Correspondence

Letter to third party certification bodies

Published 18 July 2023

Office of the Biometrics and Surveillance Camera Commissioner
2 Marsham Street
London SW1P 4DF

Enquiries@obscc.org.uk

Third Party Certification Accreditation Bodies:

• SSAIB

• IQ Verify Ltd

• NSI

By email

28 June 2023

Dear Accreditation Bodies,

Office of the Biometrics and Surveillance Camera Commissioner: third-party certification scheme

You will be aware of the Data Protection and Digital Information (no. 2) Bill which will effectively abolish the Office of the Biometrics and Surveillance Camera Commissioner (OBSCC), and the need for the government to publish the Surveillance Camera Code, with no suggestion about what might replace the code of practice, if anything.

As the Bill continues its passage through Parliament, there is no indication as to whether non-statutory schemes, such as the third-party certification scheme, for which you are accreditors, will survive, at least in their current shapes. I have commissioned my own independent review of what gaps there may be when the OBSCC is abolished. That report is due at the end of July.

With the Bill likely to receive Royal Assent next spring, I have decided to take matters into my own hands to ensure a sensible withdrawal or potential handover of non- statutory activity within my responsibilities for Surveillance Cameras. At this stage the Home Office cannot commit to taking over the third-party certification scheme, and it is unclear as to whether any other statutory body would have the inclination to do so. Understandably, none is prepared to commit in advance of the Bill being enacted. But waiting until next spring to decide on an exit strategy would only lead to confusion, and I am committed to ensuring an orderly withdrawal.

My aim is to ensure that you, users of the scheme (your clients), and other interested parties have certainty in advance of the Bill coming into effect. Consequently, I have decided that the scheme should close at the end of July this year. This will give you an opportunity to discuss the ramifications, notify your clients, and make preparations well in advance of my Office closing and the effective removal of the code.

What would this look like in practice?

• There would be no new certification after 31 July 2023.

• Those clients that are due reaccreditation between 1 August and the commencement of the Bill, should be offered an extension until that commencement date. There is some precedent for this in the shape of extensions that took place during the covid pandemic. While there would be nothing to prevent accreditors carrying out a desk audit, we appreciate that this may be prohibitively expensive.

• What happens to those clients that are certified beyond the commencement of the Act? In practice, there would be no code against which businesses could be effectively tested. However, there would be nothing to prevent such businesses measuring themselves and demonstrating good practice against the principles even though the code would have expired. Similarly, as things stand, there would be no body or mechanism to remove certification after commencement of the Act, nor any sanction for advertising accreditation against the now expired code.

• What would happen to those payments that have been made for periods beyond the commencement of the Act? While the transactions are between accreditor and client, it would be most helpful to understand how accreditors are receipting their work. If payments are made monthly or annually then the certification could end at commencement of the Act, with payments no longer being made. Where prepayments have been made beyond next spring then accreditors and clients would have to consider an accommodation whereby certification could either end or be continued against the principles of the expired code. None of this precludes another agency stepping in to manage the scheme.

I should like to take this opportunity to thank you for your important contribution in the success of the third-party certification scheme, which has been embraced by a range of clients using public space surveillance technology. There will be more time to reflect on the scheme and your invaluable contribution at the end of my tenure as Commissioner.

If it were helpful, I would be glad to discuss these matters further in advance of you writing to your clients. I appreciate that you may not wish to discuss your payment arrangements in front of other accreditors, and I would be happy to receive your advice on that matter in writing.

I look forward to hearing from you.

Yours sincerely,

Professor Fraser Sampson

Biometrics and Surveillance Camera Commissioner