The Face on the Bus Pass

The National Entitlement Card is Scotland’s bus pass. It is also the largest collection of Scottish faces no biometric regulator watches, and the one body built to watch biometrics cannot touch it.

Scotland has something no other part of the UK has: a biometrics regulator whose statutory remit reaches the face. And right now the man who holds the post is asking Parliament for a law that does not yet exist. Police Scotland is pressing ahead toward live facial recognition. It put the question to a public “national conversation” in 2025, resolved to keep going, and expects to put a business case to its oversight board in 2027.¹ The Scottish Biometrics Commissioner has written to ministers to say the technology should not go anywhere near a Scottish street until primary legislation governs it.² The regulator is telling you, on the record, that he cannot stop the thing he exists to watch.

What he can watch is narrow, and narrow by design. The Scottish Biometrics Commissioner Act 2020 gives him oversight of biometric data held for criminal justice and police purposes by three bodies: Police Scotland, the Scottish Police Authority, and the Police Investigations and Review Commissioner.³ The Code he enforces binds those three and no one else.⁴ The Commissioner says as much himself, warning of a “Biometric Wild West” in the spaces the law does not reach, objecting in the same breath to police bulk-searching the passport and driving-licence databases.⁵ A handful of staff, a budget under £700,000, an office built on the stated assumption of no significant expansion.⁶ By design, it watches one room.

None of this is news. Before the Act was passed, Open Rights Group Scotland and a sitting MSP argued that the Commissioner’s reach should run to biometrics wherever they are found, in education, in health, in retail. The point was made in 2018, and dropped.⁷ What replaced it is an oversight body for the police, and silence everywhere else. Asked in 2023 whether facial recognition was being used in Scotland’s schools or its public services, the Scottish Government replied that it did not hold the information: school facial recognition, it said, is a matter for local authorities; for the rest, contact the bodies directly.⁸

That silence is where the largest of these holdings sits, and no one with biometric expertise is watching it. The National Entitlement Card is the bus pass, the young person’s card, the proof of age, the cashless school lunch, the key to a hundred council services. As of June 2026 there are 2,973,029 active cards.⁹ Every card issued from secondary-school age up carries a photograph. For a child carded through school, the photograph need not be taken for the card at all: one council’s privacy notice describes lifting it from the school’s own records, the SEEMiS system, and reusing it.¹⁰ From age eleven a pupil’s school photo becomes a record in the Card Management System, kept, in that notice’s words, “until you advise us you no longer require your card.”¹¹ Indefinitely, then. Thirty-two councils are joint controllers, the Improvement Service processes the applications through the national portal, the programme office sits inside Dundee City Council, and the photograph travels onward into the extract that proves identity across the country’s other public services.¹² The scheme’s privacy assessment has not been revised since 2020.¹³ Its oversight, the government confirms, is ordinary data-protection housekeeping: a data protection officer, an annual audit, the auditors of public spending. Nothing biometric, and no specialist regulator anywhere in the chain.¹⁴

The law gives two answers to one question: is this photograph biometric data? Under the 2020 Act, a facial photograph capable of identifying a person is biometric data the moment it is held; the definition is broad and the wording is plain.¹⁵ Under UK GDPR, the same photograph stays ordinary until software is run across it to identify someone, becoming special-category biometric data only then. The councils hold to the second reading: their privacy notices say they collect no special category data, and they treat the photograph as an ordinary passport snap.¹⁶ You cannot govern what you will not name, and here the naming comes last. But the name is the only thing that waits: a stored face is matchable the day it is filed, and the software that reads it is no lawyer. The law’s timing changes the paperwork, not the picture.

The usual reassurance is that none of it matters, because the photographs only make bus passes, and any police access is “case by case”.¹⁷ Set aside that the phrase reveals nothing about how fast, how often, or who may refuse. The scheme also says such sharing is logged, but that is its own word, in a document from 2020, and nothing published confirms the log exists, still less what any audit of it found. A record no one is required to check is not oversight. A last reassurance says the photographs get deleted anyway. One copy does. The online portal deletes its image within sixty days of the card being made, two years for the Young Scot cards kept for proof-of-age audit; the Card Management System keeps the photograph for as long as you hold a card.¹⁸ Deleting the application copy clears the queue, not the gallery. And the deeper answer is that envisaged use has never once been a safeguard. A capability, once built, is pushed to the limit of what it can technically do, whatever the brochure said at the start. RIPA was sold for terrorism and serious crime, and a council used it to watch a family for three weeks to check which school catchment they lived in; the surveillance tribunal ruled it unlawful.¹⁹ England kept the DNA of people it never convicted until Strasbourg ordered it to stop.²⁰ Police held more than nineteen million custody photographs, over sixteen million of them searchable by face, years after a court ruled the retention of the never-convicted unlawful.²¹ Number-plate cameras grew from catching stolen cars into tens of millions of reads a day, kept for a year.²² Clearview scraped twenty billion faces off the open web and sold the result to police forces.²³ South Wales Police ran live facial recognition in the street until the Court of Appeal ruled its use unlawful.²⁴ Where a limit was set at all, a court or a statute set it, not the purpose written at the outset, and only after the capability had been defended to the last, with the public’s own money. The times it stopped are the times something with teeth was standing in the way.

And the demand for faces is not hypothetical. Thirteen police forces in England and Wales now use live facial recognition; the Metropolitan Police scanned more than 1.7 million faces in the first four months of 2026 alone.²⁵ Every such system needs a gallery to match against. Scotland has deployed none of it, which is the opening, not the all-clear: it could be the first place to govern the technology before it arrives rather than after. But the council database of Scottish faces already exists, and nothing with teeth stands between those faces and whatever use is found for them next. The Information Commissioner is no answer here: a UK-wide generalist, reactive by design, holding the very doctrine that a photograph is not biometric until software is run across it, and auditing nothing in this system unless someone first complains. The point is not that a child’s bus-pass photo is being matched against a watchlist today. The point is that no one can tell you it is not, because no one is required to look, and the one body built to look was sent to the wrong room. The figures hold a grim symmetry, and it runs the way you would least expect. The Commissioner’s reviews estimate more than three million images in Police Scotland’s systems, reviewed, audited and reported to Parliament; but those are images, not individuals, repeat shots of a far smaller population, on the order of 380,000 people on the criminal history system.²⁶ The National Entitlement Card is close to one face per holder, across roughly two million people.²⁷ By distinct faces, the council holding is the larger, and it is watched by no one with the word biometric in their job title.

None of this is an argument against the card, or against a single key to public services. A small country gains from not making its people prove who they are from scratch at every counter. The argument is against holding millions of facial photographs with no acknowledgement that they are biometric, no binding limit on what they may become, no independent audit that the limits hold, no specialist regulator with the power to compel change, and no real answer to the person whose face it is. A capability at this scale has to be acknowledged, constrained, audited, governed, and answerable. This one is none of the five. Move the perimeter; do not empty the vault.

The public is already standing on this ground. People back the targeted use of facial recognition, the search for someone who has committed a crime, and pull back sharply from the blanket kind, the tracking of the population at large; in the three countries surveyed a majority said they did not trust government to use the technology responsibly.²⁸ Support follows the safeguards, not the capability. Govern it and the licence follows; leave it ungoverned and the licence was never given.

There is a floor for all of this, and Scotland sits below it. Since February 2025 the European Union’s AI Act has banned the untargeted scraping of faces to build recognition databases, and the real-time biometric identification of the public by police outside narrow, authorised cases; the binding obligations for high-risk biometric systems follow, after a deferral agreed in outline in 2026, in December 2027.²⁹ Scotland’s Code, by contrast, binds only the police, confers no power to prohibit, and triggers no legal action of its own when breached, which is why the Commissioner is reduced to asking for a law. And the floor is one Scotland says it wants: since 2021 its ministers have held a standing power to keep devolved law in step with the EU’s.³⁰ The five tests, met at home, would carry Scotland most of the way to that floor, with no one aiming for Brussels at all. Scotland cannot adopt the AI Act: data protection, and most of the levers around it, are reserved to Westminster.³¹ But it can hold its own public bodies to the standard, exactly as it already does for the police. That is alignment by good governance, not by borrowing a statute.

Different jurisdictions have chosen different tools, but they share a common principle: population-scale biometric data is governed, audited and answerable, not held quietly and called ordinary. It is established international practice, and Scotland has joined it for the police but not for its civilian holdings. New Zealand looked at the same problem and, in 2025, issued an enforceable code for biometric processing that covers civilian use, under privacy law it already had, with no new statute and no new regulator.³² Australia went further. Having rejected an ungoverned national identity card in the 1980s on civil-liberties grounds, it came back and built the governed version: a voluntary digital identity, independently accredited, regulated by two separate watchdogs, with binding limits on what may be collected and a public register of who is trusted to hold it.³³ Estonia, whose entire state runs on a national identity, gives every citizen a log of who has looked at their records and the standing to ask why.³⁴ Illinois answers a narrower question, but answers it to the person: once a face is scanned into biometric form, the holder is liable to the individual directly, with a right to sue and damages that do not turn on proving harm.³⁵

England and Wales are the cautionary tale. They have no statutory code for civilian biometrics at all, and the government that brought reform forward in 2023 proposed to abolish even the police biometrics watchdog; an independent report warned the change would leave “significant gaps” in oversight.³⁶ Scotland is rightly proud of being the exception. The point of this essay is that the exception stops at the police-station door, and the faces on the other side of it have less protection in Scotland than a police-held fingerprint does. Run recognition across them and, in Wellington or Tallinn, an enforceable regime answers at once; in Scotland nothing specialist answers at all.

There are two ways in, and the argument turns on which one fits. The Act already lets Scottish Ministers add bodies to the Commissioner’s remit by regulation, and a statutory review of his functions is live as this is written, weighing exactly that.³⁷³⁸ But section 2(7) moves the bodies, not the purpose: the remit it extends still reaches only biometric data held for criminal justice and police purposes. Add the councils tomorrow and the bus-pass photographs still escape, because they are held for travel and proof of age, not for policing. The Independent Advisory Group that designed the post drew that line in 2018, confining its recommendation to policing; the review now debates extending it to more criminal-justice bodies, the prison service among them.³⁹ The largest civilian holding in the country is not in the room.

Reaching it needs the other way in: primary legislation, widening the purpose the Commissioner is allowed to watch. That is the same vehicle he is already demanding for live facial recognition. His ask and this one become a single bill. It need not be the policing Code; New Zealand’s example shows a lighter instrument can carry the weight. It needs only to make the holding acknowledged, constrained, audited, governed, and answerable. Do that, and most of the European floor arrives as a side effect, for the price of governing your own house.

Scotland built the regulator the rest of the UK keeps wishing it had, and aimed it at the one part of the problem already under the brightest light. The unwatched faces are not the ones in police custody, which are watched, reviewed and reported to Parliament. They are the millions of faces in a council database, gathered for a bus pass, lifted in childhood from a school camera, called ordinary by the people who hold them, and watched, in any specialist sense, by no one at all.