Facial Recognition and the Biometrics Strategy

On non-live AFR, the so-called Identify scheme, I will focus on the databases that are being used. After we have built the facial image—the map or code of a person’s face—we match it against a database of images. What is that database and where do those images come from? The police have watch lists of people they are concerned about. Obviously, we want terror suspects to be on a watch list so that the police can do their job properly. There has been a question about scraping social media for images that police forces can match against. Can the Minister confirm that today? If we are doing that in an untargeted fashion for those about whom there are legitimate concerns, we ought not to be. There are also custody images on databases such as the police national database, about which there are long-running concerns, as we have heard on my Select Committee. When the police take someone’s picture and put it on to the PND, it stays there. It does not matter whether they are convicted and go on to a list of people with convictions—perhaps we would understand if that were the case—or they are found innocent or no action is taken against them; their images are kept on the database anyway.

We have known for many years that the way the police have been processing the facial images of innocent citizens is unlawful. In the High Court in 2012, in the case of RMC and FJ v. Commissioner of Police of the Metropolis, the High Court was clear that it was being managed unlawfully. The Home Office responded, albeit some years later—I am not entirely sure why it took so long to respond to such an important issue—setting out a six-year review period in which the police would have to review the images on the database to decide whether they should weed and take out the images of innocent citizens. It also said that any of us could proactively ask the police force to remove our images because we claim our innocence.

There are several problems with that. Unsurprisingly, the number of requests to remove facial images from the database has been low, because people do not know about it. The fact that people have to proactively prove their innocence to not be on a police database is also fundamentally an issue. It is well known, however: the minutes from the September meeting of the Law Enforcement Facial Images and New Biometrics Oversight and Advisory Board say that

“most forces were struggling to comply”

with the Government’s response to the High Court’s ruling of unlawfulness. In answer to my questions in the Select Committee hearing, the Minister in the other place and her officials confirmed that no additional resource had been given to police forces to respond to or promote the fact that people can request the removal of their images from the database, or to undertake the review in which they are supposed to weed out and delete the images that they are not keeping on the database.

Evidently, the system is not fit for purpose. In my view, we continue to act in a way that the High Court said was unlawful, and I know that the Information Commissioner has also expressed concern. It will be useful if the Minister sets out how the Government will act to improve the situation, not only in terms of resourcing and support for police forces across the country but in terms of honouring the Government’s commitment to build new databases, so that the process can be automatic. Technology is pretty advanced now in some of these areas of facial recognition. If Facebook is able to identify me, tag me and take an action, and if Google is able to identify me and allow me to search for myself online, surely the Government ought to be able to auto-scan images, identify people who are not criminals and automatically delete the images of them. That ought to be deliverable. Indeed, it was our understanding that such a system was being delivered, but only a few weeks ago, when I asked Baroness Williams, the Minister in the House of Lords with responsibility for this issue, when we could expect the new computer system to be delivered, there was stony silence from the Minister and her officials. They were not clear when it was going to be delivered, why it had been indefinitely delayed and whether the delay was due to financing, contractual issues or technology issues. There was no clarity about how the existing system would be fixed.

We found in 2012 that the system was unlawful in relation to civil liberties. That in 2019 going into 2020, we do not know what we are doing to fix it or how it will be fixed, it is wholly unsatisfactory. Will the Minister give us a clearer update today about when the automatic deletion service will be available to police forces?

I am not alone in saying this—indeed, it seems to be the view of everybody but the Government. The Information Commissioner has opened investigations; the independent biometrics and forensics ethics group for facial recognition, which advises the Home Office, agrees with me; the London Policing Ethics Panel agrees with me; the independent Biometrics Commissioner agrees with me; and, perhaps unsurprisingly, civil liberties groups such as Liberty and Big Brother Watch not only agree with me but are involved in legal action against various police forces to challenge the legal basis on which these biometrics trials are being conducted. When he responds, will the Minister say that the Government now agree with everybody else, or that they continue to disagree with everybody else and think that this situation is okay?

I will now address the second part of this debate, which is the biometrics strategy. I focused on facial recognition because it is a particularly timely and sensitive component of a broader biometrics strategy. All of us who use technology in our daily lives know that biometric markers and data can be used to identify our location, identity and communications. That means that the Government and, indeed, the private sector can access data and learn things about us, and that area of technology is growing. People are rightly concerned about ensuring that the right checks and balances are in place. It is one thing for an individual to agree to facial recognition technology in order to unlock their tablet or phone, having read, I hope, about what happens to their data. It is another thing, however, for them not to be given the opportunity to give their consent, or not to receive a service and therefore not know about it, when the state is using the same types of technology.

The biometrics strategy needs to get into the detail. It needs to set out not only what is happening now but what is envisaged will happen in the future and what the Government plan to do about it, in order to protect civil liberties and inform citizens about how the data is being used. Clearly, they would not be informed individually—there is no point in telling a terrorist planning an incident that there will be a camera—but the right balance can be achieved.

Again, I do not understand why the Government are so slow in responding to these fundamental issues. It is so long since the 2012 High Court ruling on the retention of custody images, and we had to wait five years for the biometrics strategy. Imagine how much the biometrics sector in this country changed during those five years. Perhaps the Government were trying to keep up with the pace of change in the technology space, but the strategy was long delayed and long awaited.

Given my tone, Sir Roger, you will not be surprised to hear that everyone was very disappointed with the biometrics strategy, because it merely gave a kind of literature review of current uses of biometric data. There was a little bit about the plans for a new platform, which the Home Office is building, regarding how different people access biometric data. It said nothing at all, however, about the future use, collection and storage of biometric data, or about data protection. It said nothing about the Government’s own use and collection of data; the need for enforceable guidelines to enable devolved decision making by, for instance, police forces across the country; how different Departments might be able to use different forms of biometric data across Government, which, evidently, is very easy to deliver with today’s technology; or how the data would be stored securely.

People are concerned about cyber-security and breaches of their personal data, so what steps will the Government take in this developing space? Where will the data be stored? In advance of this debate, I received representations arguing that we should not send it to companies overseas and that it should be stored in the UK. One would think that the biometrics strategy addressed those issues, but it does not. Is the beta version of the biometrics strategy due soon, or does the Minister think that the Government have provided a sufficient response on this important field?

I do not want to keep saying that everybody agrees with me, because that would be a little uncomfortable, but there is no denying that the Biometrics Commissioner, the Surveillance Camera Commissioner and the Information Commissioner’s Office have all said exactly the same thing—this biometrics strategy is not fit for purpose and needs to be done again. The Government need to be clearer and more transparent about their endeavours and make that clear to the public, not least because these areas of technology move at pace. I understand entirely why police forces, civil servants or others want to be able to take the opportunities to deliver their services more efficiently, more effectively and with more impact—we support that—but the right checks and balances must be in place.

I will touch on our fundamental rights and freedoms, because that debate does not get enough air time in the technology space. Our freedoms are increasingly being challenged, whether the issue is cyber-defence or how we regulate the online world, and also in this space. Fundamental freedoms—freedoms that we hold, or purport to hold, dear—are encapsulated in the European convention on human rights and the Human Rights Act 1998. They go to the very nature of this technology, such as the right to a private life that can only be interfered with for a legitimate aim and only if that interference is done proportionately. Scanning a load of people going about their day-to-day life does not feel proportionate to me, and there is no accountability to make sure that it is being done legitimately. As my hon. Friend the Member for Newcastle upon Tyne Central (Chi Onwurah) said, if the selections that those technologies pick up are resulting in false matches or are discriminating, primarily against women and people from ethnic minority backgrounds, that also ought to be considered.

Those freedoms also include freedom of expression and of association. In public protests in recent weeks, people who dearly hold certain views have gone too far by moving away from their right to freedom of expression and to peaceful demonstration, towards criminal activity, intimidation or hostility. We should set the tone and say that that is not welcome or acceptable in our country, because having a right also means having a responsibility to use it wisely. Of course we want to protect those who want to demonstrate through peaceful public protests.

I am sure the public will say—this lies at the heart of my contribution—“Fine. Use some of this technology to keep us safe, but what is the right balance? Do we understand how it is being used? What are the accountability measures? What rules and guidance are being put down by the Government, on behalf of Parliament and the people, to make sure this is being done in a way that is not a slippery slope towards something we ought not to be doing?” We need a wider debate in public life about how we protect freedoms in this new digital age, and this issue is an example of that.

The House of Commons digital engagement programme is often a very good process for Westminster Hall debates, as it allows the public to be part of the conversation and to submit their comments. It would be remiss of me to not point out that some members of the public highlighted a certain irony in the fact that this debate was being promoted on Facebook, so I have shared their concerns, but that is still a medium through which the public like to engage in debate. Hundreds of thousands of people engaged across different platforms—way more than I was expecting—which shows the level of public interest in the use of these technologies.

As might be expected, there were two sides to the argument. The minority view on the platforms was, “I have nothing to hide. Please go out and keep us safe. Crack on, use it.” The other side said, “Actually, this is a slippery slope. I don’t know how this is used, and I’m worried about it. Why can’t I go about my day-to-day life without the police or the state surveilling me?”

I will share some of the comments. On the first side of the argument was Roy. I do not know where he is from. I wish his location had been given, because I could have said, “Roy from Sheffield”. He said:

“No objection. I’ve nothing to hide and don’t find it scary or objectionable for ‘the state’ to be able to track my movements. They already can if I’m in a car”—

I did not know that—

“and that doesn’t seem to be a problem. The added security of the police being able to track potential terrorists far outweighs any quibbles about reduced privacy.”

That is a perfectly legitimate view.

Karyn said:

“Having seen the numbers of crimes solved and even prevented by CCTV I have no objections. Today we have to be realistic, with phones listening in on conversations for marketing and plotting where we are, this is small price to pay for public safety and if you have done nothing there is nothing to fear.”

That is an interesting contribution on what is happening in the private and state sectors. We need to be much more advanced in both spheres.

That was a minority view, however. I do not have the percentage, but the bulk of comments came from people who are concerned. Chris Wylie, who many of us will have read about—he was the Cambridge Analytica whistle- blower, so he clearly knows something about these issues —was firm:

“No. Normalising this kind of indiscriminate surveillance undermines the presumption of innocence.”

We should pause on that, because it is really important. Why should we be tracked and surveilled by the police on the assumption that we might be guilty of something? That does not feel right, just as it does not feel right that people have to prove their innocence to get their images taken off a police database. Chris went on to say:

“It should never be up to us as citizens to prove we are not criminals. Police should only interfere with our lives where they have a reasonable suspicion and just cause to do so.”

I share Chris’s views.

Andrea said that this was a slippery slope:

“The idea that some people have about privacy as an exclusive issue for the bad guys is completely wrong. Not only privacy prevents my acts from limiting my rights but also avoids an unjustified use of power by the Gov’t.”

Again, we should pause there. It is our job in Parliament to hold the Government to account, yet we have no strategy, legislation or rules to enable us to do so. That is a fundamental problem. She goes on to say:

“Such a huge involvement of disturbing tech could lead to a 1984-like slippery slope, one which none of us wants to fall in, regardless of their legal background.”

Jenny said:

“I believe that this would suppress people’s ability to engage in public demonstrations and activities that challenge the government, which is hugely dangerous to democracy.”

A lot of people said that if they thought the state was scanning their data and putting it on a database, they might not associate with or take part in public demonstrations. If that were to happen, it would represent a significant diminution of our democratic processes.

Lastly, Bob said:

“It makes it easier for a future, less liberal government to monitor the activity of dissident citizens. During the miners strike in the 1980s miners were stopped from travelling just on the suspicion they would attend rallies based on their home locations and where they were heading. How would this technology be applied in the future for, say, an extinction rebellion march?”

Regardless of our political disagreements across the House, none of us thinks that the state is overreaching in a way that many other countries would. However, given the lack of legislation, guidance and regulation to enable us to hold the Government to account, and with independent commissioners and regulators saying that this is not good enough, I agree with Bob. There is a huge risk in not putting in place a framework with the appropriate checks, balances and protections, not just because that is the right and important thing to do today, but because we need that framework for future Governments.

On accuracy and bias, some of the information illustrates clearly that errors for low-resolution surveillance footage can exceed 10%, so there is still a question mark over the validity of the process. If as many as 10% of people are found not to be the right person, I question the validity of the process.

We cannot deny or ignore the concerns of Elizabeth Denham, the Information Commissioner. She raised concerns about facial recognition technology and law enforcement in her blog:

“There is a lack of transparency about its use and there is a real risk that the public safety benefits derived from the use of FRT will not be gained if public trust is not addressed.”

I refer to the questions that the hon. Member for Bristol North West asked, and I suspect others will, in relation to the need for public trust that the system will not be abused or used detrimentally against people. People feel strongly about this matter. How does the use of FRT comply with the law? How effective and accurate is the technology? How do forces guard against bias? What protections are there for people that are of no interest to the police? How do the systems guard against false positives and their negative impact? That is clearly an issue.

My hon. Friend the Member for South Antrim (Paul Girvan) tabled a parliamentary question on 24 May 2018—

“To ask the Secretary of State for the Home Department if he will take steps to ensure that the facial recognition software that law enforcement bodies use is accurate.”

It clearly tells us that there are concerns across all four regions of the United Kingdom—England, Scotland, Northern Ireland and, obviously, Wales.

The background is clear. The courts ruled in the 2012 RMC case that it was unlawful to hold custody images without making a distinction between those who were convicted and those who were not. In response, the Home Office has introduced a system to allow unconvicted individuals to request the deletion of their images. We understand the system and that is all great, but it is an opt-out scenario; the individual must ask for the deletion of their image. I am not sure how many people would think of doing so; I suspect it would be the last thing on many people’s mind, with their busy lives. I know I probably would not think of doing so. I would not know that my images have been stored away for a rainy day to be pulled out, even though I am completely innocent. The presumption, “You may well do something someday” is not enough of a reason to hold on to these things. An arrest must be made for fingerprints to be taken and stored, and yet no arrest is needed for images of a person in the background of an event to be taken and perpetually stored by successive Governments—not just this Government, but every Government that comes after, if the legislation is in place.

The excuse of cost is a weighty consideration, and so is the protection of personal identification. I say this honestly: because of my age I have lived through the height of the troubles, when cars were searched, ID was a must and the battle against terrorists was daily. I lived with that, not just as an elected representative, but as a former member of the part-time army—the Territorials and the Ulster Defence Regiment. We seem to be heading that way again. I could understand it if the Government were to make it known that they believed that retaining this process would save lives—I would understand the thinking behind what they are trying to do—but that if necessary, there would be a mechanism to have the information removed. I could understand it if there was that level of transparency. However, to say that the reason is that there is not enough money to do an IT upgrade just does not wash with me, and I suspect it does not wash with others taking part in today’s debate.

I agree with the Science and Technology Committee report, “Biometrics strategy and forensic services”, published on 25 May 2018, which states:

“The Government must ensure that its planned IT upgrade…is delivered without delay…to introduce a fully automatic image deletion system for those who are not convicted. If there is any delay in introducing such a system, the Government should move to introduce a manually-processed comprehensive deletion system as a matter of urgency.”

That would be my request to the Minister. We have great respect for the Minister; that goes without saying, but we are very concerned about what is proposed, or could possibly happen, and we have to record those concerns.

I further agree that facial image recognition provides a powerful evolving technology, which could significantly help policing. I am all for that, but everyone must be clear about what is acceptable, what is not acceptable, what is held and for what purpose. That underlines my point that if it is for the sake of security, then say it and we can debate the merits of the case. If that is the purpose, let us debate it honestly, truthfully and in an informed way, to ensure that all concerns are taken on board.

I am all for targeting those on a watchlist or those affiliated with those on a watchlist, as in previous examples of terrorism on the mainland and back home as well, but let us be clear that it is happening, and let us be clear that those who take umbrage against it have the information that they need to ensure that their images are not stored even though they have not committed a crime and are not a person of interest. I am conscious of the need to protect human rights, protect privacy and protect those who are innocent, although I understand the reasons for the process.

In conclusion, I look to you, Minister, as I always do. We must have a chance to debate these issues and make an informed decision about the strategy and the justification for it. I look forward to the report’s coming before us, but I must record my concerns.

Issues that concern me include the size and content of any watchlist that might be constructed—particularly vis-à-vis the effectiveness of the size of the watchlist. In the Manchester Evening News report it was revealed that 30 million people per annum visit the intu Trafford Centre. It is an iconic destination in my constituency. However, over the sixth-month period during which the technology was being deployed, only one positive identification was made. That makes me question whether it was right to draw so many members of the public into the ambit of the experiment, for what seems to be a low level of effectiveness.

We also have to consider where the technology is being used. The police themselves said to me that some events or venues will be more suitable, and some less. Also we need to consider why it is used—at whose initiative or request such technology is deployed. In the Trafford Centre the intu management themselves had suggested it to Greater Manchester police. Is it right that police priorities should be set by the wishes of private enterprises? If that can be right, and in some circumstances there can be a partnership approach between the police and private entities, if the private entity draws a disproportionate benefit from the activity is it not right that it should pay for it? Football clubs pay for additional police protection at football matches.

We have heard concerns about potential ethnic bias in the databases and technologies that are currently available. I am told that what is on the market, as it were, at the moment is better at matching north European and south-east Asian males than other ethnic categories. That relates to the countries in which the algorithms that underpin the technology were developed, but from the public’s point of view we can say that if there is any ethnic disparity, or perception of it, in the way the technologies apply, it is bound to sow public mistrust. It cannot be right that we make use of technologies that do not treat all communities equally.

I have mentioned my concerns about where decisions are taken in police and other public agencies. It has been made clear by regulators that that should be at the most senior strategic level, and in my view it should be in the context of an absolutely transparent national framework. I also think we must think about mechanisms for accountability both to individual members of the public and the community that a police force serves overall.

Finally, while we are not going to halt the speed of spread of technology, and I think that we can expect more resources to go into such technology in the future, there is a question about how we prioritise resources vis-à-vis effectiveness and public buy-in. The static facial recognition technologies that have been used have excited much less contention and public concern. People can understand that the police hold a database of those with previous convictions and criminal records, and that they will check, where they have got someone whom they are not able to identify, against those records. I understand that that database is in need of new investment, which it is not currently scheduled to receive. I ask the Minister whether that might be the first priority for investment in facial recognition technologies; can the investment that is needed in the police national database be brought forward?

I am glad we have had the opportunity to debate the matter in Parliament today. I would be misleading the House if I suggested that it was causing widespread concern among my constituents, but in fact it should be. How the technology is being used, and the context in which we are made aware of its use, should concern us all. That is not to say it should not be used, but in the absence of a clear legislative or regulatory framework for its use, I do not think it would be right for the House not to ask those questions today.

“proportionate and necessary use of Facial Search within PND”

and that it had been operating in accordance with its own policy, Home Office policy, and College of Policing guidance. However, it identified similar concerns to those that have been raised in the debate, and the need for improved legislation, a statutory code of conduct to govern Police Scotland’s use of biometric data, and better independent oversight.

The main legislation relating to biometrics in Scotland dates from 2010. The hon. Member for Bristol North West mentioned 2012 legislation being out of date already, and I absolutely accept that the 2010 measure is now too old. It predates the time when Police Scotland started to upload photos on to the police national database, in 2011. I understand that the facial search functionality of PND became generally available in March 2014. We do indeed have some catching up to do to make sure that issues to do with images and facial recognition technology are properly covered in legislation.

Following the inspectorate report, the Independent Advisory Group on the Use of Biometric Data in Scotland was established to produce more detailed proposals for plugging some of the gaps and setting up a more ethical and human rights-based framework. I thoroughly recommend the group’s report—it is a fascinating read. It draws on a range of expertise, not just from members of the group, but from the police, human rights and data protection groups, and experts such as the Biometrics Commissioner, the Forensic Science Regulator and the Biometrics and Forensics Ethics Group, which advises the Home Office. The report found that

“those involved in this field in Police Scotland...appear to work to very high standards of international repute, with a good grasp of the ethical and human rights implications of their work”.

It also made several recommendations about enhancing the legislative framework and oversight. Specifically, it recommended a Scottish biometrics commissioner and an ethics advisory group. It recommended a new legislative framework, accompanied by a code of practice, and made more detailed policy recommendations that I will come to shortly. I am pleased that those recommendations have been accepted by the Scottish Government. A public consultation has been held, and a biometric data Bill will soon be introduced to implement them. That is the right approach, and hopefully it will deliver the comprehensive framework that hon. Members have argued for today.

Let me turn to two of the most controversial aspects of the debate. In Scotland, 2010 legislation allows Police Scotland to retain fingerprints and DNA data from convicted individuals indefinitely. Data from individuals prosecuted for certain sexual and violent offences may be retained for three years, regardless of whether there is a conviction, and the chief constable can apply to the sheriff court for a two-year extension. More generally, data from individuals who have been arrested for an offence must be destroyed if they are not convicted or if they are granted an absolute discharge. Usual practice for photographs also follows that regime, which is slightly different from what happens in England and Wales, particularly with regard to the disposal of photographs of those who have not been charged or convicted.

Is that the perfect approach? I do not think we can answer that conclusively; we must be led by the evidence as it develops. It is perfectly legitimate to question whether a blanket policy of the indefinite retention of biometrics after every conviction is reasonable, because, as the advisory group pointed out, there is no abundance of evidence to suggest what degree of retention has proved the most useful. Biometric data is likely be more useful in identifying the perpetrators of some crimes compared with others, but the risk of offending and reoffending involves a range of factors, including many individual aspects. In an ideal world, the length of time we kept biometric data would be decided for each individual case, but that is not a practical approach, so we must consider the evidence gathered and do the best we can.

The use of automated facial recognition systems is hugely problematic, and our general approach must be evidence led. If such technology is to be used, it must be used only where necessary, and it must be done proportionately and on as targeted and limited a basis as possible. There are huge concerns about the impact of such technology on privacy and freedoms such as the freedom of assembly, and there is a danger of bias and discrimination. Studies have shown that such technology can disproportionally misidentify women and black and minority ethnic people, and as a consequence people from those groups are more likely to be wrongly stopped and questioned.

We must by now have sufficient evidence from forces in London and south Wales to show what automated recognition could look like in practice, what it is capable of achieving, and the price to be paid for that achievement. I will not say that I envisage no circumstances where the use of such technology could be justified—for example, it could be used to counter a specific and serious threat or danger—and I am probably somewhere between Roy and Chris in the range of views set out earlier. Nevertheless, I would be reluctant to see such technology rolled out in Scotland before the new regulatory and oversight regime is in force and before issues of bias and discrimination have been addressed. It seems sensible to stop the use of the technology elsewhere until its implications have been fully assessed and debated, sufficient checks are in place, and there is sufficient public support.

I will end with a quote from the advisory group:

“In this context, it is essential that sensitive personal data are collected only for specific, explicit, lawful and legitimate purposes. In seeking to achieve a careful balance between the needs of citizen and state, there is clearly a need for independent oversight, and for the development of a broad framework of consistent ethical and human rights respecting principles against which all biometric use for policing, law enforcement and public protection purposes in Scotland can ultimately be checked”.

The SNP supports an approach that involves a comprehensive legislative framework and a regularly updated code of conduct. We need strong oversight through a commissioner to ensure that the use of biometrics is proportionate, necessary and targeted, and respects human rights, privacy and data protection rules. I congratulate the hon. Member for Bristol North West on securing this debate. I hope there will be many more to come, with more MPs in attendance, as this important subject requires much more discussion.

My hon. Friend the Member for Stretford and Urmston (Kate Green) spoke about her personal experience and the Trafford Centre in her constituency. She made the important point—I have had the same conversation—that the police want and need a transparent, national and consistent framework, because they feel that they have to make things up as they go along. Experiences will differ: South Wales police has demonstrated a completely different attitude from the Met’s in rolling out facial recognition, and it cannot be right for people to experience different technologies in completely different ways and with different attitudes, depending on the police force in the area where they live.