It is not possible to assess the reliability, efficacy and fairness of Police Scotland’s retrospective facial recognition (RFR) use because the force does not conduct any audits or performance assessments, says Scottish biometrics commissioner Brian Plastow.
While live facial recognition (LFR) uses cameras to scan public spaces and crowds to identify people in real time by matching their faces against a database of images compiled by police, RFR can be applied to any already-captured images retroactively.
Unlike LFR, which is used overtly with specially equipped cameras atop a visibly marked police van, police RFR use is much more covert, and can be applied to footage or images behind closed doors without any public knowledge the surveillance has taken place.
While Police Scotland regularly uses RFR search capabilities, it is yet to deploy LFR.
According to a joint assurance review published by Plastow and His Majesty’s Inspectorate of Constabulary in Scotland on 25 March 2025, Police Scotland “does not currently collect, store, or analyse specific data to assess the effectiveness” of its RFR technology, and holds “extraordinarily little data” on the system’s overall performance.
For example, the review noted there is no information on how many RFR identifications led to successful outcomes, such as arrests or resolved cases, or how accurate the technology is.
This includes no information on the rate of false positives and negatives, in the absence of which, “it is not possible to assess the reliability, effectiveness, and fairness” of the system, the review stated.
With the information available, the review found that between April 2023 and March 2024, Police Scotland carried out 3,813 RFR searches of the UK’s Police National Database (PND), and 193 searches via the Child Abuse Image Database (CAID). However, across both databases, a potential match was found in just 2% of cases.
For comparison, the Metropolitan Police carried out 31,078 searches via the PND over the same period, while Greater Manchester Police carried out 5,290, although the review did not contain information on what percentage of these forces’ searches resulted in a match.
The review also found that while Police Scotland’s general use of the PND is audited, the force conducts no audits of its RFR use and has conducted no post-implementation review of its effectiveness.
In combination with the complete lack of evaluation, the review highlighted that Police Scotland still does not have a clear roadmap setting out its long-term vision or strategy for using biometric technologies.
“Not conducting evaluation, and not having a strategy makes it difficult for Police Scotland to know which technologies it should use (or not use) and which it should invest in (or not invest in),” it said. “The absence of any published evaluation makes it difficult for the public to understand whether these are effective policing tools.”
Police Scotland is currently aiming to have a biometrics policy in place by the end of October 2025.
The review also identified issues around the quality of custody image photos, the poor resolution of which makes them unsuitable for use in facial recognition searches.
“A sizeable portion of custody images are not searchable under PND facial search functionality,” it stated. “This gap could mean that people who have had their custody image previously taken are not being detected on future probe images uploaded by Police Scotland, which could lead to crimes not being detected.”
Police Scotland said a “software issue” was causing the custody images to be captured at a lower-than-recommended minimum size, which, in combination with further compression, is making them unusable.
“Extreme caution must be exercised with any retrospective ICT fix to uncompress these images. If they cannot be fully restored to their original format, the reliability of the data could be significantly compromised,” said Plastow.
“Police Scotland should ensure this issue is solved, particularly considering the adoption of new systems such as the UK Home Office Strategic Facial Matching Project.”
To alleviate the issues identified, the review made four recommendations to Police Scotland regarding its use of RFR.
This includes developing a bespoke policy on the use of RFR to search PND and CAID; conducting a training needs analysis for all officers and staff regularly working in this area; and improving the collection of data evaluating the effectiveness of Police Scotland’s RFR technology.
It further recommended that the force improves the resolution of its custody images before taking part in the Home Office’s Strategic Facial Matching Project.
“In an increasingly digital world, the future of law enforcement lies in achieving the right balance between the introduction of new technologies for public safety and safeguarding fundamental rights,” said Plastow.
“For biometrics, public confidence should be maintained with transparency, robust governance and independent oversight. This, along with the issues highlighted in our report, should prompt significant reflection for policing in Scotland.”
Responding to the findings of the review, assistant chief constable Steve Johnson said: “We will consider the Scottish biometrics commissioner’s recommendations in full, and in the context of the development of our biometrics strategy, policy and standard operating procedures.
“Our Biometrics Oversight Board is already aware of this issue and is overseeing work to improve the quality of images taken in custody and the collaboration with the Home Office Strategic Facial Matching Project, which mirrors the recommendations.”
The review also highlighted ongoing issues around the illegal retention of millions of custody images in the PND, which are still being held despite the High Court ruling in 2012 that they must be deleted.
While Plastow noted in the review that this means the PND contains “hundreds of thousands” of illegally retained custody images, the previous biometrics commissioner for England and Wales, Fraser Sampson, estimated in February 2023 that “there are probably several million” unlawfully held images in the database.
The National Police Chiefs’ Council (NPCC) previously confirmed to Computer Weekly in November 2023 that a national programme between policing and the Home Office had been launched a month before to ensure consistency and coordination across how police retain, process and then use custody images, particularly for facial recognition purposes.
While the joint review acknowledged the existence of this NPCC-led programme, it contained no information on its progress.
As it stands, there are over 19 million custody images in PND, 16 million of which are enrolled in the database’s RFR search gallery – although a high number of duplicates means it is unknown how many individuals are included in the data.
Police Scotland’s lack of management information is not limited to its use of RFR.
In February 2025, a separate review by Plastow into the use of DNA data by Scottish policing bodies found they are failing to properly record and publish data on the ethnicity of arrested people, meaning there is no way of establishing whether minority groups are over-represented in policing databases.
“During our fieldwork, the Scottish Police Authority [SPA] Forensic Services and Police Scotland were unable to provide us with any reliable management information on the ethnicity of anyone held within the Scottish DNA Database, as the database is nearly 30 years old and was not designed to record this information,” said Plastow at the time.
“The fact that SPA Forensic Services and Police Scotland are failing to properly record and publish data on the ethnicity of arrested people whose biometric data is then held is concerning, against the context of the former and current chief constables having stated publicly that issues of institutional racism persist within Police Scotland.
“Accordingly, we have been unable to establish whether there is any over-representation on the grounds of ethnicity or any other protected characteristic in Scotland.”
#Scottish #police #hold #data #facial #recognition