 I call on the cabinet secretary to speak to and move the motion in his name. Minister, I am delighted to open stage 1 on the principles of the Scottish Biology Commissioner's Bill. I thank Margaret Mitchell, the convener on the Justice Committee for the scrutiny of the bill and on the stage 1 report in it. I also thank the Finance Committee and the Delegated Powers and Law Reform Commission for the consideration of the bill. I commend the Justice Committee for taking evidence from a very wide range of stakeholders and individuals. I am grateful to those stakeholders for their considered views that they offered at the committee. I very much welcome the committee's view that the establishment of an independent Scottish biometrics commissioner is both timely and necessary and its recommendation to the general principles of the bill be agreed to. The committee made a number of detailed recommendations and comments in its report and called on the Government to consider and to respond to them. The Government is still reflecting on some of those points, but I hope that the interim response that I provided to the committee earlier this week provides a useful indication of the Scottish Government's position. I will issue my final response next week. This afternoon's debate, I want to focus on the principles of the bill, what we want to achieve through it, although, of course, I will try to address some of the more significant points that the committee raised. By introducing the Scottish biometrics commissioner's bill, the Scottish Government is recognising the need for transparency and accountability in how biometric data is used in the context of policing and criminal justice, and how important those are to building and maintaining public trust. We live in times of rapid technological change where the development of new biometric techniques continued to evolve. Scientific innovation and policing has the capacity to make us safer, but it also raises pertinent questions about ethics, lawfulness and privacy. Therefore, we should recognise that public confidence requires that fundamental rights and the rule of law are both respected and, importantly, seem to be respected. With that in mind, the bill creates an independent commissioner to ensure that the approach to biometric data is effective, is lawful and is ethical, and to ensure that an appropriate balance is struck between keeping communities safe, respecting the rights of the individual and improving the accountability of the police. I cannot stress enough how important it is that we equip our police officers with the necessary technology to ensure that they can keep us safe. However, let me equally stress how important it is that the public have absolute confidence in those technological advances and how their data will be collected or retained. That bill, the commissioner and the code of practice will help to provide those reassurances. The new commissioner's general function is to support and promote the adoption of lawful, ethical and effective practices in relation to collection, use, retention and disposal of biometric data in the context of policing and criminal justice. That function is to be carried out by keeping under review relevant law, policy and practice by promoting public awareness, promoting and monitoring the impact of a code of practice. I will turn first to the scope of the oversight arrangements that are contained in the bill. That is currently applied to Police Scotland and the Scottish Police Authority, but I intend to broaden the scope by bringing forward amendments at stage 2 to also include the part of the police investigations and review commissioner. That is to recognise that it manages biometric data in the course of its investigations. The justice committee will also be pleased to hear that I am actively considering the inclusion of cross-border devolved policing bodies such as the British Transport Police, the Ministry of Defence Police and the National Crime Agency. I want to speak now about the commissioner's public awareness raising function. Given the explosion in biometric data and technologies in recent years, it is all the more important that we have an independent commissioner who will lead a national conversation about rights, responsibilities and standards. The justice committee has asked how that conversation can be progressed. That is a golden opportunity for the new biometrics commissioner to link up with other commissioners such as the information commissioner and the Scottish Human Rights Commission to perhaps take forward a national campaign. I now want to turn to the code of practice and the associated functions and powers of the commissioner. The justice committee has raised a number of questions and recommendations on those topics. I will address some of them now. I welcome the committee's support and principle for the requirement to have a code that the commissioner will prepare and promote. I envisage that the code will set out the standards and responsibilities of Police Scotland and the SPA with the aims of ensuring good practice, driving continuous improvement and enhancing accountability. The code will be subject to consultation and to the approval of both the Scottish ministers and, crucially, the Parliament. However, let me clear up a misunderstanding here. The code is already being put on a statutory footing. The bill includes a number of statutory provisions about the code. For example, it requires the commissioner to prepare and review a code. It requires there to be a consultation on the content of the code and it requires specified policing bodies to have regard to the code. The bill therefore already delivers on the committee's recommendation that the bill should establish a statutory basis for the existence and application of the code. It is the content of the code that is not specified in the bill. That is to allow for flexibility and future proofing and to ensure that the commissioner may act in a way that is impartial and allows them to use their judgment. The committee's recommendation on using the independent advisory group's code as an interim code is well-intentioned. However, I feel that the specification of the code by anyone other than the new commissioner would undermine the key principles of impartiality and statutory consultation. I believe that the better solution here is to let the commissioner undertake the process of preparing the code in the way in which the bill currently specifies, which includes consultation, so that we have a code that is fully formed and up-to-date and, as I say, which has been informed by the view of relevant parties. Liam McArthur I am grateful to the cabinet secretary for giving way and explaining his rationale around the code of conduct. Will you not accept that the IAG, in drafting the code of conduct, were seeking views and expertise from the stakeholders that he insists would need to be consulted on such a code? Excuse me, cabinet secretary. I have to sneeze at the microphone. Sorry about that. I do accept that. There is nothing stopping the new commissioner having regard to the IAG's code of practice, consulting with IAG members and so on and so forth. If I just would not want to pin the commissioner into that corner, I think that the new commissioner should have the flexibility. It is important, because if the commissioner is going to be genuinely independent and therefore, for him or her to have that independence, he should be allowed to develop the code in a way that he sees fit. He is right to mention the fact that the IAG, of course, consulted with a number of the relevant parties. I will now turn to the commissioner's powers. To enable the commissioner to effectively perform his or her functions, he will have the power to require police bodies to provide information. A failure to provide information to the commissioner can be referred to the court of session for enforcement. The information gathered by the commissioner will allow the commissioner to prepare and publish reports that will be laid before Parliament, containing recommendations directed to the police bodies listed in the bill. Those bodies can be required to respond publicly to a recommendation and, if they fail to do so, the commissioner could publicise such a failure. The ability to draw Parliament's and, indeed, the public's attention to the activities of police bodies should not be, and I am certain, is not underestimated. The Justice Committee is content with— John Finnie? Thank you, Presiding Officer. I am grateful to the cabinet secretary for taking intervention on that point. I plan to mention this in my speech, or what you could do instead is just have it a requirement to adhere to, and there would be no need for any of this. We know that judicial review, for instance, is not a simple process. Surely, with any piece of legislation, there can be discretion-afforded decision making within it, but just have it compulsory. Before you respond, I know that I am on my hobby horse, but what word did you use there? You should not have used it. Yes, we are not going to use the term you, are we? Thank you. Cabinet secretary. That is a punishable offence by Mr Finnie, I am certain. In terms of his substantial point, I was just about to come to why I think that approach would be the wrong one. I will continue, as I said, in a meeting with the member. I will continue to keep an open mind, but why I am not persuaded yet, I want to come to that point. I thought that the evidence from the commissioner in England and Wales was quite compelling when the commissioner came in front of the Justice Committee, the biometrics commissioner of England and Wales told the Justice Committee, and I will quote directly, that the police are sensitive about carrying the public with them. That means that, when we visit, they are always extremely open with us, we always have open discussions and they are always amenable to our suggestions about their compliance. The basic reason is that they want to continue to hold public trust. The commissioner then went on to talk about what a different dynamic would be if there was a requirement to have a duty to have. The commissioner thought that that change in dynamic would be extremely unhelpful. I am also of that view, and I think that all of us understand that the police are under a great deal of scrutiny, as they rightly should be, something that I completely agree with and I know that the police agree with. They have scrutiny from HMICS, the Sub-Committee on Policing, the Justice Committee from this Parliament more broadly and widely. They have accountability to the SPA, the PIRC of course, Audit Scotland and so on and so forth. Therefore, I think that they are very aware of that public scrutiny and attention. The importance that they put on taking the public with them is an important dynamic that I would not want to see necessarily change. However, I will listen to what the member has to say and what the Justice Committee has to say in that regard. However, it is important to be firm that there are consequences if a recommendation by the commissioner is ignored. A number of consequences might occur. The situation can be reported to Parliament, which not only then makes it public, but it incurs reputational damage. However, the body in question might also be called to account to this Parliament, in fact, to the Sub-Committee convened by the member. Also, the commissioner may decide that lack of co-operation has highlighted the need for a full review or indeed the need for legislative change. If that was a recommendation that a commissioner made, we would be open to that suggestion. Therefore, the lack of regard to the code or to a recommendation from the commissioner may well have far-reaching consequences. I hope that the Justice Committee will feel reassured by that, but I suspect that there will be a continual matter of debate as we progress through stage 3 of the bill. As the committee recognises, the role of biometrics is fast becoming an essential element of the way in which Scotland is policed and crime is investigated and prosecuted. As the commissioner for the retention of biometric material observed, many countries are looking at what Scotland is doing through the bill. I want to put Scotland at the forefront of driving forward transparency, accountability and improvement in relation to biometric data for policing and criminal justice purposes. That is why the architecture of the bill allows flexibility, why the definition of biometric data is broadly drawn and why the commissioner's powers and functions are focused on rights and responsibilities. The bill creates a biometric commissioner from modern times who will operate in a fast-changing world but always with a focus on our rights, our safety and our expectation of transparency in policing and the criminal justice system. I look forward to working with members of all parties to secure those objectives as we continue to take the bill through Parliament. I move that the Parliament agrees to the general principles of the Scottish Biometrics Commissioner's Bill. I now call Margaret Mitchell to open on behalf of the Justice Committee. I am pleased to speak as the convener of the Justice Committee on the Scottish Biometrics Commissioner's Bill. I start by expressing my thanks to the Justice Committee members and clerks for their hard work and to all the witnesses who provided evidence as part of our scrutiny of the bill. The last 25 years have seen a digital revolution with technology now central to the way we live. That impacts on how the police investigate crime. The bill establishes a Scottish Biometrics Commissioner and a statutory code of practice to provide oversight for the collection, use, retention and disposal of biometric data in the context of policing and criminal justice. The committee welcomes the bill but, as ever, the devil is in the detail. The oversight system that the bill creates sets the blueprint for Scotland's response to the growing influence of biometrics. The committee agreed that the bill must set out clearly the principles that should underpin the oversight. The promotion and protection of human rights, privacy, public confidence and community safety are crucial. It is disappointing that the Government's response to our report does not support the specific inclusion of those principles in the bill. The committee believes that the bill must provide the commissioner with the necessary powers to hold the police service to account for its use of biometrics and to ensure compliance with the code of practice. That is absolutely vital to ensure public confidence and trust in the use of biometrics by the police and by the criminal justice system. The committee agrees that the Scottish biometrics commissioner should be independent of the Government and appointed by the SPCB, should be able to scrutinise biometric processes adopted by all those who provide policing within Scotland and those who share biometric data with the Police Scotland, including the British Transport Police and the National Crime Agency. At present, other public sector and private sector bodies are collecting and sharing biometric data without regulation. There is a lack of transparency here that requires to be addressed urgently. The bill only proposes that the commissioner has oversight of Police Scotland and the SPA at a time when public concern over the use of biometrics is growing. Witnesses suggested a wide-ranging debate on the issue to be led by the new commissioner. The committee arges the Government to fully meet its policy and intention of providing confidence to the public by extending the debate to apply to all those who collect biometric data in Scotland. I welcome the cabinet secretary's recognition of the need and calling him to support the commissioner in leading the debate. Members unanimously support the code of practice to be established by the commissioner and that the code is considered and improved by the Parliament. Given the far-reaching human rights, ethical and privacy issues relating to the use of biometrics for criminal justice and policing purposes, the lack of powers for the commissioner to ensure compliance with the code raises concerns. While the name and shame is a key approach taken to oversight of the 43 police forces in England and Wales, there is only one police force in Scotland. The committee considers that this approach is not a viable option open to the new commissioner under the code of practice. The committee considers that the commissioner must have the powers to enforce any compliance that may be needed. Equally, we recognise that there may well be exceptional circumstances where the police are not able to comply with the code. The committee therefore recommends—and there was lengthy discussion on that—that the half-regard to approach be reviewed in the light of experience and that the commissioner reports to the Parliament on its effectiveness. I note the Government's view that the commissioner should explore procedural changes with Police Scotland or recommend new legislation to strengthen the observance of the code, but those are far from ideal options. Another key concern that was raised in evidence was the lack of a complaint mechanism in the bill. It is essential that people are able to complain about their biometric data being taken or used without their consent. The committee recommends that the bill provides a complaint mechanism to allow the commissioner to deal with complaints from the public. It is disappointing that the cabinet secretary is opposed to that recommendation. Cabinet secretary, I thank the convener for giving way. Does the convener recognise that it is very important for us to not stray into the reserve functions of the information commissioner and that, as things stand currently, if anybody has a complaint in Scotland about how their data is being used or concerns if it is being misused, they can, as things stand, go to the information commissioner for that complaint to be investigated. Margaret Mitchell Cabinet secretary, the bill is all about transparency. The collection of more biometric data for individuals is very personal information here. If we are to have trust and this is going to be successful, then the public must have a mechanism to complain. I do urge him and hope that he will reconsider that when we look at stage 2 and 3. The use of technology that impacts on the rights of individuals must always be justified and proportionate. The bill must ensure that police always adopt an ethics-centred approach to the use of new, invasive technologies. The commissioner will have a key role to play in exploring whether the use of new technologies is necessary and justified and in ensuring that technology is used within the principles that might underpin the oversight mechanism. The committee recommends that the bill provides for an ethics adviser group to assist the commissioner and that the group be appointed by the commissioner and be independent of government. I am sorry to see that the cabinet secretary rejects the statutory basis for such a group. The cabinet secretary recently announced plans to establish an independent chaired ethics group to advise the government. It would be helpful if he could be clear that the ethics group for the commissioner would be separate from any appointed by him. Serious concerns were also expressed about private companies who collect and share biometric data with the police and public sector use of biometrics such as parole e-monitoring and local government CCT systems. The bill provides very few, if any, reassurances. The committee therefore recommends that the Scottish Government review provision of the scope of the commissioner's remit and powers after a suitable period of time, that the commissioner reports to the Parliament annually on the adequacy of the resources provided to their office and that the Scottish Government must review the commissioner's funding in co-operation with the SPCB. I note the Government's comments on a review of funding and post-legislative scrutiny. However, we should not rely on post-legislative scrutiny. We should aim to get the red legislation right first time. The committee considers the bill will require to be strengthened at stages 2 and 3, and I ask the cabinet secretary to rethink some of his objections to our recommendations. In the meantime, the committee welcomes the bill and recommends that the Parliament agrees its general principles. I am pleased to open the stage 1 debate into the proposed Scottish Biometrics Commissioner Bill on behalf of the Scottish Conservative and Unionist Party. For the avoidance of doubt, like the committee, my colleagues and I are supportive of the principles of it and shall vote accordingly at decision time. At the outset, I echo the conveners' thanks to the clerks for pulling together a great deal of information on what is a complex area into a comprehensive, clear and very accessible report. The principles of the bill are sound to address ethical and human rights considerations in Scotland relating to the collection, use, retention and disposal of biometric data in the context of policing and criminal justice. It seeks to do this by establishing the post of a Scottish Biometrics Commissioner who will oversee the use of biometric material and draw up and promote the use of a code of practice, which will govern how biometric material should be used and gathered. It also seeks to underpin public trust in the way that police use biometric data, which is a key point that I shall return to shortly. I have set this out in that way because I think that that scope raises a number of considerations that have been highlighted in the committee's report and which bear further examination as the bill progresses. First, and perhaps most importantly, what will determine the success of the bill, both in the immediate but also in the medium and longer terms, lies I think in the resourcing of it. The committee's report is clear that one of the key concerns raised by witnesses centres around the level of resources required to allow the commissioner to operate effectively. The report states clearly that other SPCB-supported office holders have faced resourcing issues as a result of changes or expansion to their role and powers over time or as a result of growing demand for activity. By its very nature, this is a rapidly developing and changing environment that is likely to see an increase in activity. The report's conclusion was stark. The committee is concerned that the financial memorandum may not sufficiently estimate the resources that may be needed to support the delivery of the commissioner's functions. In the same vein, the law society has made a useful and important submission to this debate and specifically highlighted that not only should the role be, as it put it, appropriately funded, but that that funding must continue at an acceptable level to allow for the inevitable mission creep. They say that only in that way can the Scottish commissioner be able to ensure that they can properly fulfil their functions and be appropriately accountable. That is why the cabinet secretary's response to the report is somewhat concerning when he says that the provision of further resources will be subject to wider public spending pressures and will be considered as part of an annual budget setting process. Of course, but that is not a cast iron commitment to ensure either appropriate or continued funding as the role inevitably enlarges. On another matter, the committee is right to highlight at paragraph 86 that biometrics use goes far beyond Police Scotland in the SPA. For example, and especially into education and the NHS, there is a public need and a public good in seeking to regulate biometrics in this way, and there is a pressing need for transparency. What do we do about that? The committee called for a public debate, but at the very least the code of practice ought to address how the commissioner will interact with private sector users of biometrics. I note again the Scottish Government's response, which is encouraging, but loads a great deal of responsibility on to the commissioner, which, of course, takes us back to the resourcing, both initially and going forward. That, of course, leads to concerns around enforcement. I recall the committee being concerned about whether there should be a duty to comply with the code, as opposed to to have regard to. The convener highlighted that the committee felt that the enforcement powers are insufficient, which could undermine public confidence. That merits further consideration, although I recall the cabinet secretary arguing his case persuasively in the committee. I note his letter of 7 January, but the review talked of just now by the convener that it would seem sensible in my view. However, if public confidence is a key aspect of the bill, I do think that the absence of a complaint mechanism, for example, to enable the public to refer issues to the commissioner for lack of compliance with the code, perhaps, is regrettable. In committee, many witnesses brought it up and specifically said that there is a risk to public confidence and transparency if a complaint mechanism is not included in the bill. I find that persuasive. I hear the point that the information commissioner's office, but I do think that the new biometrics commissioner will want to be engaged with the public and be available. One can just imagine a situation in which the new commissioner is seeking to fulfil the public engagement, or awareness role, is approached by the public about an apparent breach but is required to send them away to the ICO, which I suggest does not lend itself to public trust and confidence. Yes, I accept the requirement in the cabinet secretary's response to develop a comprehensive communication strategy to understand the role, but I am less persuaded that there is not merit in including a direct complaint mechanism as the committee unanimously recommended. My final point that I owe to my learned friend, Gordon Lindhurst, who I expect will develop what I am increasingly of the view is a key issue in closing. The cabinet secretary rightly raised the issue of enforcement, and I think that it is worth exploring this further. Section 12 3B of the bill allows the court of session to treat failure, to provide information to the commissioner under section 11, as a contempt of court. The drafting of this seems not only somewhat draconian given the lack of similar provisions elsewhere, but given the particular drafting, an individual will not know in advance whether or not an action will be contempt of court, unlike perhaps the situation in which someone knows if ignoring a direct order of the court. Furthermore, the interplay between section 11 and section 11 3 under which a person is not obliged to provide information, which that person would be entitled to refuse to provide in proceedings in a court in Scotland, is, I would gently suggest, challenging. I will leave it there for both consideration by my colleague later and perhaps review at stage 2. As suffice would say, I confirm that we will support the principles at stage 1. I look forward to cross-party collaborative working going forward to drive improvements into the Scottish biometrics commissioner bill. I now call James Kelly to open for labour. Thank you very much, Deputy Presiding Officer. I am delighted to open the debate this afternoon for Scottish Labour. I confirm that Scottish Labour will be supporting the general principles of the bill at decision time this evening. I also want to place on record, as other speakers have done, my appreciation of the work that the Justice Committee has done, that the clerks in particular have put in to compile on the report and the witnesses that also appeared before the committee. I think that the legislation that we have before us is important. If you look at the background to biometric data and data and the importance of it in relation to policing and criminal justice, it plays an absolutely central role going back over 100 years. Police and law enforcement agencies have used data very effectively in order to prosecute crime and have committed those crimes to justice. The data collection and the extent of data that is collected has increased significantly, as Margaret Mitchell has said, over the past 25 years, particularly with the vast improvements that we have seen in technology. That is very welcome in terms of helping the police to do their job. We have seen numerous examples of cold case reviews that have allowed the police to go back and investigate crimes that had taken place in the past 30-40 years and bring forward successful prosecutions as a result of improvements in biometric data techniques. As I said, that is very much welcome, but at the same time, the breadth of collection of data and the number of people that it covers, how that data is stored, and how long it is stored for. There are then central issues around that, both in terms of people's human rights and giving the police and prosecution authorities the ability to carry out their job effectively. Therefore, it is essential that we establish an independent biometric commissioner. In terms of the committee's report, there are three issues that have come out and have already begun to play out in the debate this afternoon. Those are around the scope, the powers and the access to the commissioner for complaints. In relation to the scope, the scope is currently limited to Police Scotland and the SPA. I welcome the cabinet secretary's announcement this afternoon to extend that scope. However, I think that that should be examined to go further than that to public bodies such as the NHS and to examine the way that some private bodies collect and store data. We did hear in evidence the concerns of the breadth of organisations that are collecting biometric data and using it and passing it to the police. There is no doubt that that will continue to grow. That is clearly an area that needs to be examined further. In terms of the powers, the powers are obviously established through the code of practice, which the commissioner will move forward with. The debate this afternoon has already been around whether the provisions in the bill currently are adequate and there has been much discussion around the phrase have regard to and whether that is legally adequate in terms of ensuring that people comply with the code of practice. I am not persuaded that the use of the phrase have regard to is strong enough. There needs to be something that is more legally compliant. For example, the cabinet secretary and I, although we agree on this legislation this afternoon, have had numerous political disagreements over the years. I can have regard to the cabinet secretary's views on the matter of the constitution. It does not mean to say that I have to follow them or I have to implement them in the speeches that I make in the chamber. Therefore, I think that we need something that is going to be stronger if we are going to give the commissioner the powers that he needs to ensure that the code of practice does not become toothless. Access is important that the public have a mechanism to bring forward complaints properly. I will listen carefully to the cabinet secretary and make a number of representations on this, but I still feel that the way that the legislation is drafted currently, there is more need to be done in terms of public awareness and there is more need to be done to allow people to bring complaints if they feel that their human rights are being compromised in any way. I emphasise, as I said earlier, that this is becoming a much bigger area. I think that the other area that is going to be crucial in the bill going forward, balanced that the bill is drafted currently, is reasonable in terms of being able to cater for future developments. This is an area that is going to expand greatly in the coming years and the code of practice needs to be able, and the commissioner needs to be able to take account of any future developments in technology. I welcome the principles of the bill. It is very important that we have a biometric commissioner who is independent. I think that there are issues that have come out in the Justice Committee's report on the scope of the commissioner's role, the powers that he has and access. I hope that the cabinet secretary takes on board some of the views that have already been expressed this afternoon. I am sure that, if there are not appropriate changes ahead of stage 2, members across the chamber will bring forward amendments to seek to strengthen the bill, to make it more effective and more robust. Thank you very much, Mr Kelly. I now call John Finnie to open for the Green Party. Okay, thank you very much indeed, Presiding Officer. Mr Finnie, when you're ready. Yes, I know him and Grant. Thank you very much. Just to advise that the Scottish Green Party will be supporting the general principles of this legislation at decision time and to thank, as others have, all those who have been involved in the process. It has been a thorough examination that has gone in, particularly to the clerks for the compilation of the report. I thank all those who have provided briefings, including Amnesty, and I refer people to my member's register of interest as a member of Amnesty. I want to talk about paragraph 87 in our report, where, as a committee, we ask the Scottish Government to consider, and the convener did allude to this, how the lack of debate and transparency on the issue of biometrics across Scotland might be addressed and what role the Scottish Biometrics Commissioner could play in that. The Scottish Government response in yesterday or the day before was that the Biometrics Commissioner would be, quote, best placed to lead the debate. I don't agree on that. I think that leaving it all to Biometrics Commissioner would be inappropriate. As the convener and others have said, this is a fast-moving situation. It may seem strange to say that we need to debate when we're actually debating this subject, but we need a lot more debate on this whole issue for the very reasons that members have outlined. The Scottish public is under a heavy degree of surveillance, and we've seen, and I'm not dwelling it, the issue of the digital triage devices that the cyber-kiosks deployed without assessment, without a robust legal basis—a little, if any, oversight by the SPA—how public rights could have been eroded there. I have to say that Police Scotland have responded extremely positively and engaged with others. That situation has moved on, and the police subcommittee is now looking at facial recognition issues. It would very clearly fall within the Biometrics Commissioner's remit, and we know already that there is a live challenge on going elsewhere in those islands. I welcome the contributions that we have had from the Scottish Human Rights Commission, the Open Rights Society, the Big Brother Watch and the Impanation Commissioner, various academics that have informed that. To commend the role that the independent advisory group has played throughout the issue, I commend an ethics advisory group to continue when the legislation passes. I believe that that should be on the face of the ball. Our stage 1 report alluded to facial recognition, facial search technology, gate and movement recognition technology, eye or retinal identification, voice recognition software, as well as data from social media capable of providing biometrics sources to the police. I am told that second generation biometrics is what that is called. We need a very robust oversight, and I recall in a different capacity at the time when the introduction of CTV was trialled in Airdrie, in the 90s. The issues still remain largely the same. Who undertakes the role, the role of the police in the private sector, for what purpose? Who has oversight of it? Who has access to the material and how long it is retained? It is Parliament that must lead that debate, along with our country's justice system, and I am sure that Police Scotland and the Crown Prosecution Service would welcome discussions on that. It is key that all of us protect the citizens right, because if we don't, who does? The code of practice has been alluded to and it is intended to set out some of those issues. The Scottish Human Rights Commission in its written submission highlighted that, for instance, the issue of a detailed analysis of deletion that was part of the independent assessment group's initial report has not been picked up in that. What we do know in the course of our deliberations was that data already in the protection of Police Scotland and the SPA is not all legitimately held. That was alluded to at Paragraph 132, and we refer to it as a legislative gap. The Scottish Government's response is that, since the publication of a 2060 HMICS review on the use of facial research functionality within the UK Police National data police, Police Scotland has successfully delivered a new national custody episode management system that enables custody images to be automatically weeded from that system when the corresponding image is similarly deleted from the criminal history system. It is unclear to me what that is supposed to mean. My understanding is that, for technical reasons, photographic details of people who had been acquitted remained on the system. If that has been correct since 2016, that is very good. Perhaps that is something that, at some point, the cabinet secretary could underline to us. The legislation covers Police Scotland and the Scottish Police Authority. My view all along has been that, with everything else, I have a frustration that we have a number of police services that operate in Scotland that are not accountable to this Parliament, British Transport Police and National Crime Agency being too. Never mind some of the other UK ones that will be more challenging to deal with. I welcome that the cabinet secretary is wanting to include British Transport Police and the National Crime Agency. I wish you luck trying to get the UK Government to agree the Ministry of Defence Feast. I hope that they will. I hope that people will support section 104 orders. However, if that is not secured, then it is not all of policing that is covered by this. It is simply the principal police force and the principal people who hold the information. Of course, what we have is a situation in which it is not just public bodies that hold information—public space CCTV systems, road camera enforcement systems, automatic number plate recognition—all of which can capture the facial images of citizens engaged in routine lawful activity. The open rights group referred us to the European Court of Human Rights, which said, "...any state that claims a pioneer role in the development of new technologies bears special responsibility for striking the right balance." That is about the scrutiny that goes into who has what, who has access to it and all the rest. Whether that is schools with the biometric information that they have, the gold card collection, as I understand it, is referred to, which is the information that is held by the national health service. Amnesty says that the regulation of biometrics outside of policing, including the private sector, is challenging but vital and the Government should consider how best to achieve that. The bill that is presently configured will not do that. I also want to briefly return to the issue of having regard to that, because, like James Kelly, I have a lot of things to do with that. I have had a lot of advice about dietary conditions, but I will overgo the public. What was the term that you used? Reputational damage of not having adhered to that advice. I think that we should get it right first time. There shouldn't be any problem whatsoever by a policing service saying that if the person who is engaged by this Parliament to deliberate on decisions says something, please do it. There shouldn't be any decision. There should be no issue about that whatsoever. The reality is that, within any system of law enforcement, there is flexibility day in, day out. Police make judgments about whether to take actions day in, day out. Crown Office, Procurator, Frisco consider that representations are made. That should not be punitive, but having regard to that is a very unsatisfactory place. Future poofing is an issue. The technology is far-ranging. We must watch out for the snake oil sales persons who are very happy to sell us technology that has a 2 per cent success rate. That is the facial recognition technology. Police Scotland has no plans to introduce this at this time, but that is in the 2026 plan. Scrutiny of the technology, as some of the representations that we have made, should also be an important function of the biometrics commissioner, and I will leave it there. Thank you very much indeed. We do have some time in hand, but let's not. I can't be over generous much, though it is interesting. Mr MacArthur, if you want to use up a wee bit extra time, any faster self, you'll get it. Thank you. I will not abuse that invitation. Scottish Liberal Democrats strongly support the principles of this focused but important bill, and, like others, I also pay tribute and offer thanks to those who have helped the committee during our stage 1 scrutiny. I also want to acknowledge the contribution of John Scott QC, along with those colleagues on the independent advisory group, who have done so much to lay the foundations for the bill that we are considering this afternoon. Mr Scott barely had time to draw breath after digging the Government out of the whole over unregulated stop and search before he was invited to help to shape the regulatory framework for the use of biometric data in Scotland. He and his IAG colleagues certainly rose to that task. It is important that Parliament now passes legislation that stays true to their recommendations. I will come on to explain shortly. I do not believe yet that the bill does that well enough. First, I want to take a moment to put the bill in context. The term biometrics is the umbrella term for our most valuable personal data, and therefore we are looking at how to govern how accessible that is to others. In 2015, it emerged that pictures of 330,000 Scots who had been taken into custody had been made available to users of the police national database. Those pictures could be accessed nationwide and included many people who had never actually done anything wrong. They were then analysed and consulted in criminal identification processes. This revelation kick-started a Liberal Democrat campaign spearheaded by my former colleague Alison McInnes to effectively protect people from the unregulated use of biometrics. He wrote to the First Minister at the time of demanding a review of facial recognition technology, prompting the announcement of a review by HMICS. During the passage of the 2016 Criminal Justice Act, Alison McInnes lodged amendments that would have subjected the collection of biometric information to the same rules as DNA and fingerprint. That would have required information to be quote, destroyed as soon as possible following a decision not to institute criminal proceedings against the person or on the conclusion of such proceedings. Two independent expert reports from HMICS and the advisory group then agreed that fresh legislation and oversight was required. While it has taken time for the Government to bring forward this bill, Scottish Liberal Democrats, as I said, clearly welcome it as we do the creation of a biometrics commissioner to oversee the collection, use, retention and deletion of biometrics. Restricting the remit to policing, however, is problematic. As the committee heard repeatedly during our evidence sessions, biometrics is increasingly being used across a range of different areas, both public and private. While there is obviously a significant challenge to ensuring any regulatory framework keeps pace with technologies that are evolving at a bewildering pace, I believe Open Rights Group amnesty and others are right in calling for the scope of the commissioner's role to be extended. Let's not forget that the IAGE recommended that the commissioner should have oversight of biometrics used by police, SPA and other public bodies. While the cabinet secretary has informed us that he plans to extend it to cover perc and I very much welcome that confirmation, he suggests that he is prepared to keep an open mind in relation to wider extension. The bill needs to be more specific about how that can be made to happen. As various witnesses told the committee, it is not unreasonable to be aiming for the commissioner's role to cover the use of biometrics by public authorities and private actors where it is being used on the general public. That may be in other parts of the justice system or in areas such as education and health, where biometrics are increasingly being used. That reflects the public mood and expectation. Of course, there is a balance to be struck between public safety and giving the police the tools that they need in order to do the job that we require of them on one hand, but individual rights, not least the right to privacy. I give way to the cabinet secretary. Can I thank Liam McArthur for giving way? I will address the substantial point about potentially broadening in the future. Does he recognise that data and biometrics data that is collected and retained by police in the SPA for policing and criminal justice purposes is unique in its own right? Often, for example, that data could be taken without the consent of the individual if needed for crime investigation purposes. Therefore, the focus on policing and criminal justice is the right place to start because of the unique nature of that data that is collected. Liam McArthur I absolutely do not dispute that at all. Nor would I dispute that that is perhaps the area of priority, but I think that we should not lose sight of the fact that we are seeing that technology increasingly used and deployed in other areas of the public realm as well. We are already seeing, as I say, public concern, for example, around the issue of live facial recognition technology referred to by John Finnie and others. Those technologies are increasingly being trialled and used by police to monitor public spaces. We must be very wary of what can amount to indiscriminate mass surveillance, not least given the inaccuracy of the technology. In their briefing, Amnesty referred to an analysis that shows that those technologies generate false positives in around two thirds of cases, but the met has put that figure as high as 80 per cent with particular problems in matching images of those from the BME community. Clearly, that is no basis for any sort of roll-out of that technology at this point. The lack of legislative framework, transparency, potential for discrimination, absence of public information and rights of review or appeal point to the use of such technologies and retention of images as potentially unlawful. That issue of review or appeal is picked up by the law society who argues that, for public confidence, a complaint mechanism should be included within the bill to enable the public to refer issues to the commissioner on the use of biometrics and where there is a lack of compliance with the code of practice. As for that code, a draft of which was drawn up by the IAG, the committee concluded that it should be on a statutory footing and come into force at the same time as the commissioner takes up office. The law society suggests that that would, for example, avoid the need for speculation as to what the code might or will include. Disappointingly, the cabinet secretary has rejected those calls, something that I am sure that the committee will return to at stage 2. Likewise, the cabinet secretary appears determined to do his own thing when it comes to the ethics advisory group. John Scott and his colleagues recommended that the establishment of such a group is part of oversight arrangements. The remit would be to work with the commissioner and others to promote ethical considerations in acquisition, retention, use and disposal of biometric technologies and data. The Government accepted that recommendation, but has failed to put it in the bill and, again, that is disappointing and needs addressing. Finally, on the question of enforcement powers, the Government has argued that the threat of naming and shaming is in itself sufficient. The committee was not convinced, nor, indeed, were many of those we took evidence from. Again, that will be something that I am sure we return to at stage 2. More encouragingly, I note the cabinet secretary's willingness to consider amending the bill to include regulating powers so that biometric data can be defined and subsequently updated. That is very much welcome. Scottish Liberal Democrats have led the way over the past five years in campaigning for proper regulation of the use and retention of biometric data, including the establishment of a biometrics commissioner. On that basis, we warmly welcome the bill but believe that there is more work to be done to ensure that it is up to the formidable task that is required of it. Thank you very much, Ms McArthur. I am now moving to open debate. There is a little time in hand. I call Rona Mackay to be followed by Shona Robison. Technology in biometrics is advancing at break next speed and we must be prepared for it by introducing a sensible framework of legislation to enable the police to detect, prevent and prosecute crime. That is why I am pleased to support the general principles of the Scottish biometric commissioner's bill today. I also thank the clerics and the bill team for their hard work in collating the evidence that we heard from a variety of excellent witnesses and I thank those witnesses for helping us with their expertise in the field. The written and oral evidence that the committee received showed broad support for the establishment of a Scottish biometrics commissioner. Of course, it is important that we have the public support and confidence in the use of this new technology. That is why a new independent and expert commissioner is pivotal to achieving that and to help us to ensure that the use of biometric data in criminal justice and policing is effective, lawful and ethical. The scope of the bill covers the acquisition, use, retention and disposal of biometric data, including fingerprints, DNA and current emerging techniques such as iris recognition, all necessary to keep communities safe and help in their fight against crime. In my view, that is an example of using technology for the best purpose, but of course human rights and data protection requirements do pose a challenge and must be strongly considered. Again, that is why the post of a Scottish biometrics commissioner is so necessary. The UK Government's commissioner for the retention and use of biometric materials, Professor Paul Wiles, is on record as saying that the bill places Scotland at the forefront of legislating for the oversight of biometric data in the field of criminal justice. He said that many other countries are interested in what Scotland is doing, because they are all aware that they will have similar issues. Biometrics in its earliest form was the introduction of the use of criminal history for photographs and fingerprinting, which has been going on for around 100 years. Those of us of a certain age can remember when DNA was introduced 30 years ago, how that revolutionised policing and crime detection. We all marveled at the technology that allowed more and more crimes to be solved. That scientific development has played a fundamental role in solving serious crimes such as murder and sexual offences. We now move on to the more sophisticated and accurate biometric testing. It is only logical for Scotland to have its own independent commissioner who will be appointed by the Parliament to ensure impartiality. Due to the fast-changing nature of that type of technology, the committee and the Government have sought to keep certain aspects of the bill flexible enough to cope with technical advances. Due to the complexity and nature of the bill, it has been split into sections. It is impossible to discuss all aspects in a short speech, but I will try to highlight the main areas of discussion during the evidence that we heard. Sections 2 to 5 set out the functions and powers of the commissioner. The primary function of the commissioner will be to draft and promote a code of practice for the use of biometrics by the police and the SPA. The commissioner will also play an important part in informing the views of policy and law makers responsible for making the law within which Police Scotland and the SPA operate. The contents of the code of practice will not be specified in the bill to allow for flexibility and future proofing, as I said earlier. There was discussion over whether the code should be mandatory and sanctions used if broken. That was mentioned by John Finnie, and I know that he feels strongly about that, rather than simply having regard to it. There is a strong argument for that, and the committee has asked the Government to review the effectiveness of that term as a working practice. In reality, the code of practice must be taken seriously, and any failure to observe it will need to be accompanied by a good reason. There can also be legal consequences if it is not adhered to, such as a judicial review. Another aspect that was widely discussed during evidence was the jurisdiction and cross-border nature in some areas where we had to consider who would be accountable for the data and where ultimate responsibility would lie. The Government believed that it is for Police Scotland and the SPA to effectively manage the data that they have allowed to be uploaded into UK databases and to ensure that records are managed effectively. The committee recommended that the national crime agency and the British Transport Police be included in the bodies set out in section 7 of the bill in relation to the functions in Scotland, and asked that the Scottish Government bring forward the necessary amendment at stage 2. The cabinet secretary spoke of that in his opening speech, and I welcome those amendments coming forward. Of course, there is an argument to include public and private bodies, as well as several members have mentioned. The Scottish Government is currently releasing, I understand, with different bodies and the UK Government on such matters, and that, as he says, is a work in progress. The committee also recommended that the commissioner for the retention and use of biometric material be added to the bodies set out in section 3 to enhance the power of the commissioner to work with others and that the forensic science regulator and surveillance camera commissioner be added. In that respect, the Government, I believe, does favour a memorandum of understanding between the organisations that would signpost the complaints mechanism available to the public that the Government supports. However, stress would be between the new commissioner and the UK commissioner to agree. The committee also recommended the set-up of an ethics advisory group. The Scottish Government is open to considering wider views on the remit and membership for this group, and to whom the group should report. The Government believes that it is important that the remit is scoped to ensure relevance, and its members have the appropriate skills and experience. As the convener mentioned, the committee recommended that a complaints mechanism should be included in the bill, but the Government believes that the commissioner's role should be one of strategic oversight rather than to deal with the resolution of individual complaints, but I am sure that that will again be fleshed out at further stages of the bill. In conclusion, there are areas of detail still to be determined in the bill, which will of course be addressed at stage 2, but that is essentially a good bill, which will greatly enhance crime prevention and detection, and I wholeheartedly support its general principles at stage 1. I am pleased to speak in this debate and support the general principles of the Scottish Biometrics Commissioner Bill and, like others, I would like to thank the clerks and the bill team for all their work so far. It has been an interesting experience looking at the bill on the Justice Committee and, certainly, expanding my knowledge of all matters biometrics. The key point is that we have to recognise that technological advances have brought huge benefits to the police in detecting, preventing and prosecuting crime, and the aim here is to ensure the effective use of the biometric technology by the police in a manner that is ethical and respects fundamental rights and freedom. The role of the commissioner and the code of practice will help to maintain public confidence in how biometric technologies and data are used by the police in crime detection. Obviously, as others have mentioned, the background of that emanates from the independent advisory group report on the use of biometric data in Scotland. The report pointed out that there is currently no independent governance or oversight of the use of biometric data in policing in Scotland. In deciding whether an independent biometrics commissioner would be necessary, they had regard to the presumption against new public bodies in Scotland, but it was considered that there was no body within the competence of the Scottish Parliament to which oversight in this area could be given. During its work, the IAG received several submissions that suggested several possible aspects to the commissioner's role, which we have heard so far in this debate. The development of a code of practice relating to the handling of biometric data and holding bodies to account for following the rules set out was, of course, a key one. There was also the recommendation that the commissioner should be able to begin investigations from their own mandate, that they should have an independent complaints mechanism, and that the commissioner should report to Parliament and publish regular reports of their work. I think that an important element that was mentioned by the IAG was that the commissioner should have a role to play in public education and public engagement, which has been touched upon during the debate. However, it was felt that one of the areas where the public is sometimes frustrated is on the delivery of clear, dragon-free information to allow them to understand the powers that the public have to hold authorities to account and how to exercise those powers. I hope that a key role of the commissioner will be in that respect of engagement with the public as we go forward. I certainly welcome some of the cabinet secretary's commitments. Firstly, on the recommendation that there should be an ethics advisory group on biometrics in Scotland, I welcome the cabinet secretary's commitment to form an independently chaired reference group to scope the possible legal and ethical issues arising from emerging technological developments. I think that that is welcome. In terms of the conclusions of the stage 1 report, as has been set out so far, there has been a bit of a debate around the scope of the bill. That is something that the committee heard a good deal of evidence on and has been debated here this afternoon. Clearly, there have been some who have called for the extension of the bill very widely, indeed not some less so to other parts of the justice system, whether it is the Scottish Prison Service or CCTV systems and so on, but others have called on it to be applied to private sector users of biometrics, as well as private sector technology developers whose work drives the development of new biometrics data. Although I have some sympathy with that, I think that the phased approach and making sure that we get it right for the justice system initially and particularly policing is very important. I welcome the fact that the cabinet secretary has agreed to extend the scope to Perk. As I understand it, the Scottish Government has said that it may be appropriate in future to extend the commissioner's oversight role to cover other criminal justice-related matters. The bill includes a power to amend the resulting act in that regard. I also understand that the Government will consider consultation in due course about including further persons or bodies with criminal justice-related functions within the scope of the Scottish Biometrics Commissioner in relation to those functions. I think that that strikes the right balance at this moment in time. Whether or not in the future it goes further than that, I think that we need to enable and allow the commissioner to get up and running and get their office to revisit the scope of that in due course. There has been a debate about the statutory footing for the code of conduct. I hear what the cabinet secretary said about the fact that the code of conduct has statutory underpinning, but it is the detail of which should be left flexible for the commissioner to develop in consultation with bodies and, of course, the public. I think that that probably strikes the right balance. As others have said, the work that is being done here in Scotland is of interest to other jurisdictions who are also wrestling with those issues as we see technology developing at a pace. I look forward, hopefully, to Scotland leading the way in this area, as I am sure it will. Maurice Corry, to be followed by Fulton Greger. Thank you, Deputy Presiding Officer. I welcome the stage 1 debate of the Scottish Biometric Commissioner Bill this afternoon. I would also like to acknowledge the work of the Justice Committee in its scrutiny, along with the clerk's support, and thank them all for that. The committee's report raised the most helpful recommendations, and one that I hope will be properly considered today. With the increasing use of biometric data, and particularly in the rise of second-generation biometrics, the need for a biometric commissioner in Scotland is absolutely clear. We now have a situation in which biometric data has evolved and expanded from the collection of not just DNA, fingerprints and photographs alone, but enhanced facial recognition, software, social media information, and voice pattern systems, among others. The legislation must reflect those changes, taking into account the sensitive nature surrounding data collection, and that is what the bill seeks to do. Of course, new biometric data opens up more opportunities for our police force. It can target the gaps in criminal proceedings, with new ways of detecting criminal behaviour through personal traits, and advanced movement technologies, for example. For victims of violent crime or sexual assault, such scientific developments can, in many cases, ensure that their cases reach a just close. Of course, I am in favour of any advancement that equips our police force in Scotland to prevent crime to the best of their ability. Yet, while biometrics may pave the way for solving serious crime in the future, it is incredibly important that any new legislation considers the ethics of using such data and technology. Indeed, the protection of human rights, personal security and privacy when gathering and storing data can present potentially serious obstacles that should not be ignored. With that in mind, the creation of a Scottish Biometrics Commissioner is a positive and necessary step forward. It is vital that such a position will allow for any biometric data policy in practice by Police Scotland and the Scottish Police Authority to be kept under close review. In particular, I welcome the decision that this role will especially be mindful of how young people and those most vulnerable might be impacted in the data gathering process. That oversight would encourage a greater level of protection and accountability for those that need it most. I am supportive of the flexible and independent nature of the commissioner's role, particularly in relation to how they might consider new technologies and incorporate them into the criminal justice system as appropriate. Importantly, the role of the biometrics commissioner could also serve to create a public dialogue about our understanding of biometric data, particularly the second generation advancements and how they might be used safely. Ultimately, the use of biometrics in Scotland needs to be made clearer and with greater transparency. A Scottish Biometrics Commissioner would have to encourage a public conversation about how data is collected and how those practices can be effectively utilised overall without infringing upon human rights standards. Linked with that, I would welcome further discussion on the possibility of whether the biometrics commissioner's role would be widened to encompass the use of biometric data by other groups. Indeed, many witness contributions included in the justice committee report felt that the public bodies such as the NHS, as well as some private companies are also in need of essential oversight in how they collect and store biometrics data. Although I accept that it may be best to start with the policing and justice remit at this stage, a clarification on whether the commissioner's capacity might be expanded to include other groups in the future would be very much appreciated. To gain public confidence in personal data protection, I believe that the bill will be further strengthened with the inclusion of a complaint mechanism as the justice committee has already recommended. We cannot expect the public to put their trust in the provision of a biometrics commissioner if the role does not allow for complaints referral. If issues are detected in Police Scotland or the SPA's handling of biometrics, the public needs to be assured that a level of accountability is in place. That would ensure that the role of the biometrics commissioner is independent and efficient. Of course, the centre of our debate today is how ethical standards can be preserved. As we know, the independent advisory group for the bill recommended an ethics advisory group be created to work with a commissioner and other key stakeholders. Its role would be to encourage ethical decisions to be made in the use, retention and disposal of biometrics. That was in response to there being no provision for such a group already contained within the bill. In my opinion, one that I am sure my colleagues share, while some are aware that the Scottish Government has indicated that it is working towards establishing the group in conjunction with the commissioner's role, I find it concerning that that has not been clarified in the bill beforehand. To conclude, Deputy Presiding Officer, I welcome the first stage of the Scottish biometrics commissioner's bill. It sets out a much-needed role alongside a code of practice that will ensure that personal data is handled in keeping with ethical standards. I hope that the upcoming stages of the bill will address some of the issues raised within the justice committee's report so that it can be as effective as possible. Thank you, Presiding Officer. It gives me pleasure to speak in this debate as a committee member on the justice committee that scrutinised the bill at stage 1. Like others, I have already said that I will take this opportunity to pay tribute to the witnesses and the clerks who have undertaken so much work on the bill. I suppose to add something else to pay tribute to the clerks for the work that they are doing on all the bills, because the justice committee, as I am sure you will know, is a very busy committee indeed, and the clerks have their work cut out there. It is great that there has been broad cross-party consensus on the bill with the committee agreeing to the general principles in its stage 1 report, and there is no doubt that we need the bill. As others have said, technological advances have brought massive benefits to policing in recent times and helped to keep us all safe. The bill and the creation of a commissioner will help to ensure that the use of biometric data is effective, lawful and ethical. If the area that the committee considered in greater depth are three that I want to focus my remarks on today, firstly the increase in the scope of the commissioner, secondly the creation of an ethics panel and then finally the flexibility of the bill to move with the times. Those are all areas that have already been covered and broadly there is agreement, but in terms of the Government response, or perhaps come from a slightly different angle from maybe some of my colleagues on the committee have already done. Starting with the bringing in others, I know that Shona Robison just talked about this a couple of minutes ago and others have raised it, but one of the areas that the committee did focus on was giving consideration to the scope of the commissioner and we did recommend that the national crime agency, the BTP, be included in the bodies set out in section 7.1 and section 3 of the bill. I do note in the response that the Scottish Government is considering the inclusion of those bodies and also the Ministry of Defence Police and the discussions that are on going in the cabinet secretary states that section 104 order under the Scotland Act 1998 would be the most appropriate mechanism for conferring duties in such bodies, and it is not possible to bring that through as a stage 2 amendment. I welcome that response because it was one of the more debated aspects at the bill, our consideration at stage 1, and I feel that it has brought clarity. We also recommended that the commissioner for the retention, use of biometric material, the forensic science regulator and the surveillance camera commission be added to section 3 of the bill. I note and welcome that the Government is considering that and perhaps the cabinet secretary could expand further on any current thoughts that he and the Government had ahead of stage 2 when summing up today if he has time. I do note that overall the Scottish Government is clear that it may be appropriate in the future to extend the commissioner's oversight role to cover other criminal justice related matters and that that will be consulted on and again I welcome that. On the ethics panel, we have already heard that this is another area of some discussion. It was around the ethics advisory group and the committee believes that an ethics advisory group which has established to support the commissioner must be independent from government and that its membership should be a matter for the commissioner. Amnesty International indeed in their briefing state that the use of biometrics has the potential to breach human rights such as the right to privacy, freedom of association and the right to peaceful assembly and they also go on to talk about facial recognition that I know John Finnie also talked about. I think that it is important that their quote is brought in here because this is an important aspect of having an ethics panel. Again, I note a very positive response from the cabinet secretary in his commitment to establish such a group which he articulated at committee on several occasions during stage 1 on his appearance. I also accept the detailed explanation for why this might not be best achieved through primary legislation, which includes that it is not within the IAG recommended in 2018 nor is the equivalent group in England and Wales a statutory group and I know that that group was referenced quite regularly. There are fears that such a move may be premature and lead to the lack of flexibility which I think we all agree is important in this piece of legislation and that the Scottish Government prefer more time as it intends to consult to obtain a wide degree of views about the best way forward to ensure that the remit is relevant and has the members with appropriate skills and experience. I think that that is a fair enough request from the Government that if it feels that there is more time to consult that we should take that seriously. Also, the lessons from the Emerging Technologies Advisory Group, which was established early this year, we could learn some lessons from that, given that there will be similar remits. Those are reasons that I have convinced me in relation to the recommendation that the committee made. The final area was the flexibility to move at the times, which I think is very important. The committee discussed this in great depth and many witnesses brought it up as well. It is very important, given the rapid change of technology that we have already talked about in the field of biometrics. Again, as I say, it is a point that is noted by many witnesses. Again, I welcome that the Government is content to bring forward an amendment at stage 2. Perhaps again, given just the initial response that the cabinet secretary sent to the committee and the recommendations, perhaps he could expand on any early thoughts around this in summing up. I would also note the calls from the Law Society in their briefing that we need to ensure that the commissioner's role is appropriately funded on an on-going basis in order to ensure any change in remit. I think that we all expect that there is nobody here who is spoken to today who does not expect it. That is a role that is going to need to be flexible. It is going to need to change, as technology changes, in order that we can have an ethical and flexible approach to that. I would totally agree with that. In conclusion, I also think that this is a good bill. There are clearly things that are going to be debated further at stage 2 to make it better. Again, that is the point that I have in this process. I think that this has been a good, quite consensual debate today, and I encourage Parliament to agree the principles at stage 1. The last of the open debate contributions is from Jenny Gilruth. I thank the clerks to the Justice Committee, the bill team and to all witnesses from whom the committee took evidence ahead of today's stage 1 debate. As we have already heard, biometrics is the technical term for a strand of biology that applies statistical analysis and measure. Many of us will use some form of biometrics on a daily basis, from entering this building to the facial recognition technology used to unlock our mobile phones. As a stage 1 report notes, over the past 30 years, this type of technology has become key in detecting and prosecuting crime. Indeed, because biometrics are non-transferable and difficult to falsify, their growing importance in the justice system cannot be underplayed. Advances in technology have created many benefits for our modern-day justice system, and the role of the new independent commissioner has therefore become of essential importance in overseeing police use of personal information, in addition to maintaining public trust in its ethical use. As the committee notes, the creation of this role is both timely and necessary. As was mentioned by Shona Robison, the need for a biometrics commissioner, independent of government, was also a key recommendation in the 2018 independent advisory group report, which noted that there should be legislation to create an independent Scottish biometrics commissioner. The commissioner should be answerable to the Scottish Parliament and reports of Parliament. The commissioner should keep under review the acquisition, retention, use and disposal of all biometric data by the police, the SPA and other public bodies. Although technological advances in biometrics have undoubtedly brought huge benefits to policing, it has also created challenges for Governments globally, as it can be difficult for legislation to keep pace. As Amnesty notes in her briefing ahead of today's debate, effective regulation of those technologies is a significant challenge that Governments across the globe are grappling with as technology evolves faster than regulatory frameworks, and we remain open-minded about how best effective regulation can achieve to ensure all biometric technology use is in line with international human rights. On the issue of human rights, as I was also mentioned by my colleague Rona Mackay, HMICS asserted that the role of the commissioner creates an opportunity in Scotland to explore emerging human rights and ethical considerations around the use of biometrics data. Indeed, as the commissioner for the retention and use of biometric material sums up the challenges of new technological advances in his 2018 annual report, he said that we are seeing the rapid exploration and deployments by the police of new biometric technologies and new data analysis. Some of those will improve the quality of policing and will do so in a way that is in the public interest. However, some could be used in ways that risk and damage the public interest, for example by reinforcing biases of which reinforcement is not in the public interest. If the benefits of those new technologies are to be achieved, there needs to be a process that provides assurance that the balance between those benefits and risks between benefits and loss of privacy are being properly managed. As such, the committee asked the Government to consider how a perceived lack of debate on transparency and the use of biometrics across Scotland might be addressed. I note in the Government's response that it accepts that the commissioner, as an independent office holder, will, once appointed, be best placed to lead any debate on the level of transparency on the use of biometrics for criminal justice and police purposes. The financial memorandum states that commissioner's role will be a part-time one, estimated to be 0.6 full-time equivalent, and the commissioner is to be supported by three full-time staff. On that, the committee heard some debate in evidence sessions as to whether or not the position should be enhanced to a full-time role. Detective Chief Superintendent John Scott advised that it will be an extremely busy role. It is a burgeoning area of business and there is so much to do. Extending the code of practice into other areas will be a huge task, so full-time might be the best option. However, Tom Nelson, director of forensic services at the Scottish Police Authority, advised that, although a full-time role was in operation in England, that individual's role covers a total of 43 forces. As such, he concluded, that a 0.6 full-time equivalent is probably reasonable, given the size of Scotland compared to England and Wales. In response to my line of questioning, Mr Nelson also explained that a lot depended on the level of staffing that is available to the commissioner. I also raised the issue with Professor Paul Wiles, who noted that I think that the role will be part-time due to a combination of the amount of time the commissioner is envisaged as providing and the extent to which his or her office can help in that process. It is a team effort rather than just being a single person. As Liam Kerr mentioned earlier, the need for public confidence and trust in the use of biometrics by the police and criminal justice system is essential. As such, the committee concluded that the Scottish Government includes a complete mechanism within the bill to enable the public to refer issues to the Scottish Biometrics Commissioner on the use of biometrics by Police Scotland and the SPA, or on their lack of compliance with the code of practice. I note from the Government's response, however, that, as the commissioner's role is intended to be one of strategic oversight, as opposed to the resolution of any individual complaints, the Scottish Government has asserted that this responsibility should instead rest with the information commissioner. The Government also mentioned, however, the development of a fully comprehensive communication strategy, which would help the public to understand the commissioner's role. I think that that is certainly very welcome. The evidence that the Justice Committee received on the establishment of the biometrics commissioner has been broadly supportive, as we have heard today. Indeed, the commissioner for the retention and use of biometrics materials, Professor Weill, stated that the bill places Scotland at the forefront of legislating for the oversight of biometrics data and criminal justice. On that positive note, I will conclude. Thank you very much, Deputy Presiding Officer. It has been an interesting debate. Clearly, there is a lot of consensus around the establishment, support for general principles of the bill and the establishment of a biometrics commissioner. In their contributions, Humza Yousaf and Liam Kerr both emphasised the need for public confidence in the role of the biometrics commissioner. That is a good test for some of the arguments that played out during the course of the afternoon. One of the areas where there has been some disagreement between the committee and the cabinet secretary is around the scope of the commissioner's role initially in the bill that is drafted as it will cover Police Scotland in the SPA. The cabinet secretary has helped to extend that to PUC and the British Transport Police. During the course of the debate, people have argued that it should be extended to public bodies such as the NHS and private companies. Shona Robison argued for a staged approach supporting what had been outlined by the cabinet secretary. Maurice Corry was interested in testing that further. John Finnie wanted to move much further down the line and take on board private companies. Listening to the arguments this afternoon and the evidence that the committee is more persuaded to be more along the line of where John Finnie is, I understand the point that Shona Robison was making about staging it, but I think that that is an important role that we are establishing here. Because of the way that the data and the collection techniques and the use of technology expands quickly and particularly the way that private companies are picking up on issues such as facial recognition technology, it is something that we need to be more robust on on the face of the bill. In that test against public confidence, we need to go further than has been outlined so far by Humza Yousaf in order to instill public confidence in the approach that we will finally want to agree. Similarly, in relation to powers, Margaret Mitchell very strongly made the case on behalf of the committee that there should be more compliance in terms of the code of practice. Again, there was a lot of discussion about this phrase have regard to whether that was strong enough. I think that if you really want public confidence, you need to go further than simply saying that you have to have regard to the matters that are within the code. In terms of access, again, if you want your public confidence, you need to have a strong complaints process that the public are able to enlist in. The points that have been made by a number of contributors around making amendments to include a complaints process are very much true. Some of the other points that were brought out around the code of practice are key that in relation to approval of that code of practice, the approval bearing in mind the wide-reaching consequences of it, the approval should be by Parliament and not by ministers. I think that that was a point that the committee felt strongly on. Other points that came out during the course of the debate were Liam McArthur, Rona Mackay and Maurice Corry. Fulton MacGregor spoke about the ethics advisory group. Liam McArthur made the point very strongly about the absence of that from the initial bill. Bear in mind the issues that we are dealing with here in terms of data collection. It is important that proper regard is given to the establishment of an ethics advisory group. Another important point that John Finnie made was about the potential gap that there is in the legislation around retention of data. We heard some evidence about that at committee that potentially there might be data that has been held, which there is not a proper legal basis for holding. I would hope that the Government, separate to this legislation, would ensure that there is an appropriate legal basis put in place to ensure that if any data has been collected that it is then deleted once its retention period has been reached. It is crucial that people's human rights should not be compromised. I think that it is actually an interesting debate this afternoon, because there have been some defences that have been brought to the fore in a reasonable and considerate manner. I am quite sure that the cabinet secretary, being the reasonable and considerate person on the earth, will take on board some of the changes that members have suggested ahead of the stage 2 consideration of the bill. It is perhaps not just a conservative instinct, and I say conservative with a small c in this consensual debate, but a human instinct to stand up for the individual, to check the power of the state and to prevent Governments or its agencies from overstepping their bounds. I welcome measures that seek to prevent unnecessary intrusion into the lives of ordinary Scots. As has been so eloquently said by my colleague Maurice Corry, legislation needs to reflect the technological progress that we have made. It should support the police in carrying out their duties in all circumstances and using new technology where appropriate in their task. However, as with all technologies or techniques, new or old, the public must be protected from any misuse or abuse of those, and their use must submit the rule of law and respect for individual dignity. With that in mind, Parliament will no doubt require to revisit the issues that arise in the course of the debate in the public and private field as we move into the future. Others in the debate have already commented on that, and I think that I can do no better than James Kelly, who already did a superb round-up of individual contributions. I shan't repeat that. If the legislation contributes to respect for those principles, the Office of the Commissioner might take a leading role in the future to promote a greater understanding of personal biometric data and how it affects us, prevent overreach and balance what Police Scotland has termed the, and I quote, competing concerns of public benefit. However, as has also been highlighted, key issues remain. First among those is the approach that any newly created commissioner would take to working jointly with the UK commissioner created in 2012. In its stage 1 report, the Parliament's Justice Committee heard evidence from the Law Society of Scotland that the bill does not specify how the Scottish commissioner would interact with his or her UK counterpart. Will Scotland's policy, having as it does a separate judicial system and police service diverged distinctly from UK policy, affect co-operation on joint competencies? All those questions arise, and I note the cabinet secretary's comments on various cross-border bodies in his opening remarks, but I think that greater clarification regarding how information sharing, obligations and oversight between the two offices and how that will work will surely be needed. That is not least in light of cross-border considerations when it comes to terrorism and organised crime. Turning to another issue, the UK commissioner Paul Wiles has told us that his mandate to monitor and publicly report is enough to ensure compliance. The bill goes a step further by giving his Scottish counterpart the power to require provision of information, but it does not grant the commissioner power to sanction public bodies found to be in breach of any proposed policy on biometrics. My colleague Liam Kerr and Margaret Mitchell, as convener of the committee, have rightly pointed to the committee's view on enforcement being weak and to the lack of a complaints procedure that will not bolster public confidence. Against the background of Scotland having a single unitary police force, there is perhaps more potential here for unintentional overreach in those areas than if we had multiple forces across the country. There is less scope for performative comparison by benchmarking in Scotland compared with the decentralised police authorities in England and Wales. Their scrutiny of standards from an enforcement perspective can be exercised by comparative means. That supports the committee's conclusion that a code of practice should be included in subordinate legislation to the bill. Naming and shaming will hardly be adequate to ensure compliance. Serious and legitimate concerns have been raised in evidence before the committee about the lack of legal enforceability in the bill that is currently drafted. Finally, for today's purposes and against that background, given the framework set out in the bill, I turn to the provision in section 12.3b, which to me seems both unclear and extraordinary in some ways. In general terms, section 11 on the commissioner's power to gather information appears to be unobjectionable, apart perhaps from subsection 11.3. Section 12, likewise, by providing a means to enforce the commissioner's powers through the recourse to the court of session, also appears to make sense, apart again from one part of it, subsection 12.3b. The difficulty, as I see it with subsection 11.3, is that the definition of what the information may or may not be referred to in that subsection is what is called in the court's unmoot point and can depend on a multiplicity of factors. That causes an immediate lack of clarity as to what information it is referring to there when it comments on information that a person would be entitled to refuse to provide in proceedings in a court in Scotland. However, the major point I think is section 12.3b, which gives the court of session power to deal with a failure to provide information to the commissioner as, and I quote, as if it were a contempt of court. The words as if it were summarise the problem with it. It isn't. So is the bill seeking to set up the commissioner as a quasi-judicial figure? I think if so that that is a bad thing because confusing roles and powers that individuals acting in public offices possess is, again, I think a bad thing. Contempt of court, of course, carries up to two years imprisonment as a penalty to deal with in the normal course, for example, failures to obtemper or carry out orders of a court, and it is not something that should be extended lightly. In short, it should not be extended to doing something that is not a failure in relation to a court but rather someone else. So I think it would be helpful, therefore, if the cabinet secretary could perhaps explain a bit more this provision and, in particular, point to if he can in the course of this debate. Specific other examples were conduct which is not contempt of an actual court, may be treated as if it were under existing legislation in other areas. However, in closing, I agree that the bill can provide a very useful counterpoint to the emerging threat of a biometric avalanche and, on that basis, I, as indeed others who have spoken here, am supportive of it. I now call Hamza Yousaf to wind up the debate. If you could take us up to five to five, that would be useful, which leaves some time for interventions and I'm sure there will be a few. I'll do my very best, Presiding Officer. I thank members who have contributed to this afternoon's debate. It's been a very healthy debate, it's been very constructive but, quite rightly, it has been very challenging. Of course, I would expect nothing less, given the subject matter. Some of those issues that I've been very familiar with have to say the issues raised by Gordon Lordhurst previously by Liam Kerr in the contempt of court, which I'll take away and give further consideration to. I'm right to the members or address it perhaps since stage 2, so some of those issues that have been raised are ones that haven't been in my consideration thus far, so I thank members for raising them with me. I'm also encouraged that the lead committee's endorsement of the bill has been reflected in the debate. The bill covers a broad range of fundamental questions, how to best keep communities safe while respecting the rights of the individuals and how to best ensure that we hold the most personal of data in an effective proportionate and ethical manner, how to ensure that the draft legislation and associated procedures are future proof to enable us to respond to technological advances in the digital age and how to best ensure that the public are aware of their rights. Equally, importantly, how to ensure that they know who to turn to should they have concerns. Those are just some of the most basic but fundamental questions that each of us has to ask in relation to the bill, and many of those who have contributed have attempted to answer those questions. It would of course be very unusual at stage 1 of any bill for it to achieve complete consensus. There is, of course, consensus that we should agree the principles and move on to stage 2, but differences across the chamber and challenges to the Government, which I have heard very loudly and clearly from right across the chamber. I will try to address some of those issues, if I can, one by one. Of course, if I have time, I am more than happy to take interventions. Clearly, if I omit any of the fundamental questions, members can intervene and ask me should they wish to do so. I thought that I would address the issue of complaint handling, first of all, that was raised almost virtually by every member, but first and foremost by the convener in her response, and as has been mentioned in the committee, as well. A fair amount of consideration was given in the drafting of the bill and in the consideration of the bill to the non-duplication of roles in relation to the Scottish Biometrics Commissioner and the UK Information Commissioner. The Scottish Biometrics Commissioner role was very much seen as a complement to the role of the information commissioner. It is worth just reiterating and stressing this. There is currently an avenue to make a complaint about the handling of data that can be investigated. That can happen right here and right now by a member of the public in Scotland. The role of the Biometrics Commissioner is designed not to duplicate that. The work of the information commissioner office is driven by complaints from individual members of the public. That is the bread and butter of what they do. That is the thrust of the work of the ICO. However, the Scottish Biometrics Commissioner's remit will be driven by identifying systemic deficiencies. There has been a lot of discussion with the ICO about the complementarity of the roles. The ICO welcomes the creation of the new biometrics commissioner. I agree with what many members have said—I think that Liam Kerr made reference to this in his remarks—that we do not want to lose public trust and public confidence, so we want to maintain that. Therefore, making it very clear about where complaints should be directed will be hugely important. I would envisage that the Scottish Biometrics Commissioner may wish to develop a fully comprehensive communication strategy about what their role is, but above and beyond that, it would be very important for the two—I will give way in just a second. It would make sense for the two commissioners to agree a memorandum of understanding to aid understanding of their respective roles to confirm that members of the public wishing to complain about the handling of the biometric data would take a complaint to the ICO. The Scottish Government officials have had a number of discussions with the ICO who have indicated their willingness to enter into a memorandum of understanding, so I give way to James Kelly. I thank the cabinet secretary for taking the intervention. I agree with the point that you do not want duplication, but it would seem logically if what we are doing is setting up a biometrics commissioner with a specific code of practice that pertains specifically to the role of the collection and retention of biometric data in Scotland, that, logically, if people have an issue with any of that process, they would want to come directly to the biometrics commissioner as opposed to go into the information of the commissioner. That just seems a logical thing from my point of view. Cabinet secretary, I do not disagree with James Kelly that there could be an element of confusion about who you go to. Again, if I just give you a practical example in terms of one that we will deal with in our everyday life as MSPs, I know that I have constituents that come into my constituency office, which I share with my colleague the MP, and they come in on reserve matters, and they will speak to me first and foremost at my surgery. I will pass their details on if it is to do with the DWP or an immigration case, often to the MP, and I inform my constituent of that. I have never had an issue with the constituent who has ever complained about the fact that I have passed on their details with their permission to do so, and for that to be pursued by the MP to hopefully get a satisfactory outcome. It can be a confusion about what an MSP deals with, what a councillor deals with or what an MP deals with, but so long as there is almost a seamless transition to the right point of contact to deal with that complaint or that concern, rarely is there an issue. I think that the memorand of understanding between the two commissioners is the right way to approach it. My other concern about the complaint handling—I should have said this from the very beginning—is that I will be absolutely open-minded to all the suggestions that are made by members across the chamber, but my concern would also be that, potentially, we could be at the scope, because the ICO very much has that reserved function of data protection and investigation of complaints. I will give careful consideration. The other point that was raised by members across the chamber, quite consistently, was the having regard to clause in the bill. I hear carefully what John Finnie was saying about James Kelly and Liam Kerr. In fact, a number of those who contributed made the point about having regard to it and saying, why don't you just make it a compliance at the beginning instead of having regard to it and then perhaps reviewing it in the future. I understand that the Parliament wishes to ensure that Police Scotland and the SPA adhere to the code of practice. It is important to know that any provision that would force them to comply with the code will, in effect, create a general regulatory regime in relation to the processing of biometric data by those bodies. Given that biometric data can also be personal data, my concern would be that such a regulatory regime would cut across data protection law, which is reserved and, again, maybe outside the legislative competence of the bill. All that having been said, I am happy to consider the committee's recommendation to review the having regard to provision. It is mindful that the Government and Parliament carry out post-legislative scrutiny on the commissioner's power at any time without any further legislative provision being required. However, I hear pretty loud and pretty clear that there is some real concern by members right across the chamber. I think that that is very sincere concern with members across the chamber. Therefore, let me give an absolute assurance that, before stage 2, let me give some reflection upon the points that have been made by each of the justice spokespeople and by the convener as well. The other issue that has been mentioned has been one around scope. Is it possible, for example, to extend the scope beyond policing or beyond Police Scotland? Excuse me. My view is that it would be possible to extend the bill within the overarching purpose of criminal justice and police purposes in order to include either private sector bodies or other Scottish public authorities that operate in this field. Indeed, the bill already expressly includes the power to do that by regulations that would allow that to be done once the commissioner's office is up and running. If we accept that the scope could extend, is the cabinet secretary able to give any greater reassurance over resourcing at this stage? Is he worried that his response to paragraph 266 in the letter that we received might not inspire confidence amongst potential candidates for the role? The bill is accompanied with it as a financial memorandum, but, on top of that, when the question was asked whether or not the resourcing was adequate in comparison to the English commissioner, the view was that it is very similar in comparison. I do not envisage that there is, at the moment, a resource challenge. Clearly, if the scope was extended and I will expand on this point, there might well be a resource implication. Of course, the Government at that point would absolutely have to look at that. We would not look to extend the scope of a commissioner if there were any concerns about resourcing. They would have to be made very obvious and very upfront in that process. I should say that any move to extend the commissioner's role would require development of a substantive case for change that is supported by an appropriate evidence base and, indeed, by a public consultation. I will keep an open mind as to broadening of the commissioner's remit in the future to include other public bodies, but that would be, and I should say this very firmly, very much after the new commissioner has had time to bed in and after a period of consultation. I think that that would be the appropriate way to do it. One of the other issues raised, Presiding Officer, by Lee MacArthur, but also raised again by a number of other members, was the issue of the ethics advisory group. I note that the committee's wish to see the ethics advisory group established on a statutory footing and being appointed by the Scottish Biometrics Commissioner for the purpose of supporting the commissioner. However, that is at odds with the IAG's recommendation, which Scottish ministers have already committed to implementing. Let me be clear that I fully support the formation of an ethics advisory group. I recognise that it can make a valuable contribution to a collective understanding of the key ethical, legal and technical issues arising from the use of biometric data in policing and criminal justice. I fully intend to honour that commitment that was made in 2018, but I remain unconvinced of the need to place this group on the face of the bill. The committee's report does not make clear why a statutory footing is required. I note that the IAG did not ask for the group to be statutory. I also note that the biometric and forensic working group for England and Wales, which the stage 1 report and the IAG both reference, is also not a statutory group. Therefore, I ask members to reconsider, explain more fully perhaps their position on that. I am very open to wider reviews on the remit and the membership for this group and to whom the group should report. The IAG called for a consultation to explore the options, and that is what I absolutely want to do. There were a number of other issues that were raised, Presiding Officer, but those were certainly the most fundamental. I will reflect carefully on some of the challenges that members have raised in relation to the biometrics bill. If the Parliament is content to approve the principles of the bill, of course I will work with the committee and committee members to amend it as appropriate and to ensure that it achieves what we want it to achieve. I am happy to commend that motion to the Parliament and to move it in my name. Thank you very much, cabinet secretary. That concludes stage 1 debate on the Scottish Biometrics Commissioner Bill. I am minded to take, if no one objects, taking a motion without notice to move forward decision time till now. Can I ask the Minister for Parliamentary Business to move such a motion? Thank you very much. The question is that decision time be moved to now. Are we all in agreement? We are. That is great. There is only one question today, and the question is that motion 20331, in the name of Humsley-Usaf, on stage 1 of the Scottish Biometrics Commissioner Bill, be agreed. Are we all agreed? We are agreed. That concludes decision time. I close this meeting.