Scottish Biometrics Commissioner

What Scottish Biometrics Commissioner does

The Scottish Biometrics Commissioner (SBC) is an independent statutory oversight body established by the Scottish Biometrics Commissioner Act 2020. Its function is to review law, policy, and practice relating to the acquisition, retention, use, and destruction of biometric data (fingerprints, DNA, and photographic images) for policing and criminal justice purposes in Scotland. The Commissioner's statutory functions extend only to Police Scotland, the Scottish Police Authority (SPA, including Forensic Services), and the Police Investigations and Review Commissioner (PIRC). The SBC does not develop or operate biometric technology systems; its core regulatory products are the statutory Code of Practice (in legal effect since 16 November 2022), the National Assessment Framework, formal Compliance Assessments, thematic Assurance Reviews (covering DNA, fingerprints, images, retrospective facial search, and vulnerable groups), and published Guidance.

The SBC operates from a self-contained secure office within Bridgeside House, Edinburgh (99 McDonald Road, EH7 4NS), on a hybrid working model with a deliberately small team led by Commissioner Dr Brian Plastow and supported by a Director (Cheryl Glen), an Operations Manager (Diego Quiroz), a Subject Matter Expert (Karen McBride), and a Business Support Officer, drawing on staff from both police and non-police backgrounds. There is no commercial revenue stream: funding is provided through the Scottish Parliamentary Corporate Body (SPCB) via an annual budget bid, and the SBC has operated within budget for four consecutive years. Delivery channels are direct oversight and reporting to the Scottish Parliament, formal compliance assessments of the three named bodies, complaints handling, public consultations, stakeholder workshops, conference speaking (including the Biometrics Institute Congress), and social media/newsletter engagement. Strategic direction is set by the Strategic Plan 2025-2029, approved by Parliament and laid before it on 10 November 2025, and supported by joint assurance reviews with academic and inspectorate partners (HMICS, Leverhulme Research Centre for Forensic Science).

Name

Scottish Biometrics Commissioner

Legal name

Scottish Biometrics Commissioner

Website

https://biometricscommissioner.scot

Company type

Private

Founded year

2021

Operating status

Operating

Headcount range

1–10 employees

Short description

The Scottish Biometrics Commissioner is an independent statutory body, established under the 2020 Act, that regulates biometric data practices of Police Scotland, the Scottish Police Authority, and PIRC, overseeing acquisition, retention, use, and destruction of fingerprints, DNA, and images.

Ownership category

akta.pro rank

Product category

Biometrics Regulatory Oversight

NAICS

Police Protection (92212)

SIC

Services-Detective, Guard & Armored Car Services (7381)

akta.pro primary industry

Data Protection, Privacy & Cybersecurity Regulators (BPAIAOAH)

Keywords

• Biometrics oversight
• Regulatory compliance
• Criminal justice
• Data protection
• Police accountability

Headquarters

HQ city

Edinburgh

HQ country

United Kingdom

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations

Revenue model

1. Scottish Parliamentary Corporate Body Funding: Funding is provided through the Scottish Parliamentary Corporate Body (SPCB). The Scottish Biometrics Commissioner Act 2020 provides for the SPCB to pay the salary and expenses of the Commissioner, and any expenses incurred in the exercise of the Commissioner's functions. Each year the SBC submits an estimated bid for funding to the SPCB. The SBC has operated within budget for four consecutive years. As a public regulatory body, the SBC does not generate commercial revenue.

Go-to-market motion1 record

Distribution channels3 records

Marketing channels8 records

Core offering

The Scottish Biometrics Commissioner is an independent statutory oversight body that promotes and enforces the lawful, effective, and ethical acquisition, retention, use, and destruction of biometric data (fingerprints, DNA, and photographic images) for criminal justice and policing purposes in Scotland. Its core offering is the statutory Code of Practice, supported by Compliance Assessments, Assurance Reviews, the National Assessment Framework, and Guidance documents directed at Police Scotland, the Scottish Police Authority, and the Police Investigations and Review Commissioner. The SBC has authority to investigate complaints and serve compliance notices.

Product overview

The Scottish Biometrics Commissioner operates as a regulatory oversight body, not a technology product company. The Commissioner's 'products' are regulatory instruments and oversight mechanisms including: the statutory Code of Practice (the primary regulatory document governing biometric data handling), the National Assessment Framework (methodology for conducting assessments), Compliance Assessments (formal compliance verification), Assurance Reviews (thematic investigations into specific biometric data areas), and Guidance documents. These products work together to provide independent oversight ensuring biometric data is acquired, retained, used and destroyed in a lawful, effective and ethical manner by Police Scotland, the Scottish Police Authority, and the Police Investigations and Review Commissioner.

Differentiator

Problem solved

Functional benefit

Products and services

• Code of Practice A statutory Code of Practice governing the acquisition, retention, use and destruction of biometric data (fingerprints, DNA, photographic images) for criminal justice and policing purposes in Scotland. The Code applies to Police Scotland, the Scottish Police Authority, and the Police Investigations and Review Commissioner and has legal effect.
• National Assessment Framework

Quantifiable outcome

• Zero breaches of the Code of Practice since it took legal effect on 16 November 2022
• +2 more outcomes

Named customers3 records

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Partnerships

13 partnerships are on record, tiered core, major and supporting.

• Scottish GovernmentcoreStrategic or Co-development Partner · 31 October 2024The SBC and Scottish Government jointly published a report on the Review of the Laws of Retention for Biometric Data under sections 18-19C of the Criminal Procedure (Scotland) Act 1995. The SBC's Strategic Plan 2025-2029 was approved by the Scottish Parliament. Scottish Ministers gave approval for the Code of Practice under Section 12 of the SBC Act 2020.
• Police ScotlandcoreStrategic or Co-development PartnerPolice Scotland is the primary body to whom the SBC's statutory functions extend. The SBC conducts compliance assessments and assurance reviews of Police Scotland's acquisition, retention, use and destruction of biometric data. The SBC investigates complaints against Police Scotland regarding Code of Practice breaches. Police Scotland has remained compliant with the SBC's Code of Practice since November 2022.
• Scottish Police Authority (SPA)coreStrategic or Co-development PartnerThe SPA is one of the bodies to whom the SBC's functions extend. SPA Forensic Services processes biometric samples and retains data on behalf of Police Scotland. The SBC conducts compliance assessments and joint activities with the SPA, including joint Assurance Reviews and attendance at SPA Board meetings.
• Police Investigations and Review Commissioner (PIRC)coreStrategic or Co-development PartnerPIRC is one of the bodies to whom the SBC's statutory functions extend. The SBC conducts compliance assessments of PIRC's biometric practices and PIRC has remained compliant with the Code of Practice since November 2022.
• Leverhulme Research Centre for Forensic SciencemajorStrategic or Co-development PartnerThe Leverhulme Research Centre for Forensic Science (University of Dundee) partnered with the SBC on the joint DNA Assurance Review published in February 2025. The SBC has expressed concern about the potential closure of the Leverhulme Institute of Forensic Science.
• HM Inspectorate of Constabulary in Scotland (HMICS)majorStrategic or Co-development PartnerHMICS partnered with the SBC on the joint Assurance Review of Retrospective Facial Search published in March 2025. HMICS is one of the bodies with whom the SBC collaborates on assurance reviews of biometric practices.
• Evaluation Support ScotlandsupportingStrategic or Co-development PartnerEvaluation Support Scotland assisted the SBC in developing its Outcomes Based Theory of Change Logic Model and Outcomes Framework for the 2025-2029 Strategic Plan. They facilitated sessions to help identify how best the SBC evidences outcomes and impact.
• Biometrics InstitutemajorStrategic or Co-development PartnerThe SBC is a member of the Biometrics Institute and the Commissioner gave a keynote address at the Biometrics Institute Congress 2025 in London. The SBC Director spoke at a side event alongside FBI, Meta, Big Brother Watch, and the United Nations on AI and Facial Recognition. The SBC republished a video from the Biometrics Institute on ethical facial recognition use.
• Scottish ParliamentcoreStrategic or Co-development PartnerThe SBC is accountable to the Scottish Parliament. The Parliament's Criminal Justice Committee approved the Code of Practice and the SBC regularly lays reports before Parliament. The SBC appears before parliamentary committees to give evidence and the SBC is supported by the Scottish Parliamentary Corporate Body (SPCB).
• Scottish Police Authority and Diffley PartnershipsupportingStrategic or Co-development PartnerThe SBC collaborated with the SPA and Diffley Partnership on the 2025 Public Attitudes Survey on police use of biometric data. The survey showed maintained and modestly improved levels of public confidence in biometrics use in Scottish policing.
• RSA Network ScotlandsupportingStrategic or Co-development PartnerThe SBC engaged with civil society through online discussion forums such as the RSA network in Scotland as part of its public consultation on the Code of Practice. RSA (Royal Society for the encouragement of Arts, Manufactures and Commerce) provided a platform for public discussion on biometrics policy.
• Information Commissioner (ICO)supportingOthersThe ICO is listed as a body the SBC may work jointly with, assist, or consult under Section 3 of the SBC Act 2020. The SBC wrote to the ICO requesting an investigation into the Digital Evidence Sharing Capability (DESC) project. The SBC signed a petition calling for the ICO to be 'reset'.
• Scottish Human Rights CommissionsupportingOthersThe Scottish Human Rights Commission is listed as a body the SBC may work jointly with, assist, or consult under Section 3 of the SBC Act 2020. It was consulted as part of the statutory consultation on the Code of Practice.

Scale indicators4 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• Irish Data Protection Commission: National data protection regulator for Ireland. Functionally similar to the SBC as an independent statutory regulator handling biometric data, conducting investigations, and publishing guidance within a single national jurisdiction.
• European Data Protection Supervisor (EDPS): Independent EU data protection authority overseeing EU institutions and advising on policy. Comparable as a specialist biometric and data protection regulator operating across a defined jurisdiction with compliance assessment and guidance powers analogous to the SBC's Code of Practice.

Emerging players

• Her Majesty's Inspectorate of Constabulary in Scotland (HMICS): Independent inspectorate scrutinizing Police Scotland. A direct strategic partner of the SBC on joint assurance reviews (e.g., the Retrospective Facial Search review, March 2025), with overlapping police-oversight mandate but a broader thematic scope than the SBC.

Regional players

• Scottish Information Commissioner: Independent Scottish regulator enforcing freedom of information and environmental information rights. Comparable in being a small, independent Scottish public body with oversight, complaint-handling, and guidance functions analogous to the SBC's regulatory approach.

Direct peers

• Information Commissioner's Office (ICO): UK-wide data protection and information rights regulator. Directly comparable as an independent statutory regulator that has absorbed the former English/Welsh Biometrics and Surveillance Camera Commissioner role; the SBC engages with the ICO under Section 3 of the 2020 Act and has jointly investigated initiatives like DESC.
• Investigatory Powers Commissioner's Office (IPCO): Independent UK body overseeing the use of investigatory powers by intelligence agencies, police, and public authorities. Comparable to the SBC in being a small, statute-based independent oversight body with judicial leadership, public reporting duties, and a narrow but critical remit.
• Surveillance Camera Commissioner (UK): UK oversight role focused on surveillance camera code of practice. Closely comparable to the SBC as a statutory commissioner role covering a defined surveillance/biometric technology area with compliance and guidance functions, though the office has been wound down and absorbed by the ICO.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/ScotBiometrics
• YouTubeyoutube.com/@scottishbiometricscommissi2754
• Facebookfacebook.com/people/Scottish-Biometrics-Commissioner/100080636025564
• LinkedInlinkedin.com/company/scottish-biometrics-commissioner

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Scottish Biometrics Commissioner