Advisory Group - Minute of meeting of 19 July 2021

Approved for publication at 2nd Advisory Group Meeting on 25 November 2021

• Bruce Adamson Children and Young People’s Commissioner
• Alan Buchanan Director of Investigations (PIRC)
• Phil Chapman Director of Investigations (designate) PIRC
• Calum Dundas Head of Data Governance – Police Scotland
• Dr Genevieve Lennon Chancellor’s Fellow, Strathclyde University
• Dr Ken MacDonald Head of Regions, Information Commissioner’s Office (ICO)
• DCS Laura McLuckie Detective Chief Superintendent, Police Scotland
• Professor John McNeill Independent advisor on human rights and policing
• Tom Nelson Director of Forensic Services, Scottish Police Authority
• Professor Derek Penman International policing and leadership advisor
• Professor Fraser Sampson Biometrics & Surveillance Camera Commissioner (BSCC)
  (England & Wales) with wider UK responsibilities
• Dr Brian Plastow (Chair) Scottish Biometrics Commissioner

• Suzanne McGuiness Mental Welfare Commission
• Diego Quiroz Scottish Human Rights Commission
• Gill Imrie HM Chief Inspector of Constabulary in Scotland

The Chair welcomed members to the first meeting of the Advisory Group for the Scottish Biometrics Commissioner (SBC) established under the provisions of Section 33 of the Scottish Biometrics Commissioner Act 2020.

The Commissioner highlighted his general functions under Section 2 of the Act and noted that the Scottish legislation was couched in positive language in terms of the need for the SBC to ‘support and promote’ the adoption of lawful, effective, and ethical practices. Members gave individual introductions and apologies were noted from Gill, Suzanne, and Diego.

The Chair took the opportunity to record his thanks to Janice Crerar, Scottish Parliament Officeholder Services for coordinating the inaugural meeting arrangements, and to her colleague Huw Williams for facilitating the virtual meeting on MS Teams as part of safe working arrangements during the ongoing Covid 19 pandemic.

The Chair spoke to the first draft of the Terms of Reference (ToR) for the Advisory Group.The provisions of Section 33 of the Scottish Biometrics Commissioner Act were discussedincluding the statutory purpose of the group which is ‘…to give advice and information tothe Commissioner about matters relating to the Commissioner’s functions.’ It was noted in discussions that the role of the Advisory Group was to offer advice and information on theexternal facing general functions and need not extend to internal governance, as the Commissioner has separate access through the Parliamentary Corporation to an independent Audit Advisory Board (AAB) providing advice on governance, finance, audit,strategic risk-management, and schemes of delegation and control.

Professor Sampson (BSCC) welcomed the opportunity for close working over respective UK jurisdictions highlighting that Section 3 of the 2020 Act, conferred powers on the Scottish Commissioner to work with others including those bodies to whom the Commissioner’s functions extend, and other Scottish and UK regulators including the Information Commissioner (ICO) and Biometrics and Surveillance Camera Commissioner (BSCC).

There was a short discussion on the content of the first draft and various points were noted.These included options around frequency of future meetings, options to establish thematic sub-groups as and when required, and options for public engagement and user involvement in the work of the Advisory Group. It was acknowledged by all that the arrangements for the group would evolve as the new SBC function is established and matures.

Members agreed to give any comments on the first draft of the ToR by 30 August 2021.

Action No 1: Members to provide feedback on draft ToR by 30 August 2021

A short discussion took place on the administrative arrangements and potential frequency of future meetings including the likely need for more regular meetings in the set-up phase once the Commissioner has recruited staff and as his office becomes operational. There was also a short discussion on the opportunity for the group to be chaired independently by anon-Police Scotland, SPA, PIRC member of the group. The Commissioner explained that once summary highlight minutes had been approved by members, they will be published on the Commissioner’s website (once established) and that the Commissioner’s staff (once recruited) would provide administrative support for future meetings.

The Commissioner explained that the full year budget line to support the work of the Advisory Group had been set by the Parliamentary Corporation at £23K, however due to phased set-up, the allocation for 2021/22 was £11.5K. This was against the context of an overall operating budget of £334K for 2021/22 and a set-up budget of £207K for one-off costs associated with establishing a business address, ICT platform, website, and staff recruitment.

The Commissioner explained the arrangements for remuneration and expenses for the Advisory Group as approved by the Parliamentary Corporation. ‘Non-employed’ members could claim a daily rate of £300 for work associated with the activities of the Advisory Group. Travel or expenses could be claimed at current rates as approved by the Parliamentary Corporation. The interim process for remuneration or expenses is for members to contact Janice Crerar at Officeholder Services (email Janice.Crerar@parliament.scot) to be provided with the necessary claim form and guidance. SBC staff will take on this function later once staff have been recruited.

Action No 2: Members to consider the option suggested by the Commissioner to appoint an (non-Police Scotland, SPA, PIRC) independent chair of the Advisory Group from within the membership. Any volunteers or nominations by 30 August 2021.

The Commissioner gave an update on progress in setting up this new commission against the context of the ongoing pandemic. The group were advised that the Commissioner had established a contractual arrangement with Scottish Government to use the secure Scots/ERDM ICT platform.

Subject to planning permission, the business address and office will be established at Bridgeside House in Edinburgh to capitalise on opportunities for shared services with other Parliamentary Commissioners at that location.

The Commissioner explained that role profiles had been developed as a precursor to the recruitment of 3 members of staff. These posts were currently being independently evaluated with a view to the posts being advertised next month. The Commissioner explained that the formalities of the open recruitment process would likely mean that it will be late October or November before the 3 staff members have been recruited and taken up post. This has a consequence in terms of operational capacity and capability for 2021.

The Commissioner has also secured the website domain biometricscommissioner.scot and a website structure plan and content has been developed. Activity is ongoing to commission the services of a website builder. It is anticipated that it will be several months before the website can go-live as there is a dependency to staff recruitment and servicing any resultant demand.

The group heard that discussion was ongoing between Scottish and UK Government to consider extending the Commissioner’s remit to include other UK-wide policing bodies 4 operating in Scotland who collect data from persons following arrest, specifically the National Crime Agency (NCA), British Transport Police (BTP), and Ministry of Defence Police (MDP).

The ongoing discussion seeks to agree the proposed provisions of a draft order under Section 104 of the Scotland Act and would also confer cross-border jurisdiction to the SBC over all biometric data acquired by UK-wide policing bodies operating in Scotland. This would also cater for situations where source biological samples such as DNA mouth swabs are taken following arrest but then go for forensic examination in laboratories in other UK jurisdictions. It also caters for the aggregation of Scottish data to UK biometric databases.

If approved, Scottish Government will need to discuss the significant expansion of responsibilities and jurisdiction with the Parliamentary Corporation re impact on a Parliamentary Officeholder.

A short discussion took place on the content of a very first draft of the SBC 4-year Strategic Plan. The Commissioner explained that he was required to lay his Strategic Plan before the Parliament by 01 December 2021. The plan will cover the period 01.12.2021 to 30.11.2025 and must set out how the Commissioner proposes to perform his functions, what the objectives and priorities are, how they will be achieved, and a timetable and indicative costs.

The Commissioner indicated his preference for a rolling programme of thematic reviews with a holistic examination of policy, procedure, and practice around the acquisition, retention, use, and destruction on one biometric theme per year. There would also be a specific thematic looking at the arrangements for children, young people, and vulnerable adults.

The Strategic Plan would also cater for the Commissioners general duties to promote public awareness and understanding, to develop, publish and assess compliance with a statutory Code of Practice, and to lay specific and annual reports before the Scottish Parliament.

As a precursor to formal statutory consultation, members agreed to give any feedback on the first working draft by 30 August 2021.

Action No 3: Members to provide feedback on draft Strategic Plan by 30 August 2021

A paper was previously circulated outlining the draft suggested SBC quality management and assessment framework developed in discussion with the Improvement Service and based on the domains of EFQM/PSIF most applicable to policing and criminal justice. The draft framework contains 42 bespoke quality indicators grouped under 6 EFQM/PSIF 5 domains which seek to answer the research question: ‘What might good practice look like in terms of biometric data use for policing and criminal justice purpose?’

A brief discussion took place and members agreed to provide feedback on the draft by 30 August 2021.

Action No 4: Members to provide feedback on draft Assessment Framework by 30 August 2021

A paper was previously circulated outlining the first draft of a suggested Code of Practice. The Commissioner highlighted his desire to follow a principles-based approach, building on the seminal work of the former IAG in Scotland chaired by John Scott QC, and to encompass the latest UK and international thinking.

The objective for the Code is to set out an agreed framework of professional standards which strikes the right balance between the needs of policing and our criminal justice system in terms of upholding the law and keeping people safe, and the rights of individual private citizens and data subjects.

The first working draft contains lead-in background chapters and inclusions and exclusions from the Code. The exclusions may be summarised as functions already within the statutory remit of another UK Commissioner, notably:

• Biometric data retained as part of a National Security Determination in Scotland (NSD) within the remit of the UK Biometrics & Surveillance Camera Commissioner (BSCC)
• Biometric data obtained in Scotland under the Regulation of Investigatory Powers legislation within the remit of the Investigatory Powers Commissioner (IPCO)
• The enforcement of data privacy and protection laws in Scotland within the remit of the UK Information Commissioner (ICO)

The Code would apply to biometric data used for policing and criminal justice purposes only. It would not apply to biometric data collected by Police Scotland, SPA or PIRC for routine or specific employment purposes. Other excluded areas include where biometrics are given voluntarily in connection with non-police or non-criminal justice purposes such as in support of overseas emigration purposes.

The Commissioner highlighted the statutory consultees under the 2020 Act, and the desire to consult as widely as possible. Initial thinking was for a minimum 3-month window for formal consultation with options discussed amongst the group for insourcing, outsourcing or hybrid modes of consultation.

The group agreed the need for the final shape of the draft Code to be acceptable to those to whom it would apply before being brought forwards for the approval of Scottish Ministers.

It was agreed that members would provide feedback on the initial draft by 30 August 2021 as a precursor to the initiation of formal consultation.

Action No 5: Members to provide feedback on first working draft of the Code of Practice by 30 August 2021.

It was agreed that the next meeting of the Advisory Group would be arranged for mid to late November 2021. This should afford sufficient time for the Commissioner to complete the recruitment of 3 members of staff, establish a business address, and launch a public facing website.

In advance of that, the Commissioner will communicate further with members once a consolidated analysis has been done of the slow-time feedback on the various draft documents circulated.

Action No 6: SBC to coordinate diaries re next meeting in November.

There was no other business at the inaugural meeting and the Commissioner thanked those in attendance. Members wished Tom Nelson and Alan Buchanan a long and happy retirement.