The Face on the Bus Pass

The National Entitlement Card is Scotland’s bus pass. It is also the largest collection of faces any Scottish public body holds that no biometric regulator watches, and the one office built for the job cannot touch it.

Scotland has something no other part of the UK has: a biometrics regulator whose statutory remit reaches the face. And right now the man who holds the post is asking Parliament for a law that does not yet exist. Police Scotland is pressing ahead toward live facial recognition. It put the question to a public “national conversation” in 2025, resolved to keep going, and expects to bring a business case to its oversight board in 2027.¹ The Scottish Biometrics Commissioner has written to ministers to say the technology should not go anywhere near a Scottish street until primary legislation governs it.² The regulator is telling you, on the record, that he cannot stop the thing he exists to watch.

What he can watch is narrow, and narrow by design. The Scottish Biometrics Commissioner Act 2020 gives him oversight of biometric data held for criminal justice and police purposes by three bodies: Police Scotland, the Scottish Police Authority, and the Police Investigations and Review Commissioner.³ The Code he enforces binds those three and no one else.⁴ The Commissioner says as much himself, warning of a “Biometric Wild West” in the spaces the law does not reach, objecting in the same breath to police bulk-searching the passport and driving-licence databases for low-level crime.⁵ A handful of staff, a budget under £700,000, an office built on the stated assumption of no significant expansion.⁶ It watches one room.

None of this is news. Before the Act was passed, Open Rights Group Scotland and a sitting MSP argued that the Commissioner’s reach should run to biometrics wherever they are found, in education, in health, in retail. The point was made in 2018, and dropped.⁷ What replaced it is an oversight body for the police, and silence everywhere else. Asked in 2023 whether there were plans to use facial recognition in Scotland’s schools or its public services, the Scottish Government replied that it did not hold the information: school facial recognition, it said, is a matter for local authorities; for the rest, contact the bodies directly.⁸

That silence is where the largest of these holdings sits, and no one with biometric expertise is watching it. The National Entitlement Card is the bus pass, the young person’s card, the proof of age, the cashless school lunch, the key to a hundred council services. As of June 2026 there are 2,973,029 active cards.⁹ Every card issued from secondary-school age up carries a photograph. For a child carded through school, the photograph need not be taken for the card at all: one council’s privacy notice describes lifting it from the school’s own records, the SEEMiS system, and reusing it.¹⁰ From age eleven a pupil’s school photo becomes a record in the Card Management System, kept, in that notice’s words, “until you advise us you no longer require your card.”¹¹ Indefinitely, then. Thirty-two councils are joint controllers, the Improvement Service processes the applications through the national portal, the programme office sits inside Dundee City Council, and the photograph travels onward into the extract that proves identity across the country’s other public services.¹²

The scheme’s core privacy assessment dates from July 2020; a supplementary assessment in November 2021 covered new supplier contracts and the under-22 travel scheme, and neither revisits the photograph or the police-sharing arrangements.¹³ Its oversight, the government confirms, is ordinary data-protection housekeeping: a data protection officer, an annual audit, the auditors of public spending. Nothing biometric, and no specialist regulator anywhere in the chain.¹⁴

The law gives two answers to one question: is this photograph biometric data? Under the 2020 Act, a facial photograph capable of identifying a person is biometric data the moment it is held; the definition is broad and the wording is plain.¹⁵ Under UK GDPR, the same photograph stays ordinary until software is run across it to identify someone, becoming special-category biometric data only then. The councils hold to the second reading, and treat the card photograph as an ordinary passport snap; the Argyll and Bute school-route notice says in terms that it collects no special category data.¹⁶ Yet the scheme’s own front door already crosses the line they draw. Applying through MyAccount, the route the councils use, an applicant verifies identity with Yoti, which does so by facial recognition.¹⁷ That is a biometric face-match, run before a card exists, and the duty to account for it is the controller’s, not the applicant’s. Special-category processing at enrolment needs a lawful basis under Article 9, an assessment that weighs it, and a notice that tells the person it is happening. The scheme’s paperwork does none of the three: the recognition appears in no council privacy notice and nowhere in the assessment. That a member of the public picked the verification route discharges nothing; the duty is the controller’s, and the person is never told.

The failure is not that they weighed the risk and got it wrong. It is that they never see a face as the thing to weigh. The scheme’s privacy paperwork is careful where it chooses to look: it fixes that suppliers process the data only within the UK; it sets retention periods for disability records; it asks whether a parent should see a child’s journey history.¹⁸ It settles where the data sits and never asks which jurisdiction can compel it, nor whether the photograph is biometric at all. The recognition already running at the front door appears nowhere in it. A stored face is matchable the day it is filed, and the software that reads it is no lawyer.

The usual reassurance is that none of it matters, because the photographs only make bus passes, and any police access is “case by case”.¹⁹ We now know how often. Freedom of information responses in June 2026 confirm that police access to the cardholder photograph runs through a standing tri-party data-sharing agreement between the programme office that operates the card, Police Scotland and British Transport Police; the photograph is one of the fields it covers, the gateway is the office’s “implied powers” rather than any statute, and every disclosure is a written request signed off by an officer of inspector rank or above.²⁰ Over three financial years the office granted about 414 of 426 requests, close to 97 per cent, and released nearly four hundred card photographs; it holds no record of any of them being run for facial recognition, identity confirmation rather than gallery matching, and the access log the scheme’s own privacy assessment promises, kept on a council SharePoint, has never been audited: asked, the council answered that no audit records are held.²¹ A record no one is required to check is not oversight. A last reassurance says the photographs get deleted anyway. One copy does. The online portal deletes its image within sixty days of the application being exported, two years for the Young Scot cards kept for proof-of-age audit; the Card Management System keeps the photograph for as long as you hold a card.²² Deleting the application copy clears the queue, not the gallery.

The deeper answer is that the brake has rarely been the purpose written at the outset. Once built, a capability is pushed to the limit of what it can technically do. Local authorities were handed covert surveillance powers, and one used them to watch a family for three weeks to check which school catchment they lived in; the surveillance tribunal ruled it disproportionate.²³ England kept the DNA of people it never convicted until Strasbourg ordered it to stop.²⁴ Police held more than nineteen million custody photographs, over sixteen million of them searchable by face, years after a court ruled the retention of the never-convicted unlawful.²⁵ Number-plate cameras grew from catching stolen cars into tens of millions of reads a day, kept for a year.²⁶ Clearview scraped twenty billion faces off the open web and sold the result to police forces.²⁷ South Wales Police ran live facial recognition in the street until the Court of Appeal ruled its use unlawful.²⁸ The pattern reaches civilian photo databases most directly of all: the passport and driving-licence collections were built to issue documents, and police now search them by face, which is the objection the Commissioner himself raises. Where a limit was set at all, a court or a statute set it, not the purpose written at the outset, and only after the capability had been defended to the last, with the public’s own money. The times it stopped are the times something with teeth was standing in the way.

The demand for faces is not hypothetical. Thirteen police forces in England and Wales now use live facial recognition; the Metropolitan Police scanned more than 1.7 million faces in the first four months of 2026 alone.²⁹ Live systems match against a watchlist, and no one loads millions of bus-pass photos into one. The exposure runs the other way. A standing database of faces is what retrospective search reaches for: one image run against the whole gallery after the fact, which is exactly the bulk-searching of passport and licence photos the Commissioner already warns against. Scotland has deployed none of the live kind, which is the opening, not the all-clear: it could be the first UK nation to govern the technology by primary legislation before it arrives rather than after. But the council database of Scottish faces already exists, and nothing with teeth stands between those faces and whatever use is found for them next. The Information Commissioner is no answer here: a UK-wide generalist, reactive by design, holding the very doctrine that a photograph is not biometric until software is run across it, under no duty to audit this holding and, by and large, waiting for a complaint before it acts. The point is not that a child’s bus-pass photo is being matched against a watchlist today. The point is that no one can tell you it is not, because no one is required to look, and the one body built to look was sent to the wrong room.

The comparison people reach for is the wrong one. The Commissioner’s reviews estimate more than three million images in Police Scotland’s systems, reviewed, audited and reported to Parliament, and record that the true total is unknown even there.³⁰ Those are images, not individuals: repeat shots of a far smaller population, on the order of 380,000 people on the criminal history system. The National Entitlement Card is close to one face per holder, across roughly two million people on the scheme’s own 2020 count.³¹ Set the police number against a curated criminal-history gallery under active specialist review, and set two million council faces against no specialist review at all. If even the watched holding cannot state its own total, that is the measure of what unwatched looks like everywhere else. And those two million faces are watched by no one with the word biometric in their job title.

None of this is an argument against the card, or against a single key to public services. A small country gains from not making its people prove who they are from scratch at every counter. The argument is against holding millions of facial photographs with no acknowledgement that they are biometric, no limit that names them as such and no one required to check the general limits hold, no independent audit, no specialist regulator with the power to compel change, and no answer to the person whose face it is beyond one that is priced: you may have the record deleted, but only by surrendering the card, and with it the bus pass, the proof of age, the cashless lunch. A capability at this scale has to be acknowledged, constrained, audited, governed, and answerable. This one is none of the five. Move the perimeter; do not empty the vault.

The public is already standing on this ground. People back the targeted use of facial recognition, the search for someone who has committed a crime, and pull back sharply from the blanket kind, the tracking of the population at large; in the three countries surveyed a majority said they did not trust government to use the technology responsibly.³² Govern it and the licence follows; leave it ungoverned and it was never given.

There is a floor for all of this, and it governs use, not storage. Since February 2025 the European Union’s AI Act has banned the untargeted scraping of faces to build recognition databases, and the real-time biometric identification of the public by police outside narrow, authorised cases; the binding obligations for high-risk biometric systems follow, after a deferral adopted by the Parliament and Council in June 2026, in December 2027.³³ What Scotland lacks is not a rule about the database sitting still, but any rule about the moment it is used: the Code binds only the police, confers no power to prohibit, and triggers no legal action of its own when breached, which is why the Commissioner is reduced to asking for a law.

The floor is one Scotland says it wants: since 2021 its ministers have held a power, renewable but currently due to lapse in March 2027 unless extended, to keep devolved law in step with the EU’s.³⁴ Meeting the five tests at home would reach the parts of that floor that fall to devolved hands, the governance of Scotland’s own public bodies, with no one aiming for Brussels at all. Scotland cannot adopt the AI Act: data protection, and most of the levers around it, are reserved to Westminster.³⁵ But it can place duties on those bodies over how they use what they hold, the same devolved footing on which it already governs the police. That is alignment by good governance.

Different jurisdictions have chosen different tools, but they share a common principle: population-scale biometric data is governed, audited and answerable, and named in law for what it is. It is established international practice, and Scotland has joined it for the police but not for its civilian holdings. New Zealand looked at the same problem and, in 2025, issued an enforceable code for biometric processing that covers civilian use, under privacy law it already had, with no new statute and no new regulator.³⁶ Australia went further. Having rejected an ungoverned national identity card in the 1980s on civil-liberties grounds, it came back and built the governed version: a voluntary digital identity, independently accredited, regulated by two separate watchdogs, with binding limits on what may be collected and a public register of who is trusted to hold it.³⁷ Estonia, whose entire state runs on a national identity, gives every citizen a log of who has looked at their records.³⁸ Illinois answers a narrower question, but answers it to the person: once a face is scanned into biometric form, the holder is liable to the individual directly, with a right to sue and damages that do not turn on proving harm.³⁹

England and Wales are the cautionary tale. They have no statutory code for civilian biometrics at all, and the government that brought reform forward in 2023 proposed to abolish even the police biometrics watchdog; an independent report warned the change would leave “significant gaps” in oversight.⁴⁰ Scotland is rightly proud of being the exception. The exception stops at the police-station door, and the faces on the other side of it have less protection in Scotland than a police-held fingerprint does. Run recognition across them and, in Wellington or Tallinn, an enforceable regime answers at once; in Scotland nothing specialist answers at all.

The Act already lets Scottish Ministers add bodies to the Commissioner’s remit by regulation, and a statutory review of his functions is live as this is written, weighing exactly that.⁴¹⁴² But section 2(7) moves the bodies, not the purpose: the remit it extends still reaches only biometric data held for criminal justice and police purposes. Add the councils tomorrow and the bus-pass photographs still escape, because they are held for travel and proof of age, not for policing. The Independent Advisory Group that designed the post drew that line in 2018, confining its recommendation to policing; the review now debates extending it to more criminal-justice bodies, the prison service among them.⁴³ The largest holding of the lot, the council database of Scottish faces, is not in the room.

Reaching it needs the other way in: primary legislation, widening the purpose the Commissioner is allowed to watch, and giving the office the powers and the budget the current Code lacks. Widen the remit of a four-person office that cannot prohibit anything, and you move the boundary while changing nothing behind it. That legislation is the same kind of vehicle the Commissioner is already demanding for live facial recognition, and Parliament will have a biometrics bill open in any case; his ask and this one could ride it together. It need not be the policing Code. New Zealand shows a lighter instrument can carry the weight, a code issued by the existing privacy regulator under existing law. Scotland cannot simply copy that route: data protection is reserved, so its generalist regulator is not Scotland’s to direct, and the one that does hold the remit has sat on the photograph-is-not-biometric doctrine for years without acting. The devolved move is to legislate for its own bodies. Do that, and that part of the European floor arrives as a side effect, for the price of governing your own house.

What that bill has to say is not mysterious, and it tracks the five tests. Name an identifying facial photograph held at population scale as biometric data in statute, so a holding cannot be called ordinary to slip the definition. Fix the purposes it may be put to and bar the rest, so a database gathered for travel and proof of age cannot quietly become a search index. Put a positive duty to audit on a named office, with power to compel disclosure and to open the access logs the scheme already keeps and never checks. And give the person whose face it is a way to answer back: to know the holding exists, to see who has reached into it, and to object without surrendering the card and every service that rides on it. Acknowledged, constrained, audited, governed, answerable, written down as duties rather than named as virtues.

Scotland built the regulator the rest of the UK keeps wishing it had, and aimed it at the one part of the problem already under the brightest light. The unwatched faces are not the ones in police custody, which are watched, reviewed and reported to Parliament. They are the millions of faces in a council database, gathered for a bus pass, lifted in childhood from a school camera, called ordinary by the people who hold them, and watched, in any specialist sense, by no one at all.

airt.scot · July 2026. Free to use, in whole or chopped into little pieces, provided the source is acknowledged. (CC BY 4.0)