 6 and 18 reflect our collaborative work.

New section 22A will allow the commissioner to make decisions on the governance, remuneration and membership of the group, with the consent of the SPCB where appropriate. It will also allow for the group to provide advice on all matters relating to the commissioner’s functions. I believe that that better reflects the bill’s approach in recognising the need to respond to the rapidly changing biometrics environment, which John Finnie mentioned.

I thank the cabinet secretary and his officials for their assistance in coming to this point. I look forward to any further debate, and I encourage members to support my amendment.

I move amendment 6.

No other member has indicated that they wish to speak, so I invite the cabinet secretary to respond.

At stage 2, Liam McArthur agreed to work with me and my officials to refine the proposal in his amendment 6, the aim of which is, as he said, to establish an advisory group to provide the commissioner with advice on legal and ethical issues relating to biometric data and technologies. I am pleased that we were able to make constructive adjustments to the stage 2 amendment to simplify how the membership of and remuneration and governance arrangements for the group will be determined. They also allow for greater flexibility in the group’s remit.

I have always supported the setting up of such a group and I recognise the importance of the commissioner being provided with advice that is not only independent, which is crucial, but also well informed. My concern was that, in committing that to legislation, we would risk losing flexibility, but Liam McArthur’s amendment 18 ensures that matters will be kept as open and flexible as they can be. It also removes the opportunity for Scottish ministers to steer the operation of the group and instead places the responsibility for decision making with the commissioner, which is exactly as it should be. It is vital to the credibility of the group that it should remain—and, of course, be seen to be—impartial.

I also agree that there should be a role for the Scottish Parliamentary Corporate Body in overseeing and approving the appointments process, the number of members and the remuneration and allowances of the group, in order to ensure transparency and value for money.

I thank Liam McArthur for the constructive way in which he has approached amendments 6 and 18. We were pleased to come to a resolution on them, and I hope that members will support them.

Does Liam McArthur wish to make any concluding remarks?

No, thank you, Presiding Officer.

Amendment 6 agreed to.

Section 5A—Complaints procedure

Group 4 is on a complaints procedure. Amendment 7, in the name of Margaret Mitchell, is grouped with amendment 5.

Amendment 7 replaces in full the amendment that I lodged at stage 2, which required the commissioner to put in place a procedure by which a person might make a complaint to the commissioner about the handling of their biometric data. My intention was to ensure that members of the public had the ability to complain directly to the commissioner if they believed that such data had not been dealt with properly by police bodies that fall within the oversight of the commissioner. That remains my intention. However, I have listened carefully to the concerns that were expressed by both the Cabinet Secretary for Justice and the Information Commissioner’s Office that it should be clear that complaints that are made via that procedure are to relate to breaches of the code of practice. I have worked with the cabinet secretary so that the provisions now make that clear.

The remainder of amendment 7 is very similar to my stage 2 amendment and it broadly achieves the same aim, as I shall explain. Amendment 7 requires the commissioner to “provide for” a procedure so that it is clear that they are not only to establish a procedure, but to retain it. The procedure is to allow an individual or their representative to make a complaint about a breach of the code of practice in relation to that individual’s biometric data. The procedure is to apply to complaints in respect of any body that is subject to the code of practice under section 7(1). That flexibility will allow the provision to cover any additional bodies that might be made subject to the code later by means of regulations under section 7(4). The procedure is to be available whether or not the individual has already instigated a complaint through the complaints mechanism of the body that they are complaining about.

In determining the procedure, the biometrics commissioner is to consult various persons, including the Information Commissioner. The provision recognises the importance of the Scottish biometrics commissioner and the Information Commissioner’s Office working together to ensure that complaints are directed to the appropriate commissioner. The procedure that is put in place by the biometrics commissioner will deal with complaints regarding failures to comply with the code, while the Information Commissioner’s Office will continue to deal with complaints about infringements of data protection legislation. Amendment 7 therefore sets out comprehensive arrangements to enable individuals to raise complaints relating to the code directly with the commissioner.

Amendment 5 moves section 5A so that it will appear after section 10, among the sections that deal with the code of practice. Given that the complaints procedure will now clearly be about complaints relating to a breach of the code of practice, that is a more suitable location.

I move amendment 7.

I support the amendments in the group. If the biometrics commissioner is to have the confidence of the public, it is important to have in place appropriate processes that will underpin the commissioner’s work. One of the gaps in the bill as introduced was the lack of a complaints procedure, but stage 2 amendments addressed that. I acknowledge the work that has been done with the cabinet secretary’s team, and the stage 3 amendments that Margaret Mitchell lodged refine and clarify the complaints procedure so that it will be clear which complaints will go to the Information Commissioner’s Office and which will go to the biometrics commissioner. The overall package of amendments at stages 2 and 3 makes the bill stronger in that area.

As members might know, I did not support the amendment that Margaret Mitchell lodged at stage 2 that required the biometrics commissioner to set up a complaints procedure. At that time, I was concerned that it could lead to duplication or disagreement between the Information Commissioner’s Office and the Scottish biometrics commissioner in relation to complaints about biometric data, because the amendment did not delimit the role of the biometrics commissioner and it would have allowed them to deal with complaints about breaches of data protection law that should properly be dealt with by the Information Commissioner’s Office.

I am pleased that Margaret Mitchell not only took my concerns on board but worked constructively with me and my officials and took on board the concerns of the Information Commissioner’s Office as set out at stage 2. Her stage 3 amendments limit the complaints procedure, quite rightly, to breaches of the code of practice. The amendments in the group also fix a number of technical points. I thank Margaret Mitchell for working with me to refine the amendments at stage 3. I will support amendments 7 and 5 and I urge others to do so, too.

I welcome the cabinet secretary’s endorsement of the amendments, and I thank him and his officials for working collaboratively with me to improve them. I think that we all agree that there should be a clear process for individuals to complain about breaches of the code of practice that directly affect them. Happily, the amendments that I lodged do precisely that.

Amendment 7 agreed to.

Amendment 5 moved—[Margaret Mitchell]—and agreed to.

Section 5B—Review of the Commissioner’s functions and powers

16:45  

Group 5 is on post-legislative scrutiny. Amendment 8, in the name of Liam McArthur, is the only amendment in the group.

Amendment 8 follows my stage 2 amendment allowing for a process of review. Amendment 8 fine tunes what was agreed to at stage 2 by making minor drafting changes and altering the timing requirements so that the reviews can be linked to the commissioner’s strategic plan. If a review is considered unnecessary, my amendment would also require a statement to be made to set out the rationale for that.

As I said at stage 2, new biometric technologies are being developed at a pace that primary legislation cannot match. It is therefore essential to put in place a framework and mechanisms for reviewing and updating. Amnesty Scotland, the Law Society of Scotland, the Open Rights Group and the Scottish Human Rights Commission all raised concerns about the commissioner’s scope in their evidence. That may need to be revisited in due course. For now, I am, again, grateful to the cabinet secretary and his officials for working with me to put in place measures that will at least allow reviews to happen.

As the Law Society said in its briefing, the reviews should be seen not as a drain on resources but as

“necessary checks to ensure the high degree of transparency of the role which is required.”

However, I accept that the most important thing is that the reviews are capable of responding to circumstances. In some cases, that may mean that a review is not required.

I move amendment 8.

At stage 2, Liam McArthur agreed to work with me to refine his amendment to require the Scottish ministers to undertake a review of the commissioner’s remit and functions at recurring intervals.

As I said at stage 2, post-legislative scrutiny is, of course, extremely important. I also said that I do not think that the bill needs to provide for it and that that is a matter better left to ministers and Parliament to determine without being tied to predetermined periods. However, I recognise that the Parliament wants to legislate on that aspect. I respect that, and I was keen to revisit the amendment to ensure that it works sensibly and in a way that achieves the most effective scrutiny possible.

In adjusting the original amendment, I am pleased that Liam McArthur recognises the benefit of linking the timing of the first post-legislative review to the end of the first strategic planning period rather than two or three years after royal assent. That allows the examination of the commissioner’s functions to be more meaningful and to consider whether the commissioner has been able to achieve all that they set out to achieve.

Amendment 8 also recognises that there may be times when it is not necessary to conduct subsequent reviews, in which case the Scottish ministers will be able to publish a statement to that effect and to lay that before Parliament. The amendment allows for a commonsense approach while retaining the need for transparency, as Parliament would be able to question ministers about their decision not to conduct a review.

I support Liam McArthur’s amendment 8, and I urge all members to do likewise.

Does Liam McArthur want to make any concluding remarks?

I thank the Government for its support. I press amendment 8.

Amendment 8 agreed to.

Section 6—Code of Practice

Amendment 9 moved—[Liam Kerr]—and agreed to.

Group 6 is on the code of practice and retention periods. Amendment 10, in the name of Liam McArthur, is grouped with amendment 11.

Amendments 10 and 11 are, again, a revised version of amendments that I pressed at stage 2. They have been proposed in recognition of the fact that there is a gap in the regulation of retention periods of biometric data.

Although DNA and fingerprints are regulated under the Criminal Procedure (Scotland) Act 1995, photos and other forms of biometric data are not. During the passage of the bill, research by the Scottish Liberal Democrats found that, since 2014, more than 375,000 images had been supplied to the police national database from Police Scotland’s criminal history system. Those images were uploaded without a clear legislative requirement for their deletion in the event of the person pictured being found innocent.

I recognise that facial recognition could be valuable for modernising how the police investigate crime but, unregulated, it represents a potentially serious threat to human rights and civil liberties. I consider that my provisions will provide a safeguard for those liberties and the necessary framework to allow for proportionate and legitimate use of the technologies.

The Ada Lovelace Institute found that

“People fear the normalisation of surveillance but are prepared to accept facial recognition technology when there is a clear public benefit, provided safeguards are in place.”

In evidence to the Justice Sub-Committee on Policing, Duncan Sloan, the temporary assistant chief constable, said that the current rules on what the police can do with images of the public are “not so clear” as the rules on fingerprints and DNA. He added that new governance arrangements

“would be valued and welcomed.”—[Official Report, Justice Sub-Committee on Policing, 16 January 2020; c 4, 5.]

Mr Sloan’s colleague, Detective Chief Superintendent Sean Scott, also supported the independent advisory group’s recommendation on a presumption for deletion of biometric data as a central part of the oversight system that is established by the bill. He stated that

“one of the IAG’s nine recommendations was about the retention periods and a presumption of deletion, and that is absolutely right.”—[Official Report, Justice Committee, 29 October 2019; c 13.]

There needs to be enough flexibility to allow for specific circumstances to be taken into consideration. However, putting retention periods in black and white will strengthen not only privacy rights but public confidence in the use of such technologies. For public authorities, that provides a much better basis on which to deploy those technologies.

I move amendment 10.

As members might be aware, I have committed to conducting a review of retention periods once the new commissioner is in place. Therefore, I was interested in the amendments that were lodged by Liam McArthur at stage 2 that require the code of practice to provide for a presumption of a fixed three-year retention period for all biometric data.

I had a number of concerns about that, as I set out in detail at stage 2. That is why I welcome Liam McArthur’s new and more flexible amendment on retention periods, which I believe allows more nuanced rules to be provided for. In particular, it will allow different periods to be specified in different cases and will avoid our having to settle now on the period that must be specified.

The new amendment will also ensure that the provision that the code of practice is required to make will be focused only on cases where there is an existing legislative gap. That will help to avoid the risk of contradictory legal provision being made, as it will avoid the code being required to set out rules on retention periods for types of biometric data that are already suitably covered by our legislation.

I support Liam McArthur’s amendments 10 and 11, and I urge members to vote in favour of them.

Amendment 10 agreed to.

Amendment 22 moved—[Humza Yousaf]—and agreed to.

Amendment 11 moved—[Liam McArthur]—and agreed to.

Section 6A—Code of practice: principles

Amendment 12 moved—[Liam Kerr]—and agreed to.

Section 15—Reports and recommendations

Group 7 concerns reporting on failures to comply with the code of practice. Amendment 13, in the name of Liam McArthur, is grouped with amendments 14 to 17.

Amendments 13 to 17 would mean that, under section 15, the commissioner would be required to “prepare and publish” reports about failures by relevant bodies to comply with the code of practice.

At stage 2, the cabinet secretary maintained that the bill’s strength can be found in the coercive powers of naming and shaming, and he observed that the power of reputational damage should not be underestimated. That always seemed to me to open up too much of a risk—one that some people might be willing to take. I am grateful that Humza Yousaf has come around to that view. In turn, I accept that the reports might be amalgamated, if appropriate, and should certainly recognise a de minimis threshold—not least in order to avoid an undue burden being placed on the commissioner.

I am pleased that the amendments strike a proportionate balance.

I move amendment 13.

As Liam McArthur has already said, this group of amendments in his name will require the commissioner to prepare and publish a report about failures to comply with the code of practice, and will remove the discretionary power to prepare and publish such reports.

It has always been expected that monitoring and reporting compliance with the code of practice will be a key aspect of the commissioner’s role. Therefore, I have no issue with the amendments. I am pleased that, as Liam McArthur has noted, a practical approach is built into them, whereby the commissioner can choose not to report on a failure that involves a minor infraction, and can produce combined reports on failure to comply by more than one person, such as when there is a common theme. I support those provisions and thank Liam McArthur for working constructively with me and my officials to refine the amendments for stage 3. I hope that members will support them.

I thank the Government again for its co-operation. I suspect that the workings of the proposed provisions might be reviewed in the future, depending on the evidence that is forthcoming. I very much welcome the support that the Government has given in order to get us to this point.

Amendment 13 agreed to.

Amendments 14 to 16 moved—[Liam McArthur]—and agreed to.

Amendment 23 moved—[John Finnie]—and agreed to.

Section 16—Requirement to respond to reports

Amendment 24 moved—[John Finnie]—and agreed to.

Amendment 17 moved—[Liam McArthur]—and agreed to.

Amendments 25 and 26 moved—[John Finnie]—and agreed to.

Section 22A—Ethics Advisory Group

Amendment 18 moved—[Liam McArthur]—and agreed to.

Section 24—Interpretation

Amendment 27 moved—[Humza Yousaf]—and agreed to.

Schedule 1—The office of Scottish Biometrics Commissioner

Amendment 28 moved—[Humza Yousaf]—and agreed to.

That ends consideration of amendments. As members will be aware, at this stage in proceedings I am required, under standing orders, to decide whether any provision in the bill relates to a protected subject matter; that is, whether it will amend the franchise or the electoral system for Scottish parliamentary elections. In my view, no provision in the bill will do any such thing, so the bill does not require a supermajority for it to be passed at stage 3.