3Biometrics
The Biometrics Strategy
34.When the Home Office published its Forensic Science Strategy in March 2016, it came without the complementary ‘Biometric Strategy’ that was originally planned. In 2013, the Government had committed to producing a ‘Biometric and Forensic Strategy’ by the end of that year.73 Subsequently, in March 2015, the Home Office undertook to publish it by the end of that year;74 later opting for two strategies—a ‘Forensic Strategy’ and a ‘Biometric Strategy’—to be produced by the end of 2015. It said:
The Government’s Biometric Strategy and associated policy framework will support an aligned approach on the use and retention of biometrics and how its implementation is governed. Whilst forensics and biometrics both involve the use of science and technology, they are different. The Government is developing two separate but aligned Forensic and Biometric strategies and remains committed to publishing both strategies by the end of 2015.75
The Government told our predecessor Committee in November 2016 that a Biometrics Strategy was “in the final stages of completion and will be published shortly”.76
35.Last year, with the Biometrics Strategy still to be delivered, we asked the Home Office about its plans for publication. Baroness Williams, the Home Office minister for countering extremism, told us in November that:
A great deal of work has been done on the [Biometrics] Strategy. It ranges across many areas of policy, some of which are developing rapidly. After reviewing it carefully, I have decided that it cannot be finalised until further work has been done in some of these areas, and so it will unfortunately not be possible to publish the Strategy until next year.77
When the minister subsequently gave evidence to us in February 2018, she told us that she expected to publish a Biometrics Strategy in June 2018.78 Baroness Williams told us that further work was being done on the draft Biometrics Strategy because its “scope was too wide” with different Government departments using biometrics for different purposes. She envisaged a “framework for governance and oversight”,79 and wanted:
something that was flexible and fit for the future in this quite fast-changing area. […] We need something in place quite urgently. It is also the reason we need to get the framework for the strategy absolutely right so that it is not only fit for the future but that it gets those ethical and legal questions fixed within it of why we are doing what we are doing, and how we deploy our policy.”80
36.The Government’s rationale for the more than four years’ delay in producing a Biometrics Strategy is less than convincing. We agree with the Minister that the Strategy needs to put in place a governance structure that is fit for the future and ‘fixes’ the ethical and legal questions involved, but it is those issues—notably around facial images—that make a Strategy urgently needed. The Government must now produce the Strategy in June, without any further delay.
Deletion of facial images from police databases
37.The High Court judgment in the 2012 ‘RMC’ case81 was critical of the governance arrangements for custody images then in place and, as the Biometrics Commissioner put it, concluded that “the retention regime was not proportionate in its treatment of unconvicted persons to the extent that it was unlawful”.82 Legislation is silent about the length of time for which custody images can be retained, but the Court held that the retention regime for custody images taken from un-convicted persons was incompatible with Article 8 of the European Convention on Human Rights. The Minister explained that the Court’s reasoning was based on the lack of distinction between those who were and were not convicted and the retention review periods set out in the police’s guidance.83
38.The Home Office commissioned its Police Science & Technology Unit to conduct a Custody Images Review, which considered the issues raised in the RMC case and reported its findings in February 2017.84 The Minister told us in November 2017 that the Review had concluded:
Unconvicted persons have the right to apply for deletion of their image, with a presumption in favour of deletion […]. However, the police have the right to retain the image if there is an exceptional reason to do so, such as the person posing an ongoing risk to the public. The [Authorised Professional Practice guidance] has since been amended to reflect this.85
In March 2017 Paul Wiles, the Biometrics Commissioner, warned that the proposed process for those not convicted of an offence to apply to the police to have their facial images deleted would be “complex, and will require a great deal of individual decision-making resulting in high compliance costs and, in spite of guidance, may lead to forces exercising their discretion differently, thereby resulting in a postcode lottery”.86
39.Our Home Office witnesses told us in February that systems were not integrated in a way that would allow automatic image deletion:
The removal [of facial images] will be undertaken only when there is a request; there is no mechanism at the moment automatically to connect the non-conviction to the custody image and therefore to prompt the police to make that removal. It relies at the moment on a request being made. […] There is no mechanism for prompting a decision to be taken on retention at that point, but there are review periods in place to ensure that, after a certain period of time, depending on the offence, the custody image’s retention will be reviewed.87
The Custody Images Review noted that images were held on a range of local custody systems which were not linked to Crown Prosecution Service or court systems, and were “not generally designed to automatically weed, review or destroy images, or to differentiate between convicted and unconvicted individuals”.88 The Home Office explained to us that if images are deleted on local custody systems they will also be automatically deleted from the Police National Database, but not the other way round.89
40.The Home Office acknowledged that the approach of allowing deletions on request for facial images, rather than automatically, differs from the “significantly more advanced” system used for DNA and fingerprints data. The Home Office told us that DNA and fingerprint databases are held “in only one place and are linked to information on the Police National Computer about case outcomes and conviction status” and that unique identifying numbers for each case “makes it possible to filter records relating to unconvicted persons automatically”.90
41.The Home Office’s Custody Images Review made it clear that its recommendations, adopted by the Government, sought to reflect the limitations of the current police IT systems and the potential costs of a manual internally-driven system of making deletions:
This approach balances the need to use information, data and intelligence to protect the public, against the Article 8 rights of individuals. It also takes account of the high estimated cost to the taxpayer of a full manual deletion exercise in respect of all custody images currently held. It is expected that the implementation of any new technological solutions, both local and national, will link and integrate intelligence, crime and prosecution data providing a better ability to search, access and assess custody images leading to improved risk-based retention and deletion.91
Any potential manual weeding exercise, the Minister told us, “will have significant costs and be difficult to justify given the off-setting reductions that [police] forces would be required to find in order to fund it”.92
42.As part of the Home Office Biometrics Programme (HOB), a National Law Enforcement Data Programme is intended to replace legacy IT systems for storage and comparison of fingerprints, DNA and facial images currently stored on the Police National Computer and the Police National Database—existing systems which are “inflexible and expensive to change”.93 The IT replacement programme would allow police officers to be able to access driving licenses images, and consideration was being given to whether passport images could also be accessed.94 The Home Office expected the “new platform being delivered by the National Law Enforcement Data Programme to […] enable a considerably more flexible approach to automatic deletion than is possible at present”.95
43.There is limited data on the number of requests for facial image deletion since the Review. The Press Association established, from data received from 37 police forces, that up to October 2017 there had been 67 requests for custody image deletions and, of the 48 where decisions had been reached, 14 had been refused.96 In the meantime, the Home Office could not provide us with statistics from police forces on the number of applications and approvals for deletions, but told us it was currently compiling them.97 Big Brother Watch have questioned the lawfulness of the Government’s approach of not automatically deleting images,98 as well as of the use of facial recognition technology.
44.The result of the 2012 ‘RMC’ case was a ruling that it is unlawful to hold custody images without making a distinction between those who are convicted and those who are not. The Home Office’s response has been to introduce a system for unconvicted individuals to be able to request the deletion of their images, but not an automatic deletion system. The Government’s solution reflects current weaknesses in IT systems and a concern about the potential cost of a manual deletion process that does not depend on external requests. New IT is planned, which might help automate the system in future. The Government’s approach is unacceptable because unconvicted individuals may not know that they can apply for their images to be deleted, and because those whose image has been taken should not have less protection than those whose DNA or fingerprints have been taken.
45.The Government must ensure that its planned IT upgrade under the Home Office Biometrics Programme is delivered without delay, and is used to introduce a fully automatic image deletion system for those who are not convicted. If there is any delay in introducing such a system, the Government should move to introduce a manually-processed comprehensive deletion system as a matter of urgency. The forthcoming Biometrics Strategy must address which of these possible routes will be followed. The Strategy should also set out the Home Office’s assessment of the lawfulness of its deletion-on-application response to the ‘RMC’ case, and the legal advice underpinning that assessment.
Facial recognition and ‘watch lists’
46.Some police forces are using images in facial recognition applications. Custody and other images stored on the Police National Database and other police force systems have been used to identify individuals in public places.99 We discussed with the Minister how images had been used for policing the Notting Hill Carnival, Remembrance Day in Whitehall and a Six Nations rugby match in Cardiff.100 The Home Office told us that the use of the technology at such events involved comparing faces in the crowds against a ‘watch list’ of people wanted by the police or previously expected to commit offences. They told us that, except where there were matches, both the watch list created for the events and the images collected at the events were subsequently deleted.101
47.There has been some controversy about these cases, nevertheless, including about the effectiveness of the technology and concerns that its reliability in making matches might vary when applied to people from different racial groups. As we noted in our recent report on Algorithms,102 research at MIT in the US found that widely used facial-recognition algorithms were biased because they had been ‘trained’ predominantly on images of white faces. The systems examined correctly identified the gender of white men 99% of the time, but the error rate rose for people with darker skin, reaching 35% for black women.103 In the UK, Big Brother Watch recently reported their survey of police forces, which showed that the Metropolitan Police had a less than 2% accuracy in its automated facial recognition ‘matches’ and that only two people were correctly identified and 102 were incorrectly ‘matched’. The force had made no arrests using the technology.104 The Minister told us in November 2017 that:
Our view is that facial searching plays an important role in the detection and prevention of crime. There is a clear need to strike a balance between protecting an individual’s privacy and giving the police the tools they need to keep us safe. A decision to deploy facial recognition systems is an operational one for the police. Further, the retention and use of such images by police is governed by the Code of Practice on the Management of Police Information (MoPI), and accompanying guidance set out in the College of Policing’s Authorised Professional Practice (APP).105
48.The Minister agreed that “there is a line between maintaining privacy and maintaining public protection”.106 The Government, she told us, “need to be absolutely clear about why they are collecting [images] and for what purpose”.107 The technology, the Minister told us, was still developing and “the reason it is being piloted, rather than being used widely, is that the technology is developing”.108 The Home Office Biometrics programme was still evaluating the technology.109 Subsequently, in May, the Information Commissioner has indicated her readiness to initiate legal action on the use of facial recognition, on data protection grounds:
There may be significant public safety benefits from using [facial recognition technology]—to enable the Police to apprehend offenders and prevent crimes from occurring. But how facial recognition technology is used in public spaces can be particularly intrusive. It’s a real step change in the way law-abiding people are monitored as they go about their daily lives […] For the use of [facial recognition technology] to be legal, the police forces must have clear evidence to demonstrate that the use of [facial recognition technology] in public spaces is effective in resolving the problem that it aims to address, and that no less intrusive technology or methods are available to address that problem. Strengthened data protection rules coming into law next week require organisations to assess the risks of using new and intrusive technologies […] I have identified [use of facial recognition technology] by law enforcement as a priority area for my office and I recently wrote to the Home Office and the NPCC setting out my concerns. Should my concerns not be addressed I will consider what legal action is needed to ensure the right protections are in place for the public.110
49.Facial image recognition provides a powerful evolving technology which could significantly help policing. There are serious concerns, however, over its current use, including its reliability and its potential for discriminatory bias. We welcome the Government’s assurances that the technology is only being used at the moment for targeting those on ‘watch lists’ rather than as a blanket approach, and that images collected from public events and the relevant watch lists are being deleted afterwards.
50.Facial recognition technology should not be generally deployed, beyond the current pilots, until the current concerns over the technology’s effectiveness and potential bias have been fully resolved. The new facial images ‘oversight Board’ that the Minister is planning to set up (paragraph 54) will need to ensure that that condition is satisfied. But in such an important area, with public confidence critical, it must be ministers and Parliament that take the final decision on any wider deployment of the technology. The forthcoming Biometrics Strategy should include an undertaking that such a decision will not be left to be “an operational decision for the police”, and provide a Government commitment to give the House an opportunity to debate and vote on the issue.
Oversight structures
51.There have been significant changes in the governance structures for biometrics in recent years. In 2016, oversight of fingerprints was added to the remit of the Strategy Board responsible for DNA, to become the ‘National DNA Database & Fingerprint Database Strategy Board’. It includes representatives from the police, the Home Office, the Forensics Regulator, the Biometrics Commissioner and the Information Commissioner.111 Paul Wiles, the Biometrics Commissioner, observed that DNA has a national database and a central management and governance framework, whereas the police use of fingerprints was still a much more dispersed system. He saw the extension of the Strategy Board’s remit as “a welcome development since it brings fingerprints within a proper, transparent and, moreover, mature national governance structure”. One of the challenges for the Strategy Board, the Commissioner believed, was “to bring the collection, use and governance of fingerprints to the same standard as that of DNA”.112
52.However, the remit if the Strategy Board does not cover facial images. Paul Wiles expressed his concern in March 2017 that “so far there has been little or no public discussion in respect of the retention and use of facial images or whether or how such a regime should be governed. The development has taken place outside the oversight of the [Strategy Board]”.113 He also highlighted the need to address the oversight and ethics of facial images:
The development of digital images, their storage on a national database, the use of powerful searching algorithms and the deployment of such technologies in public spaces transforms facial images into something new. Whilst even the best matching algorithms cannot reach the accuracy levels achieved by DNA, and like fingerprints require human interpretation, they are improving and are already being deployed. […] Facial images are a powerful new biometric but the acceptance by the public of their use for crime control purposes may depend on the extent to which the governance arrangements provide assurance that their use will be in the public interest and intrusion into individual privacy is controlled and proportionate.114
53.The Biometrics & Forensics Ethics Group recommended in September 2017 that the public’s views should be sought in relation to whether they consented to the images from their driving licenses and passports being available to police officers on the street.115 The Biometrics Commissioner was concerned that “unlike DNA or fingerprints, facial images can easily be taken and stored without the subject’s knowledge and facial images of about 90% of the adult population already exist in passports or driving licences”.116 He noted that in 2016 there were 19m facial images on the Police National Database, 16.6m of which were searchable using facial recognition software.117 This compared with 5.2m people on UK DNA databases, or 8% of the population.118 The national fingerprint database holds 8m unique arrestee ‘ten-print’ records and 2.4m unmatched finger-marks and palm-prints.119
54.We discussed with the Minister the possibility of the police having images available for nine-tenths of the adult population in real-time, and the potential privacy issues involved. While the current poor reliability of facial recognition technology is a concern in itself, an eventually effective system could pose different issues for privacy if linked to passport and driving licence image databases. Baroness Williams emphasised “the tenet that the police need to use the biometrics, that they have, for policing purposes”,120 and she told us that:
I agree that independent ethical oversight of police use of biometrics is desirable, and for this reason we have extended the remit of the Biometrics & Forensics Ethics Group from DNA and fingerprints to all biometrics.121
The Minister acknowledged that governance and oversight arrangements have grown over several years and were “quite complicated”. The Home Office were considering the formation of an ‘oversight board’ for facial recognition that would bring three regulators and oversight bodies together (the Biometrics Commissioner, the Surveillance Camera Commissioner and the Information Commissioner) with the police.122
55.There are important ethical issues involved in the collection, use and retention of facial images that have greater salience than for DNA, fingerprints and other biometrics, not least because facial images can easily be taken and stored without the subject’s knowledge and because (unlike DNA and fingerprints) facial images databases—passports, driving licences and custody images—already include 90% of the adult population. Recent developments in the oversight of biometrics, to include facial images, will help such issues to be addressed. We welcome the Minister’s decision to set up a facial images ‘oversight Board’. The forthcoming Biometrics Strategy should consider the scope for further refinement in the oversight architecture, including how image databases should be managed and regulated, potentially by a dedicated ‘Regulator’ or by the Biometrics Commissioner with an extended remit.
73 Home Office, Government response to the Second Report from the Science and Technology Committee: Forensic science, Cm 8750 (November 2013)
74 Science and Technology Committee, Legacy: Parliament 2010–15, Ninth Report, Session 2014–15, HC 758
75 Science and Technology Committee, Current and future uses of biometric data and technologies: Government Response to the Committee’s Sixth Report of Session 2014–15, Second Special Report, HC (2015–16) 455, p4
76 Science and Technology Committee, Forensic Science Strategy: Government Response to the Committee’s Fourth Report, Second Special Report of Session 2016–17, HC 845
77 Letter from Baroness Williams, 30 November 2017
78 Q85
79 Q94
80 Qq83–85 (see also Q144)
81 RMC and FJ v Commissioner of Police for the Metropolis and Secretary of State for the Home Department [2012], EWHC 1681 (Admin). (The case involved two unconnected individuals—‘RMC’ and ‘FJ’—who had been arrested but subsequently not prosecuted, and who sought to have their custody images destroyed.)
82 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016, para 300
83 Letter from Baroness Williams, 30 November 2017
84 Home Office, Review of the use and retention of custody images (February 2017)
86 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016, para 300
87 Qq132, 135 [Christophe Prince, Director for Data & Identity, Home Office]
88 Home Office, Review of the use and retention of custody images (February 2017), para 1.4
89 Letter from Baroness Williams, 28 March 2018 (also BSF002)
90 Letter from Baroness Williams, 28 March 2018 (also BSF002); Qq150–151 [Christophe Prince, Director for Data & Identity, Home Office]
91 Home Office, Review of the use and retention of custody images (February 2017), paras 1.13–1.14
92 Letter from Baroness Williams, 28 March 2018 (also BSF002)
95 Letter from Baroness Williams, 28 March 2018 (also BSF002)
96 Mail online, `Custody image deletion request figures revealed’, 12 February 2018
97 Letter from Baroness Williams, 28 March 2018 (also BSF002)
98 Big Brother Watch, ‘Misleading, incompetent and authoritarian: the Home Office’s defence of facial recognition’, 19 April 2018
99 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016 (March 2017)
100 Qq139–143, 157
101 Letter from Baroness Williams, 28 March 2018 (also BSF002)
102 Science and Technology Committee, The use of algorithms in decision-making, Fourth Report of Session 2017–19, HC 351
103 Joy Buolamwini, Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification, Proceedings of Machine Learning Research 81:1–15 (2018)
104 Big Brother Watch, Faceoff: The lawless growth of facial recognition in UK policing (May 2018)
106 Q106
107 Q145
108 Qq142, 160, 161
109 Q162
110 Elizabeth Denham, ICO blog, Facial recognition technology and law enforcement (14 May 2018)
111 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016 (March 2017), paras 11, 13
112 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016, paras 13, 14
113 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016, para 303
114 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016 (March 2017)
116 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016, para 305
117 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016 (March 2017), para 301. (In February 2018 the Minister estimated 21m images in total (some of which were not facial images), including 12.5m which are searchable (Qq106–110).)
118 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016, para 15
119 Commissioner for the Retention and Use of Biometric Material, Annual Report 2016, para 30
120 Qq166–169
121 Letter from Baroness Williams, 30 November 2017. (A ‘Biometrics & Forensics Ethics Group’, an advisory non-departmental public body, provides independent advice to ministers and the Strategy Board on ethical issues concerning the operation of DNA and fingerprint databases.)
122 Qq101, 158; Letter from Baroness Williams, 28 March 2018 (also BSF002)
Published: 25 May 2018