Oral evidence: Current and future uses of biometric data and technologies, HC 734Wednesday 10 December 2014
Oral evidence, 10 December 2014.
Witnesses
Lord Bates, Parliamentary Under-Secretary of State for Criminal Information, Home Office, and Marek Rejman-Greene, Senior Biometrics Adviser (Deputy Director), Home Office, gave evidence.
Chair
Gentlemen, welcome to our session. Lord Bates, welcome to this end of the corridor. It is a long time since I saw you at this end; it was back in the 1992 Parliament. Welcome back. Perhaps your colleague would be kind enough to introduce himself.
Marek Rejman-Greene
I am Marek Rejman-Greene, senior biometric adviser at the Home Office, and I also work out of CAST—the Centre for Applied Science and Technology.
Chair
Do you think the public accept that the emergence and roll-out of the widespread application of biometric technologies is a foregone conclusion?
Lord Bates
I was listening to the discussion before. When you ask the public, it depends on the question you put to them. When you present a grainy CCTV image of a missing child, I do not think there is a parent, or a human being, in the country who would be unwilling to sacrifice any amount of privacy data to try to identify and protect that person as quickly as possible. Alternatively, people rightly get very suspicious about big government and intrusiveness—people using their data for reasons of which they are either not aware or have not consented to. I think that is the reason why in all we have done we have tried to hold to a position of balance, trading off those two pressures. In my reading of it, I do not think we will ever reach a point where we can say this is where the balance will be. It will shift, driven by events and technology, but it is a balance of which we are very conscious.
Chair
In your written evidence you used the phrase “direction of travel”. I think you heard us question the previous panel on the absence of a strategy that was promised in our previous report. Where is the direction of travel, and how does that impact upon a strategy that the chief constable is clearly looking forward to having?
Lord Bates
You have been around Whitehall and Westminster long enough to see that sometimes strategies are offered as a panacea and they do not always deliver on that. The general argument is that there should be some bringing together of the various elements of Government, and of course that happens. I think the biometrics commissioner pointed out that the cross-Government forensics and biometric policy group is meeting at this very point. One of the things they are addressing today is whether there is a need for a strategy. I do not have a read-out from that yet, but I know that I have another appointment with the Committee in January, if invited, as part of the legacy review. I would be very happy to respond to that point in more detail, or in advance in writing, should you so wish.
Chair
That would be very helpful. Can we press you a little further on the cross-Government activity that is occurring? I take it by that that you mean “cross‑departmental”.
Lord Bates
Yes.
Chair
I guess it takes into account the spectrum of applications that we heard about in the previous panel: from access to schools or sports clubs through to issues around the criminal justice system. Would you expect the strategy, if that is the right word, to start to define where the limits are for applications within different Government sites?
Lord Bates
Yes.
Chair
For example, there has been recent publicity about the acceptability or otherwise of fingerprints in schools.
Lord Bates
Partly, it would be a case of joining together in one easily accessible place what those limits are. Through the Protection of Freedoms Act, the Data Protection Act and the Human Rights Act we have a broad principle-based approach to this, about lawful purpose in the retention of data, and the balances—people’s right to privacy and family life, and so on. There are broad principles. We have heard about court cases, judgments and technology, which seems to be changing almost by the week. Sometimes, in a fast-moving area, that broad principles-based approach can be more suitable, but in terms of the response it is happening on a cross‑departmental basis through the forensics and biometric policy group. Ministers will obviously take the advice of that group as to what action they feel is needed in this area, and will respond.
Chair
In the final part of the Biometrics Commissioner’s report he explains that some of his work is in the classified area, but a lot of this work needs to carry public confidence with it. The forensics policy group does not seem to be terribly transparent. It seems to me that it would help public confidence if a lot more of these discussions were not only transparent but that external bodies could have the right to make inputs into them.
Lord Bates
Yes, I think that is broadly what should happen. As part of public confidence, people need to recognise that, for example, when we talk about reports going up to the Home Secretary—whether it has been cleared, what can be redacted and so on—in statute there are very clear limits as to what can happen. It can only be on national security grounds, or in cases where there is an ongoing police investigation, or where there are other risks. In other words, it is not simply that it is an uncomfortable truth, or something we would not like in the public domain. It is not that type of editing; it is something which goes across all areas, whether it is the independent inspector of terrorism or borders and immigration. Sensitive work is going on by the police and security services to keep our country and borders safe, and sometimes that means some things cannot be released into the public domain, but the public should have confidence that, where that is not the case, they will see the reports.
Stephen Mosley
In a report on identity cards by our predecessor Committee in 2006, the then Government reassured the Committee that there were a couple of scientific advisory committees: one was a biometrics expert group and the other was a biometrics assurance group. They were looking at biometrics and providing scientific advice to the Government. In the 2014 list of scientific advisory committees neither of those groups appears. Do you know what happened to them, and who now provides independent scientific advice on biometrics to the Home Office?
Marek Rejman-Greene
The Biometrics Assurance Group was formed at the request of Parliament specifically to look at the national identity scheme. As that scheme was beginning to go into roll-out, the need for it began to be less pressing. In addition, the loss of one of the members of that Biometrics Assurance Group, who gave evidence last time, meant we were missing a considerable part of the industry inputs. The decision was made that that was no longer as pressing. There may well be a question about whether it should come back again, but it is up to yourselves to make those recommendations. Regarding the working group, there is a technical Working Group within Government which has access to specialists who are on that group. It is called BWG—the Biometric Working Group. Again, I think it was referred to in the first hearing. Apart from that, we have very close relationships with CAST and all our opposite numbers in other Governments. We have continued relationships and discussions with academics and suppliers to understand where the current technology is and where the issues are. We also take note of criticism, perhaps from people who have a concern about the use of biometrics, to make sure we have a full understanding of the context against which all of this advice should be given to Ministers in the Home Office.
Stephen Mosley
In one of our previous evidence sessions we heard from Andrew Tyrer of Innovate UK, who made the comment that a lot of the testing of biometric systems was done by the manufacturers themselves. Does the Home Office make any independent testing, or does it just rely on their assurances?
Marek Rejman-Greene
There are occasions when we do it ourselves and occasions when we monitor the way in which suppliers undertake the testing. One example is the use of biometrics for control of access to buildings for critical national infrastructure; if you have a data storage room, you want to make sure you can use biometrics to identify individuals who can go into that data control room, or not. A standard was developed in the UK, which we are hoping to move towards a European standard. That testing is contracted out to the National Physical Laboratory, one of the key leaders in this field. Another example is IABS, which is a system used for immigration and asylum seekers—the 18 million people who applied for visas and asylum. That system was tested prior to delivery, and met the requirements placed on it by the user community, so we do that. It is expensive and time-consuming, so there is a need to balance the depth of the testing against the benefits and uncertainties.
Stephen Mosley
We also heard from Professor Amoore, who said that in the rush to adopt biometric technologies they were sometimes being adopted quicker than they could be proved effective. What do you think about that evidence? Do you think there is a case for that or not?
Marek Rejman-Greene
I think we have to separate the commercial sector from the state sector. The commercial sector has its own drivers. Whether or not they wish to use the technology as a security system or a convenience service is their commercial decision. In the state service there has generally been a reluctance to go straight through and be one of the early adopters, perhaps with the exception of automated passport gates at airports. We were the second country in the world to go for those gates because we saw the potential. We had to live with all the development and we are now into the third generation of those gates. We do not necessarily have to be the first in the field. Many of the large-scale systems are already trialled and tested in other countries. We have the benefit of going to those countries and understanding how they work, and what the benefits and costs are.
Stephen Mosley
I am conscious that we have not heard from the Minister on the issue of scientific advice on biometrics. From the ministerial chair, how effective is the scientific advice that you receive?
Lord Bates
It is very effective in formulating the response—the advice which comes up to Ministers. In all these things, particularly at the present time, I am slightly suspicious when people claim almost oracle-like knowledge and expertise. Therefore, I think that the approach which has been outlined is the right one: rather than believing that you have the answers, you engage in what you might call open source—not quite cloud, but that type of thing—and say, “This is very fast moving,” and you look at what other people have got. From that point of view, the Government position is that we very much approve of working with European partners in particular, where we have some ongoing projects to develop things and learn the technology internationally. Close relationships with the United States are very important, particularly from the security point of view, and information is provided there. Rather than trying to have everything in-house, drawing from a wide range of academic expertise and practice is the right approach, and so far it seems to be serving us well.
Stephen Metcalfe
I think you were here for the first panel. Is that right?
Lord Bates
Yes.
Stephen Metcalfe
You heard some of our discussions about the police use of facial recognition software. When did the Home Office become aware that the police were developing a searchable database, and were you involved at the outset? There is some confusion about whether it is or is not being used.
Lord Bates
As to the precise date, I may need to write to you so that we get the facts absolutely right. Chief Constable Sims referred to the police national database being brought into the Home Office. Facial data was put on there, and it was a searchable database. At that point, you rightly identified in your line of questioning a gap, which we recognise, in the analysis, and the safeguarding of public trust and confidence in how facial recognition data is used, because the technology is moving at such a rapid rate. Now is clearly the point when we need to look very carefully at that. In the light of the court ruling on the Met police’s retention of it, the Home Office instituted a policy review of the statutory basis for the retention of facial images. That will take place and we will be consulting key stakeholders. We would also welcome the views of your Committee on what safeguards need to be there.
Stephen Metcalfe
I do not want to put words into your mouth, but I think what you have just said is that you became aware of this rather than being involved at the outset.
Lord Bates
I need some technical help on that. There are two elements. Clearly the collection of facial images has happened for a very long time, and it is an accepted process. What we have not necessarily had before is the software technology to be able to search that on the computer, and therefore the question of whose facial images should be on it has come to the fore.
Marek Rejman-Greene
Perhaps I could help on that point. In about 2012, a supplier—the integrator that provides PND—demonstrated the capability to Chief Constable Mike Barton and the rest of that team. That sowed the potential for the use of facial comparison in PND. It was only this year that the capability was switched on. It went through a rather long period of time, and I believe the gradual uploading of images was done this year, but I need to confirm that.
Stephen Metcalfe
It was demonstrated to the Home Office first.
Marek Rejman-Greene
To Chief Constable Mike Barton; I think we were not directly involved in that demonstration.
Stephen Metcalfe
It was demonstrated to the chief constable that this—it is PND, isn’t it?
Marek Rejman-Greene
Yes.
Stephen Metcalfe
The capability was there and then it was switched on. What I am trying to get to is: at what point did the Home Office think there might be an issue that we need to regulate? We are now searching through photographs for people potentially to interview or request information from, and there is a privacy issue. If we do not know how stable and how good that software is in finding the right person, we may be infringing someone’s privacy. I want to know at what point you became aware of that, and what steps are being taken to address it.
Lord Bates
The permanent secretary at the Home Office expressed a concern about this. He has acknowledged that there should have been better consultation between the point at which you have the images and the point at which you flip the switch, effectively, to enable that database to be searched. There should have been more consultation at that point. In relation to the retention of images, particularly by the Met, I think it would be fair to say that the permanent secretary expressed some disappointment in writing in July this year to the Metropolitan police that they had not dealt with the issue as expeditiously as he would have liked. We are moving further down that track; it is changing almost by the week.
Stephen Metcalfe
Putting aside the time line, do you think that in principle it is right that people who have not been subsequently charged or convicted of crimes should have their facial features searched for potential links? Is it proportionate?
Lord Bates
You use the word “proportionate”, which is a key test in this. We have to acknowledge—I am conscious that I am not directly answering your question, and I will explain why. I am very conscious that if you look at other data that was being held—DNA data and fingerprint data—the information commissioner and the biometrics commissioner said that, if there was no charge, it must be destroyed, and millions of records have been destroyed. Following that principle across, there is certainly a big question, and the reason why I cannot say at this stage is that to do so would be to pre-empt the review I have just announced to consult people on what should be the correct response.
Pamela Nash
I was surprised to learn during the course of this inquiry that the Biometrics Commissioner’s responsibilities are confined to DNA and fingerprints. He made it very clear this morning that he does not want to expand those responsibilities and his work load. Have the Government considered extending the responsibilities of the biometrics commissioner to include all biometrics that are used by the police force?
Lord Bates
Of course we are always open to review on the powers. I was listening very carefully to what the Biometrics Commissioner was saying this morning.
Pamela Nash
Just to warn you, he is behind you.
Lord Bates
Is he? It sounds like a Christmas pantomime.
Chair
On this question, there are lots of images that Members of Parliament would like deleted.
Lord Bates
Not least from Select Committees. Of course we are going to look at this. We had taken the view, until we commissioned the review I mentioned in answering Mr Metcalfe’s point, that we felt broadly that they were adequate. We have heard what the biometrics commissioner said, and we have launched the review. I can say to the Committee that the role of the biometrics commissioner in response to facial images will be a key aspect of the review.
Pamela Nash
Would the review also consider, if it felt it was inappropriate, whether there would be other methods for that to be regulated? If it becomes clear that it should not be the role of the Biometrics Commissioner, or that it would be too much for that office, would there be further consideration of who should have responsibility for these additional biometrics?
Lord Bates
Yes. We recognise that the current governance of the data being held is not sufficiently covered. The chief constable, the police and the Home Office recognise that. That is the reason why we need the review. We are talking about different elements in terms of facial recognition, and there are limitations in the science of it. Facial recognition, unlike DNA and fingerprints, can change over time, particularly in the case of young people. Today, the Home Secretary and the Prime Minister are announcing very important developments in child exploitation identification software online. That technology is of a different nature from a fingerprint, an iris and DNA. Therefore, there could be an argument, which will be made in the review, that they ought to be treated in some way differently.
Pamela Nash
I think we can appreciate that, but it is a fair prediction that the technology is advancing rapidly and might be used further in the near future by the police and beyond. Have the Government considered in the review who will be responsible for new technologies—perhaps ones we have not thought of yet? How can we frame legislation and policy around the new technologies that will be emerging in the future?
Lord Bates
On the technologies, perhaps I could bring in my colleague. I will then deal with the policy side.
Marek Rejman-Greene
Chief Constable Sims mentioned the potential use of speaker recognition. Other technologies in the last few years have been interesting—for example, the potential to use gait recognition from CCTV, and trying to infer. That area is almost straying into the forensic science regulator’s domain. In the last few months of the previous forensic science regulator’s time, I think he was beginning to try to get various sectors to regulate their own areas. In a sense, the forensic aspects were being taken care of. As to where police would do it, I think Chief Constable Sims said there is an interest in trying to make the most use of current technology, rather than perhaps branching out to ever more esoteric ones. Even though the potential may be there, the indications are that certainly for widespread police use—
Chair
Isn’t this a classic area where, because you and I have limited powers to predict the future, it would be sensible to create a regulatory structure around the broader societal principles we are seeking to address, rather than specific technologies?
Marek Rejman-Greene
I think that is more a policy question than something in which I would be involved.
Chair
I would have thought that technologists would agree with the logic of that policy position.
Lord Bates
From a policy point of view, the broad principle of what you are saying is right. Whatever happens, whether it is gait—the way someone walks—or whether it is voice or face, whatever means we use to identify people, that seems to be pretty sensible.
Chair
It would seem sensible to pre-empt all of that by having a regulatory structure which said that if the police or any other agency were seeking to use evolving technology, it automatically slotted into the responsibility of an existing regulator rather than waiting until after the event.
Lord Bates
Chair, I appreciate your generosity in trying to phrase it for me, but I think we are more or less in the same area. I think the principles-based approach is the right one in fast-moving technology. That is the reason why we still have a Data Protection Act which does its job, even though it was enacted in 1998 and technology has moved on quite dramatically since then. We need principles and infrastructure which capture the broad principles and give confidence, and therefore other new technologies can slip into them as they are developed. But that is a view, and we are open to further advice on it.
Pamela Nash
We are aware that the Biometrics Commissioner is responsible for the retention and use of biometrics by the police, but not the immigration database. Is that being considered in the review, or is it outside it?
Lord Bates
On that specific point, I may need to write to the Committee.
Pamela Nash
Thank you.
Mr Heath
You have said several times that you deal with these biometric matters on a cross-Government basis, so I am hoping that you will be able to shed some light on something that is not directly a Home Office matter—the Government identity assurance scheme which is being brought out. One of the assurance levels the Cabinet Office has indicated is biometric information. Of the 25 exemplar services that are being trialled, how many use biometric evidence?
Marek Rejman-Greene
None, because the infrastructure has not been put in place as part of the IDA scheme. As far as I know, all the services are at level two, which is quite a way short of level four.
Mr Heath
Do you know what the intention is in terms of bringing things up to level four? Is it that none of those 25 will ever be used at level four, or will some of them in due course, or are we talking about other services that would require level four?
Marek Rejman-Greene
The point is that the levels of assurance are related to the risk involved. When there is life and death involved, obviously we might be thinking about level four, but when there are just matters of relatively low levels of financial loss to Government, the decision was made to go to that lower level of assurance. It is a matter of taking the risk and understanding what appropriate security mechanisms are required.
Mr Heath
In your modelling of how it might be applied in circumstances where a level four assurance was necessary, is part of the thinking that there would always be at least some human involvement in the process, so you do not have complete automaticity? The exercise of judgment and a brain are involved.
Marek Rejman-Greene
Our present-day knowledge about the way biometrics systems work is that they are never perfect, so there will always be some need for and recourse to a fallback anyway. If you were to imply that there was an automated decision that affected the individual, it might well be counter to one of the Data Protection Act requirements, which is that you should not take that decision in a purely automated way.
Mr Heath
That is built into it.
Marek Rejman-Greene
I do not know. I cannot speak to it, because the plans for the much longer term of the identity assurance scheme are still being worked on. There is a lot of effort being made to try to get today’s technology implemented.
Mr Heath
You have been very helpful. Thank you.
Graham Stringer
If I can take you back to the questions Andrew asked a few minutes ago, you gave a partial response. As biometric technologies change, are invented and develop, do you think it is necessary to review the data protection legislation?
Lord Bates
That probably relates back to what I was saying. Because it is principle-based, it has stood the test of time. The criteria used for assessing sensitive personal data, for example, are very clearly set out in the Act, and the different treatments of the two. I think it does hold firm in general. However, the statutory basis for facial images needs to be reviewed, and I have approved that work. It may be that the review shows a need for new legislation, perhaps relating to the Protection of Freedoms Act. It might be more that area that we look at, if needed, than the data protection.
Graham Stringer
To be clear, are you saying there are some specific reviews under way but not a general review of the Data Protection Act?
Lord Bates
The review which is under way is on facial recognition—how that is covered by existing legislation and existing governance through the commissioner’s office, and also how it is supervised within the Home Office in the context of the police national computer. That is the scope of the review we are looking at.[1]
Graham Stringer
You do not believe that a general review is necessary at the present time.
Lord Bates
We have not found that, but we are open to it. For example, I note the Committee’s report published previously that looked at the responsible use of data, which we are in the process of responding to. That made some very interesting recommendations about privacy, the amount of data people share and whether they should be better aware of what they are signing up to. This is ongoing, and we will continue to look at it.
Graham Stringer
Are you completely confident that the current legislation protects citizens against biometric data being used in a way that they have not given their consent to?
Lord Bates
It would be difficult for any Home Office Minister to sit before a Committee and say they had absolute confidence in it. History tells me that probably the next day you wake up to headlines showing that your confidence was somewhat misplaced. The best you can do is to say you are sceptical, and keep it under a watchful eye and under review. We are looking particularly at areas like the operation of privacy impact assessments, the information commissioner’s powers of investigation, and the sanctions he has available under the Data Protection Act. These are the kinds of areas currently under review.
Graham Stringer
Perhaps I can ask the question in a less minatory way. Do you have any evidence that biometric data have been used when people have not given their consent?
Lord Bates
I think that is the facial images case that we are currently wrestling with.
Graham Stringer
That is the only area.
Marek Rejman-Greene
There is probably also a case under the Protection of Freedoms Act where children’s biometrics have been taken without any statutory measures.
Chair
This was in schools.
Marek Rejman-Greene
Yes. That is an example where the need for a specific regime has been recognised.
Graham Stringer
There has been some criticism that the Government have not been proactive enough in influencing data protection at European level. How do you respond to that accusation?
Lord Bates
It is certainly not what is happening on the ground. The operation that we have across Europe is very active. There is an agreement on sharing biometric data across Europe, which goes under the heading of “Prüm”—that is not an acronym, but the town in Germany where the conference took place. The Government have said they will look at that and we are preparing a business case on it. We are trialling some of the recommendations from that. We will make a decision on whether to join that set of regulations and directives in 2015, but, before that, Parliament will of course have its say, because it will require legislation to do so.
Stephen Mosley
In the written evidence we received from the Home Office it was stated that biometric identification systems should demonstrate “a lawful purpose, a pressing need and proportionality”. How do you ensure that biometric systems demonstrate those three criteria?
Lord Bates
That is an excellent question. I will bring in my colleague to respond to some of the technical elements. It is something where we are aided by the independent offices of the biometrics and information commissioners, the science advisers within the Home Office and a science council, which is chaired by the permanent secretary. Through those mechanisms we keep things under review, but it is in the nature of the fast-moving changes I have referred to a number of times that you are often reacting to particular stories, concerns and issues that come to light in the public square. You are reacting to them and examining them on that basis, and sometimes it is very difficult to get out in front. That is probably part of the thinking behind the wider strategy across Government and whether there is a need for it.
Marek Rejman-Greene
To expand on that a little, privacy impact assessments are made to understand what the trade-offs are. In the nature of those privacy impact assessments, you have a consultation process which enables all sides to bring to the fore their concerns and the opportunities generated by a new service that is perhaps under consideration. There is also an economic angle to all of this. The business cases go through quite rigorous assessments to see whether there is a benefit as opposed to the costs involved in working on proposed new systems. There are those two technical controls. There is also the political dimension. That ensures that when information about this is published, for example, a proposed intention to go to tender, MPs—the political process—can engage to put the question: is this a proportionate and transparent way of introducing a new service?
Stephen Mosley
Do you think that open standards for the governance of biometrics are a suitable way of governing how biometrics are used within the commercial and Government sectors, or do you need a more formal legislative framework?
Marek Rejman-Greene
I think we have to separate those two. Obviously there are limitations to what we can do in terms of trying to impose standards on the commercial sector. They have to make a decision whether it is worth their while having an open system or one which is de facto their own, keeping all the information about how they implement a system within their own companies. In terms of government systems, the first direction is almost always to try to look at open standards for a number of reasons, principally because it means that the services and systems are not necessarily custom-designed, so you can open it out to the marketplace and there is no need to have any hidden interfaces. It also opens up those interfaces to the sharing of data with other countries and systems, provided that is legal. Having open standards also enables all the details of how those systems operate to be out in the open. It allows for innovation, so you know the constraints within which to innovate; and it means, therefore, that UK companies can bid for parts of the systems that relate to the biometric component. I hope that has given you an idea.
Stephen Mosley
Yes. It sounds like the right thing to do. The follow-up question to that is: what are you doing to promote those open standards and encourage people to use them?
Lord Bates
We promote open standards for exactly those reasons through a myriad of international standards organisations—the WTO and many international groups. The main reason why we want open standards is that biometric data is connected with travel, cross-border crime, protection and security, so it makes sense to do that. But there is that element, which seems to me quite right, that if a commercial organisation says, “Forget about the standards. We believe this one works best for us and we want to take a chance on it,” as a commercial organisation they should be able to do that. Government has to operate to a different set, as has been said.
Chair
I tend to agree with you that technical standards are not the bailiwick of Government; that is for expert panels in industry, the BSI and so on. One aspect of open standards which is hugely important is public confidence in them. If people have doubts about the integrity of systems, they can openly challenge if they know how the systems are designed to operate. Finally, I want to move to maintaining public confidence in this whole space. We have to strike a balance between the needs of law enforcement and other agencies, and the necessary protections of privacy when it comes to biometrics. What are you doing to try to maintain a sensible balance in that space?
Lord Bates
We want to make people aware of what rights they have, the access they have, and the people who operate on their behalf. We were talking about the commissioners’ offices and getting people to believe that, if they have a grievance and concern, they can go there and there is an appeal or a redress mechanism available to them. There is also the work of Parliament. I suppose that ultimately—which is where your Committee is going—the more we get science and technology out there and debated in the public square, the better it will be, because that plays into almost where we began with this process: this careful balance, which is not just one for politicians, Home Office Ministers or officials. It is for society as a whole to say, “We are aware of the significant advantages of keeping us secure, keeping our borders safe, keeping our loved ones safe, and also the attractions of technology in providing ease of access and movement, and also in economics and commerce.” But there have to be serious concerns about the potential risks of having such data held, its proper use and how you maintain that debate. The more discussion and the more awareness there is, the better. The Government are looking at ways to do that, but it is only a part of the discussion. This is something in which the media and civil society need to engage and have a far wider debate about the issues.
Chair
Stemming from that, Sarah Newton asked the previous panel about the security of the data. Industry has said to us that often the security aspects of this are bolted on at the end rather than being an integral part of design. Can we have an assurance that any system that Government procure, or authorise procurement of, will have security of people’s data right at the heart of it?
Lord Bates
From my experience and the discussions I have had on this, it seems as if it is always the private sector that might bolt on security at the end of the process. It seems to me that Government in particular bolts on security right at the beginning of the process. It is quite interesting to see different public attitudes. People willingly share quite detailed information about themselves on websites and social media without much care or concern. When that same information is provided to the Government there is a different set of criteria, yet actually security is probably far more hard-wired into every process of what Government does, particularly because it is dealing with national security issues, and I think people could have more confidence in that particular area of security of data. The private sector probably has some catching up to do.
Graham Stringer
Can I ask a very similar question to Andrew’s but perhaps take a step back? We have all this wonderful new technology at the moment that enables the police to do things they could only have dreamt of 25 years ago, and we have proper concern about balancing that against individual privacy and personal rights. When you step back and look at the breadth of the legislation, do you think we have got the balance right, or that, as the Daily Mail and other newspapers think, because of the concern about privacy and some of the inadequacies of the security systems, there are rapists and murderers going free because we have destroyed part of the databases, and possibly we are not going to keep the data that we have got? Do you think you have the balance right throughout all the legislation?
Lord Bates
It is a very good question, and it is almost a philosophical one.
Graham Stringer
It is a very practical question as well.
Lord Bates
If we have the balance right, I would say it is a fine balance in this context. The database provides the police with over 25,000 matches a year, and 700 matches to murders, manslaughters and rapes. We recognise that that is where it is doing its job very effectively. On the other hand, we are having a discussion about facial images held by the Met police. Those are the two ends we balance, but I think it is right. The best you can hope for is that Parliament, the Home Office and the systems of government hold decision makers’ heels to the fire over this to get them constantly to think, “What is that balance? Have we got it absolutely right?” because it will shift over time.
Graham Stringer
Do you think we have got it right? I suppose that is the question I was asking.
Lord Bates
We have broadly got it right, but it is not quite there as of today in relation to facial imagery in terms of the overall strategy. That is the reason why we are undertaking the work to correct it, if it needs to be.
Chair
Gentlemen, thank you very much for your attendance this morning. It has been really interesting. Oral evidence: Current and future uses of biometric data and technologies, HC 734 29 [1] The witness later clarified that, he intended to say “… in the context of the police national database.”