Biometrics Commissioner’s address to the Westminster Forum: 5 May 2020

"In January this year I wrote my last annual report as commissioner on the use of biometrics for policing. When it was finished, I sent it to the Home Secretary and I am waiting for her to publish it, as she is required to do by laying it before Parliament. As I was writing that report, I was aware of the emergence of a new virus in China but not that it would become a global pandemic. Many commentators have made the point that when we eventually come out of this emergency the world that emerges may not be as it was before - that the effects of coronavirus (COVID-19) will lead to some enduring change. That there will be a new ‘normal’. However, there is much less agreement about how it will be different.

When I wrote my report, I was largely looking back and reporting on the police use of biometrics in the previous year. There was an exception to that in a section where I addressed the issue of the emergence of new biometrics and the Artificial Intelligence (AI) driven analytics on which they depend and whether, if they are used in policing, that should require new legislation to provide a governance framework? Those comments were made in a world that has since been turned upside down by coronavirus. My term of office comes to an end in mid-June and since this will probably be my final speech as Commissioner, I thought that I would try and address the question of whether the points that I made then about the need for new legislation are still applicable now?

The legislation governing the police use of biometrics is the Protection of Freedoms Act 2012, but it only governs DNA and fingerprints because, whilst at that time the possibility of other biometrics was known, there was scepticism as to whether they would become reliable enough to the deployed in policing. Since that legislation was passed, the situation has been transformed by the growth of AI analytics and the availability of very large data sets for their development. Facial and voice matching has improved significantly, and trials of their use are being conducted. This rapid growth of both AI and biometrics has meant their use is being widely explored across both the public and private sectors, although mainly outside of policing. Whatever the post coronavirus world looks like, the one thing that I am certain of, is that these new technologies will play an important role in shaping that future world. Consequently, the new technologies are now part of high politics across government and not just a niche issue for policing and the Home Office, although the police use of technology will always require particular attention.

In January I concluded my discussion of the new technologies with a point that I was cautious about making. It was that decisions about the use and governance of AI analytics and biometrics involved a politically strategic choice about what kind of future social and political world we wanted to create. I did so because it was clear to me that the new technologies had widespread (possible) application across almost every aspect of society to the point that, whether we liked it or not, they would result in a major disruption of our world, perhaps of an order like those wrought by past major technological changes. The technologies are going to lead to a new social and political framing of the world we will live in and they may even be the basis for re-building our economy, if it emerges badly damaged from the pandemic. The emergency is also illustrating the fact that the new technologies themselves will not determine the nature our future world - there is no necessary technological determinism, driven either by God or mammon. Our world will be the product of the decisions that we make about how we use the new technologies. That is progress because in January I still felt that it was necessary to argue against such determinism and for the need to make political choices.

I pointed to the example of China as a country that had already made its strategic political choice and was actively seeking a technological lead in this area as a basis to develop its global power and influence. The Chinese choice is to use the technologies for a new and previously unattainable form of social control over both the lives and thinking of their citizens. My caution was because I knew I could be accused of shroud waving and inviting the response that we were not China and would not make the same choices. But that misses the point which is that if we do not want to create a future in the image of China then we need to decide what kind of future do we want to create?

I feel less cautious in making that claim now because the pandemic has underlined the point. China has demonstrated how effective their technical means of control can be and also how it raises opposition and how brutal the response to such doubts will need to be.

In this country concerns have been raised that the new technologies should not be deployed without a proper consideration of their operating model and whether that sustains our civil liberties. There is also a debate as to how to distinguish what uses of the new technologies may be acceptable in an emergency and how we ensure different judgements apply once the emergency has abated. Parliament recognised the problem in its debates of the emergency coronavirus Act, by insisting that its application be time-limited, and that any extension should be approved by Parliament. In so far as the Act made emergency changes in the retention of biometric profiles by the police, my Office will have to make a report on the consequences of those changes before Parliament considers any extension.

Different uses of the new technology have emerged out of a series of separate pragmatic decision from government and the private sector. So far, continuing with that approach has seemed to be the preferred method of the government, encouraged by a muted public response to current uses of the technologies. However, the extent of public concern has been growing.

In past examples of such major transformations, laissez faire pragmatism quite quickly had to be governed by public decision making in order to guide the society legislators wished to see. We must be careful, of course, that regulation does not stifle innovation or limit other aspect of freedom, such as the freedom to pursue knowledge. The practical problem is how we choose the right balance in our approach.

Liberties are a touch stone but how should our concern for liberty be used in developing a vision of our new ‘normal’?

In trying to address that question My first point in January was that the new technologies are developing at a speed that politics, government and legislation has not kept up with. That remains the case and indeed has been knocked further back by the current emergency. Even though not all of government is dealing directly with coronavirus, it seems to have paralysed other thinking, as the Brexit debate did for the years before.

At the same time, the search for solutions to coronavirus is pushing the new technologies even faster, whether that be vaccine development or case tracking by mobile phones. If the new technologies are to be part of our future, then we also need some proper thinking about their governance.

My second point was that we have failed to develop properly rigorous methods for trialling and evaluating the new technologies before deploying them. I was talking about trialling new technologies for policing but the same could be said more generally. There is a danger that instead of choosing how to deploy new technologies based on evidence, we fall under the spell of technical wizardry as providing easy solutions to problems.

During the current crisis there has been an admirable determination to conduct proper trials of vaccine and medical therapeutics, even if at break neck speed. Proper trials methodology is well embedded into medical science and its governance but not in many other areas.

Each other area of application - for example policing - needs a standard trials methodology. Unless we have proper trials we run the risk of deploying technologies that have unforeseen or even harmful effects, or that we fail to develop the necessary decision making framework for their successful use, or that they are less effective and more costly than existing solutions, or in some cases simply do not work and so lead to embarrassing reversals.

We must address the fact that claims made by technology developers, perhaps in good faith based on their evaluations, may not be replicable when their technologies are used in real world applications. The point is not one of hostility to developers or to dampen technical development but to extend the development process into the application phrase with rigour. There is a debate to be had as to whether developers should engage in this application evaluation and not just finish with a limited demonstration. That is what happens in medicine.

My third point was that not all applications of the new technologies will be in the public interest to deploy. This a more controversial point in that we may have different views as to how we should make judgements as to which technologies it is acceptable to deploy. My report was about policing and I argued that we should resolve such differences by applying a public interest test.

In other words, that we should determine, based on the best evidence available to us, how far a use-case would bring public benefit (rather than benefits to a particular, partial or commercial interest). The reason I hold this view is that biometrics depend on analytics that often use data about individuals and sometimes reveal very personal aspects of our biological being or social behaviour.

This means that some uses of the new technology will intrude into individual rights, including but not limited to, the right to respect a person’s privacy. Such intrusion can only be justified on the basis that it brings other, more general benefits, that outweigh these disadvantages. In other words, intrusions into individual rights must be balanced against a wider public interest: what lawyers refer to as ‘proportionality’. Such an approach is well established in policy making and public law, at least in western democracies. It is reflected in trans-national governance such as the European Convention on Human Rights. We already have a framework for thinking about proportionality. Proportionality judgements are always made in context as we respond to a changing world and that is why decisions made in this emergency must be re-visited once it is over and not be allowed to drift into a different context.

This does not mean that I think that the new technologies can only ever be deployed if they are in the public interest. There will be situations in which it is reasonable to allow use for private or commercial interests but again proportionality tests should still apply. How such cases are identified and in which governance is something that our legislators will have to grapple. The issue is already firmly on the political agenda in many countries, because of concerns about the use being made of individual data holdings by tech-based companies, and legislators are under pressure to provide a governance framework.

My fourth point was that by their very nature, public interest tests can’t be made by a partial or vested interest. Whilst groups may work to develop their own governance arrangements - the police service, for example, are doing so - they will risk foregoing public trust if they are viewed as being partially or self-interested no matter how high minded and lawfully, they operate. The Commissioner of the Metropolitan Police has talked of this danger in recent speeches.

Groups are likely to achieve public trust if they reflect or implement general propositions taken by a public body determining the public interest, whether that is Parliament or the courts declaiming public law. The same general point, it seems to me, will apply to what governance Parliament decides is appropriate for the use of the new technologies by the private sector.

Trust will be central in future to the deployment of new technologies as it always has been and once lost can be difficult to re-gain. The present crisis has demonstrated just how important public trust is for a government trying to manage an emergency. When the emergency is over and we come to re-examine our national threat assessment and our planned responses, as we surely will, then the government will need to address the best way to maintain public trust in an emergency just as much as how they best use scientific advice.

My fifth point was public interest tests ought to be informed by the sentiment of the public, but that sentiment is not best read from simple public opinion surveys, although methodologically more sophisticated work may have a part to play.

For citizens to reach an informed view they need to be informed by a public debate - the sentiment of the public should be formed based on such evidence and reasoning. This public debate ought to be instigated, if not led, by ministers. To date this has been largely missing and if government wants a future which makes significant use of AI and biometrics, ministers will need to persuade the public that it is their interests to do so and they have put clear governance in place to prevent abuse.

My final point was that public interest tests need to be made by a public body that has legitimacy to do so and ultimately that means by Parliament. That means that we will need fresh parliamentary legislation to govern the police use of new biometrics beyond DNA and fingerprints. The present government gave a manifesto commitment to do this which appears to change the approach adopted by the previous administration. The lessons of the current pandemic make it obvious that legislation creating governance for new biometrics will need to go beyond policing and cover the broader use of the new technologies certainly by State actors but probably also the private sector.

Such legislation will need a cross-government approach, will not be easy and take time to develop. What I do not see yet is a minister anywhere in government leading such thinking and starting a public conversation."