The thin blue line: How the law is keeping pace with biometric data use

The BBC drama Life on Mars thrusts DCI Sam Tyler back in time to 1973 after being hit by a car in 2006. Unsure if he is at the centre of an elaborate ruse or in a coma fighting for his life, Tyler struggles with the societal norms and standards in the 70s police force he finds himself working for. Although the programme inflates officers’ disregard for forensics, best characterised by the scene where DS Ray Carling and DC Chris Skelton try to remove a drainpipe with their bare hands to check it for fingerprints, it does give an insight into policing in that era.  

Unlike Carling and Skelton, who found the idea of searching for fingerprints a foreign concept, the reality is biometric data, such as pictures, DNA, and fingerprints have been employed by the police for decades to identify criminals and victims. The latter has been used for over 100 years in Scotland. However, they were used nowhere near as often to convict criminals as they do today. This is in part thanks to a large database of prints that have been built up over decades from convicted criminals, as well as the development of the analysis and identification process.   

One of the first attempts in Scotland to gather a local database of prints was in 1952, when senior officers, who were investigating the murder of four-year-old Betty Alexander, took a palm print of every man living in the Garnethill area of Glasgow. When officers tested 20-year-old Sammy McCloy they got a match, and he was later sentenced to life imprisonment.    

Since then, the collection of biometric data has changed drastically. Particularly with the introduction of new forms of data, such as facial search and recognition, which have already been deployed by the Metropolitan Police. In March 2021, Dr Brian Plastow was appointed as the Scottish Biometric Commissioner, to help keep up with the rapid development of technology that has been, and will be, employed by Police Scotland and other justice bodies. In the last 18 months, Plastow has been working to bring in a statutory Code of Practice which would cover the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes in Scotland.   

The proposed code put forward by Plastow has been accepted by the Criminal Justice Committee, without amendment, and is expected to go before MSPs this month.   

Plastow says: “It is a world first, Scotland will be the first country in the world to adopt a statutory Code of Practice, on a national basis, to regulate how the police and criminal justice sector use biometric data.”  

The code will apply to Police Scotland, the Scottish Police Authority, and the Police Investigations & Review Commissioner. However, it does not extend to the whole criminal justice system, Plastow says: “I mentioned in my evidence to the Criminal Justice Committee that it doesn’t cover prisons. It also doesn’t extend to Crown or defence agents.  

“That is important as the Scottish Government are funding a big digital evidence sharing project, known as Digital Evidence Sharing Capability (DESC).      

“This will allow the police, the legal system, and the Crown Office, to share data to assist in effective prosecution in cases, and swift exoneration of innocent people. As part of that, biometric data will be shared. So, the code will apply to some of the bodies, but not them all.”  

Having oversight over some and not all “makes it more difficult to have a holistic end-to-end systematic look at the process, in terms of the entire journey of a biometric sample from the point of capture after somebody has been arrested, or at a crime scene, until it has worked its way right through the criminal justice process”.  

In 2008, the Scottish Forensic Database was reviewed by Professor Jim Fraser. He found that there was no independent oversight predominantly when it came to DNA and fingerprints used for criminal purposes.   

Then in 2015, Alistair McGregor QC, the first Biometrics Commissioner for England and Wales, revealed that UK policing had rolled out facial search software to the Police National Database (PND). “That got [Scottish] parliamentary interest,” says Plastow. Particularly at the time, England and Wales had a commissioner for biometric data, surveillance cameras, and a regulator for forensic science, while Scotland had none of these roles.    

As the rapid advancements of technologies make it harder for the law to keep up, it is hoped that the Code of Practice will perform better than drafting, passing, and amending legislation, Plastow explains: “The Code of Practice is a vehicle to deal with the inability to keep pace. It can be amended quickly, you can be quite fleet-footed about that, whereas, with the best will in the world, it takes two or three years to amend primary legislation.”  

Plastow believes the statutory Code of Practice is “the bit of the jigsaw that is missing”, by providing a framework for professional decision-making for the police when they adopt new biometric technologies or adapt existing ones. The code would give them 12 principles to ask themselves if the technology is the right thing to implement. The code will also provide a public complaints mechanism for data subjects.   

There is a concern from Plastow that, although things are working well between his offices and the bodies they oversee, there is a potential vulnerability. He says: “There is a potential vulnerability in that the police or others could adopt technology without me knowing about, or me knowing that they are about to. Then I could just get involved in the wash-up stage when it goes wrong, that is the risk.  

“My suggestion to the Criminal Justice Committee was that they should put a requirement into the legislation, that when adopting new biometric technology, the bodies to whom the code applies must give advanced notice to the commissioner, so that that we can comment on it.  

“My role is, in law, to support and promote the adoption of ethical practices, so it is an enabling role. We are not here to try to obstruct the police, we are here to try to help them do the right thing.”  

South of the border, the UK Government is trying to pass legislation which would abolish the role of the Biometrics Commissioner and the Surveillance Camera Commissioner for England and Wales. The latter deals with issues like facial recognition, as it is not considered a biometric data form, unlike in Scotland.  

The Biometrics Commissioner would relinquish some of its powers to the Investigatory Powers Commissioner and the Surveillance Camera Commissioner would give its powers to the Information Commissioner’s office. Meaning issues related to surveillance would be dealt with simply as a data protection issue. 

However, the Data Protection and Digital Information Bill sponsored by the now former Secretary of State for Digital, Nadine Dorries, may be on a shaky peg after Dorries refused to join Truss’s cabinet.  

One form of biometric data collection that has had a lot of attention on the grounds of ethics is live facial recognition (LFR). In July 2022 a Metropolitan Police van with LFR cameras was set up outside a tube station. The LFR system scanned over 15,600 faces, with four turning up what is referred to as ‘true alerts’. Of these four, three arrests were made.   

Although live facial recognition is not currently being used by Police Scotland, there is a margin for error in the current technology, as “it is only looking for characteristics of similarity, so you need a human in that process ultimately to make decisions. It is a less reliable biometric”, says Plastow.     

The margin for error does cause a great deal of concern for many people as certain demographics are harder to be identified. Plastow explained why the technology struggles to correctly identify certain skin tones: “A lot of the biometric software producers have got a lot better at this, but in the early days, typically what would happen would be that a biometric system would be trained and developed in Silicon Valley and the algorithms would be trained on white faces, predominantly male. Because of that, the system is less effective at identifying people who are not white.    

“There are also issues with light reflection, white reflects light more easily than the colour black. There have been several studies done internationally that have shown that many of these biometric applications are discriminatory in their ability to identify people with black or brown skin.”  
 

Three crucial dimensions must be considered when trying to solve a crime, Plastow highlights; “what is legal, what is technologically possible, and what is acceptable to society”. He gave an example of how Police Scotland uses the most advanced DNA interpretation available, DNA 24. Plastow explains: “Where we start to get into the moral ethical territory is what if the police decided that they could use DNA to ascertain the potential skin colour of a suspect from a crime scene sample or eye colour. Well, that would be legal, and it is technologically possible, but is it acceptable in society? I would suggest not.”