Scottish Biometrics Commissioner Act 2020

Code of practice

7 Code of practice

(1) In furtherance of the Commissioner’s general function, the Commissioner must prepare, and may from time to time revise, a code of practice on the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes.

(2) The code of practice must include provision about when biometric data must be destroyed in cases where a relevant enactment does not make such provision.

(3) In making provision in accordance with subsection (2), the Commissioner must have regard to the provision made by relevant enactments.

(4) The code of practice may make different provision for different purposes.

(5) Sections 8, 10 and 12 apply to a revised draft code of practice as they apply to a draft code of practice.

(6) For the purpose of this section, the following are “relevant enactments”—

(a) Part 2 of the Criminal Procedure (Scotland) Act 1995,

(b) section 56 of the Criminal Justice (Scotland) Act 2003,

(c) Chapter 4 of Part 4 of the Age of Criminal Responsibility (Scotland) Act 2019.

8 Key considerations in preparing the code

In preparing a draft code of practice, the Commissioner must have regard to the importance of—

(a) promoting and protecting human rights,

(b) promoting and protecting an individual’s right to privacy,

(c) promoting and protecting public confidence in the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes, and

(d) ensuring the safety of individuals and communities.

9 Effect of the code

(1) The following persons must comply with the code of practice when exercising functions to which the code relates—

(a) constables and police staff of the Police Service of Scotland,

(b) the Scottish Police Authority,

(c) the Police Investigations and Review Commissioner.

(2) A court or tribunal in civil or criminal proceedings must take the code of practice into account when determining any question to which the code is relevant.

(3) Failure to comply with the code of practice does not of itself give rise to grounds for any legal action.

(4) The Scottish Ministers may by regulations amend subsection (1) so as to add a person or description of person, vary an entry listed in it, or remove an entry.

(5) In this section, “constable” and “police staff” have the same meanings as in section 99(1) of the Police and Fire Reform (Scotland) Act 2012.

10 Consultation on the code

(1) In preparing a draft code of practice, the Commissioner must consult—

(a) the Scottish Ministers,

(b) the Lord Advocate,

(c) the Lord Justice General,

(d) the Faculty of Advocates,

(e) the Law Society of Scotland,

(f) the chief constable of the Police Service of Scotland,

(g) Her Majesty’s Inspectors of Constabulary in Scotland,

(h) the Scottish Police Authority,

(i) the Police Investigations and Review Commissioner,

(j) the Information Commissioner,

(k) the Scottish Human Rights Commission,

(l) the Commissioner for Children and Young People in Scotland, and

(m) such other persons as the Commissioner considers appropriate.

(2) For the purpose of subsection (1), it is immaterial that anything done by way of consultation was done before this section comes into force.

11 Further procedure in relation to the first code

(1) Having prepared a draft of the first code of practice with which the Commissioner, with the consent of the Scottish Ministers, wishes to proceed, the Commissioner must lay a copy of it before the Scottish Parliament.

(2) In finalising a draft of the first code of practice, the Commissioner must have regard to any representations about it that are made to the Commissioner within 60 days of the date on which the copy of it is laid under subsection (1).

(3) In calculating the period of 60 days for the purpose of subsection (2), no account is to be taken of any time during which the Parliament is dissolved or in recess for more than 4 days.

12 Approval of the code

(1) Once the Commissioner has finalised a draft code of practice, the Commissioner must submit it to the Scottish Ministers for approval.

(2) The Scottish Ministers may approve a draft code of practice—

(a) without modification, or

(b) with such modifications as they, with the consent of the Commissioner, consider appropriate.

(3) If the Scottish Ministers do not approve a draft code of practice, they must give the Commissioner a statement of their reasons for not approving it.

13 Bringing the code into effect

(1) A code of practice approved under section 12(2) has no effect until the day appointed for the code by regulations made by the Scottish Ministers.

(2) Ministers must, when laying before the Scottish Parliament a draft of an instrument containing such regulations, also lay a copy of the approved code of practice.

(3) The Commissioner must publish the approved code of practice as soon as reasonably practicable after the regulations are made.

14 Report on the code

(1) The Commissioner must—

(a) keep the code of practice under review,

(b) prepare and publish a report on the Commissioner’s findings, and

(c) lay a copy of the report before the Scottish Parliament.

(2) The first report prepared under subsection (1) must be laid before the Parliament no later than 3 years after the date on which the first code of practice comes into effect.

(3) Subsequent reports prepared under subsection (1) must be laid before the Parliament no later than 4 years after the date on which the last such report was laid.

15 Complaints about failures to comply with the code

(1) The Commissioner must provide for a procedure by which an individual, or someone acting on an individual’s behalf, may make a complaint to the Commissioner that a person who is required by section 9(1) to comply with the code of practice has not done or is not doing so in relation to the individual’s biometric data.

(2) The procedure must provide for it to be available whether or not procedures—

(a) established by the person about whom the complaint is made, and

(b) which allow for the making of a complaint (or other representation) about the acquisition, retention, use or destruction of the individual’s biometric data,

have been or are being pursued.

(3) In determining the procedure, the Commissioner must consult—

(a) the Scottish Public Services Ombudsman,

(b) the Information Commissioner,

(c) the persons about whom a complaint may be made, and

(d) such other persons as the Commissioner considers appropriate.

(4) The Commissioner must give such publicity to the procedure as the Commissioner considers appropriate and must give a copy of the procedure to any person who requests it.

(5) The Commissioner must keep the procedure under review and must vary it whenever, after consulting the persons mentioned in subsection (3), the Commissioner considers it appropriate to do so.

(6) In subsections (2), (4) and (5), “the procedure” means the procedure for the time being in effect.