Part 7: Other provision about use of, or access to, data Retention of biometric data Section 128: Retention of biometric data from INTERPOL
Section 128 inserts a new section into the CTA 2008 (new section 18AA) to vary the regime governing the retention of biometric material obtained through INTERPOL co-operation. New section 18AA sets out updated retention rules for biometric data that has been received through INTERPOL. The National Crime Agency (NCA), in its capacity as the UK’s National Central Bureau (NCB), receives daily notifications from INTERPOL of all new, updated and cancelled notices and diffusions. INTERPOL notices are international requests for cooperation or alerts allowing police in member countries to share critical crime-related information, including information relating to national security cases, e.g. counter-terrorism investigations. Member countries may also request cooperation from each other through another alert mechanism known as a 'diffusion'. This is less formal than a notice and is circulated directly by an NCB to all or some member countries. INTERPOL notices or diffusions may include biometric materials, for example fingerprints.
	Subsection (2) makes a consequential amendment to section 18A(4) CTA 2008, to recognise the new retention power provided by new section 18AA.
	Subsection (3) inserts new sections 18AA and 18AB into the CTA 2008. New section 18AA(1) defines the biometric data to which the new section applies (subsection (1) refers to "section 18 material" - see section 18(2) CTA 2008 for a definition of that term). Subsection (1) is intended to apply to section 18 material that is provided as part of a notice or a diffusion.
	New section 18AA(2) provides that a law enforcement authority may retain the biometric data received from INTERPOL until the UK NCB informs the authority that the INTERPOL notice or diffusion has been cancelled or withdrawn. At this point, the law enforcement authority must either delete the biometric data from its systems, or it may make a National Security Determination under section 18B CTA 2008 to authorise its retention for a period of time.
	New section 18AA(3) makes equivalent provision for cases where the law enforcement authority is also the NCB.
	New section 18AA(5) clarifies that new section 18AA(1) also applies to biometric data that is not provided with an initial notification or diffusion, but that is provided subsequently as part of that request etc.
	Subsection (3) of section 128 also inserts a new section 18AB into the CTA 2008. Section 18AB confers a delegated power on the Secretary of State to make changes by secondary legislation to amend section 18AA where there are changes to INTERPOL’s name or its processes in relation to the processing or sharing of INTERPOL biometrics with member countries. For example, if INTERPOL was to adopt alternative forms of co-operation to its current notices and diffusions, this power would enable any consequential amendments to section 18AA that are necessary. Such secondary legislation would be subject to the affirmative procedure.
	Subsection (4) makes a consequential amendment to section 18BA(5) CTA 2008.
	The effect of subsection (5) is that new section 18AA will apply to biometric data received via INTERPOL prior to the commencement of this section, if the request or threat to which the data relates remains outstanding. Subsections (6) and (7) make provision to enable a law enforcement authority to continue to retain and use (in accordance with section 18D(1) CTA 2008) biometric data relating to live requests for co-operation etc., even if the requirement to destroy the material arose prior to the commencement of this section. However, such legacy material may not be used in evidence against the person to whom the material relates in criminal proceedings that were instituted before the commencement day or for any criminal proceedings in another country at any time.
	Section 145 sets out that section 128 comes into force on Royal Assent of the Act.