Biometrics

There has been an outbreak of common sense in Scotland, alas not in Australia where governments and solutions providers are still snorting facial biometric pixie dust. The Scottish legislature's Justice Sub-Committee on Policing  comments

The introduction of live facial recognition to policing in the UK is a relatively new phenomenon.

Police Scotland has an ambition, outlined in its 10-year strategy, to introduce its use by 2026. Its assessment of the likely equalities and human rights impact as “likely to be positive in nature” is in stark contrast to the evidence received by the Justice Sub-Committee on Policing.

The live facial recognition software which is currently available to the police service is known to discriminate against females, and those from black, Asian and ethnic minority communities.

For this reason, the Sub-Committee believes that there would be no justifiable basis for Police Scotland to invest in this technology.

We therefore welcome confirmation from Police Scotland that they have no intention to introduce it at this time.

Prior to any decision to introduce live facial recognition technology to policing in Scotland, it is essential that a robust and transparent assessment of its necessity and accuracy is undertaken, and that the potential impacts on people and communities are understood.

The use of live facial recognition technology would be a radical departure from Police Scotland’s fundamental principle of policing by consent.

Police Scotland need to demonstrate that its use of this technology is provided for in legislation and meets human rights and data protection requirements.

This short inquiry has highlighted the pressing need for a much wider debate on the use of live facial recognition technology by the police service, as well as more widely across the public sector, and by private companies. Politicians could play a key role in determining whether there is public consent for the use of this technology.

The Sub-Committee hopes that this inquiry has gone some way to begin that debate, and that the Scottish Government will take up the challenge.

Police Scotland currently use retrospective facial recognition technology. Its procedures and practices would benefit from a review by the Scottish Police Authority and any incoming Scottish Biometrics Commissioner.

In particular, consideration of the risks and legal implications of Police Scotland accessing and using any images held illegally on the UK Police National Database of people who have not been convicted of any crime.

The same concerns arise from Police Scotland’s ability to access and use images of people who have not been convicted of any crime, but which are retained on the legacy IT systems they inherited from the former Scottish police forces.

The Sub-Committee believes that the police must have all necessary tools at their disposal to combat crime and keep communities safe.

New technologies have the potential to assist Police Scotland in detecting and solving crimes. However, each new technology must be assessed on its merits, with an honest and transparent discussion of both the benefits and the risks.

The Sub-Committee warmly welcomes Police Scotland’s intention to introduce the use of ethics panels to consult with relevant stakeholders to identify and mitigate risks, and to inform its decisions on whether to introduce new technologies.

The Subcommittee's report concludes -

Live facial recognition technology 

Police Scotland does not currently use live facial recognition technology. However, at present plans to introduce facial recognition technology are included in Police Scotland’s 10-year strategy, Policing 2026.

The evidence received by the Sub-Committee during its inquiry indicates that a number of safeguards need to be met, prior to Police Scotland introducing the use of this technology. A key issue to be resolved is the technology’s lack of accuracy.

It is clear that live facial recognition technology is currently not fit for use by Police Scotland. The Sub-Committee believes that there would be no justifiable basis for Police Scotland to invest in technology which is known to have in-built racial and gender bias, and unacceptably high levels of inaccuracy.

The Sub-Committee therefore welcomes Police Scotland’s confirmation that they will not introduce live facial recognition technology at this time. We also welcome their commitment to participate in a wider debate on policy, which will include civil liberties groups and academics, and to ensure that necessary safeguards are in place, prior to making any decision to introduce live facial recognition technology. Wide stakeholder engagement has clearly added value to current plans to deploy cyber kiosks.

However, if Police Scotland does not now intend to introduce live facial recognition technology by 2026, the Scottish Police Authority should update the 10-year strategy to reflect that position, as part of the planned review in 2020.

If Police Scotland does intend to introduce live facial recognition technology at some point in the future, the impact of its use must be fully understood prior to any decision being taken to introduce it to policing in Scotland.

The recent challenges in court to the legality of the use of live facial recognition technology by the police services in England and Wales suggests that there is a lack of public consent for its use, as well as a lack of confidence in the current legal framework being relied upon.

The Sub-Committee recommends that the following actions be taken prior to any decision to introduce live facial recognition technology to policing in Scotland:

• The Policing 2026 strategy should be updated to include details of the type of technology to be introduced, and the necessity and parameters of its use. The strategy’s equality and human rights impact assessment (EqHRIA) should also be reviewed by the Scottish Police Authority to ensure that it is suitably robust.

• The Scottish Police Authority must ensure that comprehensive human rights, equalities, community impact, data protection and security assessments are carried out.

• Similar assessments are also required prior to introducing any other technologies within Policing 2026, especially where there is a risk of collateral intrusion into areas of personal privacy and human rights. Any such assessments should be made publicly available.

• The Cabinet Secretary for Justice must ensure that there is a robust legal and regulatory basis for the use of live facial recognition technology in Scotland. This would provide legitimacy for the police service and assurance for the public.

The Sub-Committee requests clarification of the Government's plans, and whether this would include a consultation on public consent for the use of this technology. 

The Scottish Police Authority must review the legal challenges to the use of live facial recognition technology by police forces in England and Wales, and consider how to mitigate the risk of similar legal challenges in Scotland.

The Sub-Committee has not received sufficient evidence of the necessity to introduce live facial recognition technology, or that it is possible to use it in a proportionate way. Its use on people who attend legitimate and legal pursuits, such as peaceful protests, concerts or sporting events, is not necessary or proportionate. 

The Scottish Police Authority should assess the necessity, proportionality and parameters of its use. Police Scotland needs to demonstrate that there is public consent for the use of live facial recognition technology before introducing it, as a lack of public consent risks undermining the legitimacy of the technology and potentially, public confidence in policing. It could also represent a failure to meet the principles set out in the Police and Fire Reform (Scotland) Act 2012.

Any consultation on the introduction of the use of live facial recognition technology must take into consideration its potential impact on human behaviour and the relationship between the public and the police.

Police Scotland and the Scottish Police Authority must clarify how they will ensure that data protection requirements will be met for the use of live facial recognition technology. This should include confirmation of whether a data protection impact assessment detailing the risks and how these are to be mitigated would be a necessary requirement.

The Scottish Police Authority should take account of the UK Biometrics and Forensics Ethics Group's framework of ethical principles when considering Police Scotland’s proposal to introduce the use of live facial recognition technology.

To provide public confidence, any incoming Scottish Biometrics Commissioner should consider any future plans by Police Scotland to introduce the use of live facial recognition technology prior to a decision being taken by the Scottish Police Authority to approve its introduction.

Retrospective facial recognition technology

Police Scotland currently use retrospective facial recognition technology, which includes facial search and match processes.

The Sub-Committee heard concerns about the legal basis for Police Scotland’s use of retrospective facial technology, and whether their processes meet human rights and data protection requirements.

The lack of legislation enabling Police Scotland to retain and use photographic images held on its IT systems is an issue which must be addressed.

Police Scotland’s retention and use of images of innocent people held on its legacy IT systems and on the UK Police National Database, is another issue which must be addressed.

This practice infringes the human rights of those whose images are retained and represents an ongoing risk of both legal challenge and reputational damage to Police Scotland.

The Sub-Committee is concerned about the lack of regulation and transparency over the use of facial recognition technology by private companies and in the wider public sector, and their practice of sharing the data they collect with the police service. If the Scottish Biometrics Commissioner is not to have any formal oversight of the private sector or wider public sector, they will not be held to the same standard as the police service.

The Sub-Committee recommends that the following actions be taken to address concerns about Police Scotland’s use of retrospective facial recognition technology: The Scottish Government should confirm whether it will legislate to enable Police Scotland to take, retain, use and share photographic images. 

The Scottish Government should address the lack of regulation over the use of facial recognition technology by private companies, and by the wider public sector, and the data they share with the police service. Police Scotland should to provide details of its plans, including the timescale, for deleting images of innocent people retained on legacy databases. 

The Scottish Police Authority should carry out a review of Police Scotland’s use of retrospective facial recognition technology. This should include their use of the UK Police National Database and the legal basis for uploading photographs to that database. It should also include consideration of the consequences of their access to and use of any images of innocent people held illegally on that Database. 

The review should take a human rights-based approach to this assessment. 

During its inquiry, the Sub-Committee considered Glasgow City Council’s plans to introduce ‘Suspect Search’ software into its public space CCTV system, and to provide Police Scotland with access to the data it collects and creates. Glasgow City Council confirmed in their written evidence that the software is not based on facial recognition, but on characteristics, such as full body image. They also confirmed that it has a tracking functionality, which is described as “quasi-real time”, to reflect the time delay in tracking an individual. The software has not yet been introduced, as the UK Information Commissioner’s Office is currently considering the data protection impact assessment. 

The Sub-Committee is to write to the ICO to request an update on its consideration, and to Glasgow City Council to request further details of its plans.

The Sub-Committee asks the Scottish Police Authority to review Police Scotland’s plans to access and use Glasgow City Council’s Suspect Search technology. This should include consideration of whether all the necessary impact assessments have been undertaken and safeguards met.