Scottish Biometrics Commissioner receives Committee boost
Amendments made to the Scottish Biometrics Commissioner Bill have strengthened the status of the proposed Commissioner, including providing an individual complaints procedure, making the code of practice set by the Commissioner binding and allowing for the Commissioner to present compliance notices. However there was a failed amendment to the scope of the Commissioner to cover public bodies, instead setting an assessment of scope of the Commissioner in three years time.
Open Rights Group have called on all of these areas to be included for the Commissioner years ago during the Independent Advisory Group on the Use of Biometrics. While the failure to expand scope is disappointing, these latest developments have moved Scotland further forward in creating the modern, effective, institutions to safeguards the rights of everyone living in Scotland.
Below is a breakdown of the newest amendments to the Bill and their potential effect.
Individual complaints procedure to be established
What?
The Commissioner must create an independent complaints procedure (Section 5A) by which a person or someone acting on a person’s behalf, may make complaints in relation to the acquisition, retention, use or destruction of biometric data by Police Scotland or the Scottish Police Authority.
Effect?
This amendment would provide for a member of the public to approach the Commissioner with concerns, specifically concerns on whether Police Scotland are following the standards set out in the yet to be developed Code of Practice.
This is an important tool in the provision of accountable and approachable institutions. Previously there was no way for an individual to raise concerns with the Biometrics Commissioner about the use of biometric data. Of course, there is a route to complain about the use of personal data (which includes biometric data) to the Information Commissioner’s Office, and it is important that the public retain that opportunity and that the two Commissioner’s can work together on this area of high public concern.
The ICO had written to the Justice Committee requesting it be made clear that a complaints procedure be established specifically in relation to the Code of Practice. That makes good sense given the ICO will have its own role and complaints procedure that should remain intact.
Review of the Commissioner’s functions, power and scope
What?
This amendment (section 5B) provides to set in statute a timeline for reviewing the funcntions and powers of the Commissioner, and whether they remain appropriate. It also importantly requires the review of the Commissioner’s scope and whether it should be extended beyond the criminal justice and police purposes by Police Scotland and the Scottish Police Authority.
Effect?
This sets in stone that the Commissioner’s scope must be considered in a review, whch is encouraging. There is still a sense of a missed opportunity here to fix the scope. We know that issues around biometrics collection go beyond policing and into other areas, and that those areas become blurred with policing too which could cause confusion down the line. Open Rights Group had called for a wider scope before this Bill even began to be debated to set a broader scope for the Commissioner, and reiterated this call alongside Big Brother Watch and Amnesty International. We remain convinced that the scope should be extended now.
Compliance and compliance notice
What?
Amendments have made the Code of Practice binding (Section 7) on Police Scotland and Government amendments have created a compliance notice scheme (Section 17 A – E).
Effect?
These two amendments have given the Commissioner greater bite in their bark. Previously those to whom the Code of Practice, the rules that the Commissioner will draw up for the acquisition, retention use and destruction of biometric data, applies would only have to have regard to the Code and not be bound by it. Now not only must it be followed by those bodies but the Commissioner can issue a notice requiriing the person to whom it is issued to take the steps necessary to comply. Failure to do so can result in reporting to the Court of Session and may result in stronger sanction such as being held in contempt of court or such other order for enforcement as it considers appropriate.
While the scope of the Commissioner remains unnecessarily narrow in ORG’s opinion, these additions to its powers and a clear commitment to review the scope in the future has meant the Bill has been strengthened through committee amendments.
The next stage is Stage 3 where the Bill is subject to a debate in the Chamber of the Scottish Parliament. Further amendments may come and we are calling for those recent amendments above not to be rolled back. While not the exact picture ORG had in mind, this is another big step in creating modern, effective institutions that will set a standard for other Commissioner’s in a similar area and further will likely influence the future of how organisations in England and Wales approach their own consideration of oversight of biometric