Police Scotland urged to create biometric data retention policy

The Scottish Biometrics Commissioner has urged Police Scotland to create a “distinct” policy on the retention of biometric data after a report found it might be holding data “longer than necessary”.

In a report published today, the Scottish Biometrics Commissioner and Scottish Government have called for a “thorough, evidence-based review” of Police Scotland’s approach to the retention of biometric data, warning the current one comes with “possible legal and ethical risks”.

The review recognised that while the retention of biometrics is currently undertaken in a “lawful, effective and proportionate manner" in Scotland, there is no distinct Police Scotland policy in place in relation to the retention of biometric data, which might be putting human rights at risk.

Scottish Biometrics Commissioner Brian Plastow said: “Police Scotland does not have a bespoke policy in relation to the retention of biometric data such as DNA, fingerprints, images and recordings taken for policing and criminal justice purposes in Scotland. Instead, such data is retained under a separate policy relating to the retention of entire criminal records.

“This means that, in some cases, biometric data is being retained for longer than necessary and that it is not being subjected to periodic reviews to ensure that ongoing retention in any individual case is both proportionate and strictly necessary.”

The review of the Retention of Biometric Data provided under sections 18 to 19C of the Criminal Procedure (Scotland) Act 1995 outlined six recommendations, four of which are made to Police Scotland.

It called for a policy to prohibit the indefinite retention without periodic review to be implemented within a year in a bid to ensure the retention of data complies with Article 8 of the European Court of Human Rights judgment (ECHR) - the right to privacy.

Currently, Police Scotland’s policy for destruction of DNA is based on a person’s 100th birthday or date of death plus three years while fingerprint data is retained in alignment with the Criminal Record Data Policy for convictions; or destructed three years from date of death.

Plastow added: “Its alignment to Crime Record Data Policy can lead to excessive retention periods which vary according to the convicted case data or the production evidence schedule. This gives rise to concerns about the lawfulness, proportionality and necessity of the prevailing biometric retention policies.”

The report also found Police Scotland had a lack of evidence on management information to support its current retention policies, and urged the organisation to fix the gap, to ensure retention policies are “lawful, ethical, effective and proportionate”, and can support any need for future legislative change.    

Other recommendations within the report included the speeding up of an ongoing review of volunteer data retention and assessment of the practicality of the one-month timeframe for DNA samples to be obtained from convicted persons.

Plastow added: “Biometric data is invaluable in the detection of crime – bringing perpetrators to justice and exonerating the innocent. But society is increasingly concerned about how this data is managed and seeks assurance that the police follow lawful, ethical, effective and proportionate methods.

“I expect that the report published today, in partnership with the Scottish Government, will provide the impetus for Police Scotland to develop distinct policy on biometric data that is consistent with the statutory Code of Practice in Scotland which mandates compliance with UK data protection law.”