UK needs legislation with specific focus on biometric technologies

Parliament needs to create legislation that explicitly deals with the use of biometric technologies in the UK, according to former biometrics commissioner Paul Wiles.

The former commissioner for the retention and use of use of biometric material told the House of Commons Science and Technology Committee that while there was currently a “general legal framework” governing the use of biometric technologies, their pervasive nature and rapid proliferation meant a more explicit legal framework was needed.

Referencing the use of various biometric technologies by UK police in particular – including live facial recognition (LFR), voice recognition and gait analysis – Wiles said the current framework governing their use had “not kept up with the development of new biometrics” and nor had “the government responded to judgments by both domestic courts and the European Court of Human Rights about the inadequacy of that current framework”, some of which “go back almost nine years”.

Wiles further added that while the Information Commissioner’s Office (ICO) could issue opinions or guidance about the use of biometric technologies, as well as intervene if “general data [protection] requirements” are not met during their deployment, specific legislation is needed to properly establish when the tech can and cannot be used, and what uses are acceptable.

“At the moment, there is a framework that allows the information commissioner to express an opinion, but when it comes to the old biometrics – DNA and fingerprints – it was Parliament that made the decision, through legislation,” said Wiles. “That’s what I’m pointing to, that lack of a legislative framework.”

He argued that creating specific legislation for the use of biometrics would make it clear “what is in the public interest and therefore acceptable, and what is not in the public interest, and therefore not acceptable”.

In terms of police facial recognition, specifically, Wiles highlighted the retention of custody images in the Police National Database (PND) – which a 2012 High Court ruling found to be unlawful on the basis that the six-year retention period was not proportionate – as a major problem.

The PND holds roughly 23 million images taken of people in custody, regardless of whether they were subsequently convicted, and is used as the basis for the “watch lists” police LFR systems operate on to identify people’s faces.

“Public interest in [the use of biometrics] developed rapidly with the use of live facial recognition by South Wales Police and the Metropolitan Police. There was clearly public concern…that there wasn’t already a clear legal framework around the use of facial images”