Oral evidence: Biometrics Strategy and Forensic Services, HC 800
Oral evidence, 6 February 2018.
Witness
Dr Gillian Tully.
Chair
Welcome, Dr Tully. Thank you very much for coming along. Thank you again for briefing us before Christmas; it is appreciated. I will start the questioning. There are two aspects to our hearing this morning. We will hear from the Minister later, particularly on the non-appearance of the biometrics strategy. We want to talk to you about developments since the Government published the forensics strategy. How do you see the position on the forensics strategy now, some two years after it was published? It was thought at the time that a lot of things were incomplete and unclear. How do you assess things now? Are they better?
Dr Tully
No, I do not think that they are better now. Over the last couple of years, we have seen some of the risks that were raised at the time crystallise. We have seen two smaller companies and, now, one large company offering forensic services to the police in the UK go out of business. The third one went into administration very recently. We do not know yet whether a buyer will be found or whether it will be wound down.
Chair
Do you have real concerns about the sustainability of the market?
Dr Tully
Absolutely. I think that something different has to happen if we are to ensure continuity of supply and, in particular, enough expertise remains in the field. A number of people have been made redundant once or twice. You cannot keep making people redundant time and again and expect that they will stay and retain their expertise in the CJS.
Chair
Presumably, getting this sorted out is critical to the administration of justice.
Dr Tully
Yes, it is.
Chair
To what extent are forensic companies bidding too low for police contracts? Is part of the problem that they cannot sustain the contract once they have won it?
Dr Tully
It seems that the way in which some of the contracts are procured tends to push towards lowest pricing; it is not the case in all the contracts, but it is in some of them. I went to talk to the forensic service providers at their group, the Association of Forensic Science Providers. I asked, “Why are you bidding quite so low on these contracts?” Their response was, “If more than 50% of the evaluation criteria for the contract award are based on price, no matter how good we are in all other areas, we can’t win unless we are low priced.” I do not believe that that is the case for all the contracts we are talking about, but it was certainly the case for some lots. Some of the other contracts had a lower amount on price, but it is a very important part of the tendering process. It seems at the minute that, although each contract may be acting in what appear to be the best interests of the force or forces involved—it certainly brings about large savings for them—the overall picture is that the constant downward pressure on price has brought things to a point where we have seen the third largest provider go into administration. I do not know the details of all the reasons why it went into administration, but, clearly, the impacts could be very substantial. We think about investment in science, investment in research, investment in training and continuous professional development, and retention of staff. All those issues come to the fore.
Chair
As I understand it, with the company that went bust last week, there was a big bail-out from the police to keep the service running for a period. Do you think that there is an issue with the quality of police procurement? Are they not weighing tenders effectively enough and putting too much focus on cost saving, rather than the sustainability of the contract?
Dr Tully
If you take an overall picture, you have to come to that conclusion. Some individual contracts have taken into account sustainability and so on, but when you look at the picture across the board I do not think that enough has been done to make sure that there is stability in the marketplace. When the strategy was published a couple of years ago, it talked about national approaches and so on. A programme has been set up within policing—transforming police forensics—but it is only now at the business case stage. There has been uncertainty for another couple of years, and I would say that there is still uncertainty among providers about what that will mean for them.
Chair
To what extent, if at all, do all the problems link back to the abolition of the Forensic Science Service in 2012?
Dr Tully
In my opinion, a very similar set of circumstances led to that closure and has carried on. In many ways, the closure of the FSS is not the cause of the problems; it was a symptom of similar problems that existed at that point in time.
Chair
Is there an issue of companies bidding low to beat in-house bids, as it were, when the police have not had to get their own labs accredited in the same way as the private sector providers have?
Dr Tully
By the time it comes to the procurement and bidding process, I do not see that as a factor. Generally, the police will put out for contract only services that they do not want to take in-house. I do not think that it is so much a factor at that point. In fact, I believe that one police insourcing activity was cancelled after the last round of tenders because they realised that there was no way that they could deliver the service themselves as cheaply as the providers had bid.
Chair
So you tend not to get competition on a particular tender between in-house and outside providers.
Dr Tully
No. What tends to happen is that a decision is made about what they are going to outsource. That will then be tendered for.
Graham Stringer
May I ask Norman’s question on the abolition of the FSS the other way round? When you were before the Committee previously, you said that the abolition of the FSS would lead to murderers and rapists getting away with crime. Is that still your view? Is there any evidence that that has happened?
Dr Tully
We have talked previously about the precise wording of what I said. There is a risk, particularly at the commissioning stage for forensic science. A crime may not be detected in the first place, and the evidence may not be secured at an early stage. We have seen that a number of potential suspected homicides, in particular, were not even recognised to be homicides in the first instance. Therefore, evidence was not preserved and was not sent for forensic examination. That is nothing to do with the FSS or its closure, but it is a significant issue, if we are looking at how we can make best use of forensic science in the criminal justice system. Recently there was a great deal of public comment about the failure to preserve evidence after the death of Poppi Worthington, for example. There have been other cases of that sort. The issue in wider commissioning is how well forensic science is commissioned in any case. In some cases, it is commissioned very well and answers the questions to which the criminal justice system needs to know the answers, but I do not think that that is routine. Another example, which was recently brought to my attention by journalists, is that, despite my issuing very clear guidance in 2016 about the need for forensic medical examination of the suspect in and the victim of an alleged offence to be carried out by different doctors, there are still some parts of the country where doctors are being asked to see a victim and a suspect in the same case. That is entirely inappropriate, because of anti-contamination measures, and could lead to a miscarriage of justice.
Graham Stringer
When we discussed the ending of the FSS, you identified as a problem not just the commissioning but the context of the evidence. Do you now have experience of cases where a lack of contextual analysis in the dialogue between the scientists and the police has led to a less effective outcome than one might have expected with the FSS?
Dr Tully
We have had this discussion before. Some of that problem was still happening when the FSS was around. I think that the problem has got worse, not because of the other providers but because of what they are being asked to do. If they are asked only to look at a little sample in a tube and to say what the DNA profile is, that is where you lose the context, whereas if someone is asked to talk about that evidence in the context of the case—to say where it may have come from and how it may have got there—you get much better value from your forensic science in court. The issue is not that people cannot do it, but that it is not necessarily always being asked for.
Graham Stringer
That is very clear. The other problem that you identified in your previous appearances before the Committee concerned not the most recent crimes but the archive of evidence from previous crimes—what are now called cold cases, I suppose. What state is the archive in at the moment?
Dr Tully
I do not have a great deal of interaction with the archive. As I understand it, the archive is static. Over time, it will decrease, as the time limit for storing cases expires. Although that was the outcome of the recent review of the archive, and there was a decision that it would not take material from other providers, I believe that when the insolvency of Forensic Telecommunications Services was discovered there was an agreement for the archive to take some of that material in-house, because at that point there were computer hard discs and all sorts that were not secured in an appropriate location. The archive therefore took those in, at least on a temporary basis. What happens when an organisation goes out of business, and where the material goes, is a particular concern.
Chair
You say that sorting this out is critical. Presumably, the potential consequences of not sorting it out are very serious miscarriages of justice—people being convicted wrongly and, on the other hand, people who have committed very serious offences potentially not being convicted.
Dr Tully
Can I check which—
Chair
I am talking about the state and fragility of the market, and what happens to everything that companies hold, and so forth, when they go out of business. Not having a proper regime in place runs the risk of serious consequences in the criminal justice system.
Dr Tully
Yes.
Chair
I have another quick question. With regard to the criminal investigation that is under way, do we have an update on the number of potential criminal cases where there have been outcomes that are now in doubt?
Dr Tully
Are you referring to the toxicology issues?
Chair
Yes.
Dr Tully
No, I do not have a consolidated set of figures on the difference in outcomes. What I can say is that, in a number of cases where the breakdown products of cannabis were present in a blood sample in the original test, those are now below the legal limit. Sitting here, I cannot say whether that is because they were always below the legal limit or because the samples have degraded over time. The breakdown products of cannabis do degrade very quickly over time. There will be criminal justice implications from that, but it is impossible to say whether there was originally a miscarriage of justice.
Chair
That will inevitably result in those cases having to be reviewed, presumably.
Dr Tully
Yes.
Vicky Ford
Can you seek scientific evidence on how quickly those products break down?
Dr Tully
Not in such a way as to enable you to back-calculate from there. There are too many factors that influence how quickly the products break down for you to be able to work backwards.
Chair
Whether it was below the legal limit at the time when it was first analysed or whether it has degraded, presumably, if it is now below the limit, the conviction is not safe.
Dr Tully
If it is a closed case and it goes back to the Criminal Cases Review Commission, the commission will have to consider whether the original conviction was safe. It will take into consideration issues such as degradation, the fact that there were two samples, the second of which could have been analysed, but was not, and what the plea was. It certainly casts doubt.
Carol Monaghan
Dr Tully, you have set deadlines for forensic providers to be accredited and to meet certain standards. What progress has been made on this? Is there a difference between police and commercial labs?
Dr Tully
Yes. I will divide the market into three to talk about progress against standards. The first group is the large commercial providers. I would say that they are extremely compliant with the standards and have been for many years. The second is policing. There has been acceptance in principle by policing that it will move towards meeting the standards. However, it is running very substantially behind where it needs to be. On digital forensics, many organisations failed to meet the October deadline. Of about 46 legal entities in policing, only around 17 had any sort of accreditation by the time the deadline passed. For most of those, it was not the full scope that was required. There is a deadline for fingerprint comparison coming up in 2018. That is a very important deadline. While the last prediction from policing was that 20 would meet it, three might miss it and four would miss it, our current assessment, based on progress so far, is that only 13, potentially, will meet the deadline in October this year, four may miss it and 10 almost inevitably will miss it.
Carol Monaghan
That is for fingerprint comparison.
Dr Tully
Yes.
Carol Monaghan
You are giving us quite specific numbers. Those that are going to miss the deadline will have to put some actions in place to come up to standards. Do you see that happening?
Dr Tully
Nationally, the NPCC has a forensic portfolio that tries to address these issues. We work together very constructively. It has a performance and standards group, led by ACC Lewis from Dorset police. We will meet later this month to see what we can do together to try to alter that trajectory. However, at this point in time, it is very difficult to alter that trajectory for October this year, because there is only so much time left and there is an awful lot left to do. I think that it is inevitable that some forces will still miss that deadline. If policing can do something radically different, there is a chance that we will be able to avert missing the 2020 deadlines around crime scene, collision investigation and fire investigation.
Carol Monaghan
May I ask you specifically about the digital forensics deadline? Did the labs that missed the deadline have a good reason for missing it? Have they made any progress in the last three months? If you are now talking about 2020, it sounds as though they have not.
Dr Tully
The 2020 deadline is for a different set of activities. The 2017 deadline has not changed. Under the criminal procedure rules, all organisations that are not compliant now have a duty to disclose that non-compliance in any statements that they make to the court.
Carol Monaghan
Do you think that that will encourage them to become compliant?
Dr Tully
I very much hope so. It is not that they have not made any progress. I do not underestimate the challenge that this has been, because digital forensics has grown massively. It is the only area of forensic science that is growing, really. It has grown massively over the last few years, and the volumes of data have grown massively. Policing has been trying to keep pace with those developments. At the same time, it has been working from a very low starting position to adopt standards. The process of what I would call validation, which is making sure that your methods are fit for purpose—that they do what you think they do and what you say they do, and that you know their limitations—has been a very steep learning curve in the digital forensics community. It is not something that the community has engaged in before. As you would anticipate, it is extremely important, because a court needs to know what the limitations of a method are—whether certain types of file may not have been found when a mobile phone was downloaded, and so on.
Carol Monaghan
Do you think that this non-compliance will change the outcome of court cases?
Dr Tully
I have asked all non-compliant organisations to state whether they are compliant and, if they are not compliant, to provide an annexe that tells the court what mitigation they have in place that will enable the court to decide whether their evidence is sufficiently reliable to be used as expert evidence, in particular. For example, have they have done the validation process? Have they have shown that their methods work? Are their staff demonstrably competent? Have they undertaken competence tests to make sure that they are competent? Do they have appropriate calibrated equipment, and so on? If organisations are well along the way to achieving the standards, they will be able to provide appropriate mitigation. The court can test that appropriately. Organisations that have made very little or no progress do not have that mitigation to provide to the court.
Chair
Is that leading some to decide to put it out to tender instead?
Dr Tully
The problem is that progress has also been very slow in the commercial sector. I said that all the large providers are very compliant, but a lot of the digital forensics providers are smaller. Four organisations in the commercial sector have accreditation, as required. Many of the other providers are one and two-person providers, working from home and using tools that they may not have validated. That sector of the market is the most non-compliant of all. When I speak at conferences, people ask me, “What are you going to do if we are not compliant? You haven’t got any power to make us stop.” That is the most concerning sector. There is a continuing effort by the NPCC’s digital forensics portfolio to help police forces to get there, but there is very little movement in the very small business sector. The four commercial providers that are compliant have a very fair complaint that delivery of some of the contracts that have been awarded went past the deadline. Not enough due diligence was done to say whether those providers would be compliant in time for the deadlines, so they missed out on those contracts to cheaper providers that were not investing in the quality standards.
Carol Monaghan
May I ask you a final question about the cost of compliance? Your annual report says that the cost of getting accreditation can range from about £7,000 to £17,000. To me, that does not seem like an awful lot for a large company, but is it enough to put off some of the smaller providers you are talking about?
Dr Tully
Those figures are just for accreditation to my codes of practice and conduct. Organisations need to be accredited to the international standards for each discipline they work in. There is also a requirement for compliance with my codes of practice and conduct, so the total bill will be higher than those figures. The difference between the two figures relates to how ready an organisation was to be accredited. The £7,000 was for an organisation that was ready and that had the accreditation body come in, check that it was ready and say, “Yes, good; off you go,” with a few actions. The £17,000 was for one that was so far off being ready that it had to have additional visits and lots of extra work, to fill in all the gaps.
Carol Monaghan
This would not be an annual fee, would it?
Dr Tully
Accreditation runs on a four-year cycle. The figures are for the first year. The first year is always the most expensive, because that is when accreditation is first granted. Overall, the large commercial providers who have had accreditation for many years reckon that having the amount of accreditation that is required is an overhead of about 15% to 20%. It is substantial, but in my view it is critically important. I am concerned that for a very small provider, especially a one-person provider, the costs are proportionately higher, but it is very difficult to see how I could fairly set a different standard for those people, because they are still providing evidence to the criminal justice system. The Chartered Society of Forensic Sciences is working with the accreditation body and me to try to work out whether there is a way in which we can help small providers to work together to minimise the costs, but still achieve the same standard. Again, it all takes time.
Bill Grant
Good morning. Your annual report advises that the accreditation visits carried out by UKAS—the accreditation service—found over 700 anomalies. To a layperson, 700 seems a large figure. Was it a batch failure? How would you explain the figure of 700? Do you worry about it? What were the main problems that you found in the audits?
Dr Tully
They were not failures like a batch failure; they were failures to meet the standard in various ways. Some of them were larger, and some of them were smaller. If we look at the specifics, from 23 visits, there were 733 findings, of which 694 were mandatory and only 39 were just recommendations. They ranged from small to large non-compliances. The main regions were control of data, business continuity and validation of methods, which I have just spoken about. On control of data, examples included computer back-ups not being stored at a separate and secure location, so that if there was a fire or anything of that nature the information would not be retrievable, and having a shared log-in on a computer where analytical data were stored. It is entirely unacceptable for multiple people to be able to log on under the same user name.
Bill Grant
Would you describe that as a standard failure?
Dr Tully
It is not something I would expect to find, given that these standards have been published since 2011, but it is something that was found. It is the sort of thing that gives the justification for having that rather expensive accreditation step at the end. If it is not there, people do not comply. If no one comes in to check whether they are compliant, it is quite clear that they do not. There was a digital forensics unit operating its own network outside the main police force IT area, so the management of its electronic information was not fully documented and did not follow force security procedures. There were business continuity plans with actions open and no owner assigned to them. As we have seen with organisations going out of business, having a proper business continuity plan is absolutely critical.
Chair
These examples cover both in-house and independent providers.
Dr Tully
Yes; this is across the board. For example, on validation, one of the requirements is that there is a library of all the information you are relying on to show the reliability of your methods.
Bill Grant
That is part of the audit.
Dr Tully
Yes. There was a validation library reference, but the actual papers were not available for anyone to see at the laboratory. How can a scientist rely on something if they do not have access to it? There are things like back doors of laboratories being accessible by anyone with swipe-card access, whereas there is a detailed swipe-control system on the front that lets only certain people in. Some of them are oversights, but until you have that sort of detailed assessment you do not pick up those oversights and make sure that they are completely covered.
Bill Grant
So it is about premises security, data security and the ability to recover data in the event of an unplanned incident, such as a fire or flood.
Dr Tully
Those were some of the actions. There were also things like no documented policy to ensure that exhibits or parts of exhibits were preserved for subsequent defence examination; the quality manual referring to all staff having undergone security vetting, but providing no detail as to how that was happening; and people not understanding or knowing about their own organisation’s code of conduct. There was a real range of things.
Chair
Some are quite serious.
Dr Tully
Yes, absolutely. There were master copy fingermark images that could be altered without any audit trail—all sorts of things that should not be happening.
Chair
So there is great scope for rogues to do mischief, if they get into one of these organisations.
Dr Tully
Yes. They are loopholes and oversights, rather than deliberate. None the less, it presents the risk that, if someone was acting improperly, they would have more ability to do damage.
Bill Grant
These are weaknesses that could be identified in the criminal justice system. These failures could have a ripple effect with regard to cases.
Dr Tully
Potentially.
Bill Grant
May I turn to another issue you will be well aware of? The Randox misconduct seems to have happened despite audits and accreditation. One of your key remits is setting and maintaining standards. What lessons are you drawing from the case when it comes to ensuring compliance with the standards that you are responsible for setting, or improving?
Dr Tully
One of the main lessons is that, back in about 2011, there was a case in the civil courts that went very badly wrong. It involved a company called Trimega, which, as you will know, has been implicated in this malpractice. If there had been some sort of system for flagging up cases that had gone wrong in the civil or family courts, there would have been the potential to catch it earlier. We need to think about what we do around flagging concerns that come from outside the criminal justice system. Let us think about that situation. Trimega was not operating in the criminal justice setting; it never entered that setting. Randox happened to employ a couple of staff who used to work there, but there was no way of tracking back to see whether those individuals had worked at a company that had been criticised in a court in the civil jurisdiction. Normal vetting procedures for forensic staff do not normally include whether they or the company they worked for previously had been the subject of criticism in a court case. Even if it were put in as a requirement, there is no system for capturing that sort of criticism. For example, in the criminal courts, my office scans all appeal court rulings, because those are generally available to scan. We look for and find anything that was highlighted by the appeal court. However, in the lower courts, often you will not get anything that has gone wrong highlighted. In the criminal justice system, for people who are compliant with the codes of practice and conduct, there is a very clear requirement to escalate what has gone on. There are very clear escalation requirements, and organisations must report to me when things have gone wrong. In this case, something came from elsewhere. It was not escalated in that jurisdiction. One can think of it then as infecting, almost, the criminal justice system. There was no central record anywhere of that judicial criticism.
Bill Grant
From memory, in the Randox case, a lot of them emanated from the lower courts. A lot of them were driving offences, as I recall.
Dr Tully
Yes, but there was no judicial criticism in those early cases. The criticism was of something that went badly wrong at Trimega in a family or civil case.
Bill Grant
Prior to that.
Dr Tully
Yes. That is an issue that we will continue to consider. We have tried before to think about whether there is a way in which we can get all judicial criticism flagged. We have not found a way of doing that yet, but we will continue to consider it. There is another important point, which is already incorporated into the codes of practice and conduct. The requirement to be accredited to the codes of practice and conduct kicked in in October 2017, so Randox was not accredited to the codes of practice and conduct. One of the requirements in the codes is a separation of responsibilities. The same person should never be responsible for development of a method, testing of the method and dealing with complaints and inquiries as to how that method has been performed. That separation of activities is very important and is now part of the codes.
Chair
So you always have a challenge.
Dr Tully
Yes. There should always be an independent challenge before a method is brought into routine use, to check that its development and validation have been done properly.
Bill Grant
Finally, are you confident that enough audit is being done vis-à-vis self-assessment or self-compliance? Are there enough independent checks? Are we too heavily reliant on companies, large or small, indulging in self-assessment or self-compliance to achieve the standards? Do we need more audits, or are we getting it just about right? Are they working to your satisfaction, bearing in mind the standard-setting?
Dr Tully
The independence comes from UKAS—the United Kingdom Accreditation Service—conducting independent audits, but it is in for only a few days a year. The system is predicated on UKAS going in to check whether there is a proper quality system, whether that system is functioning properly, whether all the internal checks and balances are functioning properly, and so on. It cannot go in and check absolutely everything in the few days for which it is there. One of the things that it will start to do is have a bit more variety in the different ways in which it assesses—a bit more spontaneity, so that people cannot predict how they are going to be audited. It will do more vertical audit, right down to raw data, to try to make sure that that is identified. The other thing that we are going to try to do is strengthen the whistleblowing procedures, in case there is somebody in an organisation who is concerned about what is going on and has not yet referred it. There is already a requirement on organisations to refer to me matters that could have an impact on public confidence or cause a miscarriage of justice. While I have always encouraged any individual also to report a problem, there will be situations where individuals do not feel comfortable about doing that in an organisation. There are two issues. One is that I am not a prescribed person under the relevant legislation. I would like to get that changed. The other thing that I am developing is an anonymous reporting facility—hopefully through my website—that will allow people to report concerns to me anonymously, if they feel uncomfortable about going through their organisation.
Bill Grant
It is clear that you need more influence or power to manage it better. Are you confident that there is a safe route for somebody who has a concern to raise that? You said that there was a website. Can they have confidence that matters that they raise will be addressed?
Dr Tully
They can have confidence that if they raise something we will certainly review and look at it. It is much easier to look at something if we have the detail. It is much more difficult to look at an anonymous referral, but we will attempt to do so. One thing that has come to my attention recently is that there are a number of doctors who have not felt that they could speak up about being asked to examine the complainant and the suspect in the same case. It is very concerning if people do not feel that they can speak up. However, we have a complaints and referrals system.
Chair
Even though the system is not adequate, perhaps, do whistleblowers still contact you?
Dr Tully
This came to me through an investigative journalist who has been looking into these issues. People did not contact me directly. There was one doctor who had raised a similar concern some years ago. On the back of that, I contacted the company and all chief constables, and issued guidance on the issue. From the work that is being undertaken now by some journalists, it seems clear that these issues are still happening, despite my having done those things. That is a concern.
Chair
Did you say that you need to be prescribed in some way in regulations, under the PIDA legislation?
Dr Tully
Yes.
Vicky Ford
Do you mean that you might be a nominated person under the legislation?
Dr Tully
That is it—being a nominated person under the whistleblowing legislation. I cannot find the formal name here.
Vicky Ford
That is the action that you would like us to recommend—that you become a nominated person under the whistleblower legislation.
Dr Tully
Yes.
Vicky Ford
Do you also think that there needs to be more awareness among doctors in the system that you are there and that they should whistleblow to you?
Dr Tully
Yes. My role impinges only very slightly on the role of any medical professionals, because they are regulated by the General Medical Council and not by me. I have issued guidance on the anti-contamination measures for collection of DNA samples. This year I have done four or five presentations at conferences to which forensic medical examiners go to raise awareness of these issues, but there is always room for raising awareness further.
Chair
But your nomination as a person to whom people can raise concerns is critical to their protection.
Dr Tully
Yes.
Damien Moore
In your annual report, you raise the prospect that it will become unsustainable for any forensic services to be managed within some police forces, as they grapple with having to deliver an accredited, high-quality forensics service. How real a prospect is that? How many forces might be in that situation?
Dr Tully
The situation that I am drawing to the attention of chief officers in that part of my report is that I very much understand that chief officers are under a great deal of pressure. They have anti-terrorism, child protection and all sorts of rising crime to deal with. My concern is about whether, amidst all those pressures, the top of an organisation, at chief officer level, can give sufficient attention to achieving quality standards in forensic science. Some forces clearly can, and have achieved the quality standards, but other police forces have not achieved the quality standards and are consistently failing to meet the deadlines. In my view, something different has to happen. I am meeting the performance and standards lead from the NPCC to see what we can do to support chief officers and to try to raise the profile of the issue. It is particularly important in areas that are outside what was traditionally considered forensics in policing—things like collision investigation, which is a highly analytical set of activities and needs to be very carefully controlled, but has traditionally sat within roads policing. The chief officer lead in roads policing is unlikely to understand a great deal about forensic science and quality standards. We really need to look at whether some police forces do not want to be involved with this sort of thing or those that do it. That may be something the police’s own transforming forensics programme will look at in due course.
Damien Moore
Do you have any idea how many police forces may be failing? Do you have a rough number, to help us?
Dr Tully
No, I do not. I have given numbers for who has failed to meet the deadlines so far. The issue is whether those forces can get into gear, meet the requirements and demonstrate not only that they can meet them initially, but that they can sustain them. This is not a one-off push to get accreditation, so that we can all breathe again; it is a way of working. It is a culture that has to be developed. If it is just a box-ticking exercise to get a badge, it brings no value. It has to be a cultural change that says, “Quality is really important, and doing things according to these guidelines is really important.”
Damien Moore
Especially if the checks are not there from outside.
Dr Tully
Yes.
Damien Moore
Where do you think that the market in forensics will be in two years’ time? As police forces move away from that, do you think that it will be in the private sector?
Dr Tully
I do not know whether police forces will move away from it. I really feel that now is the time for there to be a review of forensic science policy that asks, “What do we want to guarantee for forensic science in this country for the criminal justice system? For whom do we want to guarantee access to the services? For what services do we want to ensure that we have continuity of supply, and how are we going to make that happen?” If it is a mixed economy between the private and the public sector, some sort of strategy needs to be in place to ensure that there is continuity of supply and that there is appropriate payment for what is difficult and complex work.
Damien Moore
So it will be a mixture of the two, possibly.
Dr Tully
It could be. To me, it seems that we need to take stock now. We have suddenly ended up in a situation that could have jeopardised thousands of cases, had emergency funding not been provided. It could still result in our losing a great deal of the skill that we have available. We have a very complex situation, in which the vast majority of analytical and interpretive skills sit in the commercial sector and the majority of fingerprint comparison skills sit in policing. Fire investigation is a good example. A lot of it is sitting in the commercial sector and the fire and rescue service. There is a requirement for fire investigation to meet standards by 2020, but currently the fire and rescue services are not paid by the police for delivering fire investigation and have no legal requirement to investigate fires. Some fire and rescue services are saying, “If we have to meet standards, and we cannot afford to do it, we will not do it any more.” There needs to be a policy that says, “What services do we need? How are we going to ensure that they are sufficiently recompensed to be able to meet the required standards?” We need to make sure that the commissioning processes across whatever sectors the services sit in take account of the national status of sustainability, and not just the impact of one contract at a time.
Chair
You are being very clear about the need for a review, to set very clear standards and to have a mechanism for maintaining those standards. It sounds to me that you are saying that the forensics strategy from two years ago has not delivered that.
Dr Tully
Yes.
Chair
Do you agree that the public have a right to know that everyone involved in this meets standards, and maintains those standards? We cannot have police forces, for example, failing to hit deadlines and to meet the standards you require. That is not acceptable, is it?
Dr Tully
That is absolutely true. It is not just about police forces; it is about some of the small companies as well.
Darren Jones
You kindly wrote to us in January setting out some of the statutory powers that you thought would help you to do your role around setting enforceable standards you can investigate and take enforcement action against, if they are not being met. Will you help the Committee to understand the risks of your not having statutory powers? What do the outcomes look like if you do not have those powers?
Dr Tully
The main outcome is that I do not believe that we can get this small number of resistant companies to where they need to go. The vast majority of policing is on board with reaching the standards, albeit that they are behind—a few are still quite reluctant. In my view, we can reach 80% to 90% compliance with the standards without statutory powers, but I do not think that we will ever get full compliance.
Darren Jones
Presumably, that will be an ongoing issue, if you cannot investigate and enforce—
Dr Tully
Yes. It makes it very difficult, particularly to investigate. Until companies or organisations properly adopt the standards and the culture that goes with them, they are not looking for and reporting failures. One of the problems we come up against when we set standards in a new area is that everybody says, “There is no problem with this area. What is the problem?” That has been very much so in digital forensics. One of the issues is that until people understand the standards and start looking for the issues, they do not see the problems, because they are not looking for them. We will have an ongoing problem with investigating problems, because we just will not see them.
Darren Jones
Sure. Why do you not have statutory powers yet? Why do you think you have not been given them?
Dr Tully
That question really needs to be addressed to the Home Office. There have been clear calls from this Committee and from me over a number of years, going back to about 2011. I am very disappointed that it has not reached sufficient priority to make it on to the Government’s legislative programme, albeit that the Home Office is working to draft legislation at the moment and has gone through that with me. If a suitable parliamentary vehicle can be found to get it on to the statute book, it should meet the requirements.
Darren Jones
That is good news. The Home Office has started to draft it for you.
Dr Tully
Yes, but it is not part of the Government’s legislative programme.
Darren Jones
So it might not get introduced. Presumably, that means that it needs to be tagged on to some primary legislation, from your perspective. There is no law that exists where you could put this as secondary legislation or statutory instruments.
Dr Tully
No. It is an issue of primary legislation.
Darren Jones
In your letter in January, you raised some concerns about the Data Protection Bill that is coming to the House, probably after recess. Will you explain those concerns?
Dr Tully
In the Bill that is coming before the House, there are exclusions for a variety of regulators. I am not listed as one of those regulators, so there are no exclusions for me at present. For example, on subject rights, there is a very significant issue relating to the investigations that I do into complaints and referrals. Those may involve a number of data subjects, who may be complainants, suspects, or members of staff at forensic organisations or policing. There is no way I can make contact with all those data subjects, give them the right to be forgotten and all the other rights that are enshrined in GDPR, and still do an effective investigation. That is an issue. There is also the issue of lawfulness of processing and which category, if any, my role falls into. We are currently seeking legal advice on that. There are some quite substantial issues with the Bill that is currently before the House.
Darren Jones
How does that compare with today? Surely you are able to do your role today under current data protection law. Are you noted as somebody who has those exclusions today? Have they just missed it in the drafting of the Bill? I do not understand what is changing.
Dr Tully
There are much greater rights under the new legislation. At the minute, I am registered as a data controller with the Information Commissioner’s Office. Clearly, I attempt to be as compliant as possible with the current regulation. However, there are much broader powers in the new legislation, particularly around the data subject.
Vicky Ford
You say that other regulators have been given special status in the Bill. What other regulators?
Dr Tully
I do not have that information to hand, but I could let you know.
Vicky Ford
It would be very helpful, if they are similar.
Dr Tully
It is probably a list of statutory regulators.
Vicky Ford
So they probably go together.
Dr Tully
Yes.
Chair
We can identify those.
Vicky Ford
That is time critical, because the Bill is going through at the moment. Presumably, if we need to do that, it will be a time-critical issue.
Darren Jones
We might want to ask the Home Office whether it thinks that, if you are going to be included as an amendment to the Bill, those statutory powers can be brought in at the same time.
Dr Tully
It would be a good question to ask.
Vicky Ford
We are going to ask the Minister about the delay in or timing of producing a biometrics strategy. What role have you had in the work that is under way to develop that strategy?
Dr Tully
I have not been involved in the development of the biometrics strategy.
Vicky Ford
Have you asked to be involved?
Dr Tully
No. I was involved in a very, very early draft at one point. Beyond that, I have had some involvement with the biometrics programme, which is ongoing. Although the strategy is—
Vicky Ford
Hold on a second. You started off with a very firm statement, saying, “I have not been involved.” You have just said, “I was involved in a very, very early draft.”
Dr Tully
I believe that that very early draft was completely abandoned. That is my understanding. I have not seen the current strategy and have not been asked to comment on it. I have input to some elements of the Home Office biometrics programme, which is currently working to develop systems for fingerprints, facial identification and DNA. My team has run various workshops with the Home Office biometrics programme about how that programme might be able to support the fingerprint comparison community in maintaining the standards for fingerprint comparison.
Vicky Ford
Do you believe that that programme fits into the strategy?
Dr Tully
Because I have not seen the strategy, I cannot comment.
Chair
Do you think that you should be involved in it?
Dr Tully
I do not anticipate that the biometrics strategy will have much to do with quality standards, and my role is only on quality standards. I think that the strategy will be more concerned with issues of privacy, control of data and so on. That will be more the remit of the Biometrics Commissioner.
Vicky Ford
What role do you have in the various biometric oversight bodies? We have been told that there are oversight bodies. Do you play a role in those?
Dr Tully
I sit as an external on the forensic information databases strategy board, which covers the DNA database and the governance of the fingerprint database. I am not a core member of the board, because to preserve my independence I need to sit on it as an independent, but I have input into that. I do not sit on the Home Office biometrics programme board, because I am told that that is a delivery-related board, not a strategic board or a board that is concerned with quality.
Vicky Ford
Do you have a role in trying to influence discussions about how biometrics are collected and retained, or is it mostly about how they are processed in the labs? Are the two intertwined?
Dr Tully
They are interlinked. For example, at the forensic information databases strategy board, we discuss issues such as the circumstances in which individuals’ biometrics are taken when they are questioned without being arrested. Those issues pass by the strategy board. I have an opportunity to input at that point.
Vicky Ford
I think that that is the last of our questions. I want to check whether there is anything that you want to add. You have expressed a number of serious concerns about different testing organisations. I do not have an overview of that. Are you concerned about a huge majority of the testing organisations, or a small number of them? I cannot get my head around the order of magnitude of this issue.
Dr Tully
I would say that a large majority of the forensic science that is delivered in England and Wales is delivered to a good quality. It is my role to look at where the gaps, risks and issues are. Sometimes my reports can look very negative, because I am concentrating on those issues. It is interesting when we look at international comparators. There are not other roles like mine in other countries, so you do not get that intense scrutiny of what the police are doing, for example, as well as what the laboratories are doing. Sometimes the perception can be that it is all rather negative. There are a lot of very good forensic scientists doing very good work out there, but a lot of them are frustrated that they do not work in an optimal system that enables them to do the best work that they could do.
Chair
Presumably, the family and civil courts need to be part of any review and the construction of a new framework.
Dr Tully
They certainly need to be considered.
Chair
The potential for miscarriages of justice in the family court, for example, could have very serious consequences. I imagine that you would see the importance of ensuring high standards there as well.
Dr Tully
Yes.
Martin Whitfield
May I invite you to add to your last answer? Would the involvement of the family courts in a review provide a vehicle for you to have the judicial oversight to spot errors that are highlighted in family courts? Would it be a vehicle to put that joined-up thinking in place, from your point of view?
Dr Tully
Potentially, yes.
Vicky Ford
What you said about there being good practice in the vast majority of cases is important to ensure that good practice, as well as to help you to identify anybody whose practice is not so good and to have the powers to take action against them.
Dr Tully
Yes. For example, fingerprint comparison has gone on in this country and other countries for 100 years without this level of oversight. That absolutely has to change, so that the courts can be given assurance that all the right quality measures are there.
Vicky Ford
I want to make sure that we get from you the specific actions that you would like us to take. If it is that we should look at the Bill and make sure that you have the right powers under the changes to data protection laws, we need to know what the actions are in order to be able to do that. Otherwise, you will come back in two years’ time and say again, “It is not good enough.” We really need to know what specific actions we can take.
Chair
You wrote to us after the briefing. Does that letter set out fully the steps that you think are necessary, or do you want to consider adding to it? We may well produce something following this hearing, because you have raised some serious issues that need to be put to the Government. We want to make sure that we have captured everything, as Vicky said.
Dr Tully
The letter was really about the statutory powers. I will consider whether there is anything further that I should put in writing to the Committee.
Chair
A little while ago, you said that a draft Bill had been developed. It sounded to me that you are positive about what it contains.
Dr Tully
Yes. It has been simplified as much as possible in order to ensure that it has a good passage through the House.
Chair
I appreciate that it is not in the current programme, but have you had any reassurance about when it may get time and what priority the Government think they need to give to this?
Dr Tully
I have been given an outline timetable, but it is not part of the Government’s programme.
Chair
Can you give us an indication of what that timetable consists of?
Dr Tully
I believe it may be introduced to the House within a couple of months.
Chair
Ah—so something may be imminent.
Dr Tully
Yes.
Chair
Thank you very much.
Dr Tully
Thank you. Examination of witnesses
Witnesses
Baroness Williams of Trafford and Christophe Prince.
Chair
Welcome, Baroness Williams. It is very good to see you, and hello, Mr Prince. Would you very briefly introduce yourselves?
Baroness Williams of Trafford
I am Susan Williams, Minister of State at the Home Office, and I cover the policy areas of biometrics, identity, data and counter-extremism.
Christophe Prince
I am Christophe Prince. I am the recently appointed director for data and identity in the Home Office.
Chair
Thank you very much indeed. Back in 2015, the Government told our predecessor Committee that they were developing two “separate but aligned” forensics and biometrics strategies and that they remained committed to publishing both strategies by the end of 2015. Why are we still waiting for the biometrics strategy?
Baroness Williams of Trafford
Although 2015 is a bit before my time, I can only apologise that you do not have the biometrics strategy. Obviously, we produced the forensics strategy. When I took over the policy area, there were several things that I was quite clear about. One was that a Government-wide strategy did not fit the bill of what we wanted to achieve, because different Government Departments use biometrics for different purposes. The Home Office uses them for quite distinct purposes, as does, say, DCMS.
Chair
You saw that the scope was wider.
Baroness Williams of Trafford
The scope was too wide. I also saw, and it has been clearer more recently, that the pace of biometrics is moving quite rapidly. I wanted to have something that was flexible and fit for the future in this quite fast-changing area.
Chair
Is not the rapid development, as you have described, the very reason you need to have a clear, legal framework strategy in place, because things are changing on the ground as we speak? The technologies are being deployed in a way that some say is unlawful. Is that not the very reason we need something in place quite urgently?
Baroness Williams of Trafford
You are absolutely right: it is the reason we need something in place quite urgently. It is also the reason we need to get the framework for the strategy absolutely right so that it is not only fit for the future but that it gets those ethical and legal questions fixed within it of why we are doing what we are doing, and how we deploy our policy. The other point that might please the Committee is that, all that said, I hope to be able to bring the strategy to you in June.
Chair
In June; right. I appreciate you offering us clarity on that. The original plan was that the forensics strategy and the biometrics strategy would be aligned.
Baroness Williams of Trafford
Yes.
Chair
It becomes more difficult when they are separated in time, but is that still the intent? Dr Tully made it clear to us that the forensics strategy had not really delivered the clear framework to deliver the high standards across the board that she felt was very necessary.
Baroness Williams of Trafford
Just because they are distinct does not mean that they cannot also be aligned. I have the kind of overarching look across the piece.
Chair
You are responsible for both strategies, are you?
Baroness Williams of Trafford
Well, forensics would be very clearly in the criminal area, and the policing would be Nick Hurd’s area. Of course, in the immigration sphere, biometrics are incredibly important. You can see why they are both distinct and aligned, because we operate across the piece.
Chair
You personally do not have any overview of the two strategies together. It is divided between the two Ministers.
Baroness Williams of Trafford
No, it is not divided between us. What I am saying is that, although they are distinct, there is alignment, and there are often times when Nick and I work together on a specific thing.
Darren Jones
The digital Minister Margot James gave evidence to our Committee in January and talked about the new data ethics and AI unit being set up in DCMS. I appreciate it is in its very early stages. My understanding from that hearing was that this is going to be a cross-departmental function, albeit one hosted in DCMS. On that point of stuff in the Home Office, stuff in Justice and stuff in DCMS, do you have any views on how that ought to work to help you get this right cross-departmentally?
Baroness Williams of Trafford
Yes. In the area of identity, we have already started cross-departmental talks, certainly with DCMS, because some of these things are whole-Government issues, although each Department needs to have a very clear idea of how what they do will impinge on another Department of Government. So, yes, we work together across Government, but we also have our distinct policy areas.
Chair
Christophe, did you want to add to that?
Christophe Prince
On the question of alignment, one reason for establishing the data and identity directorate was to ensure that we did have alignment. I also have responsibility for the forensics strategy within my directorate so that we can ensure that there is linkage—
Chair
You are the glue that binds it all together.
Baroness Williams of Trafford
He is.
Christophe Prince
I attempt to be.
Chair
Your letter to us last November spoke of further work that needs to be done in some areas before you delivered the strategy.
Baroness Williams of Trafford
Yes.
Chair
Could you give any more clarity on what those areas are? It is great to know that it will now come in June. That is wonderfully precise; I know that Government Departments tend to talk in seasons, which are more flexible than months. Can you give us some guidance about the areas on which you have been working?
Baroness Williams of Trafford
As I have said to you, I wanted to clarify the scope of the strategy, but I also wanted a framework for governance and oversight, which I think is so important in this area. We need the public to trust that what we are doing is clearly legal and that we articulate clearly why we are using biometrics, and for what purpose.
Chair
Your letter tells us that the custody image review reported its findings in February 2017—a year ago. Are there any other reviews that still need to be finished before you can publish the strategy in June?
Baroness Williams of Trafford
I can report that there are no other planned reviews, and, as I say, I plan to publish the strategy in June of this year.
Chair
Thank you very much. Martin?
Martin Whitfield
I was going to ask questions about the forensic science strategy, so it may be that these are points for Christophe. In 2016, it referred to a review by police forces about creating a joint forensic and biometrics service. How is that progressing?
Baroness Williams of Trafford
It is progressing fine.
Martin Whitfield
Good. Can we bore into that a little further?
Christophe Prince
Work on developing the capacity and capability in the police to deal with biometrics and forensics—particularly in forensics—is being taken forward through the transforming forensics programme, which has done some initial work, and the more recent proposals that have been put together by the police are being looked at, at the moment. Exactly how they will then provide improved forensic services themselves and work with the market will depend on the outcomes of that programme.
Martin Whitfield
Presumably, also, to wait at least until June, when the biometrics strategy is published.
Christophe Prince
Elements of what they do will be influenced by the biometrics strategy, but most of the forensics work—
Martin Whitfield
It will already be done.
Christophe Prince
The direction will be set by the strategy.
Martin Whitfield
Is there a timescale that you can share that you are working towards for this—seasonal or otherwise?
Christophe Prince
Not at the moment. The latest proposals from the police for the transforming forensics programme have just been submitted and are being reviewed at the moment. Decisions should be taken shortly, which will then decide on which elements are to be taken forward, but I cannot give specific times on that.
Martin Whitfield
At the moment, there is a combination of bodies that oversee fingerprints and DNA. Is it anticipated that there is going to be an oversight framework for the other types of biometrics that are envisaged?
Baroness Williams of Trafford
It is fair to say that governance and oversight arrangements have grown over successive Governments and that they are quite complicated at this stage. I want to ensure that they operate clearly and smoothly. At this stage, we are considering the formation of a board that would bring the main commissioners together with the police.
Martin Whitfield
Progressing that, the forensics regulator obviously covers the criminal justice system, but we heard earlier about problems with disconnect—that the family and civil courts are not part of that. I suppose the first simple question is: do you accept that there is a gap? Secondly, what do you think you can bring or offer to narrow that gap?
Baroness Williams of Trafford
I have just heard the end of your interview with the forensics commissioner. I met her last week, and it is our intention to put the regulator on a statutory basis. I think that will give them robust enforcement powers, but at this stage we will limit it to the criminal justice system.
Martin Whitfield
You have hinted at the split between the Home Office and the Ministry of Justice. Do you think there is a debate to be had about who should manage the whole of forensics and biometrics, or are you confident that this joint body will be a way of allowing cross-departmental work successfully?
Baroness Williams of Trafford
I am confident that the joint body will work. Whether you are looking at forensics, biometrics or indeed many other areas of Government, you cannot neatly package them into one Department or one Minister very often. So I am confident that this arrangement should work.
Martin Whitfield
But often it is where they cross jurisdictions that the problems occur, as we have heard today.
Baroness Williams of Trafford
It is; you are right.
Martin Whitfield
Thank you for your confidence in what is being proposed.
Baroness Williams of Trafford
This time next year, when you call me back—
Chair
Thank you for confirming your availability. Bill?
Bill Grant
The biometrics commissioner advises us that there are at least 19 million facial images—a significant number—retained on the Police National Database. Do you see that as a good thing for securing or identifying criminal suspects, or is it a potentially excessive intrusion of privacy, and are there enough measures in place to allay those fears? Which one comes up to the top?
Baroness Williams of Trafford
You are absolutely right that there is a line between maintaining privacy and maintaining public protection. Our view is that there are not 19 million facial images; there are actually 21 million people on the PND. Sorry, not 21 million, but 21 million images—not people.
Chair
You mean that there may be many images that are of the same person.
Baroness Williams of Trafford
Exactly. There also may be images that are tattoos or scars. So, 21 million does not equate to the number of people.
Bill Grant
It is not individuals. It may be tattoos appertaining to an individual, of which there is a series of pictures.
Baroness Williams of Trafford
Yes.
Bill Grant
That inflates the figure.
Baroness Williams of Trafford
That inflates the figure.
Chair
But it does include many people who are innocent, against whom proceedings have not been pursued.
Baroness Williams of Trafford
Perhaps I will get on to that as well in terms of the custody image review, but, of those 21 million images, we estimate that about 12.5 million are searchable; but, of those searchable images, they, again, do not equate to 12.5 million people. They equate to 12.5 million searchable images—that is, images that can be used. That is putting it in context. The number of images is more than you think but it does not equate to the number of people. The custody image review came in last year, I seem to recall. It gets reviewed; clearly, someone who is innocent can apply to have their image taken away and it will be taken down. There are decisions around public safety. There are various categories of the types of people of whom images are kept.
Chair
Could you confirm how many applications there have been in that two-year period to have images removed and what percentages of those have been successful?
Baroness Williams of Trafford
I do not have that information. Christophe, do you have it?
Christophe Prince
We are in the process of gathering that information from police forces in order to understand the number of requests for deletion and the number that have been approved.
Chair
Will you write to us?
Baroness Williams of Trafford
Yes, we will do.
Chair
It would be appreciated if you gave us as much detail on that as you can.
Bill Grant
Have you finished with that one?
Baroness Williams of Trafford
If I have answered it to your satisfaction.
Bill Grant
I am happy with that. You mentioned the custody image review and that the system has been amended. The guidelines, I would imagine, have been approved or amended. Do you think the guidelines are sufficiently clear for all police forces to apply a consistent and uniform interpretation of these rules? Are they robust enough for equity and fairness in application?
Baroness Williams of Trafford
Yes. I think that is a very fair question. I do not have any evidence that it is not working well, but I have asked for further information about how it is being applied to assure both ourselves and, of course, the public that it is working well.
Bill Grant
There is no evidence to suggest it is not working well.
Baroness Williams of Trafford
There is no negative evidence out there, but we are just seeking that further assurance.
Christophe Prince
In terms of the assessment that is made by the police with respect to removal or otherwise, the national retention assessment criteria template is being put in place. It builds on common tools that the police use to assess whether to retain those images, and that should help drive through some of the consistency in the way in which police make decisions around its use.
Bill Grant
You are sensing a commonality and a level playing field.
Christophe Prince
Yes. The guidance is intended to drive it, and there is nothing to suggest otherwise.
Bill Grant
Again, the biometrics commissioner has expressed concerns about the up-and-coming strategy and proposals. He has raised concerns that it may evolve to be a sort of postcode lottery. It is almost like the previous question. Is he justified in his concerns or is he overreacting to it? Is his concern justified?
Baroness Williams of Trafford
I think the rules are very clear that, if someone is not convicted of an offence, they have the right to request that the custody image is removed from all police databases. The rules come with a general presumption that it must be removed unless police consider that there is an exceptional case for retaining it. If they are on the ViSOR system—the violent and sex offender register—or they are a potentially dangerous person, that would be a reason to retain. But the police obviously look at each case on its own merits.
Graham Stringer
If somebody is on the sex offender register, will there not be a facial image of that person anyway?
Baroness Williams of Trafford
There will be on the ViSO register, but, as I understand it, ViSOR gets uploaded to PND. When you request the removal, you request—I understand—the removal of all images.
Christophe Prince
I do not know if actual images are kept on ViSOR or whether those are kept in a separate position.
Baroness Williams of Trafford
ViSOR might simply be a database.
Christophe Prince
Of biographic details.
Baroness Williams of Trafford
Yes, as opposed to images.
Christophe Prince
I can check that.
Graham Stringer
Will you write to us and confirm one way or another?
Baroness Williams of Trafford
I understand that the PND is where the images are kept.
Bill Grant
Reverting to the lottery aspect of it, in the proposals there is a human element of decision making and a certain flexibility in decision making in relation to that. Is there a risk that goes with that discretion? Is there a risk of that discretion being used firmly or lightly, or varying throughout the forces?
Baroness Williams of Trafford
They have to have the approval of a chief officer in order to retain. That might include something like the individual being the subject of an ongoing investigation, but they are the rules around continued retention. I guess, unless it is retained, it should be removed.
Bill Grant
But there is a risk from the various chief constables throughout the area that there could be a variation in how they approach it.
Baroness Williams of Trafford
I guess there always could be, because you bring in the question of human element, but if there are clear rules around it that lessens that risk.
Bill Grant
You are confident that they would be followed by the various chief constables with a degree of equity, if they are following the rules.
Baroness Williams of Trafford
Yes, if they are following the rules.
Darren Jones
I have a supplementary on the databases, and I appreciate you may want to write to us on it. With my other hat on in the European Scrutiny Committee, there have been quite a few documents that have come before us for scrutiny around European databases for collection of facial recognition, fingerprints and other biometrics at various points, either on border control or elsewhere. Do you know whether that information is held on EU or UK databases, and has your Department done any preparations for whatever the outcome of Brexit might be to ensure that UK citizens’ information is protected in that process?
Baroness Williams of Trafford
Will there be EU citizens’ information on the PND? There could well be. On the second part of your question, we have just done the Home Office elements of the Data Protection Bill—one of the most complex Bills I have ever had to bring through—which aligns the law enforcement directive with UK law. I am confident that there is good alignment, and it may well be the case that there are EU citizens’ images on the PND if there is a necessity to put them there for the reasons I have outlined.
Darren Jones
Are you happy from the Bill’s perspective that the mechanisms are in place, apart from negotiations with the European Union, and that there should not be any unexpected risks around that?
Baroness Williams of Trafford
Around the LED?
Darren Jones
Yes.
Baroness Williams of Trafford
Because it is a directive, it is a direct transposition into UK law. In terms of it being robust, in meeting EU requirements, because it is a direct transposition, I am confident. Clearly, I cannot see into the future if rules change, but, as we stand, it copies the LED. I would say in this space that the UK has led the way on law enforcement and data protection across the EU, so we are one of the states that lead, but obviously we are a state that is leaving.
Chair
Your letter to us of 1 February said, “Chief officers have the discretion to retain a custody image where this is necessary for a policing purpose and there is an exceptional reason to do so.” I assume that when you say, “there is an exceptional reason to do so,” that means that we are talking about quite a small minority of cases.
Baroness Williams of Trafford
Yes.
Chair
Quite apart from the right for a citizen to request a deletion of an image, when someone has been arrested, perhaps interviewed and an image has been taken, but a decision has been taken not to pursue criminal proceedings against them and everything has been dropped, presumably what you are stating in the letter is that at that point the image should be deleted, unless there are exceptional circumstances.
Baroness Williams of Trafford
There is a presumption of deletion, if the criteria are met, but it would not, as you say, necessarily be deleted—for example, if that person was—
Chair
But the only reason not to delete at that point, irrespective of a request from the citizen, would be when there were exceptional circumstances and exceptional reasons why the image should not be deleted.
Baroness Williams of Trafford
Yes.
Chair
I am told that images are still routinely kept, and that it would require a citizen to make a request for it to be deleted.
Baroness Williams of Trafford
That is correct.
Chair
But surely that amounts to an unlawful policy. If we look at the 2012 case law, and the Biometric Commissioner’s annual report, which refers to the unlawful retention regime in place, we can see that the retention of images of innocent people unless and until they apply is an unlawful policy, is it not?
Baroness Williams of Trafford
In an ideal world—
Chair
Let us just deal with the law. Is this not an unlawful policy, based on what your letter says?
Baroness Williams of Trafford
I think it was deemed not to be unlawful.
Christophe Prince
Yes, the view was, and remains, that the implementation of the custody image review is sufficient to meet the 2012 ruling. It will be only on application that a decision will be taken to retain or remove an image.
Chair
So, is the Biometrics Commissioner content with all images being retained unless and until someone makes an application?
Christophe Prince
A separate review process is in place for any image on the system. Therefore, it will not be retained indefinitely; it will have to be reviewed after a certain period of time.
Chair
I am still a bit unclear. You have said that, in accordance with your letter, it would be retained only if there was an exceptional reason—in other words, in the vast majority of cases, they ought routinely to be deleted if the person has no proceedings brought against them. But you are also now saying that images are routinely kept unless and until there is an application to delete.
Christophe Prince
The removal will be undertaken only when there is a request; there is no mechanism at the moment automatically to connect the non-conviction to the custody image and therefore to prompt the police to make that removal. It relies at the moment on a request being made.
Vicky Ford
I do not see that as a contradiction. As I understand it, all images are kept unless the individual says, “Take my image away.” The image is then pretty much automatically taken away, unless it is an exceptional circumstance whereby the person is considered to pose an extra risk. That is how I understand it to have been explained.
Chair
Right—but the letter says something different: that chief officers “have the discretion to retain a custody image where this is necessary for a policing purpose and there is an exceptional reason to do so.”
Vicky Ford
Exactly.
Chair
So irrespective of a request—most people will not even know that they have a right to make a request, and I would be interested to know how often and how that information is disseminated about their right to make a request—it should be retained only if there is an exceptional reason to do so.
Vicky Ford
Correct—and that is what it says in the letter.
Chair
No, it is absolutely not. It is not what it says at all.
Christophe Prince
The image would be retained only if there was an exceptional reason to do so after a request had been made.
Chair
Okay, so if the vast majority of people have no idea of their right to request, images continue to be retained—and, it seems to me, under the 2012 case law, to be unlawful.
Baroness Williams of Trafford
I think that the ruling said that what we were doing was lawful. What I was trying to say was that within the technology there is no automatic deletion mechanism, but that is something that obviously, in due course—
Chair
I understand that you have made the point that it would be very costly to go through and clear out those images.
Baroness Williams of Trafford
That is the position at the moment, yes.
Chair
I understand that, but when someone has been arrested, has had an image taken and a decision has been taken that criminal proceedings should not be brought against them, I do not understand why that image should not be deleted at that point.