The report states
In its broadest sense, biometrics is the measurement and analysis of a biological characteristic (fingerprints, iris patterns, retinas, face or hand geometry) or a behavioural characteristic (voice, gait or signature). Biometric technologies use these characteristics to identify individuals automatically. Unlike identity documents or passwords, biometrics cannot be lost or forgotten since they are a part of the user and are always present at the time of identification. They are also difficult, though not impossible, to forge or share.
Three future trends in the application of biometrics were identified during the inquiry: the growth of unsupervised biometric systems, accessed via mobile devices, which verify identity; the proliferation of "second-generation" biometric technologies that can authenticate individuals covertly; and the linking of biometric data with other types of 'big data' as part of efforts to profile individuals.
Each of these trends introduces risks and benefits to individuals, to the state and to society as a whole. They also raise important ethical and legal questions relating to privacy and autonomy. We are not convinced that the Government has addressed these questions, nor are we satisfied that it has looked ahead and considered how the risks and benefits of biometrics will be managed and communicated to the public.
The Government has been largely silent on the matter since the abolition of the Government's Identity Card Programme in 2010 and the destruction of the National Identity Register. And yet, in other policy areas, including immigration and law enforcement, the use of biometric identification systems by the state has expanded. If the Government is to build public trust in biometric data and technologies, there is a need for open dialogue and greater transparency. We therefore recommend that the Government sets out how it plans to facilitate an open, public debate around the use of biometrics.
Management of the risks and benefits of biometrics should have been a core element of the Government's joint forensics and biometrics strategy. Despite undertaking to publish this document at the end of 2013, we were dismayed to find that there is still no Government strategy, no consensus on what it should include, and no expectation that it will be published in this Parliament. This is inexcusable. We expect a comprehensive, cross-departmental forensics and biometrics strategy to be published by the Government no later than December 2015.
In the absence of a biometrics strategy, there has been a worrying lack of Government oversight and regulation of aspects of this field. We were particularly concerned to hear that the police are uploading photographs taken in custody, including images of people not subsequently charged with, or convicted of, a crime, to the Police National Database and applying facial recognition software. Although the High Court ruled in 2012 that existing policy concerning the retention of custody photograph by the police was "unlawful", this gap in the legislation has persisted. At the very least, there should be day-to-day, independent oversight of the police use of all biometrics. We therefore recommend that the Biometrics Commissioner's jurisdiction should be extended beyond DNA and fingerprints to cover, at a minimum, the police use and retention of facial images.The Committee's Conclusions and recommendations are -
Scientific advice on biometrics
1. The Foresight Programme's 2013 report on Future Identities was a missed opportunity to examine biometrics and identify the main trends, and the associated challenges, that policy-makers in this field will face in the future. Indeed, it is astounding that biometrics was deemed 'beyond the scope' of an apparently forward-looking piece of analysis when, three years earlier, the Government had been seeking to rely on biometrics as part of its identity card programme. We agree with the Biometrics Commissioner that this type of forward-looking analysis is desirable. (Paragraph 28)
2. We recommend that Foresight builds on the evidence gathered during this inquiry and undertakes a short, "Policy Futures" study to examine systematically the emerging issues, risks and opportunities arising from developments in biometrics. This analysis should be frequently reviewed in order to keep pace with rapid advances in biometrics and should be applied by the Government to assist its preparations for, and to help it shape, how this field may unfold in the future. (Paragraph 29)
3. Despite a previous assurance from the Government, given over 12 months ago, that the publication of the forensics and biometric policy group's minutes was on the horizon, this has not occurred. As a result, the remit and status of the group, as well as what has been on its agenda, remain a mystery. This continuing lack of transparency in the delivery of scientific advice to Government on biometrics is unacceptable and goes against the Government's own guidance, as set out in the 2010 Principles of scientific advice to Government. (Paragraph 35)
4. To improve its transparency, we recommend that the remit, membership and outputs of the forensics and biometric policy group should be placed in the public domain immediately. A commitment should also be made to the publication of the minutes of all future meetings, unless there are overriding reasons of national security for not doing so. (Paragraph 36)
A strategy for biometrics
5. The Government undertook to publish a joint forensics and biometrics strategy by the end of 2013. Over a year later, there is no strategy, no consensus on what it should include, and no expectation that it will be published in this Parliament. In its absence, there remains a worrying lack of clarity regarding if, and how, the Government intends to employ biometrics for the purposes of verification and identification and whether it has considered any associated ethical and legal implications. (Paragraph 41)
6. The Government should be developing a strategy that exploits emerging biometrics while also addressing public concerns about the security of personal data and the potential for its use and misuse, with particular reference to biometric data held by the state. (Paragraph 42)
7. We expect a comprehensive, cross-departmental forensics and biometrics strategy to be published by the Government no later than December 2015. (Paragraph 43)
Testing biometric systems
8. When biometric systems are employed by the state in ways that impact upon citizens' civil liberties, it is imperative that they are accurate and dependable. Rigorous testing and evaluation must therefore be undertaken prior to, and after, deployment, and details of performance levels published. It is highly regrettable that testing of the 'facial matching technology' employed by the police does not appear to have occurred prior to the searchable national database of custody photographs going live. While we recognise that testing biometric systems is both technically challenging and expensive, this does not mean it can be neglected. (Paragraph 54)
9. When testing does occur, the continued use of a variety of testing protocols by suppliers makes it difficult to analyse and compare, with any degree of confidence, the performance of different systems. Following the abolition of the Biometrics Assurance Group, it is unclear who is responsible for interpreting the outcomes of biometric testing for the Government. (Paragraph 55)
10. The Government should explain, in its response to this report, why the facial matching technology employed by the police was not rigorously tested prior to being put into operational use. We further recommend that the Government details what steps it is taking to encourage suppliers of biometric systems to comply with established UK testing standards. (Paragraph 56)
Public attitudes
11. We welcome the Government's commitment to the principle of proportionality when it is considering implementing a biometric application. However, we are not convinced that the Government has clear steps in place—such as conducting mandatory privacy impact assessments—to measure consistently whether or not a specific biometric application is proportionate. (Paragraph 61)
12. We have seen in the past how public trust in emerging technologies may be severely damaged in the absence of full and frank debate. Despite growth in commercial and Government applications of biometrics, the Government appears to have made little effort to engage with the public regarding the increasing use of their biometric data, and what this means for them, since the scrapping of the Government's ID card scheme in 2010. This is exactly the type of issue that the Government's joint forensics and biometrics strategy should have addressed. (Paragraph 68)
13. We recommend that the Government sets out, in its response to this report, how it plans to facilitate an open, public debate around the growth of biometric systems. (Paragraph 69)
Data storage and system security
14. High profile cyber-attacks and data loss incidents have undermined the public's confidence in the ability of both Government and industry to store their data securely. Security considerations should never be an "afterthought" or an optional extra. We welcome the Minister's confirmation that the security of the Government's biometric systems is "bolted on" at the beginning of the design process. However, such assurances alone will do little to diminish the public's concerns while data losses continue to occur. (Paragraph 75)
15. We recommend that, in its response to this report, the Government outlines the steps taken to mitigate the risk of loss, or unauthorised release, of the biometric data that it holds. (Paragraph 76)
16. Current legislation places responsibility on the institution rolling out a (biometric) system to ensure that appropriate security measures are in place when storing personal data. However, we are concerned that there is no proactive, independent oversight of whether this is occurring. Conducting a privacy impact assessment at the outset of all projects and policies that collect, retain or process personal data would help to ensure that those implementing a biometric system are fully aware of, and compliant with, the necessary security measures. (Paragraph 77)
17. We therefore reiterate the recommendation made in our report, the Responsible Use of Data, that privacy impact assessments should be conducted at the outset of all projects and policies that collect, retain or process personal data, including biometric data. (Paragraph 78)
18. In our opinion, under no circumstances should the state roll out a biometric system that does not provide any scope for human intervention. (Paragraph 84)
19. In the interests of greater transparency of data collection and use, we reiterate our earlier recommendation; namely that the Government drives the development of a set of information standards that companies can sign up to, under which they commit to explain to individuals their plans for the use of personal data (including biometric data), in clear, concise and simple terms. (Paragraph 85)
Legislation and standards
20. We agree with the Government and the Information Commissioner's Office that, as a principle-based framework, the Data Protection Act 1998 should provide adequate regulation in the face of developments in biometric technologies. However, we are mindful of the concerns raised by experts in the field, such as Professor Sue Black, and therefore recommend that the Government keeps this matter under review. (Paragraph 93)
21. To avoid a biometric application once again being put into operational use in the absence of a robust governance regime, we recommend that:
- the forensics and biometric policy group is reconstituted with a clearer mandate to analyse how developments in biometrics may compromise the effectiveness of current policy and legislation;
- as recommended in paragraphs 35 and 36, the reconstituted group should operate in a transparent manner, be open to receiving inputs from external bodies and publish its outputs;
- the Government, police and the Biometrics Commissioner should use these outputs to identify gaps in the legislation to be addressed ahead of any new biometric application going live. (Paragraph 101)
The role of the Biometrics Commissioner
22. We agree with the Biometrics Commissioner that there is value in the provision of day-to-day, independent oversight of police use of biometrics and that such oversight should extend beyond fingerprints and DNA. We also agree that broadening the Commissioner's responsibilities would be a "more sensible" approach than establishing a new, separate commissioner covering other biometric traits. (Paragraph 104)
23. We therefore recommend that the statutory responsibilities of the Biometrics Commissioner be extended to cover, at a minimum, the police use and retention of facial images. The implications of widening the Commissioner's role beyond facial images should also be fully explored, costed and the findings published. We further recommend that the Government clarifies where the operational boundaries lie between the Biometrics Commissioner and the Forensic Science Regulator. (Paragraph 105)
Quality standards
24. Standards become increasingly useful when they are widely adopted—namely required by customers and used by vendors to build standards-compliant products. As a customer, the Government can demand that its biometric systems adhere to national and international standards. While we recognise the advantages of the Government using its procurement powers in this way, and of the benefits of interoperability between biometric systems, we are also aware that there will be instances when interoperability should be prevented in order to limit access to sensitive personal information. Once again, in the absence of a comprehensive biometrics strategy, it is not clear how the Government aims to strike this delicate balance. (Paragraph 110)
25. The Government should explain, in the interests of the responsible use of data, how it intends to manage both the risks and benefits that arise from promoting open standards and the interoperability of biometric systems. (Paragraph 111)