Independent report on changes to the functions of the Biometrics and Surveillance Camera Commisoner arising from the Data Protections and Digital Innovation (No.2) Bill 2023.  By Professor Pete Fussey and Professor William Webster.

Press Release from the Biometrucs and Surevillance Camera Commisioner:

A new report points to a ‘worrying vacuum’ in government plans to safeguard the public in relation to biometrics and surveillance.

The authors of the independent study warn that plans to abolish and not replace existing safeguards in this crucial area will leave the UK without proper oversight just when advances in artificial intelligence (AI) and other technologies mean they are needed more than ever.

The report by the Centre for Research into Information Surveillance and Privacy (CRISP) analyses the likely effect of abolishing the roles of the Biometrics and Surveillance Camera Commissioner (BSCC) and the requirement for the government to publish a surveillance camera code of practice.

At the moment the BSCC is responsible for overseeing police use of DNA and fingerprints in England and Wales (and in Scotland and Northern Ireland for national security purposes), and for encouraging the proper use of public space surveillance cameras. But both roles will be revoked if, as expected, the government’s Data Protection and Digital Information Bill becomes law in Spring 2024.

The 67-page report, commissioned by the BSCC after discussions with the Home Office, recognises that the government has made arrangements for the transfer and continuation of the BSCC’s quasi-judicial functions in relation to deciding police applications to retain DNA profiles and fingerprints of people arrested but not convicted of serious crimes, and of reviewing National Security Determinations (NSDs) which allow police to keep biometrics on national security grounds.

However, the report also identifies significant areas where the government has made no specific plans to retain other BSCC oversight functions, including:

• reviewing police handling of DNA samples, DNA profiles and fingerprints
• maintaining an up-to-date surveillance camera code of practice with standards and guidance for practitioners and encouraging compliance with that code
• setting out technical and governance matters for most public body surveillance systems including how to approach evolving technology including AI-driven systems such as facial recognition technology
• providing guidance on technical and procurement matters to ensure that future surveillance systems are of the right standard and purchased from reliable suppliers
• providing reports to the Home Secretary and Parliament about public surveillance and biometrics matters

The loss of the surveillance camera code is identified as a particularly retrograde step with research for the report showing that the code is widely valued and respected among security and surveillance practitioners.

Among the industry experts consulted, Alex Carmichael, from the Security Systems and Alarms Inspection Board, said:

"Without the Surveillance Camera Commissioner you will go back to the old days when it was like the ‘wild west’, which means you can do anything with surveillance cameras so long as you don’t annoy the Information Commissioner…so, there will not be anyone looking at new emerging technologies, looking at their technical requirements or impacts, no one thinking about ethical implications for emerging technologies like face-recognition, it will be a free-for-all."

The current Biometrics and Surveillance Camera Commissioner is Professor Fraser Sampson who is due to complete his time in post on 31 October.  He said:

"After receiving this report, I am more concerned than ever that, unless the government acts soon, there will be a worrying vacuum in our arrangements for overseeing and regulating these crucial areas of public life just when society needs those safeguards more than ever.

The lack of attention being paid to these important matters at such a crucial time is shocking, and destruction of the surveillance camera code that we’ve all been using successfully for over a decade is tantamount to vandalism.

There is no question that AI-driven biometric surveillance can be intrusive, and that the line between what is private and public surveillance is becoming increasingly blurred. The technology is among us already and the speed of change is dizzying with powerful capabilities evolving and combining in novel and challenging ways.

What I think of the decision to abolish the roles and the office of the Biometrics and Surveillance Camera Commissioner is neither here nor there. All that really matters is that we don’t simply junk the protection those roles have provided and instead find a way to retain the functions that this report clearly shows are still needed.

If we want to properly protect the privacy and rights of our citizens as well as realise the potential benefits of these types of technology now and in the future, what we need is for government to get a sensible grip on it in terms of oversight and regulation. Unfortunately, the opposite is happening and we are loosening the limited controls that we do have.

It is clearly in the public interest that the government uses the little time it has left to make sure it plugs the alarming gaps that will be left by the destruction of BSCC functions and office.

The planned loss of the surveillance camera code is a good example of what will be lost if nothing is done.  It is the only legal instrument we have in this country that specifically governs public space surveillance. It is widely respected by the police, local authorities and the surveillance industry in general. It’s in one of those things that would have to be invented it didn’t already exist, so it seems absolutely senseless to destroy it now, junking the years of hard work it took to get it established.

As the report points out, the Court of Appeal said in its most important judgment on facial recognition, the code could be developed to guide the police on questions of facial recognition deployment and inclusion on facial recognition watchlists, and to promote consistency in local police policies on facial recognition.

Instead, the code is set to perish along with the role of Surveillance Camera Commissioner and there are no plans to replace it."

Some senior police officers and academics were also concerned with the dangers of treating public space surveillance solely as a data protection issue. 

Assistant Chief Constable Jenny Gilmer of South Wales Police, who is National Police Chiefs’ Council (NPCC) lead on CCTV, told the authors:

"The ICO are concerned with the output from this industry. You know, when you look at the civil liberties side of it, regardless of the fact that we’re producing video footage of people walking down the street, it’s actually the whole process of being able to create that information in the first place… It’s the issue that we’ve actually got people sat there physically watching these other people walking around going about their business. And that’s what we really have to control very securely because, obviously, within policing, we have to have directed surveillance authorities and other authorities with regards to being able to look at somebody. But the control over the operators and local authority systems etc., and the CCTV consultants that needed to be really well controlled."

Professor Lorna Woods, Professor of Internet Law at Essex University, said:

"Often surveillance technologies can operate in such a way that they may not raise significant or serious data protection concerns … data protection is about how data processing happens … It doesn’t really look into the acceptability of the purposes … whereas surveillance is recognising that the state has power. And that in using that power on all citizens there is a risk that that power can get abused. When you’re talking surveillance, you have to justify why you’re doing it in a way you don’t when you’re talking about data protection."

The report’s authors, respected surveillance experts Professor Pete Fussey and Professor William Webster, also provide a detailed analysis of government claims that non-judicial functions of the BSCC are duplicated elsewhere and therefore do not need to be specifically replaced when the BSCC is gone.

They conclude that “none of these arguments bear robust scrutiny” and note particularly that the claim that the Information Commissioner’s Office (ICO) will unproblematically take on many BSCC functions mistakes surveillance as a purely data protection matter and thereby “limits recognition of potential surveillance-related harms.”

The authors also take particular issue with the timing of the planned changes saying that:

• The current moment is a time of accelerated innovation in the scale and capability of surveillance technology. This is particularly heralded by advancements in biometric surveillance. Concerns have simultaneously arisen over surveillance technologies (and AI in general) to the extent that they have now become mainstream issues. These issues are not going to go away.
• Additional to this, are heightened challenges for policing agencies and other public bodies to regain public trust and confidence. Considering these issues together raises questions over the added impact of removing oversight at this specific time. Debates around surveillance are often, and unnecessarily, polarised and divisive. Rolling back oversight at this time is highly likely to split the debate further, making it more challenging for surveillance users to gain trust, legitimacy and support within the communities they aspire to serve.

The full report is available here.