6.Section 2 provides for the Commissioner’s general function. The general function is to support and promote the adoption of lawful, effective and ethical practices in relation to the acquisition, retention, use and destruction of biometric data by Police Scotland, the SPA and the PIRC. It also allows the Scottish Ministers to amend, by regulations, the list of persons subject to the Commissioner’s functions by adding, removing or varying a person or description of a person It should be noted that “person” is defined widely in schedule 1 of the Interpretation and Legislative Reform (Scotland) Act 2010 and includes bodies as well as individuals, whether or not incorporated. However, the Commissioner’s remit extends only to criminal justice and policing, so any person with a range of functions added to the list in section 2(1) would be subject to the Commissioner’s functions only in respect of the handling by that person of biometric data for criminal justice and police purposes.
7.This section goes on to specify that the Commissioner’s general function does not extend to biometric data in relation to which the Commissioner for the Retention and Use of Biometric Material (“CRUBM”) has a function under section 20 of the Protection of Freedoms Act 2012 – which provides that the CRUBM must keep under review national security determinations, including determinations made under section 18G of the Criminal Procedure (Scotland) Act 1995. A national security determination is made if the chief constable determines that it is necessary for biometric data to be retained for the purposes of national security. The CRUBM must keep under review the uses to which the biometric data retained pursuant to a national security determination is being put. As regards Scotland, the CRUBM has a general function of keeping under review the retention and use of biometric data not subject to a national security determination where the data is collected using powers in the Terrorism Act 2000 or the Terrorism Prevention and Investigation Measures Act 2011.
8.Section 2 requires that in exercising the Commissioner’s general function, the Commissioner is to keep under review the law, policy and practice relating to the acquisition, retention, use and destruction of biometric data by Police Scotland, the SPA and the PIRC. The Commissioner is to promote public awareness and understanding of the powers and duties of those bodies in relation to biometric data, how those powers and duties are exercised and how those powers and duties may be monitored or challenged. In exercising those functions, the Commissioner is to have regard to technologies used or capable of being used for the purpose of acquiring, retaining, using or destroying biometric data. The Commissioner must also promote, and monitor the impact of, a code of practice.
9.The Commissioner’s powers relate to biometric data which is acquired, retained, used or destroyed for criminal justice or police purposes. Although the terms “criminal justice purposes” and “police purposes” are not defined, the latter would include any activities which the police legitimately undertake. This goes beyond just the prevention and detection of crime. It would therefore also cover, for example, work the police do to help identify a dead body (even where the death has not been categorised as suspicious). It would also cover work the police do to investigate an act carried out by a child who is below the age of criminal responsibility.
10.Under subsection (5), the Commissioner may carry out, commission or support any research the Commissioner considers appropriate. The Commissioner may also make recommendations concerning any matter relevant to their general function.
11.In exercising the Commissioner’s general function, the Commissioner is to have regard to the interests of particular groups – these are children and young people (those aged under 18 years) and vulnerable persons. Vulnerable persons are those who may have difficulty understanding why and how their biometric data is being processed by the police, the SPA or the PIRC.
12.Section 3 allows the Commissioner to consult, assist or work jointly with a prescribed list of bodies, as well as anyone else the Commissioner considers appropriate, at their discretion. This (like all other sections) is subject to the Commissioner’s general function, so that work could only be undertaken if it would further the objectives of the Commissioner.
13.Section 4 permits the Commissioner to do anything which appears to the Commissioner to be necessary or expedient to the carrying out of their functions, such as entering into contracts, acquiring or disposing of land or obtaining advice, assistance or any other service from a third party (such as legal advice from a solicitor). However, this is subject to the caveat that the Commissioner may only pay a person for advice, assistance or for any other service with the approval of the Scottish Parliamentary Corporate Body (“the SPCB”). This gives the SPCB a role in approving the appointment of a person to provide advice or other service to the Commissioner.
14.Section 5 requires the Commissioner to comply with any direction given by the SPCB in respect of the following: the location of the Commissioner’s office; the sharing of staff, premises, resources or services with other public offices or bodies; the form and content of the Commissioner’s annual report (which will cover relevant issues arising during the year, the Commissioner’s activities during the year and any recommendations arising from that activity); and the process to be followed in appointing members of the advisory group established under section 33. Any such direction is to be made publicly available by the SPCB.
15.However, the Commissioner is only subject to possible control by the SPCB to the extent explicitly specified. Aside from these specified matters (which do not infringe upon the core job of having oversight of the use of biometric data for criminal justice and police purposes), the Commissioner is not an agent of the Crown and there is no general obligation to comply with directions. The Commissioner is therefore independent and is not subject to the general control of the Parliament, the Government, or the SPCB.
16.Subsection (1) of section 6 of the Act requires the Scottish Ministers to prepare, publish and lay before the Scottish Parliament a report on the Commissioner’s functions. This must be done within one year of the expiry of the period covered by the Commissioner’s first strategic plan under section 28. In preparing such a report, subsection (2) requires the Scottish Ministers to consult such persons as they consider appropriate. Subsection (3) requires the Scottish Ministers to consider whether the functions of the Commissioner remain appropriate and whether the list of bodies subject to the Commissioner’s functions and the list of bodies subject to the code of practice should be amended.
17.Following on from the first report, subsection (4) requires the Scottish Ministers to prepare, publish and lay before the Scottish Parliament within every five year period thereafter either another report or a statement as to why a report has not been prepared. If the Scottish Ministers are of the view that there is no need to prepare and publish a report then they must publish and lay before Parliament a statement setting out why they consider such a report to be unnecessary. However, that option is not available in relation to the first report provided for by subsection (1). Subsection (5) makes it clear that the requirements placed on Scottish Ministers under subsections (2) and (3) (in relation to consultation and the content of any report) apply to subsequent reports as they apply to the initial report. Subsection (6) provides the meaning of “relevant document” for the purpose of subsection (4).