Total number of images held by criminal justice system unknown, report reveals

The total number of images held in the criminal justice system is unknown, an assurance review by the Scottish Biometrics Commissioner, Dr Brian Plastow, has revealed.

The report states that the exact volume of the images held was not “not easily accessible or possible to determine”, yet added it is “significantly higher” than all other biometric data types combined.

Plastow estimates that at least three million images are being held by Police Scotland alone.

The organisation itself only collects numbers of images taken when a person is in custody, which is around a quarter of the estimated total at 646,935 images relating to 382,052 people.

Both the Scottish Police Authority (SPA) – Police Scotland’s scrutiny body – and the Police Investigations and Review Commissioner could not identify the exact volume of images held for biometric purposes but could identify the types held.

This creates a knowledge gap which brings up issues relating to the governance of images, the report states.

It highlights that unlike other biometric data such as DNA and fingerprints, images are recorded in different formats and databases which creates control framework challenges.

It also raises concerns over the information given to people during the image acquisition process. The report stresses internal guidance is “mostly silent” on information rights and good practice.

The commissioner had already voiced such concerns in a prior review and although this report said Police Scotland had made progress, it added it had not “satisfactorily discharged” previous recommendations.  

It also states Scots law is silent regarding the retention period of images. Police Scotland and the SPA have followed retention practice for convicted persons according to Criminal History System conviction retention periods, which risks images being retained “longer than necessary”.

The upcoming Review of the Laws of Retention in Scotland is due to further examine the retention issue. It is scheduled for October this year and will be conducted by the Scottish Government. 

The report also states bodies had gaps within their governance frameworks regarding the international transfer of biometric data, with Police Scotland and SPA forensic services having no visibility of when UK exchange mechanisms shared Scottish records with the EU and other international jurisdictions. However, it noted that these exchange agreements are a reserved matter.

The commissioner had no new recommendations as he was “satisfied” that the bodies were compliant with the statutory code of practice.

In a statement shared with Holyrood, Plastow concluded the bodies “are using images in a lawful, effective, and ethical way." 

"The exact volumes of images held are currently unknown by each agency resulting in significant governance challenges. However, there is clear evidence of the management of biometrics being improved within and between each organisation as a result of the requirements of the statutory code of practice approved by the Scottish Parliament in November 2022," Pastlow added.