Scotland biometrics commish wants ICO to look into cops use of cloud

After Microsoft revealed that it could not guarantee the sovereignty of UK policing data hosted on its cloud servers, the Scottish biometrics watchdog has called on a formal investigation into Scotland’s police use of the U.S. company’s cloud services.

Police in Scotland have been using the cloud for its Digital Evidence Sharing Capability (DESC), a £33 ­million (US$42 million) evidence-sharing IT system designed to provide easier access to CCTV footage, photographs and other data – including biometrics.

Microsoft, however, admitted last month that it could not guarantee policing data uploaded into DESC would remain in the UK. U.S. Companies must abide by the U.S. Cloud Act, which allows federal law enforcement agencies to compel domestic companies to provide data stored on servers regardless of whether the data is owned by a firm based outside the U.S.

Scottish biometrics commissioner Brian Plastow says that Microsoft’s revelation has led to uncertainty over police use of its cloud services, Computer Weekly reports. This was compounded by the recent discovery that Police Scotland chose not to formally consult on deploying the cloud-based system with the UK’s data regulator, the Information Commissioner Office (ICO).

“I would welcome an investigation by the ICO into whether the specific law enforcement processing arrangements for DESC by Police Scotland and DESC partners in Scotland, which includes biometric data, is fully compliant with UK data protection law,” says Plastow.

According to the Scottish Biometrics Commissioner’s Code of Practice, Police Scotland must ensure that biometric data is protected from unauthorized access and disclosure under UK GDPR and the Data Protection Act 2018, he adds.

Plastow’s warnings over the legality of using Azure began in April last year after it was found that the DESC service was contracted to body-worn video provider Axon and hosted on Azure without major data protection questions being resolved. The DESC pilot was launched in January 2023.

The ICO has already issued a police cloud guidance but was criticized by data protection experts for being too “generic,” according to Computer Weekly.

Article Topics

biometric data  |  biometrics  |  cloud services  |  data storage  |  Information Commissioner’s Office (ICO)  |  Microsoft  |  police  |  Scotland  |  Scottish Biometrics Commissioner