Science and Technology Committee
Oral evidence: Biometrics Strategy and Forensic Services, HC 800
Tuesday 6 February 2018
Ordered by the House of Commons to be published on 6 February 2018.
Members present: Norman Lamb (Chair); Vicky Ford; Bill Grant; Darren Jones; Stephen Metcalfe; Carol Monaghan; Damien Moore; Neil O’Brien; Graham Stringer; Martin Whitfield.
Questions 1 - 184
Witnesses
I: Dr Gillian Tully, Forensic Science Regulator.
II: Baroness Williams of Trafford, Minister for Countering Extremism, Home Office; and Christophe Prince, Director for Data and Identity, Home Office.
Witness: Dr Gillian Tully.
Q1 Chair: Welcome, Dr Tully. Thank you very much for coming along. Thank you again for briefing us before Christmas; it is appreciated.
I will start the questioning. There are two aspects to our hearing this morning. We will hear from the Minister later, particularly on the non-appearance of the biometrics strategy. We want to talk to you about developments since the Government published the forensics strategy. How do you see the position on the forensics strategy now, some two years after it was published? It was thought at the time that a lot of things were incomplete and unclear. How do you assess things now? Are they better?
Dr Tully: No, I do not think that they are better now. Over the last couple of years, we have seen some of the risks that were raised at the time crystallise. We have seen two smaller companies and, now, one large company offering forensic services to the police in the UK go out of business. The third one went into administration very recently. We do not know yet whether a buyer will be found or whether it will be wound down.
Q2 Chair: Do you have real concerns about the sustainability of the market?
Dr Tully: Absolutely. I think that something different has to happen if we are to ensure continuity of supply and, in particular, enough expertise remains in the field. A number of people have been made redundant once or twice. You cannot keep making people redundant time and again and expect that they will stay and retain their expertise in the CJS.
Q3 Chair: Presumably, getting this sorted out is critical to the administration of justice.
Dr Tully: Yes, it is.
Q4 Chair: To what extent are forensic companies bidding too low for police contracts? Is part of the problem that they cannot sustain the contract once they have won it?
Dr Tully: It seems that the way in which some of the contracts are procured tends to push towards lowest pricing; it is not the case in all the contracts, but it is in some of them. I went to talk to the forensic service providers at their group, the Association of Forensic Science Providers. I asked, “Why are you bidding quite so low on these contracts?” Their response was, “If more than 50% of the evaluation criteria for the contract award are based on price, no matter how good we are in all other areas, we can’t win unless we are low priced.” I do not believe that that is the case for all the contracts we are talking about, but it was certainly the case for some lots. Some of the other contracts had a lower amount on price, but it is a very important part of the tendering process.
It seems at the minute that, although each contract may be acting in what appear to be the best interests of the force or forces involved—it certainly brings about large savings for them—the overall picture is that the constant downward pressure on price has brought things to a point where we have seen the third largest provider go into administration. I do not know the details of all the reasons why it went into administration, but, clearly, the impacts could be very substantial. We think about investment in science, investment in research, investment in training and continuous professional development, and retention of staff. All those issues come to the fore.
Q5 Chair: As I understand it, with the company that went bust last week, there was a big bail-out from the police to keep the service running for a period. Do you think that there is an issue with the quality of police procurement? Are they not weighing tenders effectively enough and putting too much focus on cost saving, rather than the sustainability of the contract?
Dr Tully: If you take an overall picture, you have to come to that conclusion. Some individual contracts have taken into account sustainability and so on, but when you look at the picture across the board I do not think that enough has been done to make sure that there is stability in the marketplace. When the strategy was published a couple of years ago, it talked about national approaches and so on. A programme has been set up within policing—transforming police forensics—but it is only now at the business case stage. There has been uncertainty for another couple of years, and I would say that there is still uncertainty among providers about what that will mean for them.
Q6 Chair: To what extent, if at all, do all the problems link back to the abolition of the Forensic Science Service in 2012?
Dr Tully: In my opinion, a very similar set of circumstances led to that closure and has carried on. In many ways, the closure of the FSS is not the cause of the problems; it was a symptom of similar problems that existed at that point in time.
Q7 Chair: Is there an issue of companies bidding low to beat in-house bids, as it were, when the police have not had to get their own labs accredited in the same way as the private sector providers have?
Dr Tully: By the time it comes to the procurement and bidding process, I do not see that as a factor. Generally, the police will put out for contract only services that they do not want to take in-house. I do not think that it is so much a factor at that point. In fact, I believe that one police insourcing activity was cancelled after the last round of tenders because they realised that there was no way that they could deliver the service themselves as cheaply as the providers had bid.
Q8 Chair: So you tend not to get competition on a particular tender between in-house and outside providers.
Dr Tully: No. What tends to happen is that a decision is made about what they are going to outsource. That will then be tendered for.
Q9 Graham Stringer: May I ask Norman’s question on the abolition of the FSS the other way round? When you were before the Committee previously, you said that the abolition of the FSS would lead to murderers and rapists getting away with crime. Is that still your view? Is there any evidence that that has happened?
Dr Tully: We have talked previously about the precise wording of what I said. There is a risk, particularly at the commissioning stage for forensic science. A crime may not be detected in the first place, and the evidence may not be secured at an early stage. We have seen that a number of potential suspected homicides, in particular, were not even recognised to be homicides in the first instance. Therefore, evidence was not preserved and was not sent for forensic examination. That is nothing to do with the FSS or its closure, but it is a significant issue, if we are looking at how we can make best use of forensic science in the criminal justice system. Recently there was a great deal of public comment about the failure to preserve evidence after the death of Poppi Worthington, for example. There have been other cases of that sort.
The issue in wider commissioning is how well forensic science is commissioned in any case. In some cases, it is commissioned very well and answers the questions to which the criminal justice system needs to know the answers, but I do not think that that is routine. Another example, which was recently brought to my attention by journalists, is that, despite my issuing very clear guidance in 2016 about the need for forensic medical examination of the suspect in and the victim of an alleged offence to be carried out by different doctors, there are still some parts of the country where doctors are being asked to see a victim and a suspect in the same case. That is entirely inappropriate, because of anti-contamination measures, and could lead to a miscarriage of justice.
Q10 Graham Stringer: When we discussed the ending of the FSS, you identified as a problem not just the commissioning but the context of the evidence. Do you now have experience of cases where a lack of contextual analysis in the dialogue between the scientists and the police has led to a less effective outcome than one might have expected with the FSS?
Dr Tully: We have had this discussion before. Some of that problem was still happening when the FSS was around. I think that the problem has got worse, not because of the other providers but because of what they are being asked to do. If they are asked only to look at a little sample in a tube and to say what the DNA profile is, that is where you lose the context, whereas if someone is asked to talk about that evidence in the context of the case—to say where it may have come from and how it may have got there—you get much better value from your forensic science in court. The issue is not that people cannot do it, but that it is not necessarily always being asked for.
Q11 Graham Stringer: That is very clear. The other problem that you identified in your previous appearances before the Committee concerned not the most recent crimes but the archive of evidence from previous crimes—what are now called cold cases, I suppose. What state is the archive in at the moment?
Dr Tully: I do not have a great deal of interaction with the archive. As I understand it, the archive is static. Over time, it will decrease, as the time limit for storing cases expires. Although that was the outcome of the recent review of the archive, and there was a decision that it would not take material from other providers, I believe that when the insolvency of Forensic Telecommunications Services was discovered there was an agreement for the archive to take some of that material in-house, because at that point there were computer hard discs and all sorts that were not secured in an appropriate location. The archive therefore took those in, at least on a temporary basis. What happens when an organisation goes out of business, and where the material goes, is a particular concern.
Q12 Chair: You say that sorting this out is critical. Presumably, the potential consequences of not sorting it out are very serious miscarriages of justice—people being convicted wrongly and, on the other hand, people who have committed very serious offences potentially not being convicted.
Dr Tully: Can I check which—
Q13 Chair: I am talking about the state and fragility of the market, and what happens to everything that companies hold, and so forth, when they go out of business. Not having a proper regime in place runs the risk of serious consequences in the criminal justice system.
Dr Tully: Yes.
Q14 Chair: I have another quick question. With regard to the criminal investigation that is under way, do we have an update on the number of potential criminal cases where there have been outcomes that are now in doubt?
Dr Tully: Are you referring to the toxicology issues?
Chair: Yes.
Dr Tully: No, I do not have a consolidated set of figures on the difference in outcomes. What I can say is that, in a number of cases where the breakdown products of cannabis were present in a blood sample in the original test, those are now below the legal limit. Sitting here, I cannot say whether that is because they were always below the legal limit or because the samples have degraded over time. The breakdown products of cannabis do degrade very quickly over time. There will be criminal justice implications from that, but it is impossible to say whether there was originally a miscarriage of justice.
Q15 Chair: That will inevitably result in those cases having to be reviewed, presumably.
Dr Tully: Yes.
Q16 Vicky Ford: Can you seek scientific evidence on how quickly those products break down?
Dr Tully: Not in such a way as to enable you to back-calculate from there. There are too many factors that influence how quickly the products break down for you to be able to work backwards.
Q17 Chair: Whether it was below the legal limit at the time when it was first analysed or whether it has degraded, presumably, if it is now below the limit, the conviction is not safe.
Dr Tully: If it is a closed case and it goes back to the Criminal Cases Review Commission, the commission will have to consider whether the original conviction was safe. It will take into consideration issues such as degradation, the fact that there were two samples, the second of which could have been analysed, but was not, and what the plea was. It certainly casts doubt.
Q18 Carol Monaghan: Dr Tully, you have set deadlines for forensic providers to be accredited and to meet certain standards. What progress has been made on this? Is there a difference between police and commercial labs?
Dr Tully: Yes. I will divide the market into three to talk about progress against standards. The first group is the large commercial providers. I would say that they are extremely compliant with the standards and have been for many years.
The second is policing. There has been acceptance in principle by policing that it will move towards meeting the standards. However, it is running very substantially behind where it needs to be. On digital forensics, many organisations failed to meet the October deadline. Of about 46 legal entities in policing, only around 17 had any sort of accreditation by the time the deadline passed. For most of those, it was not the full scope that was required. There is a deadline for fingerprint comparison coming up in 2018. That is a very important deadline. While the last prediction from policing was that 20 would meet it, three might miss it and four would miss it, our current assessment, based on progress so far, is that only 13, potentially, will meet the deadline in October this year, four may miss it and 10 almost inevitably will miss it.
Q19 Carol Monaghan: That is for fingerprint comparison.
Dr Tully: Yes.
Q20 Carol Monaghan: You are giving us quite specific numbers. Those that are going to miss the deadline will have to put some actions in place to come up to standards. Do you see that happening?
Dr Tully: Nationally, the NPCC has a forensic portfolio that tries to address these issues. We work together very constructively. It has a performance and standards group, led by ACC Lewis from Dorset police. We will meet later this month to see what we can do together to try to alter that trajectory. However, at this point in time, it is very difficult to alter that trajectory for October this year, because there is only so much time left and there is an awful lot left to do. I think that it is inevitable that some forces will still miss that deadline. If policing can do something radically different, there is a chance that we will be able to avert missing the 2020 deadlines around crime scene, collision investigation and fire investigation.
Q21 Carol Monaghan: May I ask you specifically about the digital forensics deadline? Did the labs that missed the deadline have a good reason for missing it? Have they made any progress in the last three months? If you are now talking about 2020, it sounds as though they have not.
Dr Tully: The 2020 deadline is for a different set of activities. The 2017 deadline has not changed. Under the criminal procedure rules, all organisations that are not compliant now have a duty to disclose that non-compliance in any statements that they make to the court.
Q22 Carol Monaghan: Do you think that that will encourage them to become compliant?
Dr Tully: I very much hope so. It is not that they have not made any progress. I do not underestimate the challenge that this has been, because digital forensics has grown massively. It is the only area of forensic science that is growing, really. It has grown massively over the last few years, and the volumes of data have grown massively. Policing has been trying to keep pace with those developments. At the same time, it has been working from a very low starting position to adopt standards.
The process of what I would call validation, which is making sure that your methods are fit for purpose—that they do what you think they do and what you say they do, and that you know their limitations—has been a very steep learning curve in the digital forensics community. It is not something that the community has engaged in before. As you would anticipate, it is extremely important, because a court needs to know what the limitations of a method are—whether certain types of file may not have been found when a mobile phone was downloaded, and so on.
Q23 Carol Monaghan: Do you think that this non-compliance will change the outcome of court cases?
Dr Tully: I have asked all non-compliant organisations to state whether they are compliant and, if they are not compliant, to provide an annexe that tells the court what mitigation they have in place that will enable the court to decide whether their evidence is sufficiently reliable to be used as expert evidence, in particular. For example, have they have done the validation process? Have they have shown that their methods work? Are their staff demonstrably competent? Have they undertaken competence tests to make sure that they are competent? Do they have appropriate calibrated equipment, and so on? If organisations are well along the way to achieving the standards, they will be able to provide appropriate mitigation. The court can test that appropriately. Organisations that have made very little or no progress do not have that mitigation to provide to the court.
Q24 Chair: Is that leading some to decide to put it out to tender instead?
Dr Tully: The problem is that progress has also been very slow in the commercial sector. I said that all the large providers are very compliant, but a lot of the digital forensics providers are smaller. Four organisations in the commercial sector have accreditation, as required. Many of the other providers are one and two-person providers, working from home and using tools that they may not have validated. That sector of the market is the most non-compliant of all. When I speak at conferences, people ask me, “What are you going to do if we are not compliant? You haven’t got any power to make us stop.” That is the most concerning sector. There is a continuing effort by the NPCC’s digital forensics portfolio to help police forces to get there, but there is very little movement in the very small business sector.
The four commercial providers that are compliant have a very fair complaint that delivery of some of the contracts that have been awarded went past the deadline. Not enough due diligence was done to say whether those providers would be compliant in time for the deadlines, so they missed out on those contracts to cheaper providers that were not investing in the quality standards.
Q25 Carol Monaghan: May I ask you a final question about the cost of compliance? Your annual report says that the cost of getting accreditation can range from about £7,000 to £17,000. To me, that does not seem like an awful lot for a large company, but is it enough to put off some of the smaller providers you are talking about?
Dr Tully: Those figures are just for accreditation to my codes of practice and conduct. Organisations need to be accredited to the international standards for each discipline they work in. There is also a requirement for compliance with my codes of practice and conduct, so the total bill will be higher than those figures.
The difference between the two figures relates to how ready an organisation was to be accredited. The £7,000 was for an organisation that was ready and that had the accreditation body come in, check that it was ready and say, “Yes, good; off you go,” with a few actions. The £17,000 was for one that was so far off being ready that it had to have additional visits and lots of extra work, to fill in all the gaps.
Q26 Carol Monaghan: This would not be an annual fee, would it?
Dr Tully: Accreditation runs on a four-year cycle. The figures are for the first year. The first year is always the most expensive, because that is when accreditation is first granted. Overall, the large commercial providers who have had accreditation for many years reckon that having the amount of accreditation that is required is an overhead of about 15% to 20%. It is substantial, but in my view it is critically important.
I am concerned that for a very small provider, especially a one-person provider, the costs are proportionately higher, but it is very difficult to see how I could fairly set a different standard for those people, because they are still providing evidence to the criminal justice system. The Chartered Society of Forensic Sciences is working with the accreditation body and me to try to work out whether there is a way in which we can help small providers to work together to minimise the costs, but still achieve the same standard. Again, it all takes time.
Bill Grant: Good morning. Your annual report advises that the accreditation visits carried out by UKAS—the accreditation service—found over 700 anomalies. To a layperson, 700 seems a large figure. Was it a batch failure? How would you explain the figure of 700? Do you worry about it? What were the main problems that you found in the audits?
Dr Tully: They were not failures like a batch failure; they were failures to meet the standard in various ways. Some of them were larger, and some of them were smaller.
If we look at the specifics, from 23 visits, there were 733 findings, of which 694 were mandatory and only 39 were just recommendations. They ranged from small to large non-compliances. The main regions were control of data, business continuity and validation of methods, which I have just spoken about.
On control of data, examples included computer back-ups not being stored at a separate and secure location, so that if there was a fire or anything of that nature the information would not be retrievable, and having a shared log-in on a computer where analytical data were stored. It is entirely unacceptable for multiple people to be able to log on under the same user name.
Q27 Bill Grant: Would you describe that as a standard failure?
Dr Tully: It is not something I would expect to find, given that these standards have been published since 2011, but it is something that was found. It is the sort of thing that gives the justification for having that rather expensive accreditation step at the end. If it is not there, people do not comply. If no one comes in to check whether they are compliant, it is quite clear that they do not.
There was a digital forensics unit operating its own network outside the main police force IT area, so the management of its electronic information was not fully documented and did not follow force security procedures. There were business continuity plans with actions open and no owner assigned to them. As we have seen with organisations going out of business, having a proper business continuity plan is absolutely critical.
Q28 Chair: These examples cover both in-house and independent providers.
Dr Tully: Yes; this is across the board. For example, on validation, one of the requirements is that there is a library of all the information you are relying on to show the reliability of your methods.
Q29 Bill Grant: That is part of the audit.
Dr Tully: Yes. There was a validation library reference, but the actual papers were not available for anyone to see at the laboratory. How can a scientist rely on something if they do not have access to it? There are things like back doors of laboratories being accessible by anyone with swipe-card access, whereas there is a detailed swipe-control system on the front that lets only certain people in. Some of them are oversights, but until you have that sort of detailed assessment you do not pick up those oversights and make sure that they are completely covered.
Q30 Bill Grant: So it is about premises security, data security and the ability to recover data in the event of an unplanned incident, such as a fire or flood.
Dr Tully: Those were some of the actions. There were also things like no documented policy to ensure that exhibits or parts of exhibits were preserved for subsequent defence examination; the quality manual referring to all staff having undergone security vetting, but providing no detail as to how that was happening; and people not understanding or knowing about their own organisation’s code of conduct. There was a real range of things.
Q31 Chair: Some are quite serious.
Dr Tully: Yes, absolutely. There were master copy fingermark images that could be altered without any audit trail—all sorts of things that should not be happening.
Q32 Chair: So there is great scope for rogues to do mischief, if they get into one of these organisations.
Dr Tully: Yes. They are loopholes and oversights, rather than deliberate. None the less, it presents the risk that, if someone was acting improperly, they would have more ability to do damage.
Q33 Bill Grant: These are weaknesses that could be identified in the criminal justice system. These failures could have a ripple effect with regard to cases.
Dr Tully: Potentially.
Q34 Bill Grant: May I turn to another issue you will be well aware of? The Randox misconduct seems to have happened despite audits and accreditation. One of your key remits is setting and maintaining standards. What lessons are you drawing from the case when it comes to ensuring compliance with the standards that you are responsible for setting, or improving?
Dr Tully: One of the main lessons is that, back in about 2011, there was a case in the civil courts that went very badly wrong. It involved a company called Trimega, which, as you will know, has been implicated in this malpractice. If there had been some sort of system for flagging up cases that had gone wrong in the civil or family courts, there would have been the potential to catch it earlier. We need to think about what we do around flagging concerns that come from outside the criminal justice system.
Let us think about that situation. Trimega was not operating in the criminal justice setting; it never entered that setting. Randox happened to employ a couple of staff who used to work there, but there was no way of tracking back to see whether those individuals had worked at a company that had been criticised in a court in the civil jurisdiction. Normal vetting procedures for forensic staff do not normally include whether they or the company they worked for previously had been the subject of criticism in a court case. Even if it were put in as a requirement, there is no system for capturing that sort of criticism. For example, in the criminal courts, my office scans all appeal court rulings, because those are generally available to scan. We look for and find anything that was highlighted by the appeal court. However, in the lower courts, often you will not get anything that has gone wrong highlighted.
In the criminal justice system, for people who are compliant with the codes of practice and conduct, there is a very clear requirement to escalate what has gone on. There are very clear escalation requirements, and organisations must report to me when things have gone wrong. In this case, something came from elsewhere. It was not escalated in that jurisdiction. One can think of it then as infecting, almost, the criminal justice system. There was no central record anywhere of that judicial criticism.
Q35 Bill Grant: From memory, in the Randox case, a lot of them emanated from the lower courts. A lot of them were driving offences, as I recall.
Dr Tully: Yes, but there was no judicial criticism in those early cases. The criticism was of something that went badly wrong at Trimega in a family or civil case.
Q36 Bill Grant: Prior to that.
Dr Tully: Yes. That is an issue that we will continue to consider. We have tried before to think about whether there is a way in which we can get all judicial criticism flagged. We have not found a way of doing that yet, but we will continue to consider it.
There is another important point, which is already incorporated into the codes of practice and conduct. The requirement to be accredited to the codes of practice and conduct kicked in in October 2017, so Randox was not accredited to the codes of practice and conduct. One of the requirements in the codes is a separation of responsibilities. The same person should never be responsible for development of a method, testing of the method and dealing with complaints and inquiries as to how that method has been performed. That separation of activities is very important and is now part of the codes.
Q37 Chair: So you always have a challenge.
Dr Tully: Yes. There should always be an independent challenge before a method is brought into routine use, to check that its development and validation have been done properly.
Q38 Bill Grant: Finally, are you confident that enough audit is being done vis-à-vis self-assessment or self-compliance? Are there enough independent checks? Are we too heavily reliant on companies, large or small, indulging in self-assessment or self-compliance to achieve the standards? Do we need more audits, or are we getting it just about right? Are they working to your satisfaction, bearing in mind the standard-setting?
Dr Tully: The independence comes from UKAS—the United Kingdom Accreditation Service—conducting independent audits, but it is in for only a few days a year. The system is predicated on UKAS going in to check whether there is a proper quality system, whether that system is functioning properly, whether all the internal checks and balances are functioning properly, and so on. It cannot go in and check absolutely everything in the few days for which it is there.
One of the things that it will start to do is have a bit more variety in the different ways in which it assesses—a bit more spontaneity, so that people cannot predict how they are going to be audited. It will do more vertical audit, right down to raw data, to try to make sure that that is identified.
The other thing that we are going to try to do is strengthen the whistleblowing procedures, in case there is somebody in an organisation who is concerned about what is going on and has not yet referred it.
There is already a requirement on organisations to refer to me matters that could have an impact on public confidence or cause a miscarriage of justice. While I have always encouraged any individual also to report a problem, there will be situations where individuals do not feel comfortable about doing that in an organisation.
There are two issues. One is that I am not a prescribed person under the relevant legislation. I would like to get that changed. The other thing that I am developing is an anonymous reporting facility—hopefully through my website—that will allow people to report concerns to me anonymously, if they feel uncomfortable about going through their organisation.
Q39 Bill Grant: It is clear that you need more influence or power to manage it better. Are you confident that there is a safe route for somebody who has a concern to raise that? You said that there was a website. Can they have confidence that matters that they raise will be addressed?
Dr Tully: They can have confidence that if they raise something we will certainly review and look at it. It is much easier to look at something if we have the detail. It is much more difficult to look at an anonymous referral, but we will attempt to do so.
One thing that has come to my attention recently is that there are a number of doctors who have not felt that they could speak up about being asked to examine the complainant and the suspect in the same case. It is very concerning if people do not feel that they can speak up. However, we have a complaints and referrals system.
Q40 Chair: Even though the system is not adequate, perhaps, do whistleblowers still contact you?
Dr Tully: This came to me through an investigative journalist who has been looking into these issues. People did not contact me directly. There was one doctor who had raised a similar concern some years ago. On the back of that, I contacted the company and all chief constables, and issued guidance on the issue. From the work that is being undertaken now by some journalists, it seems clear that these issues are still happening, despite my having done those things. That is a concern.
Q41 Chair: Did you say that you need to be prescribed in some way in regulations, under the PIDA legislation?
Dr Tully: Yes.
Q42 Vicky Ford: Do you mean that you might be a nominated person under the legislation?
Dr Tully: That is it—being a nominated person under the whistleblowing legislation. I cannot find the formal name here.
Q43 Vicky Ford: That is the action that you would like us to recommend—that you become a nominated person under the whistleblower legislation.
Dr Tully: Yes.
Q44 Vicky Ford: Do you also think that there needs to be more awareness among doctors in the system that you are there and that they should whistleblow to you?
Dr Tully: Yes. My role impinges only very slightly on the role of any medical professionals, because they are regulated by the General Medical Council and not by me. I have issued guidance on the anti-contamination measures for collection of DNA samples. This year I have done four or five presentations at conferences to which forensic medical examiners go to raise awareness of these issues, but there is always room for raising awareness further.
Q45 Chair: But your nomination as a person to whom people can raise concerns is critical to their protection.
Dr Tully: Yes.
Q46 Damien Moore: In your annual report, you raise the prospect that it will become unsustainable for any forensic services to be managed within some police forces, as they grapple with having to deliver an accredited, high-quality forensics service. How real a prospect is that? How many forces might be in that situation?
Dr Tully: The situation that I am drawing to the attention of chief officers in that part of my report is that I very much understand that chief officers are under a great deal of pressure. They have anti-terrorism, child protection and all sorts of rising crime to deal with. My concern is about whether, amidst all those pressures, the top of an organisation, at chief officer level, can give sufficient attention to achieving quality standards in forensic science. Some forces clearly can, and have achieved the quality standards, but other police forces have not achieved the quality standards and are consistently failing to meet the deadlines. In my view, something different has to happen.
I am meeting the performance and standards lead from the NPCC to see what we can do to support chief officers and to try to raise the profile of the issue. It is particularly important in areas that are outside what was traditionally considered forensics in policing—things like collision investigation, which is a highly analytical set of activities and needs to be very carefully controlled, but has traditionally sat within roads policing. The chief officer lead in roads policing is unlikely to understand a great deal about forensic science and quality standards. We really need to look at whether some police forces do not want to be involved with this sort of thing or those that do it. That may be something the police’s own transforming forensics programme will look at in due course.
Q47 Damien Moore: Do you have any idea how many police forces may be failing? Do you have a rough number, to help us?
Dr Tully: No, I do not. I have given numbers for who has failed to meet the deadlines so far. The issue is whether those forces can get into gear, meet the requirements and demonstrate not only that they can meet them initially, but that they can sustain them. This is not a one-off push to get accreditation, so that we can all breathe again; it is a way of working. It is a culture that has to be developed. If it is just a box-ticking exercise to get a badge, it brings no value. It has to be a cultural change that says, “Quality is really important, and doing things according to these guidelines is really important.”
Q48 Damien Moore: Especially if the checks are not there from outside.
Dr Tully: Yes.
Q49 Damien Moore: Where do you think that the market in forensics will be in two years’ time? As police forces move away from that, do you think that it will be in the private sector?
Dr Tully: I do not know whether police forces will move away from it. I really feel that now is the time for there to be a review of forensic science policy that asks, “What do we want to guarantee for forensic science in this country for the criminal justice system? For whom do we want to guarantee access to the services? For what services do we want to ensure that we have continuity of supply, and how are we going to make that happen?” If it is a mixed economy between the private and the public sector, some sort of strategy needs to be in place to ensure that there is continuity of supply and that there is appropriate payment for what is difficult and complex work.
Q50 Damien Moore: So it will be a mixture of the two, possibly.
Dr Tully: It could be. To me, it seems that we need to take stock now. We have suddenly ended up in a situation that could have jeopardised thousands of cases, had emergency funding not been provided. It could still result in our losing a great deal of the skill that we have available.
We have a very complex situation, in which the vast majority of analytical and interpretive skills sit in the commercial sector and the majority of fingerprint comparison skills sit in policing. Fire investigation is a good example. A lot of it is sitting in the commercial sector and the fire and rescue service. There is a requirement for fire investigation to meet standards by 2020, but currently the fire and rescue services are not paid by the police for delivering fire investigation and have no legal requirement to investigate fires. Some fire and rescue services are saying, “If we have to meet standards, and we cannot afford to do it, we will not do it any more.”
There needs to be a policy that says, “What services do we need? How are we going to ensure that they are sufficiently recompensed to be able to meet the required standards?” We need to make sure that the commissioning processes across whatever sectors the services sit in take account of the national status of sustainability, and not just the impact of one contract at a time.
Q51 Chair: You are being very clear about the need for a review, to set very clear standards and to have a mechanism for maintaining those standards. It sounds to me that you are saying that the forensics strategy from two years ago has not delivered that.
Dr Tully: Yes.
Q52 Chair: Do you agree that the public have a right to know that everyone involved in this meets standards, and maintains those standards? We cannot have police forces, for example, failing to hit deadlines and to meet the standards you require. That is not acceptable, is it?
Dr Tully: That is absolutely true. It is not just about police forces; it is about some of the small companies as well.
Q53 Darren Jones: You kindly wrote to us in January setting out some of the statutory powers that you thought would help you to do your role around setting enforceable standards you can investigate and take enforcement action against, if they are not being met. Will you help the Committee to understand the risks of your not having statutory powers? What do the outcomes look like if you do not have those powers?
Dr Tully: The main outcome is that I do not believe that we can get this small number of resistant companies to where they need to go. The vast majority of policing is on board with reaching the standards, albeit that they are behind—a few are still quite reluctant. In my view, we can reach 80% to 90% compliance with the standards without statutory powers, but I do not think that we will ever get full compliance.
Q54 Darren Jones: Presumably, that will be an ongoing issue, if you cannot investigate and enforce—
Dr Tully: Yes. It makes it very difficult, particularly to investigate. Until companies or organisations properly adopt the standards and the culture that goes with them, they are not looking for and reporting failures. One of the problems we come up against when we set standards in a new area is that everybody says, “There is no problem with this area. What is the problem?” That has been very much so in digital forensics. One of the issues is that until people understand the standards and start looking for the issues, they do not see the problems, because they are not looking for them. We will have an ongoing problem with investigating problems, because we just will not see them.
Q55 Darren Jones: Sure. Why do you not have statutory powers yet? Why do you think you have not been given them?
Dr Tully: That question really needs to be addressed to the Home Office. There have been clear calls from this Committee and from me over a number of years, going back to about 2011. I am very disappointed that it has not reached sufficient priority to make it on to the Government’s legislative programme, albeit that the Home Office is working to draft legislation at the moment and has gone through that with me. If a suitable parliamentary vehicle can be found to get it on to the statute book, it should meet the requirements.
Q56 Darren Jones: That is good news. The Home Office has started to draft it for you.
Dr Tully: Yes, but it is not part of the Government’s legislative programme.
Q57 Darren Jones: So it might not get introduced. Presumably, that means that it needs to be tagged on to some primary legislation, from your perspective. There is no law that exists where you could put this as secondary legislation or statutory instruments.
Dr Tully: No. It is an issue of primary legislation.
Q58 Darren Jones: In your letter in January, you raised some concerns about the Data Protection Bill that is coming to the House, probably after recess. Will you explain those concerns?
Dr Tully: In the Bill that is coming before the House, there are exclusions for a variety of regulators. I am not listed as one of those regulators, so there are no exclusions for me at present.
For example, on subject rights, there is a very significant issue relating to the investigations that I do into complaints and referrals. Those may involve a number of data subjects, who may be complainants, suspects, or members of staff at forensic organisations or policing. There is no way I can make contact with all those data subjects, give them the right to be forgotten and all the other rights that are enshrined in GDPR, and still do an effective investigation. That is an issue.
There is also the issue of lawfulness of processing and which category, if any, my role falls into. We are currently seeking legal advice on that. There are some quite substantial issues with the Bill that is currently before the House.
Q59 Darren Jones: How does that compare with today? Surely you are able to do your role today under current data protection law. Are you noted as somebody who has those exclusions today? Have they just missed it in the drafting of the Bill? I do not understand what is changing.
Dr Tully: There are much greater rights under the new legislation. At the minute, I am registered as a data controller with the Information Commissioner’s Office. Clearly, I attempt to be as compliant as possible with the current regulation. However, there are much broader powers in the new legislation, particularly around the data subject.
Q60 Vicky Ford: You say that other regulators have been given special status in the Bill. What other regulators?
Dr Tully: I do not have that information to hand, but I could let you know.
Q61 Vicky Ford: It would be very helpful, if they are similar.
Dr Tully: It is probably a list of statutory regulators.
Q62 Vicky Ford: So they probably go together.
Dr Tully: Yes.
Chair: We can identify those.
Vicky Ford: That is time critical, because the Bill is going through at the moment. Presumably, if we need to do that, it will be a time-critical issue.
Q63 Darren Jones: We might want to ask the Home Office whether it thinks that, if you are going to be included as an amendment to the Bill, those statutory powers can be brought in at the same time.
Dr Tully: It would be a good question to ask.
Q64 Vicky Ford: We are going to ask the Minister about the delay in or timing of producing a biometrics strategy. What role have you had in the work that is under way to develop that strategy?
Dr Tully: I have not been involved in the development of the biometrics strategy.
Q65 Vicky Ford: Have you asked to be involved?
Dr Tully: No. I was involved in a very, very early draft at one point. Beyond that, I have had some involvement with the biometrics programme, which is ongoing. Although the strategy is—
Q66 Vicky Ford: Hold on a second. You started off with a very firm statement, saying, “I have not been involved.” You have just said, “I was involved in a very, very early draft.”
Dr Tully: I believe that that very early draft was completely abandoned. That is my understanding. I have not seen the current strategy and have not been asked to comment on it. I have input to some elements of the Home Office biometrics programme, which is currently working to develop systems for fingerprints, facial identification and DNA. My team has run various workshops with the Home Office biometrics programme about how that programme might be able to support the fingerprint comparison community in maintaining the standards for fingerprint comparison.
Q67 Vicky Ford: Do you believe that that programme fits into the strategy?
Dr Tully: Because I have not seen the strategy, I cannot comment.
Q68 Chair: Do you think that you should be involved in it?
Dr Tully: I do not anticipate that the biometrics strategy will have much to do with quality standards, and my role is only on quality standards. I think that the strategy will be more concerned with issues of privacy, control of data and so on. That will be more the remit of the Biometrics Commissioner.
Q69 Vicky Ford: What role do you have in the various biometric oversight bodies? We have been told that there are oversight bodies. Do you play a role in those?
Dr Tully: I sit as an external on the forensic information databases strategy board, which covers the DNA database and the governance of the fingerprint database. I am not a core member of the board, because to preserve my independence I need to sit on it as an independent, but I have input into that. I do not sit on the Home Office biometrics programme board, because I am told that that is a delivery-related board, not a strategic board or a board that is concerned with quality.
Q70 Vicky Ford: Do you have a role in trying to influence discussions about how biometrics are collected and retained, or is it mostly about how they are processed in the labs? Are the two intertwined?
Dr Tully: They are interlinked. For example, at the forensic information databases strategy board, we discuss issues such as the circumstances in which individuals’ biometrics are taken when they are questioned without being arrested. Those issues pass by the strategy board. I have an opportunity to input at that point.
Q71 Vicky Ford: I think that that is the last of our questions. I want to check whether there is anything that you want to add. You have expressed a number of serious concerns about different testing organisations. I do not have an overview of that. Are you concerned about a huge majority of the testing organisations, or a small number of them? I cannot get my head around the order of magnitude of this issue.
Dr Tully: I would say that a large majority of the forensic science that is delivered in England and Wales is delivered to a good quality. It is my role to look at where the gaps, risks and issues are. Sometimes my reports can look very negative, because I am concentrating on those issues.
It is interesting when we look at international comparators. There are not other roles like mine in other countries, so you do not get that intense scrutiny of what the police are doing, for example, as well as what the laboratories are doing. Sometimes the perception can be that it is all rather negative. There are a lot of very good forensic scientists doing very good work out there, but a lot of them are frustrated that they do not work in an optimal system that enables them to do the best work that they could do.
Q72 Chair: Presumably, the family and civil courts need to be part of any review and the construction of a new framework.
Dr Tully: They certainly need to be considered.
Q73 Chair: The potential for miscarriages of justice in the family court, for example, could have very serious consequences. I imagine that you would see the importance of ensuring high standards there as well.
Dr Tully: Yes.
Q74 Martin Whitfield: May I invite you to add to your last answer? Would the involvement of the family courts in a review provide a vehicle for you to have the judicial oversight to spot errors that are highlighted in family courts? Would it be a vehicle to put that joined-up thinking in place, from your point of view?
Dr Tully: Potentially, yes.
Q75 Vicky Ford: What you said about there being good practice in the vast majority of cases is important to ensure that good practice, as well as to help you to identify anybody whose practice is not so good and to have the powers to take action against them.
Dr Tully: Yes. For example, fingerprint comparison has gone on in this country and other countries for 100 years without this level of oversight. That absolutely has to change, so that the courts can be given assurance that all the right quality measures are there.
Vicky Ford: I want to make sure that we get from you the specific actions that you would like us to take. If it is that we should look at the Bill and make sure that you have the right powers under the changes to data protection laws, we need to know what the actions are in order to be able to do that. Otherwise, you will come back in two years’ time and say again, “It is not good enough.” We really need to know what specific actions we can take.
Q76 Chair: You wrote to us after the briefing. Does that letter set out fully the steps that you think are necessary, or do you want to consider adding to it? We may well produce something following this hearing, because you have raised some serious issues that need to be put to the Government. We want to make sure that we have captured everything, as Vicky said.
Dr Tully: The letter was really about the statutory powers. I will consider whether there is anything further that I should put in writing to the Committee.
Q77 Chair: A little while ago, you said that a draft Bill had been developed. It sounded to me that you are positive about what it contains.
Dr Tully: Yes. It has been simplified as much as possible in order to ensure that it has a good passage through the House.
Q78 Chair: I appreciate that it is not in the current programme, but have you had any reassurance about when it may get time and what priority the Government think they need to give to this?
Dr Tully: I have been given an outline timetable, but it is not part of the Government’s programme.
Q79 Chair: Can you give us an indication of what that timetable consists of?
Dr Tully: I believe it may be introduced to the House within a couple of months.
Q80 Chair: Ah—so something may be imminent.
Dr Tully: Yes.
Q81 Chair: Thank you very much.
Dr Tully: Thank you.
Witnesses: Baroness Williams of Trafford and Christophe Prince.
Q82 Chair: Welcome, Baroness Williams. It is very good to see you, and hello, Mr Prince. Would you very briefly introduce yourselves?
Baroness Williams of Trafford: I am Susan Williams, Minister of State at the Home Office, and I cover the policy areas of biometrics, identity, data and counter-extremism.
Christophe Prince: I am Christophe Prince. I am the recently appointed director for data and identity in the Home Office.
Q83 Chair: Thank you very much indeed. Back in 2015, the Government told our predecessor Committee that they were developing two “separate but aligned” forensics and biometrics strategies and that they remained committed to publishing both strategies by the end of 2015. Why are we still waiting for the biometrics strategy?
Baroness Williams of Trafford: Although 2015 is a bit before my time, I can only apologise that you do not have the biometrics strategy. Obviously, we produced the forensics strategy. When I took over the policy area, there were several things that I was quite clear about. One was that a Government-wide strategy did not fit the bill of what we wanted to achieve, because different Government Departments use biometrics for different purposes. The Home Office uses them for quite distinct purposes, as does, say, DCMS.
Q84 Chair: You saw that the scope was wider.
Baroness Williams of Trafford: The scope was too wide. I also saw, and it has been clearer more recently, that the pace of biometrics is moving quite rapidly. I wanted to have something that was flexible and fit for the future in this quite fast-changing area.
Q85 Chair: Is not the rapid development, as you have described, the very reason you need to have a clear, legal framework strategy in place, because things are changing on the ground as we speak? The technologies are being deployed in a way that some say is unlawful. Is that not the very reason we need something in place quite urgently?
Baroness Williams of Trafford: You are absolutely right: it is the reason we need something in place quite urgently. It is also the reason we need to get the framework for the strategy absolutely right so that it is not only fit for the future but that it gets those ethical and legal questions fixed within it of why we are doing what we are doing, and how we deploy our policy.
The other point that might please the Committee is that, all that said, I hope to be able to bring the strategy to you in June.
Q86 Chair: In June; right. I appreciate you offering us clarity on that. The original plan was that the forensics strategy and the biometrics strategy would be aligned.
Baroness Williams of Trafford: Yes.
Q87 Chair: It becomes more difficult when they are separated in time, but is that still the intent? Dr Tully made it clear to us that the forensics strategy had not really delivered the clear framework to deliver the high standards across the board that she felt was very necessary.
Baroness Williams of Trafford: Just because they are distinct does not mean that they cannot also be aligned. I have the kind of overarching look across the piece.
Q88 Chair: You are responsible for both strategies, are you?
Baroness Williams of Trafford: Well, forensics would be very clearly in the criminal area, and the policing would be Nick Hurd’s area. Of course, in the immigration sphere, biometrics are incredibly important. You can see why they are both distinct and aligned, because we operate across the piece.
Q89 Chair: You personally do not have any overview of the two strategies together. It is divided between the two Ministers.
Baroness Williams of Trafford: No, it is not divided between us. What I am saying is that, although they are distinct, there is alignment, and there are often times when Nick and I work together on a specific thing.
Q90 Darren Jones: The digital Minister Margot James gave evidence to our Committee in January and talked about the new data ethics and AI unit being set up in DCMS. I appreciate it is in its very early stages. My understanding from that hearing was that this is going to be a cross-departmental function, albeit one hosted in DCMS. On that point of stuff in the Home Office, stuff in Justice and stuff in DCMS, do you have any views on how that ought to work to help you get this right cross-departmentally?
Baroness Williams of Trafford: Yes. In the area of identity, we have already started cross-departmental talks, certainly with DCMS, because some of these things are whole-Government issues, although each Department needs to have a very clear idea of how what they do will impinge on another Department of Government. So, yes, we work together across Government, but we also have our distinct policy areas.
Q91 Chair: Christophe, did you want to add to that?
Christophe Prince: On the question of alignment, one reason for establishing the data and identity directorate was to ensure that we did have alignment. I also have responsibility for the forensics strategy within my directorate so that we can ensure that there is linkage—
Q92 Chair: You are the glue that binds it all together.
Baroness Williams of Trafford: He is.
Christophe Prince: I attempt to be.
Q93 Chair: Your letter to us last November spoke of further work that needs to be done in some areas before you delivered the strategy.
Baroness Williams of Trafford: Yes.
Q94 Chair: Could you give any more clarity on what those areas are? It is great to know that it will now come in June. That is wonderfully precise; I know that Government Departments tend to talk in seasons, which are more flexible than months. Can you give us some guidance about the areas on which you have been working?
Baroness Williams of Trafford: As I have said to you, I wanted to clarify the scope of the strategy, but I also wanted a framework for governance and oversight, which I think is so important in this area. We need the public to trust that what we are doing is clearly legal and that we articulate clearly why we are using biometrics, and for what purpose.
Q95 Chair: Your letter tells us that the custody image review reported its findings in February 2017—a year ago. Are there any other reviews that still need to be finished before you can publish the strategy in June?
Baroness Williams of Trafford: I can report that there are no other planned reviews, and, as I say, I plan to publish the strategy in June of this year.
Chair: Thank you very much. Martin?
Q96 Martin Whitfield: I was going to ask questions about the forensic science strategy, so it may be that these are points for Christophe. In 2016, it referred to a review by police forces about creating a joint forensic and biometrics service. How is that progressing?
Baroness Williams of Trafford: It is progressing fine.
Q97 Martin Whitfield: Good. Can we bore into that a little further?
Christophe Prince: Work on developing the capacity and capability in the police to deal with biometrics and forensics—particularly in forensics—is being taken forward through the transforming forensics programme, which has done some initial work, and the more recent proposals that have been put together by the police are being looked at, at the moment. Exactly how they will then provide improved forensic services themselves and work with the market will depend on the outcomes of that programme.
Q98 Martin Whitfield: Presumably, also, to wait at least until June, when the biometrics strategy is published.
Christophe Prince: Elements of what they do will be influenced by the biometrics strategy, but most of the forensics work—
Q99 Martin Whitfield: It will already be done.
Christophe Prince: The direction will be set by the strategy.
Q100 Martin Whitfield: Is there a timescale that you can share that you are working towards for this—seasonal or otherwise?
Christophe Prince: Not at the moment. The latest proposals from the police for the transforming forensics programme have just been submitted and are being reviewed at the moment. Decisions should be taken shortly, which will then decide on which elements are to be taken forward, but I cannot give specific times on that.
Q101 Martin Whitfield: At the moment, there is a combination of bodies that oversee fingerprints and DNA. Is it anticipated that there is going to be an oversight framework for the other types of biometrics that are envisaged?
Baroness Williams of Trafford: It is fair to say that governance and oversight arrangements have grown over successive Governments and that they are quite complicated at this stage. I want to ensure that they operate clearly and smoothly. At this stage, we are considering the formation of a board that would bring the main commissioners together with the police.
Q102 Martin Whitfield: Progressing that, the forensics regulator obviously covers the criminal justice system, but we heard earlier about problems with disconnect—that the family and civil courts are not part of that. I suppose the first simple question is: do you accept that there is a gap? Secondly, what do you think you can bring or offer to narrow that gap?
Baroness Williams of Trafford: I have just heard the end of your interview with the forensics commissioner. I met her last week, and it is our intention to put the regulator on a statutory basis. I think that will give them robust enforcement powers, but at this stage we will limit it to the criminal justice system.
Q103 Martin Whitfield: You have hinted at the split between the Home Office and the Ministry of Justice. Do you think there is a debate to be had about who should manage the whole of forensics and biometrics, or are you confident that this joint body will be a way of allowing cross-departmental work successfully?
Baroness Williams of Trafford: I am confident that the joint body will work. Whether you are looking at forensics, biometrics or indeed many other areas of Government, you cannot neatly package them into one Department or one Minister very often. So I am confident that this arrangement should work.
Q104 Martin Whitfield: But often it is where they cross jurisdictions that the problems occur, as we have heard today.
Baroness Williams of Trafford: It is; you are right.
Q105 Martin Whitfield: Thank you for your confidence in what is being proposed.
Baroness Williams of Trafford: This time next year, when you call me back—
Chair: Thank you for confirming your availability. Bill?
Q106 Bill Grant: The biometrics commissioner advises us that there are at least 19 million facial images—a significant number—retained on the Police National Database. Do you see that as a good thing for securing or identifying criminal suspects, or is it a potentially excessive intrusion of privacy, and are there enough measures in place to allay those fears? Which one comes up to the top?
Baroness Williams of Trafford: You are absolutely right that there is a line between maintaining privacy and maintaining public protection. Our view is that there are not 19 million facial images; there are actually 21 million people on the PND. Sorry, not 21 million, but 21 million images—not people.
Q107 Chair: You mean that there may be many images that are of the same person.
Baroness Williams of Trafford: Exactly. There also may be images that are tattoos or scars. So, 21 million does not equate to the number of people.
Q108 Bill Grant: It is not individuals. It may be tattoos appertaining to an individual, of which there is a series of pictures.
Baroness Williams of Trafford: Yes.
Q109 Bill Grant: That inflates the figure.
Baroness Williams of Trafford: That inflates the figure.
Q110 Chair: But it does include many people who are innocent, against whom proceedings have not been pursued.
Baroness Williams of Trafford: Perhaps I will get on to that as well in terms of the custody image review, but, of those 21 million images, we estimate that about 12.5 million are searchable; but, of those searchable images, they, again, do not equate to 12.5 million people. They equate to 12.5 million searchable images—that is, images that can be used. That is putting it in context. The number of images is more than you think but it does not equate to the number of people.
The custody image review came in last year, I seem to recall. It gets reviewed; clearly, someone who is innocent can apply to have their image taken away and it will be taken down.
There are decisions around public safety. There are various categories of the types of people of whom images are kept.
Q111 Chair: Could you confirm how many applications there have been in that two-year period to have images removed and what percentages of those have been successful?
Baroness Williams of Trafford: I do not have that information. Christophe, do you have it?
Christophe Prince: We are in the process of gathering that information from police forces in order to understand the number of requests for deletion and the number that have been approved.
Q112 Chair: Will you write to us?
Baroness Williams of Trafford: Yes, we will do.
Chair: It would be appreciated if you gave us as much detail on that as you can.
Q113 Bill Grant: Have you finished with that one?
Baroness Williams of Trafford: If I have answered it to your satisfaction.
Q114 Bill Grant: I am happy with that. You mentioned the custody image review and that the system has been amended. The guidelines, I would imagine, have been approved or amended. Do you think the guidelines are sufficiently clear for all police forces to apply a consistent and uniform interpretation of these rules? Are they robust enough for equity and fairness in application?
Baroness Williams of Trafford: Yes. I think that is a very fair question. I do not have any evidence that it is not working well, but I have asked for further information about how it is being applied to assure both ourselves and, of course, the public that it is working well.
Q115 Bill Grant: There is no evidence to suggest it is not working well.
Baroness Williams of Trafford: There is no negative evidence out there, but we are just seeking that further assurance.
Christophe Prince: In terms of the assessment that is made by the police with respect to removal or otherwise, the national retention assessment criteria template is being put in place. It builds on common tools that the police use to assess whether to retain those images, and that should help drive through some of the consistency in the way in which police make decisions around its use.
Q116 Bill Grant: You are sensing a commonality and a level playing field.
Christophe Prince: Yes. The guidance is intended to drive it, and there is nothing to suggest otherwise.
Q117 Bill Grant: Again, the biometrics commissioner has expressed concerns about the up-and-coming strategy and proposals. He has raised concerns that it may evolve to be a sort of postcode lottery. It is almost like the previous question. Is he justified in his concerns or is he overreacting to it? Is his concern justified?
Baroness Williams of Trafford: I think the rules are very clear that, if someone is not convicted of an offence, they have the right to request that the custody image is removed from all police databases. The rules come with a general presumption that it must be removed unless police consider that there is an exceptional case for retaining it. If they are on the ViSOR system—the violent and sex offender register—or they are a potentially dangerous person, that would be a reason to retain. But the police obviously look at each case on its own merits.
Q118 Graham Stringer: If somebody is on the sex offender register, will there not be a facial image of that person anyway?
Baroness Williams of Trafford: There will be on the ViSO register, but, as I understand it, ViSOR gets uploaded to PND. When you request the removal, you request—I understand—the removal of all images.
Christophe Prince: I do not know if actual images are kept on ViSOR or whether those are kept in a separate position.
Baroness Williams of Trafford: ViSOR might simply be a database.
Christophe Prince: Of biographic details.
Baroness Williams of Trafford: Yes, as opposed to images.
Christophe Prince: I can check that.
Q119 Graham Stringer: Will you write to us and confirm one way or another?
Baroness Williams of Trafford: I understand that the PND is where the images are kept.
Q120 Bill Grant: Reverting to the lottery aspect of it, in the proposals there is a human element of decision making and a certain flexibility in decision making in relation to that. Is there a risk that goes with that discretion? Is there a risk of that discretion being used firmly or lightly, or varying throughout the forces?
Baroness Williams of Trafford: They have to have the approval of a chief officer in order to retain. That might include something like the individual being the subject of an ongoing investigation, but they are the rules around continued retention. I guess, unless it is retained, it should be removed.
Q121 Bill Grant: But there is a risk from the various chief constables throughout the area that there could be a variation in how they approach it.
Baroness Williams of Trafford: I guess there always could be, because you bring in the question of human element, but if there are clear rules around it that lessens that risk.
Q122 Bill Grant: You are confident that they would be followed by the various chief constables with a degree of equity, if they are following the rules.
Baroness Williams of Trafford: Yes, if they are following the rules.
Q123 Darren Jones: I have a supplementary on the databases, and I appreciate you may want to write to us on it. With my other hat on in the European Scrutiny Committee, there have been quite a few documents that have come before us for scrutiny around European databases for collection of facial recognition, fingerprints and other biometrics at various points, either on border control or elsewhere. Do you know whether that information is held on EU or UK databases, and has your Department done any preparations for whatever the outcome of Brexit might be to ensure that UK citizens’ information is protected in that process?
Baroness Williams of Trafford: Will there be EU citizens’ information on the PND? There could well be.
On the second part of your question, we have just done the Home Office elements of the Data Protection Bill—one of the most complex Bills I have ever had to bring through—which aligns the law enforcement directive with UK law. I am confident that there is good alignment, and it may well be the case that there are EU citizens’ images on the PND if there is a necessity to put them there for the reasons I have outlined.
Q124 Darren Jones: Are you happy from the Bill’s perspective that the mechanisms are in place, apart from negotiations with the European Union, and that there should not be any unexpected risks around that?
Baroness Williams of Trafford: Around the LED?
Darren Jones: Yes.
Baroness Williams of Trafford: Because it is a directive, it is a direct transposition into UK law. In terms of it being robust, in meeting EU requirements, because it is a direct transposition, I am confident. Clearly, I cannot see into the future if rules change, but, as we stand, it copies the LED. I would say in this space that the UK has led the way on law enforcement and data protection across the EU, so we are one of the states that lead, but obviously we are a state that is leaving.
Q125 Chair: Your letter to us of 1 February said, “Chief officers have the discretion to retain a custody image where this is necessary for a policing purpose and there is an exceptional reason to do so.” I assume that when you say, “there is an exceptional reason to do so,” that means that we are talking about quite a small minority of cases.
Baroness Williams of Trafford: Yes.
Q126 Chair: Quite apart from the right for a citizen to request a deletion of an image, when someone has been arrested, perhaps interviewed and an image has been taken, but a decision has been taken not to pursue criminal proceedings against them and everything has been dropped, presumably what you are stating in the letter is that at that point the image should be deleted, unless there are exceptional circumstances.
Baroness Williams of Trafford: There is a presumption of deletion, if the criteria are met, but it would not, as you say, necessarily be deleted—for example, if that person was—
Q127 Chair: But the only reason not to delete at that point, irrespective of a request from the citizen, would be when there were exceptional circumstances and exceptional reasons why the image should not be deleted.
Baroness Williams of Trafford: Yes.
Q128 Chair: I am told that images are still routinely kept, and that it would require a citizen to make a request for it to be deleted.
Baroness Williams of Trafford: That is correct.
Q129 Chair: But surely that amounts to an unlawful policy. If we look at the 2012 case law, and the Biometric Commissioner’s annual report, which refers to the unlawful retention regime in place, we can see that the retention of images of innocent people unless and until they apply is an unlawful policy, is it not?
Baroness Williams of Trafford: In an ideal world—
Q130 Chair: Let us just deal with the law. Is this not an unlawful policy, based on what your letter says?
Baroness Williams of Trafford: I think it was deemed not to be unlawful.
Christophe Prince: Yes, the view was, and remains, that the implementation of the custody image review is sufficient to meet the 2012 ruling. It will be only on application that a decision will be taken to retain or remove an image.
Q131 Chair: So, is the Biometrics Commissioner content with all images being retained unless and until someone makes an application?
Christophe Prince: A separate review process is in place for any image on the system. Therefore, it will not be retained indefinitely; it will have to be reviewed after a certain period of time.
Q132 Chair: I am still a bit unclear. You have said that, in accordance with your letter, it would be retained only if there was an exceptional reason—in other words, in the vast majority of cases, they ought routinely to be deleted if the person has no proceedings brought against them. But you are also now saying that images are routinely kept unless and until there is an application to delete.
Christophe Prince: The removal will be undertaken only when there is a request; there is no mechanism at the moment automatically to connect the non-conviction to the custody image and therefore to prompt the police to make that removal. It relies at the moment on a request being made.
Vicky Ford: I do not see that as a contradiction. As I understand it, all images are kept unless the individual says, “Take my image away.” The image is then pretty much automatically taken away, unless it is an exceptional circumstance whereby the person is considered to pose an extra risk. That is how I understand it to have been explained.
Chair: Right—but the letter says something different: that chief officers “have the discretion to retain a custody image where this is necessary for a policing purpose and there is an exceptional reason to do so.”
Vicky Ford: Exactly.
Chair: So irrespective of a request—most people will not even know that they have a right to make a request, and I would be interested to know how often and how that information is disseminated about their right to make a request—it should be retained only if there is an exceptional reason to do so.
Vicky Ford: Correct—and that is what it says in the letter.
Chair: No, it is absolutely not. It is not what it says at all.
Christophe Prince: The image would be retained only if there was an exceptional reason to do so after a request had been made.
Q133 Chair: Okay, so if the vast majority of people have no idea of their right to request, images continue to be retained—and, it seems to me, under the 2012 case law, to be unlawful.
Baroness Williams of Trafford: I think that the ruling said that what we were doing was lawful. What I was trying to say was that within the technology there is no automatic deletion mechanism, but that is something that obviously, in due course—
Q134 Chair: I understand that you have made the point that it would be very costly to go through and clear out those images.
Baroness Williams of Trafford: That is the position at the moment, yes.
Q135 Chair: I understand that, but when someone has been arrested, has had an image taken and a decision has been taken that criminal proceedings should not be brought against them, I do not understand why that image should not be deleted at that point.
Christophe Prince: There is no mechanism for prompting a decision to be taken on retention at that point, but there are review periods in place to ensure that, after a certain period of time, depending on the offence, the custody image’s retention will be reviewed. So, depending on the offence, after 10 years or six years, there will be a review of the image.
Q136 Chair: There should be.
Christophe Prince: Yes, there should be.
Q137 Chair: By the individual police force.
Christophe Prince: Yes.
Baroness Williams of Trafford: Yes.
Q138 Graham Stringer: Is it exactly the same policy that applies to retention of DNA or fingerprints, if somebody is not charged? I understood that the DNA record is destroyed and fingerprints are taken off the record. So, if that can be taken off the record, why can’t the image?
Baroness Williams of Trafford: Because they are two different systems.
Q139 Chair: But that has quite serious implications for people’s rights, does it not? The point has been made to me that South Wales Police have been awarded a £2 million grant for automated facial recognition, and that they have a database that includes many innocent people. In effect, the Home Office appears to have justified significant spending on facial recognition software that utilises innocent people’s images.
Baroness Williams of Trafford: South Wales used the automatic facial recognition technology in quite a defined test.
Q140 Chair: The Six Nations.
Baroness Williams of Trafford: Yes, the Six Nations. They very clearly publicised the purpose of the pilot event and people were very clear about what was happening. They are not looking at every face in the crowd; they are testing the crowd against specific faces that they have for a particular—
Q141 Chair: Many of whom will be innocent people.
Baroness Williams of Trafford: No. The list of faces that they have is of people who are wanted for criminal purposes, so the facial matching of the crowd aims to match the faces—
Q142 Chair: So it does not utilise their database, which includes many innocent people.
Baroness Williams of Trafford: Not in that case, no.
Christophe Prince: In the circumstances where they deploy it, they will have an identified list of individuals where they have a suspicion or belief that they may be targeting that event or are known to be involved in those types of events, and they will use that as the basis against which they will identify facial images. They are obliged to follow the Surveillance Camera Commissioner’s code of conduct when using those arrangements. It will be a specified list, not a generalised view, and checking against not a broad range of facial images but only those they deem relevant to that circumstance.
Baroness Williams of Trafford: The technology is not fully developed yet, hence the quite controlled pilot arrangements that were in place.
Q143 Chair: Is it also right that on Remembrance day the Met Police used a subset of people who had some mental health-related issues, identifying one person and stopping them proceeding down the street?
Baroness Williams of Trafford: I have literally no knowledge of that, but I can certainly look into it and write to you on it. I would not want to give you false information.
Chair: Thank you.
Q144 Bill Grant: On data and image retention I wonder where the strategy goes. You go on a bus or a train, you go into a shopping mall or a small corner shop—how does the law apply to those images? Are they totally separate, as we go about our daily lives? Where does the policy or strategy embrace those? I do not know where they all go.
Baroness Williams of Trafford: Inherent in your question is the sort of thing I have been looking at, which is to ask whether what we are doing is legal, ethical, transparent and robust, and whether it has public confidence.
Q145 Bill Grant: When I stop to think about the imagery that is gathered daily, minute by minute, while we are innocently and quietly going about our business, it feels to me like a monster is out there.
Baroness Williams of Trafford: These things are potential monsters, which is why the Government need to be absolutely clear about why they are collecting and for what purpose.
Q146 Bill Grant: I also value the safety that it brings for the protection of others, and evidence in courts and so on, but the balance is very complex—need I remind you.
Baroness Williams of Trafford: Yes, it is complex.
Q147 Martin Whitfield: The Government are satisfied that the wide database of facial recognition is so valuable and important that it outweighs what seems to me to be a relatively simplistic task of putting a step in to remove the individual’s facial identity that was taken for an arrest where nothing further happened. That relies on two reviews sometime in the future, or that individual knowing and writing to the police to say, “Please remove my identity.”
Baroness Williams of Trafford: In the case of facial images—and that has been deemed lawful.
Q148 Martin Whitfield: The Government are satisfied that the value of the data as a whole outweighs what would seem to me to be a simplistic step of saying, when there is no further action, that the image is removed—or is it just that there is not a system, and it has to rely on the individual to write in?
Q149 Chair: As Graham has said, it is a different approach from that for DNA.
Baroness Williams of Trafford: Yes, it is; that is absolutely right.
Q150 Chair: I have failed yet to understand the rationale beyond different systems, particularly with regard to human rights, for a different approach to be taken to DNA as to facial recognition.
Christophe Prince: They are on different systems. The use of DNA and fingerprints in the criminal justice system is significantly more advanced, which is therefore reflected in how the systems have been set up.
Q151 Chair: But that is no justification for a more lax system to apply to one type of identification than another.
Christophe Prince: There are technical challenges in automating in the same way as we do for DNA and fingerprints.
Q152 Chair: But do you take the point that there is no justification for a different approach in terms of people’s rights?
Baroness Williams of Trafford: They have just grown up in different ways.
Q153 Chair: Yes, but surely we have to get to a point where we apply the same principles across the board to all these technologies, do we not?
Christophe Prince: In terms of the same principles, and to answer the question around other uses of the collection of data, the Data Protection Act, which is being updated at the moment, provides the baseline framework on which issues around necessity and proportionality are applied for the use of any data, including facial images. We will find that there will be differences in particular uses around a particular image—say, DNA and fingerprints, which we have specifically legislated for. For facial images, we are using the Data Protection Act and the Information Commissioner’s code of conduct as well as the Surveillance Camera Commissioner’s code of conduct. With respect to removal and retention, there is the guidance that is put to the police. So, it is a slightly more complex framework at the moment. The different uses will be different, but the principles of necessity must be the same.
Q154 Stephen Metcalfe: Thank you. I want to move on from retention to collection of images. How does an image end up on the PND?
Baroness Williams of Trafford: It ends up on the PND if a person has been convicted—no, has been arrested.
Q155 Stephen Metcalfe: Only if they have been arrested. So, the police collecting images of people in the street is a myth.
Baroness Williams of Trafford: They would not be on the PND.
Christophe Prince: There will be some samples of images that have been collected from investigations that may be placed on the PND for suspects, for example. The PND acts as an intelligence database to enable people to identify individuals as part of investigations.
Q156 Stephen Metcalfe: But would the individual know that they had had their image captured and, potentially, put on to the database?
Christophe Prince: In certain circumstances, no, but that will arise only when there is an active investigation and they have identified someone, and they are looking to ensure that the image is available to other police forces.
Q157 Stephen Metcalfe: Okay, so when images have been collected at things like the Notting Hill carnival, that would be because they are part of an active investigation.
Christophe Prince: I couldn’t say exactly what happened in the Notting Hill carnival circumstance, but they would have been following the Information Commissioner’s and the Surveillance Camera Commissioner’s code of conduct for the retention of any images that may have come out of that, only in specified circumstances.
Q158 Stephen Metcalfe: Do you think that the public are aware of the changes that have taken place in this area of biometrics? Is there a role for greater education? Most people are now aware of the impact of DNA testing and fingerprints, but probably not of the fact that there is a database of images—some where people are aware that their image has been taken and some where they may not be—and that there is technology that is able to scan the images and, potentially, link your image to a crime and turn you into a suspect.
Do you think that public awareness is as great as it should be? Secondly, is there something we should be doing collectively to raise that? Thirdly, will the biometrics strategy tackle some of those issues?
Baroness Williams of Trafford: I think you are absolutely right to raise those questions, Stephen. I have said that we are looking to establish an oversight board to deal with the governance and use of images. Certainly, the strategy will help to deal with it, but there is a wider engagement needed from Government in getting the trust of the public about why we are using images data, whatever it is—and data cover a huge field—to ensure public confidence. There is quite an interesting juxtaposition here; members of the public will give the most incredible amount of data to a faceless internet provider, but they are suspicious of what the Government might be doing when actually what the Government are trying to do is to keep them safe. But we have got to be able to answer those questions.
Chair: I suppose it is because the Government run the criminal justice system.
Baroness Williams of Trafford: Absolutely, of course. But it is amazing how people will make themselves vulnerable in other areas, in giving so much away.
Q159 Stephen Metcalfe: You have said that this is a developing technology that is being used.
Baroness Williams of Trafford: Yes, the automatic facial recognition.
Q160 Stephen Metcalfe: But is the software to scan an image or potentially compare images fairly well-developed technology now?
Baroness Williams of Trafford: It is certainly developing. I would not say that it is perfect technology at all.
Q161 Stephen Metcalfe: The reason I ask is to ascertain whether the facial recognition software is delivering too many false positives.
Baroness Williams of Trafford: The reason it is being piloted rather than being used widely is that the technology is developing.
Q162 Stephen Metcalfe: Okay. And who is developing the technology? Is it a Government collaboration, or is it purely commercial? Is it the same software that is being used on things such as Facebook to identify your friends?
Baroness Williams of Trafford: Pass.
Christophe Prince: Within the national systems and the Department, it is the Home Office biometrics programme, which is developing and replacing some of the existing infrastructure and will also be, for some of that, providing some of the facial matching technology. It goes through a rigorous process of testing the outputs from those algorithms and the technology on which they sit. That is part of that programme. There will be circumstances where other users may have slightly different algorithms or facial recognition technology running on their own systems, but, nationally, that is being done by the Home Office biometrics programme.
Q163 Stephen Metcalfe: The Biometrics and Forensics Ethics Group signalled that the public’s view needed to be sought. As I understand it, 90% of the adult population have their images stored somewhere across Government databases, including on driving licences, passports, and so on. It is about whether those images should be shared with the police. Do you have a view on this yet?
Baroness Williams of Trafford: That goes back to my point that we in Government and the police need to be clear that the reason for giving consent has to be legal, transparent and ethical.
Q164 Chair: Right, but do you have a concern about that? You are absolutely right to define those sorts of principles, but does that lead you to conclude that we probably will end up with those images from driving licences and passports being available to the police on their national computer?
Baroness Williams of Trafford: The reason I am so keen on a framework is that you need to hold on to those principles, and it is very much the Government’s job to do that, or you start to get into the realms of, as I remember from a few years ago, the council looking through people’s bins under counter-terrorism legislation. Clearly, that is miles away from what we are talking about here, and we have to make sure that we stick to those principles.
Q165 Chair: Internationally, the Chinese are using this technology quite a lot, and there seems to be quite a lot of development here. We have to be careful about the direction in which we are going, do we not? There has been a lot of criticism of the Chinese for their use of facial recognition, and we have to be careful that we maintain exactly the principles that you articulate.
Baroness Williams of Trafford: That is where I thank God that we live in a democratic country.
Q166 Stephen Metcalfe: I have one final point on the public’s view. If it is decided that those 90% of images are to be shared and that police should have access to a live database, does that effectively mean that we then have a national identity card?
Baroness Williams of Trafford: No, I think we have moved well away from the national identity card.
Q167 Stephen Metcalfe: Okay, but if the police can check live whether your photo on your database matches you in front of them, that is effectively the same thing, is it not?
Baroness Williams of Trafford: I think the two are quite far away.
Christophe Prince: The police are able to access certain databases to verify identity in certain circumstances, when they have an investigation or a reasonable suspicion. Just because the police may have access in principle does not mean that in an individual circumstance they will be able to, or that it would be necessary and proportionate for them to do so. There are other controls around that.
Q168 Chair: None the less, in effect, if the police had access to 90% of images through passports, driving licences and so forth, surely we end up with the police in effect holding our identity cards rather than us as citizens. We become walking identity cards, don’t we? That is the reality of what could be in store, if the police have access to all those images.
Baroness Williams of Trafford: If you come back to the tenet that the police need to use the biometrics that they have for policing purposes, that situation does not arise—but it needs to be very clear.
Q169 Chair: That comes back to your point about building public support for this.
Baroness Williams of Trafford: Absolutely it does, yes.
Q170 Martin Whitfield: Going back to the relationship between the custody image review and fingerprints and DNA, are there are any significant issues about fingerprints that are holding up the strategy in June, or have all those questions been posed and answered for you?
Baroness Williams of Trafford: I think that the retention rules around DNA and fingerprints are well established, and I do not have any concerns about that.
Q171 Martin Whitfield: Or any intentions to revisit it.
Baroness Williams of Trafford: No.
Q172 Martin Whitfield: Do you have any concern about the variety of databases and locations that the DNA fingerprints are held on, in the mix between the electronic fingerprints and the actual physical fingerprints that are taken? Is that of any concern or worry?
Baroness Williams of Trafford: It has not been expressed to me. Clearly, the electronic world is moving on and technology is moving on, and in 20 years’ time they may all be held electronically, but, for the moment both are—
Q173 Martin Whitfield: The system that we have is working well, and there are no signs of crisis.
Q174 Do you think that the governance of fingerprints, which is not at the same standard as that for DNA, should come up to that standard, or are you satisfied? Given that fingerprints are probably the oldest form of identity that the police use—it is a more historic system, and the DNA one is more modern—are we going to bring fingerprints up to DNA or are we just going to leave the system as it is?
Baroness Williams of Trafford: I think that, with putting the forensics regulator on a statutory footing, questions like that may be something that she or he may look at in future, in terms of standards.
Q175 Martin Whitfield: So once the statutory footing is established, it may be a question.
Baroness Williams of Trafford: Yes, a question for the future, but I do not want to pre-empt what she might want to do.
Q176 Martin Whitfield: Good. Do you have a timescale about when she is going to end up on a statutory footing? I just cheekily add that one in.
Baroness Williams of Trafford: May I just use that terrible phrase “in due course”?
Q177 Chair: She indicated that something might be imminent—in two months’ time.
Baroness Williams of Trafford: Well, due course in my world means in the next three months, yes.
Chair: That is reassuring, thank you.
Q178 Damien Moore: The Biometrics Commissioner’s annual report raises the interesting prospect of new types of biometrics coming to the fore, with voice, iris and gait analysis, and envisages that big data analytics could, in future, allow someone to bring all those different types of biometrics together. Do you see any need for safeguards in that respect?
Baroness Williams of Trafford: I think that the safeguards are the safeguards we have been talking about this morning. There are some very exciting developments—as you say, gait analysis and voice recognition, as well as the AFR technology. Some of them are in very early development, and they all have to have the same rigour applied to them at the point when they become developed. But some of them are in very early development stages.
Q179 Damien Moore: And if they were shared with private sector businesses or algorithm designers, might you address that in your biometrics strategy?
Baroness Williams of Trafford: In terms of sharing with the private sector? It is quite important that we work with the private sector to understand what might be possible, but also possible within the realms of legality. Through the Criminal Finances Bill, we talked about the Government and private sector, particularly banks, working together to uncover serious and organised crime through a collaboration between public and private.
Q180 Chair: The Biometrics Commissioner made an interesting point in the report, saying: “The use by the police of other biometrics may well be in the public interest and may improve public safety but the points made above in respect of facial images equally apply. Indeed, the lack of clarity about future governance arrangements for new biometrics may actually impede such growth.” In other words, if you do not have the sort of reassurance in place and a clear legal framework that everybody signs up to, you do not, because you do not have public confidence, gain the advances and are not able to exploit this technology, in the right sense of the word, as you may be able to with that framework in place. Does that make sense to you?
Baroness Williams of Trafford: Certainly, it goes to a lot of what we have been talking about this morning, and it certainly goes to my ambition to set up an oversight board. The possibilities are really exciting, but I also think that there should always be safeguards in place to ensure that any privacy or ethical issues are very robustly considered.
Q181 Darren Jones: Dr Tully said in the previous session that she had concerns about the pricing models when working with private companies—for forensic labs, for example. One has gone bust already, and she said that there might be concerns with others, when they have competed based on pricing that is probably insufficient, at least for the most complicated requirement. Do you share that view in the traditional forensics space? If you do, would you take that forward to these new areas of biometrics with private-public partnerships?
Baroness Williams of Trafford: There are many forensic services providers, and this is the first one that has gone bust. Obviously, there was the Randox situation last year, but that was an entirely different matter. There are plenty of forensics providers that are perfectly viable, but it is important that the police in their procurement take into account what market viability looks like.
Q182 Darren Jones: So it is a question for the local police force, not for Government.
Baroness Williams of Trafford: The police are the ones who procure the services.
Q183 Chair: Thank you very much indeed. We really appreciate your time.
Baroness Williams of Trafford: I will write to you on the points where you wanted further clarification.
Q184 Chair: One of the points that you are going to write about is the number of applications and denials, when an innocent person thinks that their image may have been restored. I have one final question on that. We would assume that, because it is only in exceptional circumstances, when an application is made, only a small proportion get turned down, when it is an innocent person.
Baroness Williams of Trafford: I would assume that, but I cannot give you that affirmation.
Chair: But that would be your assumption, based on the exceptional circumstances test that you apply.