The Face on the Bus Pass

The National Entitlement Card is Scotland’s bus pass. It is also the largest collection of faces any Scottish public body holds that no biometric regulator watches, and the one office built for the job cannot touch it.

Scotland has something no other part of the UK has: a biometrics regulator whose statutory remit reaches the face. The man who holds the post is asking Parliament for a law that does not yet exist. Police Scotland is pressing ahead toward live facial recognition. It put the question to a public “national conversation” in 2025, resolved to keep going, with a business case not expected before its oversight board until 2027 at the earliest.¹ The Scottish Biometrics Commissioner has written to ministers to say the technology should not go anywhere near a Scottish street until primary legislation governs it.² The regulator is telling you, on the record, that he cannot stop the thing he exists to watch.

What he can watch is narrow, and narrow by design. The Scottish Biometrics Commissioner Act 2020 gives him oversight of biometric data held for criminal justice and police purposes by three bodies: Police Scotland, the Scottish Police Authority, and the Police Investigations and Review Commissioner.³ The Code he enforces binds those three and no one else.⁴ The Commissioner says as much himself, warning of a “Biometric Wild West” in the spaces the law does not reach, objecting elsewhere in the same submission to police bulk-searching the passport and driving-licence databases for low-level crime.⁵ A handful of staff, a budget under £700,000, an office built on the stated assumption of no significant expansion.⁶ It watches one room.

Before the Act was passed, Open Rights Group Scotland and a sitting MSP argued that the Commissioner’s reach should run to biometrics wherever they are found, in education, in health, in retail. The point was made in 2018, and dropped; the private-sector half of it was arguably never Holyrood’s to grant, the public-sector half was, and both went down together.⁷ What replaced it is an oversight body for the police, and silence everywhere else. Asked in 2023 whether there were plans to use facial recognition in Scotland’s schools or its public services, the Scottish Government replied that it did not hold the information: school facial recognition, it said, is a matter for local authorities; for the rest, contact the bodies directly.⁸

That silence is where the largest of these holdings sits, and no one with biometric expertise is watching it. The National Entitlement Card is the bus pass, the young person’s card, the proof of age, the cashless school lunch, the key to a hundred council services. As of June 2026 there are 2,973,029 active cards.⁹ Every card issued from secondary-school age up carries a photograph. For a child carded through school, the photograph need not be taken for the card at all: one council’s privacy notice describes lifting it from the school’s own records, the SEEMiS system, and reusing it.¹⁰ From age eleven a pupil’s school photo becomes a record in the Card Management System, kept, in that notice’s words, “until you advise us you no longer require your card.”¹¹ Indefinitely, then. Thirty-two councils are joint controllers, the Improvement Service processes the applications through the national portal, the programme office sits inside Dundee City Council, and the photograph travels onward into the extract that proves identity across the country’s other public services.¹²

The scheme’s core privacy assessment dates from July 2020; a supplementary assessment in November 2021 covered new supplier contracts and the under-22 travel scheme, and neither revisits the photograph or the police-sharing arrangements.¹³ Its oversight, the government confirms, is ordinary data-protection housekeeping: a data protection officer, an annual audit, the auditors of public spending. Nothing biometric, and no specialist regulator anywhere in the chain.¹⁴

The law gives two answers to one question: is this photograph biometric data? Under the 2020 Act, a facial photograph capable of identifying a person is biometric data the moment it is held; the definition is broad and the wording is plain.¹⁵ Under UK GDPR, the same photograph stays ordinary until software is run across it to identify someone, becoming special-category biometric data only then. The councils hold to the second reading, and treat the card photograph as an ordinary passport snap; the Argyll and Bute school-route notice says in terms that it collects no special category data.¹⁶ The scheme’s own assessment, listing the reasons a DPIA was required at all, gives first that the scheme “processes special category data on a large scale”.¹⁷

The scheme’s own front door already crosses the line they draw. Applying through MyAccount, the route the councils use, an applicant can choose to verify identity with Yoti, which does so by facial recognition.¹⁸ That is a biometric face-match, run before a card exists, and the duty to account for it is the controller’s, not the applicant’s. Special-category processing at enrolment needs a lawful basis under Article 9, an assessment that weighs it, and a notice that tells the person it is happening. Only the third is done. The application service’s own notice describes the biometric face match, and names an Article 9 condition exactly once in twenty-five pages, for the documents a disabled-card applicant submits as proof. It names none for the face. The scheme’s assessment does not weigh the match either, and the council privacy statement quoted earlier, which says it collects no special-category data at all, says nothing about it.¹⁹²⁰ That a member of the public picked the verification route discharges nothing; the duty is the controller’s. Ending it needs no new statute. Enforcement of Article 9 belongs to the reserved regulator, which by and large waits to be asked, but the ministers and councils that run the scheme control the enrolment design, the notices and the assessment today, and could account for the match tomorrow.

The failure is not that they weighed the risk and got it wrong. It is that they never see a face as the thing to weigh. The scheme’s privacy paperwork is careful where it chooses to look: it fixes that suppliers process the data only within the UK; it moves to set retention periods for disability records; it asks whether a parent should see a child’s journey history.²¹ It settles where the data sits and never asks which jurisdiction can compel it, nor whether the photograph is biometric at all. The recognition already running at the front door appears nowhere in it. A stored face is matchable the day it is filed, and the software that reads it is no lawyer.

The usual reassurance is that none of it matters, because the photographs only make bus passes, and any police access is “case by case”.²² We now know how often. Freedom of information responses in June 2026 confirm that police access to the cardholder photograph runs through a standing tri-party data-sharing agreement between the programme office that operates the card, Police Scotland and British Transport Police; the photograph is one of the fields it covers, the gateway is the office’s “implied powers” rather than any statute, and every disclosure is a written request signed off by an officer of inspector rank or above.²³ Over three financial years the office granted 414 of 426 requests, close to 97 per cent, and released nearly four hundred card photographs; it holds no record of any of them being run for facial recognition, and the access log the scheme’s own privacy assessment promises, kept on a council SharePoint, has never been audited: asked, the council answered that no audit records are held.²⁴ A record no one is required to check is not oversight.

A last reassurance says the photographs get deleted anyway. One copy does. The online portal deletes its image within sixty days of the application being exported, two years for the Young Scot cards kept for proof-of-age audit; the Card Management System keeps the photograph for as long as you hold a card.²⁵ Deleting the application copy clears the queue, not the gallery.

Ask each keeper of the boundary in turn, and every answer is a nil return. The Scottish Biometrics Commissioner confirms on his own record that he has never been consulted about expanding the card, prepares no guidance on multi-purpose identity cards because they are not policing, and is “not involved in the NEC scheme” at all.²⁶ Police Scotland states that it does not use facial matching on photographs held under the scheme, and has made no requests for them for that purpose; the same response denies holding any agreement with a council, the Improvement Service or the programme office for access to the photographs at all, and six days later the programme office disclosed the standing agreement that names the force as a party.²⁷ And the Improvement Service, the body that operates the card and the address to which every deflection points, sits outside freedom of information law altogether: fourteen years on the government’s candidate list, and by its own mid-2025 workplan the research had yet to commence.²⁸ Individually, each answer reassures. Read together, they are the finding: no consultation, no guidance, no matching on anyone’s record, and an operator outside freedom of information. The absence is symmetrical across the regulator, the police and the statute book, and a boundary no one can inspect from any side is not a boundary. It is a hope.

The brake has rarely been the purpose written at the outset. Once built, a capability is pushed to the limit of what it can technically do. Local authorities were handed covert surveillance powers, and one used them to watch a family for three weeks to check which school catchment they lived in; the surveillance tribunal ruled it disproportionate.²⁹ England and Wales kept the DNA of people they never convicted until Strasbourg held it a breach of private life.³⁰ Police held more than nineteen million custody photographs, over sixteen million of them searchable by face, years after a court ruled the retention of the never-convicted unlawful.³¹ Number-plate cameras grew from catching stolen cars into tens of millions of reads a day, kept for a year.³² Clearview scraped over twenty billion images off the open web and sold access to police and security agencies abroad.³³ South Wales Police ran live facial recognition in the street until the Court of Appeal held its use was not in accordance with the law. They paused for three years, then resumed in 2023 once an independent study answered the equality-duty ground: nothing in the judgment, the force said, fundamentally undermined the use of the technology.³⁴ The pattern reaches civilian photo databases most directly of all: the passport and driving-licence collections were built to issue documents, and police now search them by face, which is the objection the Commissioner himself raises. Where a limit was set at all, a court or a statute set it, not the purpose written at the outset, and only after the capability had been defended to the last, with the public’s own money. The times it stopped are the times something with teeth was standing in the way, and the record grades the teeth: a ruling ignored for years, a judgment that held for three, a deletion that came only when Parliament legislated.

At least twelve police forces in England and Wales now use live facial recognition; the Metropolitan Police scanned more than 1.7 million faces in the first four months of 2026 alone.³⁵ And the demand has reached Scotland’s own inspectorate: in August 2026 the Chief Inspector of Constabulary called for facial recognition to be explored for keeping banned fans out of football grounds, framing the question as not whether to adopt the technology but how fast.³⁶ Live systems match against a watchlist, and no one loads millions of bus-pass photos into one. The exposure runs the other way. A standing database of faces is what retrospective search reaches for: one image run against the whole gallery after the fact, which is exactly the bulk-searching of passport and licence photos the Commissioner already warns against. Scotland has deployed none of the live kind, which is the opening, not the all-clear: it could be the first UK nation to govern the technology by primary legislation before it arrives rather than after.

Scotland has done the equivalent once. When Strasbourg struck down the English DNA regime, it used the Scottish statute as the measure: samples from the unconvicted kept only for adults charged with violent or sexual offences, for three years, extendable only by a sheriff. The Court called that position “of particular significance”, and named England, Wales and Northern Ireland as the only jurisdictions in the Council of Europe permitting indefinite retention of anyone suspected of anything. The same judgment attaches a duty to going first: “any State claiming a pioneer role in the development of new technologies bears special responsibility for striking the right balance in this regard.”³⁷ Holyrood wrote the narrower rule; Strasbourg used it to condemn the wider one.

The gallery would search badly, the fallback runs: a school photograph taken at eleven, aged out of likeness, lit however the assembly hall was lit. Grant it. A holding is not governed by its own poor quality. Every renewal swaps an old face for a current one, so the gallery improves by ordinary administration, and nobody is required to notice when a collection too ragged to search becomes one that searches cleanly. Incapacity decays. A limit has to be written down.

But the council database of Scottish faces already exists, and nothing with teeth stands between those faces and the decision to hand them over. The Commissioner’s writ starts only once police acquire; the gallery, and the choice to disclose from it, answer to no one. He watches the destination; no one watches the tap. Acquisition for policing is inside the remit, so of the two ends of a transfer, only the Police Scotland end is governed: the gallery escapes because it is held for the wrong purpose, the disclosure decision escapes because a council is not one of the three bodies, British Transport Police, the sharing agreement’s other force, is not one of the three either, and a 97 per cent grant rate is a fact about the discloser, whom nobody oversees. The fix has to stand at the tap: govern the discloser, and every requester is covered at source.

The Information Commissioner is no answer here: a UK-wide generalist, reactive by design, holding the very doctrine that a photograph is not biometric until software is run across it, under no duty to audit this holding and, by and large, waiting for a complaint before it acts.

The reasoning is older than the Commissioner. In 1995 the Strasbourg Commission held that retaining photographs taken at a public demonstration did not touch private life, because they “had not been entered in a data-processing system” and the authorities “had taken no steps to identify the persons photographed by means of data processing”.³⁸ The card gallery is a data-processing system whose purpose is identifying people. Neither thing the Commission relied on is true of it.

The point is not that a child’s bus-pass photo is being matched against a watchlist today. The point is that no one can tell you it is not, because no one is required to look, and the one body built to look was sent to the wrong room.

The comparison is with Police Scotland’s own holdings. The Commissioner’s own assurance review estimates more than three million images in Police Scotland’s systems, reviewed, audited and reported to Parliament, and record that the true total is unknown even there.³⁹ Those are images, not individuals: repeat shots of a far smaller population, on the order of 380,000 people on the criminal history system. The National Entitlement Card is close to one face per holder, across roughly two million people on the scheme’s own 2020 count.⁴⁰ Set the police number against a curated criminal-history gallery under active specialist review, and set two million council faces against no specialist review at all. And those two million faces are watched by no one with the word biometric in their job title.

The other objection asks why the bus pass, when the passport and driving-licence galleries are larger and hold the faces of most adults in the country. Because those galleries are reserved: Holyrood cannot legislate for them, which is why the Commissioner is reduced to writing to the Home Office about their bulk searching, though the Scottish end of that practice, Police Scotland’s own requests, already sits inside his Code’s reach.⁴¹ The National Entitlement Card is the population-scale civilian holding Scotland can govern. The settlement answers the question: the card is the one gallery whose keys are in Edinburgh.

None of this is an argument against the card, or against a single key to public services. A small country gains from not making its people prove who they are from scratch at every counter. The argument is against holding millions of facial photographs with no acknowledgement that they are biometric, no limit that names them as such and no one required to check the general limits hold, no audit that has ever opened the access log, no specialist regulator with the power to compel change, and no answer to the person whose face it is beyond one that is priced: you may have the record deleted, but only by surrendering the card, and with it the bus pass, the proof of age, the cashless lunch. A capability at this scale has to be acknowledged, constrained, audited, watched, and answerable. Move the perimeter; do not empty the vault.

In a survey run across the UK, Australia and the United States over the turn of 2019 into 2020, people backed the targeted use of facial recognition, the search for someone who has committed a crime, and pulled back sharply from the blanket kind, the tracking of the population at large; in all three countries a majority said they did not trust government to use the technology responsibly.⁴² Govern it and the licence follows; leave it ungoverned and it was never given.

There is a floor for all of this, and it governs use, not storage. Since February 2025 the European Union’s AI Act has banned the untargeted scraping of faces to build recognition databases, and the real-time biometric identification of the public by police outside narrow, authorised cases; the binding obligations for high-risk biometric systems follow, after a deferral adopted by the Parliament and Council in June 2026, in December 2027.⁴³ What Scotland lacks is not a rule about the database sitting still, but any rule about the moment it is used: the Code binds only the police, confers no power to prohibit, and triggers no legal action of its own when breached, which is why the Commissioner is reduced to asking for a law.

The floor is one Scotland says it wants: since 2021 its ministers have held a power, renewable but currently due to lapse in March 2027 unless extended, to keep devolved law in step with the EU’s.⁴⁴ Meeting the five tests at home would reach the parts of that floor that fall to devolved hands, the governance of Scotland’s own public bodies, with no one aiming for Brussels at all. Scotland cannot adopt the AI Act: data protection, and most of the levers around it, are reserved to Westminster.⁴⁵ But it can place duties on those bodies over how they use what they hold, the same devolved footing on which it already governs the police. That is alignment by good governance.

Different jurisdictions have chosen different tools, but they share a common principle: population-scale biometric data is governed, audited and answerable, and named in law for what it is. It is established international practice, and Scotland has joined it for the police but not for its civilian holdings. New Zealand looked at the nearest problem and, in 2025, issued an enforceable code for biometric processing that covers civilian use, under privacy law it already had, with no new statute and no new regulator. Its trigger is purpose: a face held for matching is biometric information before any software runs, an ordinary photograph is not, and once covered the code’s rules follow the information into storage.⁴⁶ Australia went further. Having rejected an ungoverned national identity card in the 1980s on civil-liberties grounds, it came back and built the governed version: a voluntary digital identity, independently accredited, regulated by two separate watchdogs, with binding limits on what may be collected and a public register of who is trusted to hold it.⁴⁷ Estonia, whose entire state runs on a national identity, gives citizens a log of who has looked at their records; it covers 15 of more than 300 state systems so far, and the justice ministry is legislating to make it mandatory for nearly all of them, which is its own verdict on partial coverage.⁴⁸ Illinois answers a narrower question, but answers it to the person: once a face is scanned into biometric form, the holder is liable to the individual directly, with a right to sue and damages that do not turn on proving harm.⁴⁹ Nearly every regime, the newest included, bites when software runs, and Illinois writes photographs out of its very definition of a biometric identifier. The stored holding is the blind spot everywhere, not a Scottish oversight. That is what makes the Scottish position unusual in the other direction: the 2020 Act already defines an identifying photograph as biometric the day it is filed. Scotland is not behind the world on this question. It is one short statute away from being ahead of it.

England and Wales are the cautionary tale. They have no statutory code for civilian biometrics at all, and the government that brought reform forward in 2023 proposed to abolish even the police biometrics watchdog; an independent report warned the change would leave “significant gaps” in oversight.⁵⁰ Scotland is proud of being the exception. The exception stops at the police-station door, and the faces on the other side of it have less protection in Scotland than a police-held fingerprint does. Run recognition across them and, in Wellington or Tallinn, an enforceable regime answers at once; in Scotland nothing specialist answers at all.

The United Kingdom has just run the experiment in public. A mandatory digital identity card, announced in 2025, drew nearly three million signatures against it, the second-largest petition on record; the new Prime Minister cancelled it within days of taking office, in July 2026, and announced that the £1.8 billion saved would go to energy bills. Read the small print and the saving is stranger than the scheme: the figure was a fiscal watchdog’s estimate for a programme with no budget line, disowned by the department’s own permanent secretary within days of publication, and never replaced.⁵¹ What did not stop is the machinery underneath: GOV.UK One Login and its wallet carried on, with a £280 million procurement naming “Digital ID” in its scope published three weeks before the cancellation and a tender expected in September.⁵² The card was the argument; the gallery was never on the ballot. Scotland should recognise the shape. It never announced a card at all. It issued one, nearly three million times, called it a bus pass, and the faces went in without a single petition.

The Act already lets Scottish Ministers add bodies to the Commissioner’s remit by regulation, and a statutory review of his functions is live as this is written, weighing exactly that.⁵³⁵⁴ But section 2(7) moves the bodies, not the purpose: the remit it extends still reaches only biometric data held for criminal justice and police purposes. Add the councils tomorrow and the bus-pass photographs still escape, because they are held for travel and proof of age, not for policing. The line is the statute’s, not the designers’: the Independent Advisory Group’s 2018 recommendation asked for a Commissioner keeping ‘all biometric data’ held by the police, the SPA and other public bodies under review, and the Act narrowed that to criminal justice and policing.⁵⁵ The review now debates extending the remit to more criminal-justice bodies, the prison service among them.⁵⁶ The response from his counterpart for England and Wales presses it to go further: to the prison service, to every body using biometrics for law enforcement and safeguarding, to the surveillance cameras councils operate. The photographs those same councils hold appear nowhere in it.⁵⁷ The largest holding of the lot, the council database of Scottish faces, is not in the room.

The advisers’ case for the narrow scope: police biometrics are taken under compulsion, much of the holding from people never convicted of anything, and they are used in decisions that deprive people of liberty; a card photograph is handed over for a bus pass. Aiming the new office at the sharpest harm first is a defensible order of operations, and the Group itself did not close the wider question: it recorded that oversight elsewhere in government was beyond its terms of reference, and that consideration could be given to extending the role.⁵⁸ The record since is the answer. The volunteered photograph is volunteered for travel, not for a standing tri-party sharing agreement the person is never told about; the child’s photograph is not volunteered at all, but lifted from a school system under a notice that says nothing about either; and the compulsion the advisers feared at the police station reappears at the counter, priced: surrender the card, and the bus with it, or stay in the gallery. Eight years on, the sharpest harm is governed and the largest holding is not. The order of operations was right. Stopping after step one was not.

The constitutional objection: data protection is reserved to Westminster; policing is devolved. A regulator whose remit is defined by the purpose the data serves sits on the devolved side of that line. Define the remit by the data instead, biometric wherever it is held and whatever it is held for, and the office starts to look like a data-protection regulator wearing a Scottish badge, which Holyrood cannot create. Read that way, section 2(1)’s purpose lock is not a drafting timidity but a competence boundary, and it would explain both why the Act was drawn so tight and why the live review reaches for the add-a-body power rather than the wider purpose. The answer is the one the Act itself relies on: Holyrood cannot regulate data protection, but it can place duties on its own public bodies about the conduct of their own functions, the footing the police Code already stands on. A bill written as governance of Scottish public bodies, what they must acknowledge, what they must audit, whom they must answer, is devolved housekeeping, not data-protection law. The drafting has to be done with the reservation open on the desk, and someone will test it. That is a reason to draft carefully, not a reason to leave two million faces unwatched.

Audit the log, correct the notices, rewrite the assessment, put the sharing on an express footing, and leave the architecture alone. But each of those fixes already had an owner. The impact assessment existed, and never asked whether the photograph is biometric. The access log existed, and nobody opened it. The privacy notices existed, and told no one about the sharing agreement. The agreement itself existed, and rested on implied powers. These are not lapses a better housekeeper would have caught; they are what a holding produces when no one is required to look, and a correction made under attention lasts as long as the attention. Fix all four tomorrow and the machinery that produced them stands untouched. That is why the tests say watched, and not merely fixed.

The route in is primary legislation: widening the purpose the Commissioner is allowed to watch, and giving the office the powers and the budget the current Code lacks. Widen the remit of a four-person office that cannot prohibit anything, and you move the boundary while changing nothing behind it. That legislation is the same kind of vehicle the Commissioner is already demanding for live facial recognition. The government’s answer so far is that legislating now would be premature, the police business case being two years away, which is exactly the drift the Commissioner is warning about: the moment to write the law is before the deployment is on the desk.⁵⁹ When that bill comes, his ask and this one could ride it together. It need not be the policing Code. New Zealand shows how light the instrument can be, a code issued by the existing privacy regulator under existing law, though a Scottish version would have to do what the Wellington code does not and reach the holding itself. Scotland cannot copy the route in any case: data protection is reserved, so its generalist regulator is not Scotland’s to direct, and the one that does hold the remit has sat on the photograph-is-not-biometric doctrine for years without acting. The devolved move is to legislate for its own bodies. Do that, and that part of the European floor arrives as a side effect, for the price of governing your own house.

The bill tracks the five tests. Name an identifying facial photograph held at population scale as biometric data for the purposes of every duty the bill creates, the move the 2020 Act’s own definition already makes, so that within Scotland’s governance of its own bodies a holding cannot be called ordinary to slip the definition. What the photograph is called under UK data-protection law stays Westminster’s; the bill does not need it. Fix the purposes it may be put to, as a rule of each body’s own conduct, and bar the rest, so a database gathered for travel and proof of age cannot quietly become a search index. Constrained is the thinnest of the five today: the sharing agreement does confine police requests to serious crime and vital interests, but a limit the parties wrote for themselves on implied powers is a limit the same parties can rewrite, and the version disclosed carries a duration clause that ran out in September 2024, with 135 requests processed in the financial year after that date; constraint that counts is enforced from outside.⁶⁰ Put a positive duty to audit on a named office, with power to compel disclosure and to open the access logs the scheme already keeps and never checks. And put the person whose face it is back in the room, by duty on the holder: a duty to tell people the holding exists, a duty to show them who has reached into it, and a duty to hear an objection without pricing it at the card and every service that rides on it. Acknowledged, constrained, audited, watched, answerable, written down as duties rather than named as virtues.

Scotland built the regulator the rest of the UK keeps wishing it had, and aimed it at the one part of the problem already under the brightest light. The unwatched faces are not the ones in police custody, which are watched, reviewed and reported to Parliament. They are the millions of faces in a council database, gathered for a bus pass, lifted in childhood from a school camera, called ordinary by the people who hold them, and watched, in any specialist sense, by no one at all.

airt.scot · July 2026, revised August 2026. Free to use, in whole or chopped into little pieces, provided the source is acknowledged. (CC BY 4.0)