What Scotland can learn from the facial recognition fiasco

Facial recognition may be an ambition for Police Scotland, but they can’t let that blind them to the steps they need to take before embarking on trials.

The use of live facial recognition, technology that seeks to identify a person from a digital image, by law enforcement has been an unravelling controversy ever since the Metropolitan Police and South Wales Police began trialing the technology in 2016 and 2017 respectively. A number of reports have questioned the accuracy, the ethics, the design, and the legal basis of these trials. There are now pending legal challenges against both Police forces.

The most recent report came last week from MPs on the Science and Technology Committee. They called for a moratorium on the use of live facial recognition until the effectiveness of and biases within the technology are fully understood and resolved, and a legislative framework has been introduced. This call had previously been made by the Ada Lovelace Institute.  The US city of San Francisco passed a moratorium on facial recognition into law earlier this year.

Police Scotland is not running any active live facial recognition trials. However Police Scotland has it as an ambition to run trials under the Policing 2026 strategy. Before trials can even begin to take place, there is a need to pause and learn from what has gone on down South. Scotland is in a strong position in terms of its record with biometrics – relative to other police forces. But it can easily lose that position if ambition takes over pragmatism and recognition of what has gone so wrong in London and South Wales.

So what should the Scottish Government and Police Scotland do?

Firstly, they should establish proper oversight for the collection, retention, use and deletion of biometric data by Police Scotland and other public bodies. Scotland is already some way towards that with the Biometrics Commissioner Bill that was introduced in May.

Secondly, establish in law the presumption of deletion of biometric data for those not suspected of any crime. This is vital before any dataset is turned into training data or trial datasets. It is already a clearly established need under human rights law from a Supreme Court decision in 2012. A dataset that is not human rights-compliant will create trials that are not human rights-compliant.

Thirdly, establish clear statutory rules for the trial of live facial recognition. The establishment of the Biometrics Commissioner is not enough. There also need to be rules and procedures established for live facial recognition. Lessons can be learned from the trials of facial recognition but also Police Scotland’s own concerning approach to trials with the cyber kiosks should be kept in mind.

Finally, there are the question marks that remain over court cases and reviews. In South Wales, a case brought by Liberty against the forces use of live facial recognition  is still to be decided. The Information Commissioner’s Office has opened a priority investigation into law enforcement’s use of facial recognition and will report on that investigation when the South Wales judgement have been issued. Police Scotland should wait for these to settle and the direction of travel to be shown before taking up trials.

The above recommendations are delivered deliberately in this order. In particular the need to get existing biometric databases in line before starting to use it for any live facial recognition trials. These databases have long been a source of concern. While Scotland has a good, even laudable record on DNA retention and deletion, custody photographs – the kinds of photos that would be used in live facial recognition trials – have not had such a deliberate and focused collection and deletion process. 

There is no legislation in Scotland which specifically regulates the retention periods for images, or indeed the way in which the images may be used. This has lead to the collection of over 1,000,000+ custody images by Police Scotland, with no policy for the disposal of these images. It would not be right to train facial recognition systems in Scotland on these images.

The proposed Biometrics Commissioner for Scotland won’t even have a binding law to make sure that deletion takes place at this stage as the only new rules that are proposed are a code of practice that Police Scotland should have to consider, but would not be binding on them. That is something that needs to be addressed and Open Rights Group intends to get this need for proper binding rules in place during discussions over the Bill with the Justice Committee at Holyrood.

The need to get the house in order before embarking on trials is the message behind the calls for a moratorium, and is probably the biggest lesson to be learned from the Met and South Wales trials. These police forces appeared unprepared to run these trials, their data still in breach of human rights standards, the public not informed and the oversight still in dispute.

Until proper rules are in place, and then those rules become practice, facial recognition trials in Scotland would be doomed to fail those fundamental tests.