Research and analysis

Biometrics and Surveillance Camera Commissioner statement on the second regulations made under section 24 of the Coronavirus Act 2020 (accessible version)

Published 29 April 2021

In March 2020, Parliament passed the Coronavirus Act 2020 (the Act) in order to provide various emergency measures to help deal with the many and widespread contingencies of the Covid-19 pandemic. Section 24 of the Act empowered the Secretary of State to make regulations allowing the police to extend the statutory deadline for retaining fingerprints and DNA profiles by six months (with the option to extend this for a second and final occasion by a further six months, up to a maximum of 12 months in total) on grounds of national security in circumstances where there was no other lawful basis to retain these biometrics. This power allowed the police to retain the relevant biometrics without the requirement to carry out a detailed review of the risk posed by an individual and without the need for a chief officer to issue a National Security Determination (NSD) authorising retention. My predecessor was consulted on the section 24 provisions at the time and provided a report last September examining the use that had been made of the power and the attendant consequences before Parliament considered a further extension for another six months, as permitted by the Act.^{[footnote 1]}

The second set of regulations came into effect on 1 October 2020 and expired on 24 March 2021. This further report has been produced to inform Parliament of the impact of the section 24 regulations over this period. Although my tenure as Biometrics and Surveillance Camera Commissioner only began on 1st March 2021, my office has remained in regular contact with the Metropolitan Police Counter-Terrorism Command (CT Policing) and I have met with them on two occasions to discuss their use of this power along with their preparations for the transition back to business as usual. I was greatly impressed with the level of commitment and focus that I encountered from the CT Policing team and also with their appreciation that these were short-term transitory provisions born of extraordinary circumstances following the conclusion of which a return to the conventional system would be instigated.

The impact of Covid-19 on the making of NSDs and the effects of the Coronavirus Act 2020

The section 24 regulations have allowed the police to extend the deadline for retention of fingerprints and DNA profiles by six months (up to a maximum of 12 months where the power has been exercised on more than one occasion) without a risk assessment both in respect of newly taken biometrics and those already subject to an NSD that, after two years ^{[footnote 2]}, would ordinarily require a new NSD for their continued lawful retention. The effect of these provisions has been a temporary ‘suspension’ of that element of my role established in the Protection of Freedoms Act 2012 (PoFA) requiring examination of each NSD made and enabling, if the NSD does not meet the necessary legal requirements, the exercise of a power to order the deletion of those biometrics. This oversight function is particularly important as the subject of an NSD is not informed of the retention, removing any opportunity for that person to challenge the determination or to make representations in respect of it.^{[footnote 3]}

Under normal circumstances, possible NSD cases are triaged to decide whether a case for a chief officer to issue an NSD (or, in the case of an existing NSD, a renewal) should be made. This preparatory work is carried out by CT Policing’s National Digital Exploitation Service (NDES) for England, Wales and Scotland or in the case of Northern Ireland by the Police Service of Northern Ireland (PSNI). National Security Determination cases are based on information provided by police forces and partner agencies, including the Security Service. These specialist police teams and those providing information to them have continued to face significant disruption, both as a direct result of Covid-19 infections and as a result of necessary government restrictions put in place to control the spread of the virus.

As my predecessor outlined in his report on the first set of regulations, the police officers involved in preparing NSD cases require specialist training and security clearance which was one of the factors which necessitated the introduction of temporary section 24 powers. At the outset of the period under review, CT Policing trained a group of officers to provide additional support to the NDES team and this has allowed them to continue making some NSDs in the conventional way required by PoFA, whilst also processing those cases that were subject to section 24 extensions earlier last year. The ‘second wave’ of the Covid-19 pandemic has, perhaps inevitably, meant a reduction in the number of cases which would ordinarily have led to an NSD decision being made and not all could be processed in time before the date by which the biometrics would otherwise fall to be deleted.

The impact of the Act’s measures over the full 12-month period from 2 April 2020 until 24 March 2021 is set out in the table below. This table is split into Regulation 1 (those extended under section 24 Coronavirus Act 2020 between 2 April to 30 September) and Regulation 2 (those extended between 1 October and 24 March).

National Security Determinations made, and 6-month extensions granted under section 24 Coronavirus Act 2020, 2 April 2020 to 24 March 2021

Regulation 1

NSD Categories	2-30 April	1-31 May	1-30 June	1-31 July	1-31 August	1-30 September	Total
s24 6 months as per Sch 7	138	121	112	156	154	78	759
s24 6 months as per S41	5	6	21	2	12	9	55
s24 6 months as per S18	4	11	5	6	6	9	41
s24 6 months PACE 1984 and Others	25	76	41	22	31	18	213
s24 6 months extension of existing NSDs (renewals)	37	28	34	21	53	22	195
Total S24 6 month extensions (Regulation 1)	209	242	213	207	256	136	1263
NSDs considered and granted by Chief Officers	2	15	8	37	33	50	145
Number of biometrics lost	0	0	0	0	0	0	0

Regulation 2

NSD Categories	1-31 October	1-30 November	1-31 December	1-31 January	1-28 February	1-24 March	Total
s24 6 months as per Sch 7	0	0	0	12	136	112	260
s24 6 months as per S41	0	0	0	0	11	7	18
s24 6 months as per S18	0	0	0	1	13	4	18
s24 6 months PACE 1984 and Others	0	0	0	2	12	10	24
s24 6 months extension of existing NSDs (renewals)	1	0	0	5	107	58	171
Total S24 6 month extensions (Regulation 2)*	1	0	0	20	279	191	491
NSDs considered and granted by Chief Officers**	70	49	47	49	25	67	307
Number of biometrics lost	0	0	0	0	0	0	0

Total S24 6 month extensions	1754
Total number of cases extended under both regulations	308
Total individual biometric profiles subject to a S24 6 month extension	1446
Total NSDs considered and granted by Chief Officers	452

*includes those cases (308) that were also subject to regulation 1 and 183 new cases that were never subject to regulation 1 as they were held under default statutory requirements.

**includes NSDs deriving from all cases including non-extended cases held under default statutory requirements.

The table shows that between 1 October 2020 and 24 March 2021, Covid-19 continued to have a significant impact on the creation and scrutiny process for NSDs. Without legislative intervention by the Home Secretary in the form of the extended regulations permitted under section 24, a considerable number of biometrics held by the police for reasons of national security that would otherwise have been properly retained under an NSD would have been lost. Indeed, the second set of regulations have allowed 491 biometrics profiles to be safeguarded and no biometrics which could have properly been considered for retention under the authority of an NSD were lost. Of the biometrics that were subject to section 24 extensions, 308 relate to cases which were originally extended under the first regulations, meaning that these biometrics can be held for up to 12 months before either an NSD is made, or a risk assessment concludes that it is not necessary and proportionate to retain them and they are destroyed. Nearly half of these possible NSD cases have already been fully risk assessed by CT Policing in preparation for their return to business as usual.

As the data above shows, during the first three months that the second set of regulations were in force (Oct – Dec 20) CT Policing were able to process all possible NSD cases in the normal way (bar one). The core NDES team completed this work, whilst officers that had been trained to provide surge support focused on processing those cases that had been extended under the first regulations. In the second half of this period (Jan – March 21), which coincided with the latest ‘lockdown’ restrictions, regulation 2 powers were used to extend the retention deadline of almost 500 biometrics samples which had recently been taken, or which related to an existing NSD that was due to expire. Most of these cases remain outstanding and will need to be processed over the next few months. I have been assured that the NDES team will continue to receive surge support as they work through this backlog. Whilst the outlook is now much brighter with the rollout of the Covid-19 vaccine programme being well-underway, there nonetheless remains some uncertainty around the future impact of the virus and the need for correlative restrictions. It will therefore be important that CT Policing maintains some additional contingent resilience for this critical function.

The data also shows that throughout this six-month period chief officers have considered and granted a significant number of NSDs (307) in the normal way required by PoFA which my predecessor and most recently I have reviewed. I am therefore satisfied that the section 24 power has been used in a responsible and proportionate manner and only when scarcity of resources or time limitations meant that the biometrics of individuals assessed as presenting a real risk to national security might otherwise have been lost.

Having taken up my post on 1 March 2021 my involvement in the NSD process has come at the very end of the process established under the temporary provisions. Unfortunately, it is not possible to assess the contribution that the biometrics retained under the section 24 power have made in terms of managing the risk presented by the individuals to whom they relate. This is because full risk assessments of many of these cases have yet to be completed, and also as routine tracking of each NSD case is not possible within the current case management system. For these reasons the number of those same biometrics which have been, or which will subsequently be, judged as falling below the legal threshold for an NSD cannot be known. What can be said is that, overall, the section 24 regulations have safeguarded biometric information identified as being of national security value, although this has necessarily come at the expense of temporarily retaining some material for an extended period which has later been assessed not to warrant further retention on grounds of necessity and proportionality. To that extent, in balancing the lawful interference with individual rights against wider considerations of national security during the extraordinary exigencies arising from the pandemic, the latter have been temporarily given limited additional weight in the way foreseen when Parliament passed section 24 of the Act. I have seen nothing to indicate that the police have applied the provisions in anything other than the manner intended: necessarily, temporarily and proportionately. It is difficult to see how, in all the circumstances, any less intrusive workable alternative would have been available but there is evidence to show significant public support for a complete return to the systems protecting their rights before the exigencies of the pandemic^{[footnote 4]}. I am pleased to see from my second visit to the NDES team (in April) that the police and their partners in the NSD process have measures in place for a return to the established and enduring statutory process and my office will continue to support me as I for my part continue to work through a high volume of NSD cases over the next few months.

1. See: https://www.gov.uk/government/news/biometrics-commissioner-statement-on-the-coronavirus-act-and-the-protection-of-freedoms-act ↩

2. The relevant provisions within the Counter-Terrorism and Border Security Act 2019, which came into force in August 2020, have extended the NSD retention period to a maximum of five years. ↩

3. In contrast to the regime under section 63G of PACE 1984 (as amended by PoFA) where subjects must be informed of the police application to retain their biometrics for an extended period, provided the grounds on which the application is made and given an opportunity to make representations against this. ↩

4. A recent survey by the Law Society found that two thirds of people said that after the pandemic it is important that people have the same ability to uphold their rights: https://www.lawgazette.co.uk/news/rule-of-law-should-not-take-a-backseat-in-pandemic-surveyfinds/5107728.article ↩