Conclusions and recommendations
Scientific advice on biometrics
1. The
Foresight Programme's 2013 report on Future Identities was a missed
opportunity to examine biometrics and identify the main trends,
and the associated challenges, that policy-makers in this field
will face in the future. Indeed, it is astounding that biometrics
was deemed 'beyond the scope' of an apparently forward-looking
piece of analysis when, three years earlier, the Government had
been seeking to rely on biometrics as part of its identity card
programme. We agree with the Biometrics Commissioner that this
type of forward-looking analysis is desirable. (Paragraph 28)
2. We recommend that
Foresight builds on the evidence gathered during this inquiry
and undertakes a short, "Policy Futures" study to examine
systematically the emerging issues, risks and opportunities arising
from developments in biometrics. This analysis should be frequently
reviewed in order to keep pace with rapid advances in biometrics
and should be applied by the Government to assist its preparations
for, and to help it shape, how this field may unfold in the future.
(Paragraph 29)
3. Despite a previous
assurance from the Government, given over 12 months ago, that
the publication of the forensics and biometric policy group's
minutes was on the horizon, this has not occurred. As a result,
the remit and status of the group, as well as what has been on
its agenda, remain a mystery. This continuing lack of transparency
in the delivery of scientific advice to Government on biometrics
is unacceptable and goes against the Government's own guidance,
as set out in the 2010 Principles of scientific advice to Government.
(Paragraph 35)
4. To improve its
transparency, we recommend that the remit, membership and outputs
of the forensics and biometric policy group should be placed in
the public domain immediately. A commitment should also be made
to the publication of the minutes of all future meetings, unless
there are overriding reasons of national security for not doing
so. (Paragraph 36)
A strategy for biometrics
5. The
Government undertook to publish a joint forensics and biometrics
strategy by the end of 2013. Over a year later, there is no strategy,
no consensus on what it should include, and no expectation that
it will be published in this Parliament. In its absence, there
remains a worrying lack of clarity regarding if, and how, the
Government intends to employ biometrics for the purposes of verification
and identification and whether it has considered any associated
ethical and legal implications. (Paragraph 41)
6. The Government
should be developing a strategy that exploits emerging biometrics
while also addressing public concerns about the security of personal
data and the potential for its use and misuse, with particular
reference to biometric data held by the state. (Paragraph 42)
7. We expect a comprehensive,
cross-departmental forensics and biometrics strategy to be published
by the Government no later than December 2015. (Paragraph 43)
Testing biometric systems
8. When
biometric systems are employed by the state in ways that impact
upon citizens' civil liberties, it is imperative that they are
accurate and dependable. Rigorous testing and evaluation must
therefore be undertaken prior to, and after, deployment, and details
of performance levels published. It is highly regrettable that
testing of the 'facial matching technology' employed by the police
does not appear to have occurred prior to the searchable national
database of custody photographs going live. While we recognise
that testing biometric systems is both technically challenging
and expensive, this does not mean it can be neglected. (Paragraph
54)
9. When testing does
occur, the continued use of a variety of testing protocols by
suppliers makes it difficult to analyse and compare, with any
degree of confidence, the performance of different systems. Following
the abolition of the Biometrics Assurance Group, it is unclear
who is responsible for interpreting the outcomes of biometric
testing for the Government. (Paragraph 55)
10. The Government
should explain, in its response to this report, why the facial
matching technology employed by the police was not rigorously
tested prior to being put into operational use. We further recommend
that the Government details what steps it is taking to encourage
suppliers of biometric systems to comply with established UK testing
standards. (Paragraph 56)
Public attitudes
11. We
welcome the Government's commitment to the principle of proportionality
when it is considering implementing a biometric application. However,
we are not convinced that the Government has clear steps in place—such
as conducting mandatory privacy impact assessments—to measure
consistently whether or not a specific biometric application is
proportionate. (Paragraph 61)
12. We have seen in
the past how public trust in emerging technologies may be severely
damaged in the absence of full and frank debate. Despite growth
in commercial and Government applications of biometrics, the Government
appears to have made little effort to engage with the public regarding
the increasing use of their biometric data, and what this means
for them, since the scrapping of the Government's ID card scheme
in 2010. This is exactly the type of issue that the Government's
joint forensics and biometrics strategy should have addressed.
(Paragraph 68)
13. We recommend that
the Government sets out, in its response to this report, how it
plans to facilitate an open, public debate around the growth of
biometric systems. (Paragraph 69)
Data storage and system security
14. High
profile cyber-attacks and data loss incidents have undermined
the public's confidence in the ability of both Government and
industry to store their data securely. Security considerations
should never be an "afterthought" or an optional extra.
We welcome the Minister's confirmation that the security of the
Government's biometric systems is "bolted on" at the
beginning of the design process. However, such assurances alone
will do little to diminish the public's concerns while data losses
continue to occur. (Paragraph 75)
15. We recommend that,
in its response to this report, the Government outlines the steps
taken to mitigate the risk of loss, or unauthorised release, of
the biometric data that it holds. (Paragraph 76)
16. Current legislation
places responsibility on the institution rolling out a (biometric)
system to ensure that appropriate security measures are in place
when storing personal data. However, we are concerned that there
is no proactive, independent oversight of whether this is occurring.
Conducting a privacy impact assessment at the outset of all projects
and policies that collect, retain or process personal data would
help to ensure that those implementing a biometric system are
fully aware of, and compliant with, the necessary security measures.
(Paragraph 77)
17. We therefore reiterate
the recommendation made in our report, the Responsible Use of
Data, that privacy impact assessments should be conducted at the
outset of all projects and policies that collect, retain or process
personal data, including biometric data. (Paragraph 78)
18. In our opinion,
under no circumstances should the state roll out a biometric system
that does not provide any scope for human intervention. (Paragraph
84)
19. In the interests
of greater transparency of data collection and use, we reiterate
our earlier recommendation; namely that the Government drives
the development of a set of information standards that companies
can sign up to, under which they commit to explain to individuals
their plans for the use of personal data (including biometric
data), in clear, concise and simple terms. (Paragraph 85)
Legislation and standards
20. We
agree with the Government and the Information Commissioner's Office
that, as a principle-based framework, the Data Protection Act
1998 should provide adequate regulation in the face of developments
in biometric technologies. However, we are mindful of the concerns
raised by experts in the field, such as Professor Sue Black, and
therefore recommend that the Government keeps this matter under
review. (Paragraph 93)
21. To avoid a biometric
application once again being put into operational use in the absence
of a robust governance regime, we recommend that:
· the
forensics and biometric policy group is reconstituted with a clearer
mandate to analyse how developments in biometrics may compromise
the effectiveness of current policy and legislation;
· as recommended
in paragraphs 35 and 36, the reconstituted group should operate
in a transparent manner, be open to receiving inputs from external
bodies and publish its outputs;
· the
Government, police and the Biometrics Commissioner should use
these outputs to identify gaps in the legislation to be addressed
ahead of any new biometric application going live. (Paragraph
101)
The role of the Biometrics Commissioner
22. We
agree with the Biometrics Commissioner that there is value in
the provision of day-to-day, independent oversight of police use
of biometrics and that such oversight should extend beyond fingerprints
and DNA. We also agree that broadening the Commissioner's responsibilities
would be a "more sensible" approach than establishing
a new, separate commissioner covering other biometric traits.
(Paragraph 104)
23. We therefore recommend
that the statutory responsibilities of the Biometrics Commissioner
be extended to cover, at a minimum, the police use and retention
of facial images. The implications of widening the Commissioner's
role beyond facial images should also be fully explored, costed
and the findings published. We further recommend that the Government
clarifies where the operational boundaries lie between the Biometrics
Commissioner and the Forensic Science Regulator. (Paragraph 105)
Quality standards
24. Standards
become increasingly useful when they are widely adopted—namely
required by customers and used by vendors to build standards-compliant
products. As a customer, the Government can demand that its biometric
systems adhere to national and international standards. While
we recognise the advantages of the Government using its procurement
powers in this way, and of the benefits of interoperability between
biometric systems, we are also aware that there will be instances
when interoperability should be prevented in order to limit access
to sensitive personal information. Once again, in the absence
of a comprehensive biometrics strategy, it is not clear how the
Government aims to strike this delicate balance. (Paragraph 110)
25. The Government
should explain, in the interests of the responsible use of data,
how it intends to manage both the risks and benefits that arise
from promoting open standards and the interoperability of biometric
systems. (Paragraph 111)
| 
