Official Report 708KB pdf
Good morning, and welcome to the fourth meeting in 2025 of the SPCB Supported Bodies Landscape Review Committee. I have received no apologies.
Today, the committee will take evidence from the Scottish Information Commissioner and then from the Scottish Biometrics Commissioner. I welcome to the committee David Hamilton, the Scottish Information Commissioner. We will move straight to questions.
My first question is a general one. I appreciate that you have provided us with a written submission, for which we are very grateful, but what do you consider to be your purpose as the Scottish Information Commissioner, and how does your role differ from the role of, for example, ministers, members of the Scottish Parliament and other bodies?
Good morning. The Scottish Information Commissioner follows an international model of best practice in which an independently appointed office-holder considers appeals regarding freedom of information requests that the public have made to public bodies. That includes everything from general practice surgeries right up to national health service boards, local authorities and the Scottish Government.
An important aspect of the role is its independence, and that independence is enshrined in legislation. My predecessors took, and I take, that aspect of the role very seriously by ensuring that we operate and make our decisions on an independent basis. The role, which was established under the Freedom of Information (Scotland) Act 2002, came into force in 2005. For the past 20 years, the commissioner’s office has been based in St Andrews, where a specialist staff of around 28 investigators and some support functions are based.
During that time, 1.4 million freedom of information requests have been made across the country and the office has issued about 10,000 decisions. The office is well established and well bedded in, and I like to think that our operations are well run. I have very experienced and dedicated staff, to whom I am eternally grateful, because they keep me right. They also have an exceptional corporate memory. This is not the first time that this topic has been examined, so it has been very helpful for me to draw on their past experience.
In your written submission, you say:
“From a functional perspective, I think I stand both alone in the public sector landscape and alone in the Commissioner landscape.”
The rest of the paragraph elaborates on that first sentence, but it captures the point that you are trying to emphasise. Do you want to say more about that?
Sure. In terms of the considerations so far, I say in my written submission that it is a mistake to lump all SPCB supported bodies together as a homogeneous entity. I am appointed by the King but I am funded by the Scottish Parliamentary Corporate Body—that is the crossover that I have with the other bodies. Some of the other SPCB supported bodies have advocacy rights and some have regulatory rights or deal with standards. My role is quite separate in that it is a distinct function. It is also different in that it has statutory powers. I act as a quasi-judicial body, and if people appeal my decisions the matter goes straight to the inner house of the Court of Session.
I have to investigate and regulate. That is one part of the job. The other part of the job is promoting the freedom of information regime. That coverage expands across my fellow office-holders as well as the SPCB. I have had to make a number of decisions in which I have judged the people who are funding me, which is a slightly unusual position. However, there are very clear lines of demarcation that are respected by both parties as to what that means and looks like.
In that context, how do you perceive your current role—and, if you want to comment more widely, that of all SPCB supported bodies—with regard to enhancing public trust and confidence in public life in Scotland?
Freedom of information is probably one of the strongest kernels of accountability and, of course, transparency that we have in a democracy. Take, for example, the current discussions about having a Scottish version of the United States Department of Government Efficiency and about using freedom of information as a way of holding to account authorities and Government. That shows that FOI is an important tool in that respect. Interestingly, I note that DOGE is trying to excuse itself from being subject to FOI legislation. Those examples show you that the Freedom of Information (Scotland) Act 2002 is a powerful piece of legislation that people fear and value.
The role of FOI in that regard is particularly strong and the legislation is particularly important. We see emerging democracies aspiring to replicate it. I am glad to see such countries often coming to Scotland and basing their new models on what we have done, because we are seen as a global leader.
I am interested in following up on something that you said. I completely understand your cautioning us against lumping together all the SPCB supported bodies. One way to look at the landscape is that some have a public trust role and others primarily have an advocacy role. Clearly, the role of the Scottish Information Commissioner, along with the role of the ombudsman, is really important for public trust. Some of the other witnesses that we have heard from talked about the importance for their role of the separation between an investigative role and an adjudication role. It sounds as though you do both investigation and adjudication. Will you outline those aspects and why they are particularly important to your role?
Yes, certainly. If people are not satisfied with the way that an authority has dealt with their request for information, they can appeal to the authority, which will carry out a review. The next stage is that people have the right to ask me to look at that. My staff and I need to consider all the information and apply the law to that case. Sometimes, that requires us to investigate and probe further—similar to what this committee is doing—to understand the issues better. When we get an FOI appeal, we get the information and then apply the law to the matter. That is our role. There is an investigative element whereby we inquire why a decision has been taken, and then we make an adjudication on that.
The independence of my office is hugely important and people very much value it. In the past 15 months for which I have been in post, a lot of attention has been paid to particular topics. I would like to think that people appreciate the fact that I take an independent view, irrespective of whom or what I am looking at. It is important that people have confidence that that is the case and that they have confidence in the quality of my decision making as much as in the quantity. My office is very focused on ensuring that our decisions are defendable and statable.
I absolutely understand the importance of the independence aspect. When we were speaking with the Ethical Standards Commissioner and the Standards Commission for Scotland, they spoke about the importance to them of separating the investigative role from the adjudication role. However, for your role, the two are combined. I am just trying to understand why it is different for them from how it is for you.
It is bit like the difference between the police and the Crown Office and Procurator Fiscal Service. As I understand it—I am certainly no expert on this—the Ethical Standards Commissioner would carry out an investigation then the Standards Commission for Scotland would judge that investigation. I am judging things, but, as part of that process, I often need to carry out investigations to understand and look behind what is going on. Beyond that, I have legally enforceable powers, whether relating to criminal offences or powers of search, that I can execute.
However, that is all framed in the context of trying to make an adjudication and come to a decision. It is not a matter of somebody coming to me and saying, “I want you to investigate this.” They have to present a case and, as part of my judicial investigation, if you like, I might ask different questions, which might take me down other routes. Asking for additional information allows me to make a judgment on the challenge that has been made.
Thank you.
Good morning, Mr Hamilton. The committee is looking not only at the case for creating new commissioners but at the landscape of existing commissioners. I think that you said as much in response to the convener’s questions a moment ago, but your submission says that
“It is a mistake to lump”
commissioners
“together as a homogenous entity”,
because, as you have fairly said, they have very different roles. This morning, we will hear from both you and the Scottish Biometrics Commissioner. In your view, is there any synergy between your work and the work of the Biometrics Commissioner?
There is none at all. I think that the suggestion came up at the Finance and Public Administration Committee, and we were scratching our heads and thinking that we did not see how that would fit.
A lot of people misunderstand my role. It is not to do with data protection; it is purely about the release of information—that is, freedom of information. The United Kingdom Information Commissioner’s Office is taking an interest in biometrics, but I do not know what the interface is between the Scottish Biometrics Commissioner and the ICO. Somebody else—the Equality and Human Rights Commission, I think, which is a UK-based organisation—might be involved, but that is probably more where the synergies sit. The closest thing UK-wide to an organisation such as mine is the Information Commissioner’s Office but, even then, the FOI function of the ICO is a small part of quite an enormous organisation.
Therefore, on your question whether I see any synergies in that respect, I would say not at all. If there had been something like that, I would certainly have highlighted it, but we had a conversation about it and we said, “No, we don’t see it.”
Thank you. That was very helpful. We will put the same question to the Scottish Biometrics Commissioner when he appears before us.
We are interested in the arguments around the creation of new commissioners. I know that you have said in your written submission that that is not something that you want to say much about, but do you have any views that you want to share with the committee on that? As you probably know, a number of proposals to create new commissioners, mainly in the advocacy space, are in train. Indeed, some are already going through the parliamentary process.
I could give you an observational perspective, but it would probably be an observation more from David Hamilton than from the Scottish Information Commissioner—and that is the danger, because you want to hear from the Scottish Information Commissioner.
The fact is that I have little to do, functionally, with the other commissioners. To be honest, I do not actually know what they do, because I do not need to. They do their job and, broadly speaking, I do not know in detail what that is.
Generally speaking, I read the recommendations and the criteria that were set out by the Finance Committee in session 2 of the Parliament, and, as I said in my submission, what was put out there made intrinsic sense. I am not sure that the Parliament has necessarily followed those criteria through the years, but that is what it is.
What I am seeing in my own workload is a growing distrust of, and weariness with, institutions. That has been fuelled by the political climate, perhaps, but also by financial cuts to services. People are angrier and more annoyed, and they are beginning to lose trust in some of the more established institutions. When people do that, they start looking for someone to take matters forward for them, and they start saying, “I need a commissioner for this,” or, “I need a commissioner for that.”
These are big questions and, to be honest, I think that the Parliament has missed a trick in making this committee’s remit so narrow, because the big benefits are going to come across the whole sector. I do not understand how we can look at the funding and structure of, say, the Children and Young People’s Commissioner Scotland without considering it in the context of the third sector, which is hugely supported by public money. When I look at your remit, I think that it is slightly unambitious. A lot of things could be done by looking at the big picture. From what I have seen, Ivan McKee’s work on this has impressed me, because it is really pulling everything together. Frankly, what we have seems to be unaffordable and we need to start looking at it, but we need to look at the whole system, not just a small piece of it.
I know that those comments are not particularly helpful to a committee whose remit has been set by the Parliament, but my observation, looking in from the outside, is that it is a bit of a missed opportunity.
09:45
Thank you for that. What you have said is very much in line with some of the evidence that the Finance and Public Administration Committee heard on the matter. The drive to create commissioners was led, to an extent, by people’s frustration about public services. The committee will consider that.
I have one more question, and it is about the location of the office. I know the town of St Andrews well; it is part of the region that I represent. It is a lovely place but a very expensive location for property—some of the most expensive streets in Scotland are in St Andrews. Is St Andrews really the best place to have a public body like yours? Are there not more cost-effective options, even in Fife? I represent Fife and I am very keen that the organisation stays in Fife, but is St Andrews really the best place for it?
The cost is a fraction of what it would be in other places, such as Edinburgh.
There is more to Scotland than Edinburgh.
There is, indeed.
We rent our accommodation on a long-term lease, so even the process of moving would be expensive and I would ask what the value of it would be. Whenever there is upset with a location, there is a danger of what that would mean for staff and staff retention. In an organisation as small as mine, it is critical not to lose staff, particularly experienced staff. Doing so could have a devastating impact on the regulatory system.
I would advocate strongly for retaining the current premises, and the cost of keeping them is very little. If there were to be new commissioners, I would be keen to explore opportunities to share space, and I have made the offer to the corporate body to do so. If the change were forced upon me, I would look at options to share with other public authorities. For example, Fife Council has a footprint in north-east Fife that we would explore using.
I mentioned to the Standards, Procedures and Public Appointments Committee that, when I came to the Parliament, I walked past the City of Edinburgh Council building and it was empty. I looked in the window and there were all these empty desks. Ironically, when I went past it today, they had put screens up—I do not know whether they had been listening. Public bodies have the capacity to share space; they just need to be slotted in. The mistake is to compartmentalise space for too few organisations instead of saying, “We could do that,” or, “We could do this.”
I am always looking for savings and efficiencies. I have even talked about getting permission to sublet, if I had spare space in my office. In the past year, following Covid, the staff attendance rate in my office has tripled. We are seeing a change of culture, with people coming back to the office, and we are making it a welcoming place where people get value from being together again. That is great: it has really put a vibe in the office. The fact that people are happy to be there and are exchanging views is increasing performance—there is no question about that. The difficulty is that what we call car-park wars have started again—it has been so successful that car parking can be a struggle. We are getting back to having issues like that.
It is a positive picture of occupancy. I am less able to share space than I was last year. Last year, I had a fairly empty office; now we have a fairly busy office and the opportunities to sublet are diminished. However, I would not rule it out, because I appreciate the importance of minimising costs.
If only we had a train station in St Andrews—but that is a debate for another day.
Before I go to colleagues, I want to pick up on a couple of points.
You talked about how you are not necessarily familiar with the work of other commissioners, which is fully understandable, but it is clear from your earlier remarks just how comprehensive your role is. I think that you said that it goes from GPs all the way up to the Scottish Government and across the public sector. Do you want to say a bit more about that? It is different from the work of some other bodies.
You also talked about the big picture and the whole system. Thank you for citing the example of third sector funding in that regard. As we look at what we have been tasked with in respect of SPCB supported bodies, do we need to see that in the context of all the other commissioners and public bodies that provide similar functions but are funded by the Scottish Government, rather than by the Scottish Parliamentary Corporate Body?
That is the nub of my point. The thing that astonished me when I took this post was the sheer number of public authorities, public bodies and public companies that are in existence. About 600 report to us from a freedom of information perspective, but those are just the top ones—we do not ask, for example, every GP surgery for data returns, because it would be unreasonable to do so. There are literally hundreds, if not thousands, of public bodies. I keep finding new ones, because we have to consider them. There are things like the Scottish pubs code adjudicator—who knew about that?—and there is the smart card users group, or something like that. I am sure that all those bodies are doing important jobs, but there is such a hidden and complicated landscape across the public sector, not just the organisations that I am aware of.
Third sector support is another thing. We have organisations that are supported by the Scottish Government, through legislation, to deliver services. That is another whole sector. You need to look at the whole thing in the round and ask whether there is duplication. Given the sheer volume of organisations, there probably is duplication. That is where the possibilities for real efficiencies sit.
We need to understand the landscape; I do not think that there is a map that explains it all. I had a chat about this with the Auditor General for Scotland, in which we were exchanging names and playing a sort of public-authority bingo. We were saying, “Have you heard of this one?” Our offices will shortly be working together to exchange information to try to understand all the organisations that are out there, although we have different views—he has an interest in auditing functions, and I have an interest in the freedom of information functions. It is a very complicated landscape. I think that there is a department for public bodies in the Scottish Government, but I have not yet discovered what or where it is.
We will be speaking to the Scottish Government and the Auditor General in the weeks ahead, so you have maybe provided us with some direction. Thank you.
Obviously, the committee has been convened because of the complicated landscape. I absolutely accept your remarks that the wider picture is relevant. We have discussed that point and it might form part of our recommendations. However, we have a very limited remit and timeframe, and we have resources for a very specific bit of work.
You alluded briefly to, I think, the UK model, in which the freedom of information functions are within wider information commissioner functions. Are there other international models to consider? I understand what you said about the uniqueness of your role, and I totally get the point about the independence that is required. I am thinking in terms of structure and what we could do in a perfect world, if we were starting from somewhere other than where we are. Is there a model that has been shown to work in other countries, or does the role always need to be completely separate from other public bodies, for reasons of trust?
There are countries that have tried to incorporate that function in other organisations: Mexico is the most recent example that I am aware of. However, that has caused problems, first of all because there is a credibility aspect. Who is actually making the decision? Who are you accountable to?
The very strength of my post and my office is that, in essence, we are accountable to the Parliament in financial and governance terms, and accountable to the people, through the courts, for decisions. That is such an important aspect, because as soon as you start getting other governance on top of that, there are questions about what is the right thing to do and who is actually making the decision.
We use—I think we use—the United Nations Development Programme. What we use is delivered by one of the United Nations agencies—: that is a complicated landscape. One of the United Nations agencies operates a rights to information rating system, which ranks countries on their legislative frameworks and structures. Our having an independent commissioner scores significantly in that system. We would see a degradation in our rating if we changed that structure, which would be a great shame, because we have an international standing that I can genuinely say is second to none. I have met all my international colleagues, and they come up to me and speak very fondly of my predecessors and the help that they have provided in building their organisations and democracies. Therefore, changing the structure would damage the legislation and the trust that the public and public authorities have in the system. From an international perspective, it would also do us significant damage with regard to our being seen as a transparent regime.
One of my follow-up questions relates to something that you alluded to earlier. With regard to the title “commissioner”, within the SPCB supported bodies there are commissioners but there are also, for example, ombudsmen, and there are roles outwith the SPCB supported bodies that have the title “commissioner”. Is the title “commissioner” useful for describing your role or all the roles that are covered by that title?
Internationally, that title is recognised. There is the International Conference of Information Commissioners; therefore, the title exists across the world. Perhaps the problem is that, because we have been in existence for so long—20 years—other, particularly advocacy, functions have come along that use the title “commissioner”. Although I can understand why that has been done, I think that it has confused matters. I am sure that you will hear evidence from the Scottish Human Rights Commission, which I think has three or four commissioners. Everyone has a different governance model, so it is a case of trying to pick your way through what the title means. It is not helpful, with regard to people asking questions about the commissioners—that sounds like a band—that there is no grouping, in that sense. It is just the case that I happen to be a commissioner and others happen to be commissioners, but we are not all the same type of commissioner.
In my final question, I will take a slightly different approach. Some other witnesses, to whom the committee spoke about ethical standards and ombudsmen, talked about the fact that, because they interact with the broader public, it is not always clear to a member of the public who has a frustration—whether it relates to their GP, the Parliament or a member of their local council—whom to go to. Those witnesses talked about creating a one-stop shop—a website or portal, for example—where a person could enter their problem, then, behind the scenes, the one-stop shop would direct them to the public trust body that would most likely be able to help them. Could your office participate in something like that? Would that help the public who use your services or would that not be relevant to you?
That would not really help me, because I have particular legal requirements in relation to applications.
Last year, commissioners discussed the potential for such a portal. The idea was that it would be very light touch, in that if a person needed to make a complaint about somebody, it would tell them to which authority or commissioner to speak. That was something that we considered.
10:00To be honest, events have in some ways overtaken us, with this committee. However, when people use their information rights, I am very keen to say, “What now?” That is really important for me. If somebody has identified a problem, what should they do with it next? On my website, I have information on what people should do if they are not happy about a service. If someone is not happy with the police, for example, I give details on the Police Investigations and Review Commissioner. If someone is not happy about how an MSP has conducted themselves, there are details on the Ethical Standards Commissioner.
We do that for all the agencies. It is about more than the seven SPCB supported bodies—it is very broad. If people are not happy with the fire service, whom do they go to? We are trying to be a clearing shop. If people identify health and safety issues, we tell them that they can speak to the Health and Safety Executive. It is not just about the commissioners—it goes much wider. That information is on a living page on our website, so, as more things come through, we add to it. If people need to take something forward, the page shows them where to go.
I have a date in the diary to chat with the Children and Young People’s Commissioner Scotland about how we can take that forward with regard to children’s rights. I am very keen for children to use freedom of information legislation and to be able to have something at the end and be inspired by it. There is no point in asking a question if nothing then happens: there has to be follow-on. Who does that? We are going to explore that and see whether we can do something so that there is follow-on. If an issue comes to us, we would say what decision we have made and suggest that the person might want to speak to a certain advocacy service or commissioner to take forward their issue.
For me, trying to take people through that process is a great use of my website. The legislation requires people who have refused to do so to provide information on appeal rights and where to go for that. Every single appeal that we get has been through a process in which the person has been told that if they want to appeal, they should go to the Scottish Information Commissioner, and has been given my details.
I would get nothing from the approach that you mentioned—I would see no benefit from it. If people are not happy about something, they should not come to me first: they should go to the relevant authority first. To be honest, it would probably cause more problems if I were to get involved in that way.
Thank you.
Good morning, Mr Hamilton. You have already used some of the labels that I am going to ask about, and some of the terminology has been part and parcel of the first half hour of the session.
However, would you define yourself as a regulatory or advocacy commissioner? That is part 1 of my question.
You have covered part 2, particularly in answering Lorna Slater’s questions. To what extent are you simply reactive and to what extent are you proactive in carrying out your statutory duties?
I am a regulator, but I am also an advocate for the legislation, but not for people. There is a distinct difference, there. My duties under the 2002 act are to regulate by making adjudications on appeals, and to promote and progress freedom of information legislation. I have a team whose function it is to promote the legislation, to train and encourage people to use it and to advise on regulatory positions, which is a key part of my duties.
That moves me on to the second part of your question. I am both reactive and proactive. I react to the demand that comes in from my enforcement team, on one side of the organisation, but I have another team that tries to drive demand by encouraging people to use freedom of information legislation. We have seen a massive increase in that. I think that we had 96,000 requests last year, which was a jump of 10,000 in FOI volume. We always have a similar number of appeals coming to us.
I am conflicted, in that I have one team trying to generate more work and another team trying to keep up with that work. The answer is that my role is both reactive and proactive.
That is not an uncommon problem in the public sector.
You mention in your written submission that there are about 500 appeals per annum. To reflect on the figures that you have just given us, how many applications or approaches do you receive and what does that translate into? If there are about 90,000 requests, 500 appeals seems like a massive drop.
It is. The success of the freedom of information system is that 86 per cent of people get a response in time and that most people—I cannot remember the exact figure—get the information that they are looking for. The legislation is, therefore, successful.
The difficulty is that 3 per cent or 13 per cent of cases—I cannot remember the figure—end up going to review so, consistently, about 0.6 per cent of all the freedom of information requests that are made across the country come to us. Of the 96,000 requests, 500 to 600 come to us. Those are always the difficult and challenging ones that require a lot of time. Investigators can be very involved in some of them.
I am sure that some of the figures are in your annual report, so feel free to supply us with a written summation of the answer to the question about how the cascade works.
I am happy to do so.
That would be great.
In your written submission, you say that you have “strong statutory enforcement powers”. Do you have all the powers that you need?
I could do with some more powers. My predecessors and I have fed that back in a number of consultations. My powers are very useful and, by and large, there is compliance. However, there are gaps that need to be addressed. For example, the deliberate deletion of information when there is no appeal is a loophole that needs to be addressed. If further legislation progresses, as it might through a member’s bill, the Parliament might wish to consider that.
That would be a change in the law rather than necessarily a change in your powers. Are there examples of your powers being insufficient? Do you feel as though your having more powers would lead to better outcomes?
Such powers come from the law, so a legislative change would be needed to allow me to exercise more powers.
Let me move on to another area. This question might require quite a short answer, because you have made it clear in your evidence this morning and in your written submission that you see yourself very much as a stand-alone commissioner. To what extent do you collaborate with other public bodies to enhance the overall effectiveness of your role and of their duties and positions?
I will break down my answer into two different areas—functional and corporate. From a functional perspective, we go out and hold training sessions. We have a very good stakeholder network and we attend sector group meetings, give updates and encourage collaboration among stakeholders. Members of my policy team do that work and are very proactive in pulling people together. The learning that we provide through newsletters, briefings and so on gets very good responses. A huge number of public authorities sign up to our webinars. We therefore work with public authorities from a functional perspective.
I am currently going round to see a lot of chief executives to ensure that there are resources for responding to freedom of information requests, so that FOI is not seen as the low-hanging fruit when there are cuts. Given the financial climate, I am beginning to see that approach.
On the corporate side of things, at the back of my mind, I am always thinking about shared services. At the beginning, that was drilled into me by the SPCB: it is very much tattooed on my forehead. Can we find out what is done and do it in a different way? There is quite a lot of good evidence of that in relation to, for example, common payroll functions. We are looking at various projects in relation to how we can do that. I am also looking at, and have offered my staff, Power BI training. We will be looking at—
What is that?
It is, in essence, a data analytics application for the business analytics and information that I use to manage my case load and display them visually to the public. If you go to my website, you can find out what my case load looks like and what my performance is, because you can see public statistics and so on. It is very much about providing visibility and transparency. We have offered that training, and I think that one office-holder will provide some staff for it, too. We try to share things as much as possible. We also have discussions about accountancy services and auditors.
With all such things, the presumption is that we will try to see whether we can share services. We have the benefit of parliamentary frameworks and we use them often. If we can, we also access Government frameworks. Perhaps the best example is that the information technology system that a lot of the commissioners use is the one that the Scottish Government and Scottish Parliament use.
We constantly look to see whether anyone is already doing something. That is the first question that we ask, and the second question is whether there is scope for us to jump on to a framework at some point. Sometimes, frameworks are not suitable, but we ask whether we can share things with somebody else.
Okay—thanks. I have one final area of questioning. I am here as a back-bench Labour MSP, but I am also the convener of the Public Audit Committee, and you mentioned conversations that you have had with the Auditor General for Scotland. Some of the points that you make in your written submission did ring some alarm bells with me. For example, first, you talk about being “financially hamstrung”. Secondly, when it comes to being more accountable, you say:
“it detracts me and my small team away from our core business.”
Thirdly, you speak about
“the disproportionality of the governance model”.
Propriety, accountability and governance are areas that regularly get public bodies into trouble, and they end up coming before the Public Audit Committee.
Indeed. I think, though, that you are reading the Scottish Parliament information centre briefing as opposed to my submission. If you look at that, it is a bit more—
No. I read your submission last night, Mr Hamilton. That was in your submission.
Yes, so the—
Was it not? I am sorry, but can we just clear that up? Did you use the expression “financially hamstrung”?
I absolutely did—yes. I am talking about the context in which that is used.
Did you say,
“it detracts me and my small team away from our core business”?
In the context of—
Are they your words or SPICe’s words?
They were used in the context of additional governance and scrutiny.
Accountability was the issue.
No—the context matters, and I was talking about a desire for additional scrutiny and accountability. I am very happy to do what is required. I said that I value scrutiny and appreciate it in all that I do. However, if there is to be further scrutiny, it will take my small team away from other functions. If it is the Parliament’s pleasure to require that, I will, of course, comply with that. I am simply raising the point that there would be a cost to it, and that would be in the performance of our other functions.
You spoke about “a cost/benefit analysis” and “an opportunity cost”. They are your words, are they not?
Yes—absolutely.
I want to be clear about it. I do not want to get this confused. Do you want to elaborate on
“the disproportionality of the governance model”?
Are those your words?
They are.
Could you elaborate on what you mean by that?
In the context of my submission, I was making the point—this chimes with the conversation that I had with the Auditor General—that the model that we have for audit is the same model that is used by all public authorities, some of which are 100 times bigger than some of the commissioners’ offices. When we look at it, we think that it is a never-ending cycle of constant audit for us, with preparation of reporting and so on. I have, probably, a full-time member of staff just reporting on all the different functions. Both Audit Scotland and, I believe, the National Audit Office have sympathy with that position, because they see that the model is perhaps disproportionate for what are small organisations. It has been minimised as much as it can be through materiality, but it is still required to happen just now.
At the moment, I am going through pre-audit planning, which involves a constant stream of questions. Frankly, we are thinking, “Oh, my goodness. Really?” Nothing has changed since last year, but it all has to be processed, ingested into systems, uploaded and so on. My plea is that we examine that and consider what an appropriate level of accountability would be, taking everything into consideration. It is an important function, but it has to be proportionate. When I look at what we, collectively, are having to do—it is all multiplied by seven—there is an efficiency saving to be made there.
We could have an audit that was part of the parliamentary audit. I would like to explore that, although there are difficulties to do with legislative terminology, because accountability is invested in the legislation. There would need to be a legislative change to allow for that, because the barrier to doing that is our founding legislation, which would need to be changed.
As commissioners, we are all deeply frustrated about that, but it is something that we just have to do.
10:15The issue of being “financially hamstrung” relates to the fact of the carry-over. I think that I said in my paper that my authority relates not to the budget but to the expenditure. If I am given a budget, I cannot just spend it; I can spend only what the authorised expenditure is. Any savings are just lost. If I cannot spend money by the end of the financial year, I will lose it; it does not roll over. I can buy something on 27 March, because I have money, but I cannot buy it on 2 April, because I do not. That is the frustration, and it is something that the auditors themselves have picked up on, saying that it is crazy and results in our not being able to do medium-term financial planning. I agree. Of course, it is not a problem that is unique to us—I have seen it in policing, and I think that it is a problem for the Parliament as well, to a degree, with regard to annual budgets. It is something that it is appropriate to look at, and it would be great if there were something that we could do about that.
You said earlier that your staff complement is around 28. Some 24 hours ago, the Public Audit Committee was taking evidence on the Water Industry Commission for Scotland, which has had two years of section 22 reports because of problems of governance, of value for money, of propriety, of accountability and so on. It has only 21 members of staff, so size is not something that allows you to avoid accountability, audit and scrutiny. It is actually quite important that those rules of transparency and accountability are in place.
It is. I do not know who regulates WICS, oversees its accounts or looks at its annual reports, but—
It is Audit Scotland.
I have a parliamentary oversight group. I go to the Standards, Procedures and Public Appointments Committee and present my annual report, I get questioned on my accounts, and my performance is looked at. One of the strongest elements in the arrangement is the fact that I am getting that scrutiny, and I take a lot of comfort from that, because it focuses my mind on the fact that I need to account for things to that committee. What is concerning is that some of my colleagues say that they are not getting that scrutiny, and it is not for want of trying—I am sure that they will speak for themselves in that regard. I am comfortable with the fact that I get scrutinised by the corporate body twice a year and also by the Standards, Procedures and Public Appointments Committee. We would be happy to give as much additional information as possible, but the point that I was making is that, if I do further reporting and so on, it has a cost to the organisation and takes us away from doing other important work. There is a need to strike a balance.
We will move on now. With respect, Mr Leonard, you might want to pursue some of those issues in your other committee. I thank you both for that exchange.
I, too, want to ask about the mechanisms around the accountability and scrutiny functions. In your written submission, you suggest—as you have done in your exchange with Richard Leonard—that your mechanisms are appropriate and robust. Annual reports feature as a main part of that scrutiny, certainly for the committees in the Parliament, and you suggest that there are ways in which that mechanism could be made more effective. Could you explain that?
One of the comments that I made was that, when I give evidence at the SPPA Committee, the report on which I am giving evidence is for the previous year. I gave evidence to the committee earlier this month on a report that was laid in Parliament in September or October, which was for the year before—that is, for the events that happened up until April last year. However, the reality is that, in the meeting, we end up talking about the here and now. That is great—actually, it is more useful—but I would just flag up the point that events that happened in 2023-24 were not looked at until 2025, so there is a time lag. That does not cause me a problem, but I think that it is slightly curious, because, if there were problems, the committee would not be aware of them until quite a long time after the event.
Different forms of accountability and scrutiny are interacting. We have the corporate body, the SPPA Committee and Audit Scotland. How do you think they are working together? Is there anything that could be done to improve that?
Again, there is a split by function. The corporate body has oversight of the corporate function. It needs to understand what I am doing and why I am doing it. Ultimately, it is my paymaster—if I need additional resource, I tell the SPCB why I need it and it makes a decision based on that. The SPPA Committee has oversight of the overall picture. It looks at how the whole system is working and it scrutinises our functions. Nobody has ever questioned me on the decisions that I have to make—correctly so, because the courts are the appropriate place for doing that.
Your organisation publishes a lot of data sets on performance, including key performance indicators against the functions that are set out in the enabling legislation. Not all the supported bodies are required to do that. Should all the supported bodies publish the same sets of information?
I do not know whether they could, because the outputs are different. It goes back to the debate about what a KPI is for and whether a measure has value. Some things do. In my role, it is entirely appropriate to seek to close cases within four months, on average, because there is an expectation that things will be dealt with. That is an average, because some people’s cases will last for two years as a result of their complexity, whereas some people’s cases will last for a few days. It depends on the circumstances. What does a measure tell you? That is the question.
I fear that KPIs are sometimes seen as an easy way of demonstrating governance. People can look at them and see that boxes have been ticked. However, as we know, KPIs can also drive bad behaviours—that is an unintended consequence, sometimes.
As colleagues do not have any further questions, I will ask one last question. It is quite broad, but it is an important one.
You talked—quite rightly—about the need for organisations to ensure that they have resource for responding to freedom of information requests. I know from my experience how much time is taken up in responding to the important right to freedom of information. However, in recent weeks, there has been some discussion in the public and parliamentary domains about portfolio questions perhaps being overused and, arguably, irresponsibly used. Do you want to say anything about the responsible use of and engagement with freedom of information by parliamentarians, journalists and the general public, and about the impact of requests on your resources and those of other bodies?
If you have nothing to say, that is fine. I appreciate that that is a broad question, but I thought that it was relevant in the wider context of prudence.
People have a right to make an application. It is not for me to judge whether that is appropriate. Over the coming years, you can expect to hear more from me and my office about the need for proactive publication and putting stuff out there. A lot of the arguments for not doing so are based on the claim that to do so would be data dumping, but that is not data dumping, because we have great things called artificial intelligence and search engines that can find that information.
The big thing that I would suggest is that, if we can build a culture of proactively releasing information, a lot of the problems—particularly a lot of the costs—will go. That is why I have taken the approach of publishing my case-load data. If anyone asks about that, we can point them to our website. I publish all the corporate data that I can up front, so that I do not have to deal with any requests regarding that. I am trying to pathfind for public authorities and public bodies and to ask, “Does the data really need to be secret or kept back? Why are you not putting it out there?” Whether that information is read is irrelevant, because there is very little cost involved—I just put it out there.
My aspiration is that my senior management team will be able to look at papers for meetings not as things that are not released and then published, but as live data on a website, so that we can say, “That is our data and what we are making decisions on.” Our papers will then become about the decisions and how we react to that public data. It is not a case of asking, “Can we approve this data for release now?” It should be out there. It is public data, and the public have paid for it, and they want to see what is going on. The important thing is how you respond to that—it is not about hiding it. A culture shift is required. If you put stuff out, it solves problems.
My experience has been quite surprising in that some things that I thought would be issues have not been issues. Some of the contentious issues, such as gender recognition reform, the “hate monster” campaign and some of the parliamentary standards issues that have appeared, have been dealt with very well by the authorities that have dealt with them, because they are geared up for that. Sometimes it is the small things that are not in the spotlight that cause problems. We were not inundated with requests about those contentious things. I expected that we would be, but we were not, because the public authorities were on it, thinking about it and proactively doing things—they proactively published and responded quickly and on time. That is what can be done. If we could expand that approach to everything, the whole system would be in a better place.
Thank you for providing Parliament with your thoughts on those matters.
Is there anything that you want to say that you have not had a chance to emphasise to us?
No, I do not think so. We have covered a lot. As I have said, the main theme for me is that there are opportunities in the broader public services to look at more helpful and productive reforms, rather than just looking at the commissioners. It is a convenient basket, but there is not a lot of space in there that will give a lot of productivity at the end.
Thank you for your time and for all your reflections and answers today. I also thank you for your written submission, and I thank you in advance for the follow-up letter and further correspondence on which you gave an undertaking to Mr Leonard.
You are very welcome.
I suspend the meeting for a few minutes to change witnesses.
10:27 Meeting suspended.
Welcome back. I am pleased to welcome to the committee Dr Brian Plastow, who is the Scottish Biometrics Commissioner, and Ross MacDonald, who is the director of the Scottish Biometrics Commissioner’s office. Thank you for joining us, for your written submission and for your time.
We move directly to questions. As with other witnesses in recent weeks, the first question is from me. I would be grateful if you would set out what you consider to be the purpose of the Scottish Biometrics Commissioner and how that differs from the role of ministers, MSPs and other bodies that exist for the public and common good of Scotland.
Thanks for the question. If I was answering that for a public audience, I would simply say that the purpose of the Scottish Biometrics Commissioner is to exercise independent oversight of how the three policing bodies in Scotland acquire, retain, use and destroy people’s biometric data. By that, I mean primarily fingerprints, DNA, photographs and recordings that are taken from people, either because they have been arrested or because they have been the victim of crime. That is the generic answer.
Our function comes from the Scottish Biometrics Commissioner Act 2020, which was passed by the previous Parliament. The function is to
“support and promote ... lawful, effective and ethical ... use ... of biometric data for criminal justice and police purposes”
in Scotland, with the three important words in that statement being “lawful”, “effective” and “ethical”.
In discharging that specialist oversight role, our function differs from that of members of the Parliament because you are all elected by the public, whereas I am, in essence, elected by you guys. I am an independent office-holder of the Parliament and we are all appointed by a committee of MSPs.
We have a specialist policing function and, in undertaking it, we work closely with other bodies that work in the criminal justice arena. About 99 per cent of our work is proactive, because when you are charged with keeping the law, policy and practice under review, you cannot do that from behind your desk: you have to get out there and ask probing questions. Does that answer your question?
Yes. I appreciate that it was quite a broad question, but your remarks are helpful. As you state in your written submission, you have a specialist independent oversight function. You also mention that, interestingly, you are the newest commissioner.
I am the oldest and, at the same time, the newest. [Laughter.]
Your written submission was really helpful, because you did not talk only about your function and that of the body; you also spoke to the wider challenge that we have been given by the Parliament and more broadly. Will you talk a bit more about what you perceive to be the current role of the SPCB supported bodies in enhancing public trust and confidence in public life in Scotland, both in terms of your responsibilities and, more widely, anything else that you want to emphasise?
Yes, I am happy to do all that. I think that I said in my written submission and in previous evidence to the Finance and Public Administration Committee that the landscape has evolved organically since about 2002. When I was appointed in 2021, I was probably the first commissioner to be created since 2008 or 2009. Were you to design the system today from scratch, you would design it very differently.
I suppose that my starting point is that I do not think that the existing landscape is not fit for purpose. That is unhelpful language to use—I would prefer to say that there is room for significant improvement in the landscape. There are opportunities for better scrutiny, more accountability, more sharing of services and more collaboration. The key to unlocking some of that would be a hub and spokes model. The hub would be a centralised engine room, if that is not the wrong term, that would provide the mission-critical corporate functions including finance, human resources and financial processing. The spokes would be the independent office-holders discharging of their very different mandates—and they are very different.
Although it is arguable that the office-holder roles involve an element or component of public trust, the word “trust” does not feature in most of their enabling legislation. At this time, there is an opportunity to reframe the landscape in a better, more effective and more efficient way, and in a way that would probably provide better and more transparent value to the public. I hope that that answers your question.
It does. It is also helpful context for the questions that colleagues will now put to you.
To follow on from the convener’s first question, I note that the committee is interested in looking for synergies between the work of current commissioners. We heard from the Scottish Information Commissioner before you. Are there any synergies or overlaps between your work and that of the Information Commissioner?
There are no legislative overlaps, in terms of our primary mandate. Of course, what we all share in common is that we are all appointed by the Parliament and are all funded by the SPCB. That necessitates, if not demands, sharing of services, because otherwise you would end up with seven cottage industries. I was appointed mid-pandemic, at a time when it was not legally permitted to physically meet anybody, so it was both desirable and necessary for me to enter a shared services arrangement from the outset. I did not want to rush off and recruit staff; rather, I wanted to think about how the function should be properly structured in order to provide best value for the public purse.
I have only three full-time staff, and Ross MacDonald has joined me for two years on temporary secondment from Police Scotland. That is partly about bringing ready expertise into the organisation to help us over a demanding period, but it is also a developmental position because nowadays, in the world of policing, there are limited opportunities to gain exposure to everything that goes with governance in a small public authority.
I think that we provide proof of concept that the shared services model can work. We are very small, but we have successfully operated for nearly four years now, and our annual reports and accounts have been cleared by Audit Scotland, so the model has withstood external audit and scrutiny.
At Bridgeside house, where we are based, the Scottish Human Rights Commission and the Children and Young People’s Commissioner Scotland are now buying in—if that is not the wrong phrase—to the shared services model. I think that we need more of that: we need more shared services and more collaboration.
As I point out in my written submission, we should not confine partnership working to just the seven bodies. For example, I operate in the criminal justice space. I meet regularly with His Majesty’s chief inspector of constabulary, HM chief inspector of prisons, HM chief inspector of prosecution in Scotland, the Police Investigations and Review Commissioner, and HM chief inspector of the Scottish Fire and Rescue Service. We have what is almost an informal peer-support network, if that is not the wrong way to describe it.
There are also opportunities for further shared services and/or collaboration. For example, because we have a small budget, we do not have our own media function—we use the media person from His Majesty’s Inspectorate of Constabulary in Scotland. We will be laying a report in Parliament next Wednesday—we have done a detailed review of DNA use. I cannot say too much about the report until it is laid in Parliament, but we have done it in partnership with the Scottish Police Authority and the Leverhulme research centre for forensic science.
We are also working with HMICS on another review that will be laid in Parliament in about three or four weeks, on how the police use retrospective image-search technologies with two UK databases: the child-abuse image database and something that is called PND—the police national database—which is a UK intelligence system.
The point of sharing those examples with you is to show that we work proactively in partnership not only with other bodies within the SPCB landscape—primarily the SPSO, with which we have the shared services agreement—but with other partners in the criminal justice space. That is a clumsy way of saying that we are advocates for, and provide visible evidence of, the opportunities that exist for partnership working, for more collaboration and for more shared services.
10:45
Thank you. That was a helpful overview. I would like to get a better understanding of how the shared service model works in practice, from the point of view of lines of accountability and who pays for what. You gave the example of your media output, which is provided from elsewhere. How does that work in practice in relation to your budget? Do you make a financial contribution to that?
Yes. If we need to use a media professional because, for example, we must lay a report before Parliament, we will engage the services of that media professional on an hourly or daily rate. For example, when we lay the DNA report before Parliament next week, that might cost us two days of a media professional’s time.
Would the same principle apply to other functions, such as finance and HR?
No. Originally, when I entered a shared services agreement with Rosemary Agnew back in 2021, the deal that was brokered through the SPCB was that, in exchange for surrendering about £22,000 from my core budget—I think that that was the amount—I would be given an office at Bridgeside house and would be provided with HR services to allow me to recruit four staff, although I chose to recruit only three, and would have all my financial processing, facilities management and mail handling done. It is probably the best deal that I have made in my life, to be honest. Now, I do not have to pay anything. In essence, my budget would be graduated down, and the SPSO’s budget would be graduated up in order to pay for the equivalent of half an extra member of staff.
So, in effect, your budget is top-sliced, and money goes into the central pot.
Exactly.
That is very interesting.
I want to ask you a slightly different question. We are looking at the criteria for creating new supported bodies, which you refer to in your written submission. In that, you stress the importance of objectivity and you say that there should always be a presumption against creating new commissioners. Based on your experience, what criteria should be prioritised when consideration is given to the creation of new SPCB supported bodies?
I think that the existing criteria that the Parliament uses are the correct criteria. However, despite that, we sometimes end up in the position in which we ended up when, for example, the Finance and Public Administration Committee said that, had the Parliament applied the criteria correctly, we would not have moved forward with a patient safety commissioner for Scotland. I do not think that there is anything wrong with the criteria: the criteria are correct. My broader point is that, by its very nature, Parliament operates in a political environment, and sometimes it can be politically expedient to do something or not to do something. That is the challenge for Parliament.
However, we really should not be creating additional public authorities in Scotland unless there is absolutely a need to do so. There will often be another way of achieving the same result. For example, the issues that gave rise to the perception that there was a need for a patient safety commissioner could probably be addressed in other ways. Those are matters for the Parliament.
My substantive answer to your question is that I think that the Parliament has the correct criteria and that it needs to apply them.
We explored some of those issues—particularly as they relate to the patient safety commissioner—with the Scottish Public Services Ombudsman when she appeared before the committee two weeks ago.
I go back to your written submission. You say that you would
“encourage the Parliament to put budgetary control measures in place to ensure that the landscape does not grow exponentially over this parliamentary session and beyond.”
Can you expand on what you mean by that?
With regard to the current landscape, you have seven different bodies that are supported by the corporate body. I bet that, if you went back in time and looked at how many staff each of those organisations had when they were established, you would find that the numbers would bear no resemblance to what they have now. I suppose that the point that I am clumsily trying to make is that, if you are charged with running one of those organisations and you are under a bit of pressure or facing a bit of demand, it is very easy to go cap in hand to the corporate body and ask for more resources. It might or might not give you them, but investing in more staff is a long-term financial obligation. Is it not funny that nobody ever disinvests in anything? You get this kind of unregulated growth.
But, Dr Plastow, you have done very well—you are employing fewer staff than you intended to employ, so you are an exemplar of what can be done.
Well, maybe—or maybe I am a control freak. I do not know. [Laughter.]
On a serious point, I have worked in public services all my life and have always kept a keen eye on the public purse. If there is a better, more effective and more efficient way of doing a thing, it is my job to ensure that that happens.
We have talked a lot about the complicated landscape. Your role and the role of your office is the newest but also probably the most specific and the narrowest of these bodies. Would it be right to say that that is largely as a result of changes to technology and evidence-gathering methods? As we look ahead to the future of the landscape, we can imagine that new technologies, such as AI—goodness knows what else is ahead of us—might require other bits of data protection, better good practice by police and so on. If we are imagining a robust shape for this landscape such that, in the future, other things are required, do you imagine that something like that could be incorporated within your office? Would there be other commissioners? How do we make your function—or the role that you play in the wider landscape—robust in relation to future technological advance?
I will give you a two-part answer. The first thing is to rewind a bit and say that, in every one of my annual reports to the Parliament, I have highlighted opportunities for expansion of the remit and not once have I suggested that that would involve more resource. One of the things that I have said to the Criminal Justice Committee and others is that biometric data is exchanged throughout the entire criminal justice ecosystem in Scotland; it is exchanged between the police, the prisons, the courts and so on. Therefore, it is a kind of artificial construct to restrict my functions to three policing bodies, because when you then have good decisions by the Scottish Government to invest in things such as the digital evidence-sharing capability programme, and biometric data is ingested into that system, some of that system is beyond oversight.
Public space safety camera oversight is the other area that I often highlight. I have said before that I see that as a strategic gap in Scotland, because we do not have a coherent public safety camera strategy that could easily be put in place with a code of practice. I will explain why that becomes important. I recently had a meeting with Liz Smith MSP and Ross Greer MSP on questions about the extent of potential foreign state surveillance in Scotland, but all the product that comes from public space and public safety cameras comes within my statutory function only when it is received by Police Scotland. I do not have a locus in the wider data-rich environment.
What I am clumsily trying to say is that there are opportunities to maximise the value from independent office holders and that those opportunities do not always involve additional cost.
I probably went off on a tangent there—I totally lost the thread.
Not at all. In this landscape review we do not just want to look at overlaps, we want to look at where there are potential gaps.
We all have biometric passports now. We can imagine a future in which payment systems are biometric or library cards have biometrics. We can imagine biometrics becoming a standard identification technique. When we imagine that landscape, we need to make sure that gaps are covered and that the system is robust, so that there is no instinct to create a new commission every time a new thing is developed. So, I appreciate your answer on that.
I have a question to help me to make sure that I have not made a mistake. Many of the other commissioners and SPCB supported bodies that we have spoken to have very public-facing roles. Am I right that your role is entirely, or nearly entirely, not public? The public do not come to you when they have a problem; your role is about supporting the police.
The public do come to us when they have a problem.
One of our functions is to maintain a statutory code of practice. Members will remember that, on 16 November 2022, our statutory code of practice, passed by Parliament, came into effect. It is a principles-based framework, with which Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner must comply. It is accompanied by information-gathering powers, powers to serve information notices and compliance notices on—for example—Police Scotland, and a public complaints mechanism.
In the early years after the code was approved by the Parliament, we did not receive any complaints. However, that was mainly because, when Police Scotland arrested people, the police were not telling them—well, they were not telling them anything, to be honest. In a report in 2023, we made the recommendation that, as happens everywhere else in the United Kingdom, if someone is arrested, you—the police—must tell that person why you are taking their data, what you will use it for, where you will store it and whom you will share it with.
In response to that recommendation—this is not a criticism—it took Police Scotland a year to produce an information leaflet. Now, in 90,000 custody episodes each year in Scotland, members of the public who are arrested and deprived of their liberty and who have their biometrics taken are given an information leaflet that explains it. The leaflet also explains about the code of practice and our function. In the past few weeks, we have received our first two complaints about the code of practice. So, we receive complaints from the public on a small scale.
You asked David Hamilton about this earlier: we are proactive about putting information out. Because of our small size, we use our public-facing website as an information repository. We publish almost everything and we try to use that as a primary public engagement mechanism. We also do what we can in other ways: we engage in various forums and we speak at conferences. It is difficult for a tiny organisation to do a lot with limited resource and budget, but I think that our approach works well.
For those aspects that are public facing—when someone has a complaint or wants to come to you for information or because they have an issue with the police—something that we have talked about with other witnesses is the idea of having a one-stop shop.
If a citizen or resident of Scotland has a problem with a public service—maybe with the police—and they need help but do not know where to start because the landscape is complicated, would it be useful for them to have a one-stop shop or a single portal to access your services?
11:00
That goes back to what I said in my first or second answer about the hub and spokes model. If you go on to the Parliament’s website, you can find the page that has the seven independent office-holders on it—although you have to be good to find it—which includes a link to each of our websites, and they explain what we do. That route is kind of clunky and not very easy or accessible, so I am very attracted not to the proposition of creating a new body—that is the last thing that we should be doing—but to the proposition of some re-engineering to create a centralised shared-service hub and spokes model, even if that involves some of us surrendering resources to create it. That is my personal view; I am not speaking for any of the other office-holders in that regard.
Thank you.
Dr Plastow, you have answered some of my rudimentary questions about the extent to which you are reactive or proactive—you have said that you are 90 per cent proactive.
However, I have a related question. In this debate, people define certain commissions and commissioners as regulatory and define others as advocacy commissioners. Where would you place yourself on that spectrum?
We are a specialist oversight body. Our function in law is to support and promote—those sound like advocacy words—the lawful, effective and ethical use of biometric data. As I said in an earlier answer, we need to know the right questions to ask to satisfy ourselves that those three dimensions are being properly addressed. We perform a specialist oversight function, and we are an arm’s-length body of the Parliament.
Members will remember that, in the previous parliamentary session, the Justice Sub-Committee on Policing had to invest a significant amount of time looking at digital triage devices and Police Scotland’s strategy and policy on facial recognition. Members who have been around for a lot longer than that will remember the Shirley McKie fingerprint scandal and how badly all that ended.
I would not want to pigeonhole us in a particular group, but providing specialist oversight is probably the best description of what we do.
In response to an earlier question, you touched on areas in which you think your remit could usefully be extended. As Lorna Slater described, you are going to come up against, and have to try to proactively pre-empt, an evolving set of challenges, but are there aspects of your powers that could be enhanced to lead to better outcomes from the work that you do?
No, because the Scottish Biometrics Commissioner Act 2020 says that the commissioner may do anything “necessary or expedient” in the discharge of her or his functions. That is quite a wide-ranging power.
In relation to the code of practice, our specific power in the act is the power to gather information, which we have used. We have previously served an information notice on Police Scotland in connection with its ingestion of biometric data in relation to the digital evidence-sharing capability programme. The reason for serving the information notice was to find out whether the sovereignty and security of the data were being properly protected.
We have never yet had to serve a compliance notice in relation to the code of practice. We have conducted two rounds of formal compliance assessments on the code with the three organisations. In the winter that has just passed and in the previous year, we found that they were all compliant with the code. However, Police Scotland’s compliance this year is conditional on its implementing the recommendations that were made jointly with the Scottish Government in a joint review of the laws of retention last autumn. To explain that in layman’s terms, we think that Police Scotland is keeping biometric data too long and that it is not reviewing the retention as it is required to do by law.
I have a final question. You are very blunt in your written submission and take a position that is contrary to Mr Hamilton’s. you say that having individual corporate HQs is a “non-affordable luxury”. That is a clear statement of your view, and you are very strong on the issue of sharing services—that comes through in your evidence this morning and in your written submission.
In your written evidence, you also allude to the fact that you are dealing with data about vulnerable adults, children and young people, and you talk about information rights. To what extent do you collaborate and work with those other commissions? If you are dealing with the treatment of the biometric data of young people below the age of 18 and so on, do you have conversations with the Children and Young People’s Commissioner Scotland on issues that are relevant to that age group or with the Scottish Human Rights Commission on, for example, a human rights approach to some of these questions? What is the extent of your interaction?
That is a great question; thanks for asking it. Under section 33 of the 2020 act, I am required to maintain an advisory group, which includes the Scottish Human Rights Commission and the Children and Young People’s Commissioner Scotland, which are the two that you referenced. Others sit on the group, including the UK Information Commissioner’s Office, a number of academics, the Leverhulme research centre for forensic science and so on. Through that professional advisory group, we engage regularly with the Scottish Human Rights Commission and the Children and Young People’s Commissioner Scotland on specific pieces of work.
In our legislation, one of the requirements is that the commissioner must—it is not discretionary—have regard to the interests of children and vulnerable people. That is why, in the first two assurance reviews that we did, we intentionally chose to look at children and vulnerable people, because it was a legislative imperative. We wanted to work with the Children and Young People’s Commissioner Scotland on the children’s assurance review, and Bruce Adamson, who was the commissioner at the time, indicated that he wanted to do that, but the commission could not resource it, so we defaulted to using the Children and Young People’s Centre for Justice.
Likewise, on vulnerable adults, we tied in with the Convention of Scottish Local Authorities through the vulnerable adults network in Scotland and brought in other practitioners and subject experts in the field. We work very heavily in partnerships with others because it is more effective and efficient to do so, and working collaboratively with others allows a tiny organisation such as mine to punch above its weight.
Thank you. That is useful
I want to turn to accountability and scrutiny mechanisms. We are interested to know whether the scrutiny that you are receiving is robust and whether you feel that it is appropriate. Could you give us your view on how you are scrutinised, and whether you think that there are more effective ways in which that could be done?
I have indicated in my written submission that I do not receive as much scrutiny as I would like. Actually, a better way to phrase it is that I do not receive scrutiny as often as I would like. In April, I will have been in post for four years, and, by April, I will have laid 11 reports in Parliament: three annual reports, an operational report, five assurance reviews—because there is one coming next week and one coming three weeks after that—a strategic plan and a code of practice. However, I have appeared before the Criminal Justice Committee only twice. That is not a criticism of the Criminal Justice Committee, because it is a whole-economy committee and it has massive issues on its plate, but I would expect, as an office-holder, to be called before the relevant committee at least once a year. I think that the right time to do that would be between November and March, after the annual report has been laid, because, obviously, if Audit Scotland picks up on any issues, that is an opportunity for the relevant committee to hold us to account. Further, we are always happy to appear before committees such as this one or the Finance and Public Administration Committee.
We appear before the corporate body in person once a year. Ross MacDonald and I did that just this morning. As with the Criminal Justice Committee, the scrutiny is very robust and intrusive, but it is supportive at the same time. I would like to appear before the corporate body twice a year. Roughly about the first week in August every year, we are asked to make our budget submission for the following year. Our budget is always based on our static staffing model plus, normally, whatever the inflation figure is that we have been asked to use—with the exception that we have Ross, temporarily, for a couple of years. I think that it would be better practice for the corporate body to look office-holders in the eye, particularly when they are making growth bids for staffing and so on, and to absolutely satisfy itself that those resources are absolutely required.
I will summarise what you have said. There should be increased frequency of your appearances in front of the corporate body and, possibly, in front of committees, although we all understand that there are capacity issues in relation to the Criminal Justice Committee, which is why, in the previous parliamentary session, there was the Justice Sub-committee on Policing, which provided extra capacity.
I want to pick up your point about the reports that you produce. Do you feel that you are not receiving any sort of scrutiny on a number of your reports?
What I am probably trying to say in a very clumsy way is that if the office-holders were to be called before the relevant committee once a year, that would be an opportunity to cover the annual report and any other relevant reports that had been laid in Parliament over that period. The Criminal Justice Committee just would not have time to see us every time we published a report, and I would not expect that, but once a year would be good, if that is achievable. That would allow all the business to be swept up in one session.
On that matter, the six key recommendations in your written submission were interesting and helpful. The last one is that
“Scottish Ministers and the Parliament should review the functions of all SPCB supported bodies every 5 years”.
Do you want to say a bit more about that? It is an interesting suggestion.
It is just a personal view, which goes back to a point that I made earlier. As I saw in policing over about four decades, organisations continually invest in new things and take on new duties and responsibilities, but we are very bad at stopping doing things. With regard to the office-holders, the particular set of circumstances that gave rise to the creation of these bodies in 2002 might have changed. Although absolutely appropriate, those bodies might no longer be relevant in 2032 or 2042, because the world will have changed. As a general principle, the fact that you decide to invest in something does not mean that you should stay with that model forever.
That is really helpful, and I appreciate the candid way in which you put that forward.
I want to reflect on the evidence that you gave to the Criminal Justice Committee, which I sit on, and what you said in response to Lorna Slater about the different ways that biometrics are utilised and where and how they might be utilised in the future, in Scotland and internationally. You indicated to the Criminal Justice Committee that there might not be a necessity for your position in the future. For the record, do you want to say that again or to say a bit more about it, for the benefit of our committee?
11:15
Yes, I am very happy to do that. Some of the biometric technologies that we have have been around for a long time. They were not even called biometric technologies. In Scotland, the police have been taking people’s fingerprints and people’s photographs for more than 120 years. DNA use has been around since the late 1980s—you can read all about that next Wednesday.
At the moment, we have a UK fingerprint database, and, under certain conditions, we share fingerprints with the European Union and Interpol. We also have a UK DNA database, and, in certain circumstances, we share DNA with the 27 member states and Interpol. Last year or the year before, the European Union agreed something called Prüm II, which is an extension of that framework. Under that agreement, the European Union will start to share people’s facial images, and, in due course, the UK will be invited to join that.
There is a move by the Home Office and the National Police Chiefs Council to create a single UK custody image database of the kind that exists for DNA and fingerprints. Artificial intelligence will be applied to that new system to facilitate retrospective facial matching and to support live facial recognition for police forces that choose to go down that route.
Therefore, we are on the edge of the next digital revolution in biometrics and policing, when advanced AI-powered technologies will facilitate facial recognition developments. We will come to a watershed moment, probably in the next few years, when we will have to make a decision about what is right for Scotland in that regard. For example, we will have to decide whether, as a country, we support the use of live facial recognition by the police.
Once we get beyond that, I can reasonably foresee a point in the future at which the contentious nature of some of this will come off the political agenda. That was my broader point. In the future, we might end up in a more settled landscape, where the Parliament is content that there is no need for independent oversight of this area, or, alternatively, that it could sit with another organisation that already exists.
Does that answer your question?
It does, and it is helpful in the context of your six key recommendations, especially the sixth one. Thank you very much for elaborating on that.
Before we conclude, is there anything that you have not had the chance to say or to emphasise?
I should have said at the start, “If you have any hard questions, ask Ross.” [Laughter.]
The parting thought that I want to leave you with is that I am not sure that I necessarily agree that the existing landscape is not fit for purpose, but I agree that there is room for significant improvement in the co-ordination of shared services and collaborative working.
That is very helpful. All your evidence today has been helpful, as has your written submission.
I thank both of you for attending, for your contributions and for your time. Next week, the committee will hear from the Scottish Human Rights Commission and the Children and Young People’s Commissioner Scotland.
That concludes the public part of our meeting. As previously agreed, we now move into private session to consider today’s evidence.
11:19 Meeting continued in private until 11:37.Air ais
Attendance