Meeting of the Parliament

Meeting date: Tuesday, March 10, 2020

Official Report 1009KB pdf

---

Scottish Biometrics Commissioner Bill

The next item of business is a stage 3 debate on motion S5M-21174, in the name of Humza Yousaf, on the Scottish Biometrics Commissioner Bill. I call Humza Yousaf to speak to and move the motion.

16:58  

I am delighted to open this stage 3 debate on the Scottish Biometrics Commissioner Bill. I thank my officials for drafting the bill and for working so constructively with members of the Opposition. I also thank members of the Opposition for taking a similarly constructive approach. I have been involved in introducing legislation in Parliament as a minister for just over seven and a half years, but I do not think that I have ever had a bill passed with so much consensus and with no member voting against a single amendment at stage 3. It has taken me only seven and a half years to get there, but I am delighted to have got there on an issue that has been, understandably, quite contentious and often quite controversial.

However, what we have now is an important piece of legislation that speaks to some of the key societal issues of our time, and touches on human rights and ethics as they relate to police use of very personal information. It is a hugely topical issue and one on which, I suspect, members from across the chamber have often been approached by members of the public in their constituencies

The origins of the bill go back a number of years. I take this opportunity to thank John Scott and his independent advisory group on the use of biometric data for shining a spotlight on biometric data in policing and criminal justice. The group’s report in 2018 was very much the inspiration for, and genesis of, the bill.

I also thank the various parliamentary committees that scrutinised the bill and its accompanying documents—in particular, the Justice Committee and its convener, Margaret Mitchell.

The bill has rightly attracted interest from a wide range of organisations and individuals. I am grateful to those stakeholders for the considered views that they offered to the Scottish Government during the preparatory phase of the bill, and to the Justice Committee once the bill had been introduced in Parliament.

I was pleased by the broad consensus in January to agree the general principles of the bill. However, the Justice Committee made a number of detailed recommendations in its stage 1 report; I am pleased to have been able to work with members to address those concerns during stages 2 and 3 in order to get to this important stage today. I welcome the cross-party support for the bill, and the very positive engagement that I have had with parliamentarians to ensure that the new legislation will do what we want it to do.

The bill will go a long way towards delivering greater transparency and accountability in how the police use biometric data, in recognition of how important that is to building and maintaining public trust.

I cannot stress enough how important it is that we equip our police officers with the necessary technology to ensure that they can keep us safe. However, I stress equally how important it is that the public have absolute confidence in those technological advances, and in how their data will be collected, retained and disposed of. The legislation, the new independent commissioner and the code of practice will, I hope, provide members of the public with the reassurances that they require.

I will focus on some key areas of the bill and what we want to achieve through it. First and foremost, the bill will make sure that our approach to biometric data, including from new technologies—such as facial recognition software, which was mentioned in the debate on amendments—is effective, proportionate and, crucially, ethical.

The bill creates an independent commissioner to advise on those issues, and to review the relevant law, policy and practice. The commissioner will oversee Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner. The bill includes a power for ministers to add at a later date, should it be required, more bodies that operate in the context of policing and criminal justice. Policing—the police bodies in particular—is the right place to start, because we know that collection and retention of data for policing purposes can be different to collection and retention of personal data or biometric data by any other sector.

The commissioner will also prepare a statutory code of practice that will set out the mandatory standards that those bodies must meet, and the responsibilities that they must undertake, with the aims of ensuring good practice, driving continuous improvement, and enhancing accountability.

The content of the code has deliberately not been specified in the bill. That allows for flexibility and future proofing—we are all aware of how fast technology can move—and will preserve the impartiality of the commissioner, which is crucial to allowing the commissioner to use his or her own judgment in the future. The commissioner will also be able to draw on expertise from the statutory advisory group.

The draft code of practice will be the subject of consultation of specified bodies and will be subject to approval by Parliament before it can come into effect. The code will be published so that everyone can see the standards that are expected of the bodies that are mentioned in the bill.

The commissioner will have powers to obtain information and to make reports and recommendations. I expect that the relationship between the bodies that are subject to the code of practice and the commissioner will therefore be predicated on transparency and accountability. We heard from the biometrics commissioner for England and Wales at stage 1, during evidence gathering, how important that dynamic is.

There will be a complaints procedure, as we heard in the debate on amendments, so that members of the public can raise concerns with the commissioner about failures to comply with the code of practice.

The commissioner will also have substantial powers—they will have teeth—and can report to Parliament failures to comply, as well as issuing compliance notices to require that concerns be addressed. In the most extreme cases, the commissioner can, ultimately, report failures to comply to the Court of Session.

Finally, but importantly, the commissioner will play a major role in raising public awareness about rights, responsibilities, and standards that are used in relation to biometric data and technologies. Given the rapid increase, in recent years, in use of biometric data and technologies, it is absolutely vital that we promote clearer understanding of the issues in our communities, especially among young people and vulnerable people.

Biometrics is evolving rapidly and offers great potential in detection, prevention and prosecution of crime, which will keep our communities safe. However, use of biometric data and technologies also raises ethical and human rights considerations. Therefore, I want to ensure that use of biometric data, including from new technologies such as facial recognition software, is effective, lawful and ethical.

The bill creates a biometrics commissioner whose powers and duties are focused on rights, accountability and responsibilities. Since the bill was introduced, there has been a lot of discussion here in Parliament about biometric data. However, now is absolutely the time to have a national discussion about the ethics and human rights issues that are associated with police use of biometric data, and for the new commissioner to lead that discussion from the forefront.

If Parliament agrees to pass the bill today, that will place Scotland at the forefront of driving forward transparency, accountability and improvement in relation to biometric data for policing and criminal justice purposes.

I thank members once again for working extremely constructively to get us to this stage.

I move,

That the Parliament agrees that the Scottish Biometrics Commissioner Bill be passed.

17:06  

I am very pleased to open the stage 3 debate on the Scottish Biometrics Commissioner Bill on behalf of the Scottish Conservatives. I confirm that we will vote to pass it at decision time tonight.

The underlying principle of the bill is to address ethical and human rights considerations in Scotland in relation to the collection, use, retention and disposal of biometric data in the context of policing and criminal justice. It seeks to do that by establishing the post of a Scottish biometrics commissioner, who will draw up a code of practice governing how biometric material should be used, gathered and so on. That is a significant role.

The bill also seeks to underpin public trust in how the police use biometric data. That trust is recognised in the bill’s policy memorandum, in which being seen to promote the confidence of the public is essential in relation to the commissioner’s functions. It requires that

“governance arrangements for the Commissioner must be, and be seen to be, transparent, accountable and free of any undue influence.”

We all, no doubt, hope that that can be achieved. Ultimately, whether or not it is will, at least partly, be around the resourcing. As the Law Society of Scotland said:

“resources need to include funding for research, public consultations, marketing and legal advice ... Promoting and knowledge of the Commissioner’s role is going to be very important”.

The committee’s report was stark. It stated:

“Other SPCB supported officeholders have faced resourcing issues as a result of changes or expansion to their role and powers over time, or as a result of growing demand for activity.”

Given that, the committee’s conclusion that

“the Financial Memorandum may not sufficiently estimate the resources which may be needed to support the delivery of the Commissioner’s functions”

remains a concern—not least because, as I read with interest, the supplementary financial memorandum projects an extra couple of hundred thousand pounds due to the stage 2 amendments. Although I note what section 22 says about the preparation of an annual report, it does not mandate an explicit requirement to report on the adequacy of resources. That remains a concern, and I hope that we see the commissioner going wide in the interpretation of section 22 to include those issues of resources.

The code of practice, which is set out in section 6, is fundamental. It has been a major area for amendment—and rightly so. During the process, the cabinet secretary amended the bill to provide greater parliamentary scrutiny of the first code of practice by ensuring that the commissioner must lay a copy of the first—draft—code before Parliament for representations. That is a good development, which should help towards the desired public trust and accountability.

The committee agreed that the promotion and protection of human rights, privacy, public confidence and community safety are crucial within that code of practice. Noting that, I inserted at stage 2 a requirement for the commissioner to have regard to those factors when preparing a code of practice. I am very pleased that Parliament agreed to my further amendments earlier this afternoon and that John Finnie trusts me that the section is as tight as it can be. On that note, Liam McArthur’s points on his amendments around the code of practice retention periods were particularly well made, and the greater nuance that we built in this afternoon is welcome.

At stage 1, many committee members raised concerns about the need for a complaints mechanism and the possible impact on public confidence of not having one. Initially, the bill did not contain any provision whereby a member of the public could raise concerns about the use of their biometric data by the police or a breach of the code of practice with the commissioner. The committee therefore recommended that a complaint mechanism be included in the bill.

Margaret Mitchell amended the bill to include a complaints process, which we have further amended today. She will talk in greater detail about it later, but I believe that it is welcome that the commissioner is required to establish, and retain, a complaints procedure that allows people to make a complaint to the Scottish biometrics commissioner about a breach of the code of practice. The amendment also states that the commissioner is to publicise the procedure, which will help to raise public awareness of their rights relating to the use of biometric data by the police and the justice system.

It is trite to say that biometric data is developing all the time and changing. None of us can possibly know what the category “biometric data” will comprise in the future; therefore, building in future proofing with regard to the commissioner’s role and functions is essential. That is why Liam McArthur’s section 22A amendment at stage 2, regarding an ethics advisory group, was welcome. He has, of course, further amended that today to create an advisory group that will allow the commissioner more flexibility.

At stage 2, Mr McArthur inserted section 5B, which will allow the powers and functions of the commissioner to be reviewed three years after the bill receives royal assent and at the end of five years after a review under that section. His amendment today, which tightened that provision up and linked it to the publication of the commissioner’s strategic plan, makes sense and should be welcomed.

This is a good bill that has been subject to considered and sensible amendments throughout the legislative process, following extensive and exhaustive evidence taking at the committee stage. There followed reflective and collaborative working, which was mentioned by the cabinet secretary, and what has emerged is a strong piece of legislation that achieves its stated aims:

“to establish the office of Scottish Biometrics Commissioner and to provide for its functions in relation to the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes.”

For that reason, we shall support it at decision time this evening.

17:12  

I am pleased to open the stage 3 debate on behalf of Scottish Labour, and I confirm that we will support the bill at decision time. I have enjoyed this afternoon’s very consensual proceedings.

With regard to the advance of technology, John Finnie was right to separate out technology and data when he spoke earlier on one of his amendments. There have been dramatic advances in technology that have ensured that much more data can be collected and that data can be held more easily. That is of great advantage in the criminal justice system, and it helps the police and prosecutors to do their jobs in bringing people to justice and giving victims reassurance when they have suffered unjustly as a result of crime.

However, the other side of the advance is an ethics and human rights aspect, as the cabinet secretary said. A lot more data is being held, and we have to ensure that the ethics that underpin that situation are robust and that people’s human rights are not undermined. Against that backdrop, the objectives of the bill are absolutely correct in setting up a biometrics commissioner to oversee the collection and retention of biometrics data.

The process has been interesting. The Government has worked collaboratively with all parties and with the committee, and we have seen the bill strengthened as it has gone through stages 2 and 3. That is how the parliamentary process should work. With regard to compliance, in particular, the original draft of the bill stated that people need “to have regard to” the work of the biometrics commissioner. The committee members had a great debate about whether “have regard” was strong enough; I certainly argued that there should be stronger compliance than “have regard”. Amendments on that theme were agreed to at stage 2, which has made the compliance aspect much stronger.

There was a gap in the original drafting of the bill regarding the complaints process. It was well intentioned, as it was felt that the Information Commissioner could deal with any complaints. However, as a number of members have said, it is important to ensure public confidence. That could have been undermined by the lack of a process for complaining directly to the biometrics commissioner if people felt there were issues about how their data was being held. The amendments that were addressed at stage 2 and refined at stage 3 build in a proper complaints process and give clarity about which complaints would be relevant to the Information Commissioner and which would go to the biometrics commissioner.

The advisory group is also important. The Law Society said in its submission that

“future proofing in this area is very important to take account of new developments in technology, and it is important to be able to draw on relevant expertise.”

Setting up an advisory group will make that process much more robust. Being able to keep all of that under review, including the issue of resources, will also ensure that all those issues are taken into account.

The process has been a good and positive one for the Parliament and for the Government, which has taken the bill through Parliament and has built on the discussions and evidence. The end product is a robust one, which Parliament and the public will have confidence in.

17:17  

I am sure that there will be a lot of similarity in what we are all going to say. I agree with the cabinet secretary about the good work that has been done by John Scott QC and his committee to get us to this point. I hope that we are going to pass—the Scottish Green Party will certainly support it—a piece of legislation that will establish a new biometrics commissioner.

The explanatory note is very specific. It says that the commissioner will

“support and promote the adoption of lawful, effective and ethical practices in relation to biometric data in a policing and criminal justice context,”

by keeping

“under review the law, policy and practice relating to the acquisition, retention, use and destruction”

of data.

As others have said, public confidence in our criminal justice system is vital. The bill started as a sound enough piece of legislation and there has been extremely positive engagement, which—dare I say it?—was a fine example of how the committee system can work. The engagement with the cabinet secretary and his colleagues was appreciated, and the bill is stronger as a result.

The policy memorandum talks about a rapidly evolving area of work. It is right to strike a balance and to say that it offers

“great potential in the detection, prevention and prosecution of crime”.

We all see that. We know that, in the past 30 years, DNA testing has been central to solving serious crimes such as murder and sexual offences. In that period, we have seen laptops, phones, CCTV, security cameras, road cameras and automatic number plate recognition collecting, storing and using large volumes of biometric data. The Justice Committee was right to say in the stage 1 report that the legislation is “timely and necessary”.

There will be oversight of facial recognition, which has been referred to, but also of facial search technology; gait and movement recognition technology; eye, iris and retinal identification; voice recognition software; and data from social media. All of those things are capable of providing biometric sources to the police—I am advised that they are known as “second-generation biometrics”.

It is important that that commissioner functions independently, as was said in the report, with no perception of overt influence from policing-related bodies.

The amendment at stage 2 that brought in a requirement to comply is significant. I had a look at what the police told us, and they were relaxed about the phrase “have regard to”. They said that that was similar to recommendations from Her Majesty’s Inspectorate of Constabulary in Scotland, which they generally work to implement. There cannot be discussions about that. These are very important matters, and one of the bill’s objectives is to improve the accountability of the police.

I am pleased that the bill will cover the British Transport Police and that the Police Investigations and Review Commissioner is involved, given its pivotal role in policing in Scotland. The independent advisory group talked about having a complaints mechanism in the bill, and I support our convener in the important amendments that have been made in that regard.

Liam McArthur’s amendments on putting the advisory group on a statutory footing are important, as is the advice and information resource that the group can provide.

The Scottish public is under heavy surveillance and it is important that we get things right. I particularly thank the Scottish Government for working with me on the technology amendments. This is a good piece of legislation, and we will support it at decision time.

17:21  

I echo the comments of others in confirming that the Scottish Liberal Democrats warmly welcome the bill and will support it at decision time. I thank all those who helped the committee during our scrutiny of the bill. Like the cabinet secretary and John Finnie, I pay particular tribute to John Scott QC and his colleagues in the advisory group for their work in laying the foundations.

I also thank the cabinet secretary for the constructive approach that he adopted in relation to the bill. Given how combative our exchanges on policing can get in the chamber, it is nice to have had that experience.

The case for establishing a biometrics commissioner to oversee the collection, use, retention and, importantly, deletion of biometrics is well made and widely accepted. Biometrics is an area of policy that is complex and highly technical, and one in which technology and its use are evolving at an astonishing pace. A robust regulatory framework and the specific expertise to oversee it are non-negotiables if we are to retain public confidence, while allowing our police and the justice system to have access to the tools that they will increasingly need.

Thanks to legislation that was passed in 2006 and 2010, we already have a legal framework governing the use of DNA and fingerprints. In 2015, however, it emerged that pictures of 330,000 Scots who had been taken into custody had been made available to users of the police national database. Many of the individuals concerned had done nothing wrong. That prompted my colleague Alison McInnes to spearhead a campaign for effective regulation of biometrics. She wrote to the First Minister at the time to demand a review of facial recognition technology, which led to HMICS undertaking an assessment.

During consideration of the Criminal Justice (Scotland) Act 2016, Alison McInnes lodged amendments to make biometric information subject to the same rules as DNA and fingerprints. She recognised the importance of consistency, including around the timely deletion of images. Although unsuccessful, her efforts paved the way for my own amendments, which Parliament agreed to this afternoon. Those amendments achieve a consistency that is in the interests of not only individuals and the wider public but the police, who have been clear about their belief in the need for both consistency and clarity, albeit with some flexibility to deal with specific circumstances, as the cabinet secretary mentioned earlier.

I acknowledge the support from the Scottish Government for those changes, as I do its support over moves to put the proposed advisory group on a statutory footing. As I said in moving my amendments, putting that on the face of the bill sends a strong signal about the importance of the group’s work in helping to underpin all that the commissioner does. That better reflects the recommendations of the independent advisory group, and I hope that it addresses what was described by the Scottish Human Rights Commission as a “regrettable” omission from the bill as introduced.

Likewise, we have made progress on the question of enforcement powers. I appreciate that some stakeholders may wish that we had gone further, while the Government argued that the threat of naming and shaming was sufficient by way of a deterrent. However, by agreeing to ensure that breaches are made public by the commissioner—save for in the most minor of circumstances—I believe that we increase the likelihood of encouraging good practice and reduce the risk of individuals or organisations seeking to chance their arm.

The final area in which I think that an important step in the right direction has been taken today relates to the way in which we ensure that the legislation keeps pace with the development of biometrics. Putting in place a robust regulatory framework is essential, as is ensuring that that framework is overseen by those with the necessary expertise. However, there is no getting away from the fact that biometrics are rapidly evolving. We need to make sure that reviews are built in so that the public can have confidence that the framework and safeguards remain fit for purpose. Again, I welcome the support of the Government and the Parliament for my amendments to allow for such a review mechanism.

The Metropolitan Police Commissioner, Dame Cressida Dick, observed that although the police should take advantage of new technology to improve policing, it is not for the police service to draw up the rules by which that technology is used. She is right, but so, too, is Amnesty International, when it warns that

“use of biometrics has the potential to breach human rights such as the right to privacy, freedom of association and the right to peaceful assembly”.

That is why we need a robust regulatory framework and a biometrics commissioner with the necessary powers. I believe that the bill gets us much of the way there. On that basis, the Scottish Liberal Democrats will support the bill at decision time.

17:25  

As deputy convener of the Justice Committee, I am glad that we have reached the final stage of this important bill in, as the cabinet secretary said, a largely consensual way.

I thank the clerks and the bill team for their hard work, and the many excellent witnesses for helping us with their expertise in this field. A lot of work and a lot of listening have gone into getting the bill to a stage where, thankfully, we have achieved cross-party support. I agree with Liam McArthur that it is now a much better, more balanced bill.

The bill will ensure that the use of biometric data in policing and criminal justice is effective, lawful and ethical. It is vital that the public have confidence in the bill and that the ethics—the human rights aspects—of the bill have been addressed. The scope of the bill covers the acquisition, use, retention and disposal of biometric data, including fingerprints, DNA and emerging techniques such as iris recognition.

The ultimate goal is to keep communities safe while respecting the rights of the individual and improving the accountability of the police. Those are important elements in maintaining public confidence in police use of biometric data. Biometrics are hugely important in the prevention and detection of crime, and in prosecuting crime.

Of course, the use of biometric identification by police is not a new phenomenon. In Scotland, police services have been using criminal history photographs and fingerprints for more than 100 years. Over the past 30 years, the use of human DNA testing has become a central tool in detecting and prosecuting crime, particularly in the case of serious crime such as murder and sexual offences.

The need for a commissioner who is independent of Government, the police and the criminal justice system was a key recommendation in both the 2016 HMICS review and the 2018 independent advisory group report. The proposal to create such a role was widely welcomed by all witnesses who gave evidence to the committee.

The Commissioner for the Retention and Use of Biometric Material, Professor Wiles, stated that the bill places Scotland at the forefront of legislating for the oversight of biometric data in the field of criminal justice. He said:

“Many other countries are quite interested in what Scotland is doing, because they are all aware that they have similar issues.”—[Official Report, Justice Committee, 24 September 2019; c 2.]

Important amendments were made at stage 2, and the Government has worked with members across the chamber to incorporate their requests to shape the bill in the best possible form. Much of what I will say has already been said, but here is a sample of some of the amendments that were agreed to at stage 2.

The bill was amended to enable the Scottish ministers to change or clarify the meaning of “biometric data” by regulations. That will allow Parliament to scrutinise any changes that Scottish ministers propose as technology advances at pace. The committee also agreed to an amendment to allow for further process in the approval of the first code of practice, with that being done by Parliament, as recommended by the committee.

Importantly, Parliament agreed at stage 2 to add the PIRC to the list of bodies that are subject to the commissioner’s oversight. The committee also agreed to amendments to require the commissioner to set up a complaints procedure and to operate an advisory group. As we have heard, the complaints procedure has featured strongly in discussions, and I am pleased that the convener’s amendment was agreed to.

The committee also accepted Scottish Government amendments to enhance the powers of the commissioner to deal with failures to comply with the code of practice.

The bill has now been amended to establish an advisory group, which was another issue that the committee felt strongly about. The Scottish ministers’ role has been removed and instead the commissioner will be allowed to make decisions about the group’s administration, procedures, membership and remuneration, with the consent of the Scottish Parliamentary Corporate Body. The intention is that that approach will make for a more impartial group, whose remit and membership are tailored to the commissioner’s requirements.

This important bill ensures that the Parliament has future proofed and locked in all the necessary safeguards to enable Scotland to deal with the evolving technology that is now necessary for the detection, prevention and prosecution of crime.

17:30  

I am pleased to close the debate on behalf of the Scottish Labour Party. We will support the passage of the bill at decision time, which comes up shortly. It has been a useful example of a good way for a bill to progress through Parliament and the discussion this afternoon has been consensual. There were differences of opinion at the earlier stages, but they were exchanged in a collegiate manner. I am glad to say that on a lot of the differences of opinion a consensual way forward has been worked out, which is to the credit of the cabinet secretary, the Opposition spokespeople and the Justice Committee for the way that the process has been conducted.

I was struck by John Finnie reeling off all the different technologies that are now available to police and prosecutors for collecting data. It took me back to the first job that I had, which was with Greater Glasgow Health Board in 1982. When I joined, there was only one computer in the whole office. John Finnie reeled off what is now available, with laptops, mobile technology, voice recognition and, of course, the advent of facial recognition technology. The police have a lot more at their disposal, which is good for investigating crime and bringing people who have committed crimes to justice. However, it means that the challenges in relation to ensuring that ethics and human rights are not compromised are greater. From that point of view, the bill has a very important role to play. As Liam Kerr stressed, getting that right is important for winning public trust, and if the public are going to have proper confidence in biometric data, the role of a biometrics commissioner can help. I cannot stress enough that the powers that the police and prosecutors have to collect and retain data is of great advantage to the victims of crime, but they must use them properly and responsibly to ensure that they have public trust.

The cabinet secretary emphasised the importance of expertise. Some of the changes that have been made as we moved through the process will allow us to draw on that expertise. The setting up of an advisory group and the passing of the amendments that Liam McArthur lodged at stages 2 and 3 will help. The bill, which we will shortly consider at decision time, has been enhanced by the introduction of greater compliance measures. The introduction of a proper complaints process that is streamlined along the proper routes for the biometrics commissioner and the Information Commissioner is helpful. As Liam Kerr pointed out, the issue of resources is important and should be kept under review. The review process that is built into the bill will help in that regard.

I am pleased to support the passage of the bill at decision time. The process has been good and we now have a more robust bill in place that the public will have confidence in.

17:34  

I welcome the Scottish Biometrics Commissioner Bill. Digital technology has advanced considerably over the past 25 years, and biometrics is one of the most rapidly developing technologies.

Biometric data is both highly sensitive and intrusive. It has evolved from first-generation biometrics, such as fingerprints and DNA, and second-generation technology such as facial recognition software, which presents opportunities and challenges. There is a need for balance between ensuring that the police have the tools that they need to keep the public safe and protecting individuals’ privacy. I thank the justice clerks for their sterling work in assisting the committee to achieve that balance.

The bill provides that the commissioner has several different functions. One is the general role to

“support and promote the adoption of lawful, effective and ethical practices”

in the use of biometric data by the police and criminal justice system. That includes how biometric data is acquired, used, retained and destroyed.

The bill also tasks the commissioner with keeping under review the laws, policies and practices relating to the use of biometric data by Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner. Furthermore, the commissioner must prepare, promote and monitor compliance with the code of practice, and promote public awareness and understanding of the biometric data powers and duties of Police Scotland, the SPA and the PIRC. The commissioner’s powers ensure that they are able to hold the police and criminal justice system to account for its use of biometrics.

The bill’s code of practice governs the collection, use and retention of the public’s biometric data by the police. After hearing the evidence presented at stage 1, the Justice Committee deemed that the inclusion of a complaints mechanism was essential to ensure that any member of the public could raise with the commissioner concerns about police compliance with, or possible breaches of, the code of practice.

I thank the cabinet secretary for his positive response to my amendment that put in place the complaints procedure and for the collaborative nature in which the Scottish Government and its officials have worked with me to amend and improve that provision. The commissioner will be required to publicise the complaints procedure, which should increase awareness among the public of their rights and bolster their confidence in the use of biometrics by the police.

In its stage 1 report, the committee stressed that the bill needed to be strengthened in order to ensure that the commissioner is able to provide robust oversight. Other improvements were made by John Finnie’s amendments, which future proofed the use of new technologies and provided that Police Scotland, the SPA and the PIRC have a duty to comply with the code of practice. Liam McArthur’s amendments introduced a presumption in favour of the deletion of biometric data after a prescribed minimum retention period and provided for the creation of an independent advisory group, which will have open and flexible oversight.

The Justice Committee’s scrutiny of the Scottish Biometrics Commissioner Bill has been an example of effective collaborative and co-operative working between the committee and the Scottish Government, which has ensured that the legislation is fit for purpose. It is one of the best examples of how this Parliament can work effectively to get the best legislation possible. The Scottish Conservatives will have much pleasure in supporting the bill this evening.

17:39  

I am grateful to members for their contributions in what has been a very constructive and consensual debate.

As I said in my opening remarks, the bill has enjoyed strong cross-party support from the start. Members have alluded to the fact that that does not happen by accident; it happens because of the open-mindedness of Opposition members. I hope that they recognise the Scottish Government’s open-mindedness.

I thank those whom we do not often hear about or do not often see at the forefront: the Justice Committee clerks; the officials, who were ably led by Elaine Hamilton, David Scott, Laura Barrie from the parliamentary counsel office and David Murdoch from the Scottish Government legal directorate, and the whole team behind them. On getting cross-party support, I make a special mention of that much-maligned political creature, the special adviser, or SPAD. John McFarlane, who is very well known to each of the Opposition spokespeople, has done an excellent job in working with my officials and me and Opposition members to get the bill to a place at which every single amendment at stage 3 was agreed to by every member. That was a really positive place for the bill to be in.

I take Margaret Mitchell’s point that the bill is not just about consensus, although I am pleased that we have consensus; it is also about effective scrutiny. We saw effective scrutiny by the Justice Committee. There was a range of views from stakeholders, some of which continue to challenge us. The Scottish Human Rights Commission, for example, continues to challenge us, and it will no doubt continue its engagement once the independent biometrics commissioner is appointed.

I will focus on some remarks that members made. Liam Kerr focused his remarks on public trust, which is, of course, hugely important. We can all think of examples of data breaches and leaks and, as I said in my opening remarks, many of us have undoubtedly been approached by members of the public with concerns about data privacy. Public trust must, therefore, be at the forefront of what we do. Having an independent commissioner with oversight of biometric data will help to give reassurance and ultimately strengthen public trust in policing. Whenever I speak to anybody who is involved in policing, particularly the chief constable, they always refer to the fact that the police get their consent from the people. The police do not get consent from the Government or the Parliament; the consent for and legitimacy of policing come from the people. That can happen only when there is public trust. Liam Kerr made that important point.

Liam Kerr also asked about finances and resources, as did James Kelly in his closing remarks. I reiterate what I have said before. It is, of course, right that the Government keep under review any representations that are made by the SPCB, for example, with respect to the resourcing provision of the office of the commissioner as part of the annual budget-setting process. I am confident that the costings in the financial memorandum and the supplementary financial memorandum are comprehensive and represent the best estimates at present. Clearly, however, the commissioner—he or she—will produce the code of practice and we will therefore have to keep that under review. That is important.

James Kelly made some excellent remarks about our having a stronger bill because of collaboration and a stronger commissioner because of the changes to the bill. He referred to the important change that we have made from the policing bodies having regard to the code of practice to their having to comply with the code of practice. I agree that that has led to a stronger bill and I hope that the changes will lead to a stronger commissioner and a stronger regulatory framework around biometrics.

John Finnie was absolutely right to say that the legislation is timely and necessary. I know that, to his credit, he has often been at the forefront in relation to human rights. He pushed the Government very hard on those matters in the committee in particular. I hope that we have met not just his expectations but those of many of the human rights organisations throughout the country.

John Finnie was also right to mention the pace at which technology changes. Dare I say it, but when he first became a police officer in Lothian and Borders Police in 1976—at the age of only five, I should say—and then a dog handler in Northern Constabulary, he could not have envisaged the pace at which technology has advanced. Police officers are now faced with that. That is a really important point.

As the chair of the serious organised crime task force, I know that the police always want to ensure—and they invest to ensure—that they keep pace with criminals. Criminals in serious organised crime gangs do not have to worry about ethics. They do not have to worry about procurement rules. They do not have to worry about legislation. They procure the technology that they require to make criminal transactions through the black market. It is essential that we allow the police the ability to invest in technology in order to keep pace with, or be ahead of, criminals, and at the same time ensure that the public are reassured about their data, about privacy and about the ethical considerations. John Finnie made that important point.

Liam McArthur was also right to reference human rights considerations. It is important to be reminded that the bill did not materialise out of thin air but resulted from a lot of hard work. Much of that was done by John Scott, but Mr McArthur was also right to reference his colleague Alison McInnes. I sat beside her at the Justice Committee many moons ago, where she often kept me right. Like many other members, she was a champion of human rights. The conversations that Alison McInnes had in this Parliament when she was an MSP, right through to the good work that John Scott has done, have meant that the bill represents a cumulative effort by a lot of different actors from a lot of different political parties, including people who are external to the Parliament. We have got to a very strong place, indeed.

Rona Mackay made excellent remarks about the independence of the commissioner. Through the process of the legislation, we have strengthened that independence, for example, with regard to the appointment of the advisory group.

Margaret Mitchell made some excellent points about the complaints process, which she has championed and led on in relation to the bill. She was right to make the point that the Scottish public will look to the Scottish biometrics commissioner when it comes to potential breaches of any code of practice. Therefore, having it in the bill that the complaints process will be a function of the biometrics commissioner is an excellent place for us to be.

We have an excellent bill. I thank all the Opposition spokespeople and the officials who have been involved in getting us to this stage. There has been a very constructive and collaborative approach.

More important than that approach, though, is that we will have a biometrics commissioner with a code of practice that I hope will give members of the public an absolute assurance that, although we want the police and those who are involved in policing to invest in technology in order to keep our streets safe, people’s biometric data will have a regulatory framework around it that will protect their rights and that takes on board the ethical considerations.

I am delighted to commend the bill in my name, and I hope that it receives unanimous support in a few seconds’ time.

That concludes the debate on the Scottish Biometrics Commissioner Bill.