Section 127 makes changes to Part 1 of the CTA 2008. Section 18A(4) CTA 2008 provides that where a law enforcement authority is processing biometric data (fingerprints and DNA profiles) under the CTA 2008 and does not know the identity of the individual to whom the biometric data relates – and has never known the identity – they may retain the biometric data indefinitely. Data that is held in such a form may be referred to as being held in a "pseudonymised form". Pseudonymised biometric data can be used by the police to wash (i.e. check) against other biometric data, for example against biometric material that is submitted against visa or asylum applications. Section 18A(5) sets out that where a law enforcement authority comes to know the identity of the individual to whom the biometrics relate, and where the individual has no previous convictions, the authority is permitted to retain the biometrics for three years (the standard retention period within the CTA 2008) from that time; following which they must either destroy the data or make a national security determination to retain it.
	Subsection (5) of this section inserts new subsections (7) to (9) into Section 18A. New subsection (7) sets out that biometric data may be retained indefinitely by the law enforcement authority in cases where such biometric data is acquired from an overseas law enforcement authority in a format which identifies the individual to whom the data relates, but the law enforcement authority takes the necessary steps to pseudonymise the biometric data as soon as reasonably practicable after receipt. These steps must remove any identifiable information relating to the biometric data. If the law enforcement authority is in a position to identify the individual in question using other information that it holds, the effect of new subsection (7)(d) is that the authority cannot rely upon this new retention provision.
	Subsection (6) makes a consequential amendment to section 18E(1) to insert a new definition of an overseas law enforcement authority.
	Subsections (7) to (12) make provision for the retrospective application of section 127, enabling a law enforcement authority to apply the section to existing biometric data and retain this data if it pseudonymises it as soon as reasonably practicable after the commencement of the section. Subsection (8) limits retrospective application to biometric data obtained or acquired in the three years before commencement of the section.
	Subsections (9) and (10) set out when a law enforcement authority is required to pseudonymise biometric data that it obtained prior to the commencement of this section to be able to apply the provisions of the section to that data.
	Subsections (11) and (12) make provision in relation to the use of biometric data that was obtained in the three years before the commencement of the section, but that the law enforcement authority was, prior to commencement, required to destroy. For example, in a case where an overseas law enforcement authority supplies the authority with biometric data that was taken almost, or even more than, 3 years ago. The effect of subsection (12)(a) is that the authority may continue to retain and use the material (in so far as it is possible to use material that is not in an identifiable form). Subsection (12)(b)(i) provides that such legacy biometric data may not be used in criminal proceedings instituted before the commencement day in England and Wales, Northern Ireland, or Scotland. This includes criminal trials that are ongoing at the date of commencement, and retrials that take place after commencement (for example, where a prior conviction has been quashed). Subsection (12)(b)(ii) provides that legacy biometric data may not be used in any criminal proceedings in any other country or territory, even if the proceedings were instituted after commencement of the section.
Part 7: Other provision about use of, or access to, data Retention of biometric data Section 127: Retention of pseudonymised biometric data