Guidance

Forensic Information Database Service (FINDS): International DNA and Fingerprint Exchange Policy for the United Kingdom (accessible version)

Updated 4 November 2024

Please note that the content and the layout of this document are controlled by the FINDS Quality Team and are not to be altered in any way.

We are constantly looking for ways to improve our policies and procedures. Constructive feedback both positive and negative is always welcome.

Please submit your feedback or proposals for change to: [FINDS_Quality_Management

homeoffice.pnn.police.uk](mailto:[email protected])

Identification

Policy Reference Number and Policy Title: FINDS-P-040

International DNA and Fingerprint Exchange Policy for the United Kingdom

Ownership

Organisation and Department Responsible: The Home Office, Forensic Information Database Services

Distribution

FSPs; LEAs; NCA – UK JICC; NCA – Missing Persons Unit; Police Forensics and Biometrics Policy Team; Home Office Crime, Policing and Fire Group; Home Office UK Central Authority; International Policy Team; International Unit at the Crown Office – Scotland; National Fingerprint Office, Department of Justice Northern Ireland, ACRO Criminal Records Office, Information Commissioner’s Office, the Office of the Biometrics Commissioner and the Scottish Biometrics Commissioner.

Recent Revision History

Issue Number: 5

Issue Date: 09/10/24

Summary of changes:

DCR1052 - Full review updates include:

• Updates in reference to the Scottish Biometrics Commissioner
• Organisation name change for NCB Manchester
• FIND Strategy Board governance board rules updates
• Judicial Co-operation Desk (JCOP) responsibilities section added
• Section added on Genetic Genealogy DNA sample/profile usage
• Mutual Legal Assistance section expanded to differentiate requests not in relation to Title II of Part 3 of the TCA Mechanism as well as requests in relation to step 1 of the Title II of Part 3 of the TCA Mechanism
• Delegated authority has also been given to NCA for the management of biometrics (DNA and fingerprint data) exchanged MLA
• INTERPOL Kinship DNA profile(s) –updated to reflect the new consent form in place
• Section added to explain that the international transfer of unidentified DNA profiles through the TCA mechanism and for these to be routed through INTERPOL to get full coverage of international database searches
• Section added for the International Commission on Missing Persons (ICMP)
• Update to I-Familia section, bulk unidentified body uploads and the updated volunteer kinship consent form

The full revision history can be viewed at the end of this document.

Definitions

Term	Definition
ACRO	ACRO Criminal Records Office manages criminal record information and improves the exchange of criminal records information nationally and intentionally.
AFIS	Automated Fingerprint Identification System – a means to auto encode and search Tenprints and scene of crime mark against a reference collection. A core AFIS system in the UK is IDENT1.
Central Authority (CA)	Central authorities have the function of receiving, acceding to and ensuring the execution of requests for MLA and are the authority for international cooperation in criminal matters. England, Wales and Northern Ireland matters are mainly managed by the Home Office UK Central Authority (UKCA) and Scotland matters by the International Unit at the Crown Office – Scotland. See Responsibilities for more details.
Crime scene latent mark	An impression of friction ridge skin (finger or palm) collected from material left at a crime scene, such impressions having been made visible by the use of fingerprint powders or chemical treatments and recorded digitally.
Crime stain sample	A sample collected from DNA material left at a crime scene.
Demographic data	The personal information that identifies an individual – not the actual DNA profile or the fingerprints
DNA	Deoxyribonucleic Acid
DNA-17	A DNA Test that targets 16 areas of DNA plus a gender marker. All DNA areas in SGMPlus are contained within DNA-17.
DNA-20+	DNA Test that targets at least 20 areas of DNA plus at least one gender marker. All DNA areas in DNA-17 are contained within DNA-20+.
DNA Interpretation	The methods applied by experts or software programmes to determine the DNA profile designations following DNA profiling.
DNA Profile	A series of numbers allocated to the areas of DNA targeted by a DNA test.
DNA Profiling	The scientific methods applied to a DNA sample to generate a DNA profile.
DNA Sample	A sample of biological material that contains DNA.
DNA Test	A set of chemicals that, when applied with scientific processes to a DNA sample, will produce a DNA profile (of the target areas of DNA for the test).
DPA 18	Data Protection Act 2018
FINDS	Forensic Information Databases Service.
FINDS-DNA	Forensic Information Databases Service – DNA unit (formerly the NDNAD Delivery Unit).
FINDS-NFPO	Forensic Information Databases Services – National fingerprint and PNC Office (formerly the NFO).
Forensic Information Databases (FIND) Strategy Board	A governing and decision-making body responsible for setting policy and assuring compliance over the databases such as NDNAD and IDENT1
Future Relationship Act	The European Union (Future Relationship) Act 2020
HERMES	Missing Persons’ Unit Case Management system
International Commission on Missing Persons (ICMP)	ICMP works with governments, civil society organizations, justice institutions, international organizations and others throughout the world to address the issue of people who have gone missing as a result of armed conflict, human rights abuses, disasters, organized crime, irregular migration and other causes. You can learn more about the ICMP on their website.
IDENT1	The UK National Fingerprint Database which contains the UK arrestee fingerprint collection (the ‘Unified Collection’) and a collection of unidentified scene of crime marks related to UK Law Enforcement investigations (the ‘UIDB’). The Scottish Police Authority share fingerprints obtained on the Tenprint database with IDENT1 automatically.
Immigration Database (IABS)	Maintained by Border Force, otherwise known as PIFE (Police/Immigration Fingerprint Exchange). Holds fingerprints of those applying for VISAs for the UK, foreign nationals who hold UK identity cards and asylum seekers.
Inbound	A request from a foreign country to search UK databases.
Forensic Investigative Genetic Genealogy (FIGG)	The use of genetics and genealogical research to understand an individual’s family history. This potential to be used in an attempt to identify an unknown suspect or an unidentified bod, however its use is not validated in the UK and may raise ethical issues.
Mutual Legal Assistance	Mutual legal assistance (MLA) is a method of cooperation between states for obtaining assistance in the investigation or prosecution of criminal offences. MLA is generally used for obtaining material that cannot be obtained on a police cooperation basis, particularly enquiries that require coercive means. Requests are made by a formal International Letter of Request (ILOR). In civil law jurisdictions, these are also referred to as ‘Commission Rogatoire’. This assistance is usually requested by courts or prosecutors and is also referred to as ‘judicial cooperation’.
MPDD	The Missing Persons DNA Database (MPDD) is a database containing DNA profile records of missing persons, relatives of missing persons (where a reference DNA profile is not available for the Missing Person), unidentified bodies and some crime stain DNA profile records that may be linked to missing persons or unidentified bodies (e.g. no-body murder case). The MPDD can: 1) retain DNA profile records (the record is permanently loaded to the MPDD) for continuous speculative searching against current, new or amended DNA profile records; or 2) have a DNA profile searched through a Non-Routine Speculative Search – where the searched record is not retained on the MPDD.
Missing Person	Anyone whose whereabouts cannot be established and where the circumstances are out of character or the context suggests the person may be subject of crime or at risk of harm to themselves or others (NB: a ‘wanted missing’ person is a person who cannot be located but is wanted in connection with a criminal investigation).
Missing Persons’ Reference Profile	A DNA profile derived from a DNA sample associated to a Missing Person. This might be derived from a personal artefact (e.g. toothbrush) or a direct medical sample.
Missing Persons Unit	The Missing Persons Unit (MPU) is the UK national point of contact for all missing person and unidentified body cases. The MPU supports police forces with missing person investigations and also with the identification of bodies and remains.
MPS CODIS Software	Metropolitan Police Service (Combined DNA Information system). Software used to undertake automated bulk International DNA exchange.
NDNAD	The National DNA Database (NDNAD) is a database containing DNA profile records of persons and crime stains that are compared against each other to identify matches to support criminal investigations. Matches are reported for persons to crime stains and crime stains to crime stains. The NDNAD can: 1) retain DNA profile records (the record is permanently loaded to the NDNAD) for continuous speculative searching against current, new or amended DNA profile records; or 2) have a DNA profile searched through a Non-Routine Speculative Search – where the searched record is not retained on the NDNAD. The retention of a DNA profile record on the NDNAD can only occur if the DNA profile has been generated by a FIND Strategy Board approved FSP from a UK DNA sample.
NIST	National Institute of Standards and Technology – the file format used for the storage of fingerprints
Northern Ireland DNA Database	A DNA database managed by Police Service Northern Ireland (PSNI) within the devolved administration and falling under relevant local legislation.
Non-routine Speculative Search for DNA	The method of searching the NDNAD or the MPDD without permanently loading/retaining the DNA profile on the DNA database. (NB: routine speculative searching is where a DNA profile is loaded and retained on the DNA database for a period of time during which a search against the DNA profile can occur.)
Non-routine Speculative Search for Fingerprints	The method of searching an AFIS system, such as IDENT1, without permanently retaining the fingerprints to the database.
NRSS	Non-routine Speculative Search.
Outbound	A request from the UK to search International databases.
PACE	Police and Criminal Evidence Act 1984 (as amended).
PACE (NI)	Police and Criminal Evidence (Northern Ireland) Order 1989 (as amended).
Person sample	A DNA sample collected directly from a person.
Reference collection	A database of known person samples (Tenprints or DNA) against which searches of unknown samples can be searched.
Scottish DNA Database	The Scottish DNA Database is a service managed by the Scottish Police Authority. DNA samples taken by Police Scotland are uploaded and searched against retained DNA profiles. Forensic Services stores all DNA obtained by Police Scotland on the Scottish DNA Database, and shares DNA profiles with NDNAD.
SGM	A DNA Test that targets 6 areas of DNA plus a gender marker.
SGMPlus	A DNA Test that targets 10 areas of DNA plus a gender marker. All DNA areas in SGM are contained within SGMPlus.
SPA	The Scottish Police Authority is independent of both the Scottish Government and policing. It is the primary governance body for policing in Scotland and was established as a public body on 1 April 2013 by the Police and Fire Reform (Scotland) Act 2012. It was set up to hold the Chief Constable to account; promote, support, and oversee improvement in policing. The Scottish Police Authority is responsible for providing the management and delivery of forensic services to the criminal justice sector in Scotland including Police Scotland; the Crown Office and Procurator Fiscals Service (COPFS), the Police Investigations and Reviews Commissioner (PIRC) and includes Independent Custody Visiting Scotland.
Status check	The research review and assessment of relevant information and intelligence data associated with People Objects Locations and Events for a policing purpose: - To identify and prevent operational compromise and conflicts of interest. - To assist in mutual cooperation where two or more parties have an active interest in the same entity. To provide a signpost for strategic and tactical information which may support the assessment of Serious and Organised Crime (SOC) in the UK as described in legislation.
TCA	The Trade and Cooperation Agreement Between The European Union And The European Atomic Energy Community, Of The One Part, And The United Kingdom Of Great Britain And Northern Ireland, Of The Other Part.
The TCA mechanism	The processes by which DNA and fingerprint exchanges under the TCA are implemented.
Tenprints	A record of the friction ridge skin of the fingers and palm of a known individual recorded electronically via Livescan or occasionally by ink and plate. Tenprints obtained upon arrest in the UK typically form part of the reference ‘unified’ collection within IDENT1.
The Missing Persons’ Operational Response Database (ORD)	The Missing Persons’ Operational Response Database is a database containing fingerprints records of unidentified bodies and in some cases ‘pseudo sets’ for missing persons. The ORD can: 1) retain fingerprint records (the record is permanently loaded to the ORD) for continuous speculative searching against current, new or amended fingerprint records; or 2) have a fingerprint record searched through a Non-Routine Speculative Search – where the searched record is not retained on the ORD.
UKCA-ECR	The United Kingdom Central Authority for the Exchange of Criminal records- this is hosted within ACRO.
UK GDPR	UK General Data Protection Regulation
Unidentified Body	A body (or parts of a body) that have been located where no identification of the individual can be made. (NB: depending on the body part, it may be that the individual is not deceased).

Legislation

This policy does not constitute legal advice. Any processing of data in accordance with this policy must be done in compliance with all relevant legislation (please refer to FINDS-SB-P- 002 as per cited in the reference section at the end of this policy), in particular the Protection of Freedoms Act 2012 (PoFA), Police and Criminal Evidence Act 1984 (PACE), the Data Protection Act 2018, the UK General Data Protection Regulations (UKGDPR), The Human Rights Act 1998, the Equality Act 2010, the European Union (Future Relationship) Act 2020, and the Criminal Procedure (Scotland) Act 2003, The Police and Criminal Evidence (Northern Ireland) Order 1989, Scottish Biometrics Commissioner Act 2020, the statutory Scottish Code of Practice under the Scottish Biometrics Commissioner Act 2020 and the Forensic Science Regulator Act 2021.

Before the UK left the European Union, requests for law enforcement information were received from EU Member States under Council Framework Decision 2006/960/JHA (“the Swedish Initiative”) and processed under Part 5 of the Criminal Justice and Data Protection (Protocol No 36) Regulations 2014 (“the 2014 Regulations”), but post-exit the UK no longer participates in the Swedish Initiative and so Part 5 of 2014 Regulations were revoked.

However, Part 5 of the 2014 Regulations still apply (with certain modifications) in respect of requests for information received from EU member States prior to 01/01/2021 – see Part 12 of the Law Enforcement and Security (Amendment) (EU Exit) Regulations 2019 (S.I.2019/742) for more details.

Objective and Scope

This document sets out the policy governing the international exchange of data held on forensic information databases under the FIND Strategy Board’s remit:

• DNA samples, DNA profiles, the searching of UK DNA profiles against non-UK DNA databases and the searching of non-UK DNA profiles against UK DNA databases.

• Fingerprints (Tenprints and scene of crime marks), the searching of UK Fingerprints against non-UK Fingerprints databases and the searching of non-UK fingerprints against UK Fingerprint databases.

DNA and fingerprints play a key role in:

• focusing the direction of criminal inquiries and contributing to detection outcomes.

• reassuring the vulnerable - including eliminating the innocent from investigations.

• providing closure to families through Missing Persons database identification.

This policy will further protect the civil liberties of those from whom DNA and fingerprints have been taken in the UK.

References and Definitions can be viewed at the end of this document.

In Scope

Subject to the section Out of Scope, this policy covers all UK DNA and Fingerprint international exchange circumstances involving:

DNA	Fingerprints
DNA Person to DNA person searching	Tenprint to Tenprint searching
DNA Person and crime stain profile searching	Tenprint to crime scene mark searching
DNA associated demographic data	Fingerprint associated demographic data
Inbound DNA profile search requests	Inbound fingerprint search requests
Outbound DNA profile search requests or releases	Outbound fingerprint search requests or releases
Criminal investigations	Criminal investigations
Missing person and unidentified body investigations	Missing person and unidentified body investigations
The UK National DNA Database	IDENT1 Arrestee Tenprint collection (Unified Collection)
The UK Missing Persons DNA Database	Missing Persons’ Operational Response Database
Match investigations and reports	Match investigations and reports
Export & import of DNA samples
DNA Step 1: Automated searching and hit/no hit exchanges under the Title II of Part 3 of the TCA. This is processed through the Metropolitan Police Service.	Fingerprint Step 1: searching and hit/no hit exchanges under the Title II of Part 3 of the TCA. This is currently processed by law enforcement fingerprint bureaux.
DNA Step 2: The request and release of personal information to a requesting country as a result of a confirmed match through exchanges under Title II of Part 3 of the TCA. This is processed through the NCA[footnote 1]	Fingerprint Step 2: The request and release of personal information to a requesting country as a result of a confirmed match through exchanges under Title II of Part 3 of the TCA. This is processed through the NCA.
The exchange of DNA related information on the Counter Terrorist DNA Database - only through Title II of Part 3 of the TCA.	The exchange of Fingerprint related information on the Counter Terrorist DNA Database - only through Title II of Part 3 of the TCA.
	The exchange of fingerprint data via INTERPOL for the purposes of arrest pending surrender or extradition under Title VII of Part 3 of the TCA or the Extradition Act 2003
	The exchange of fingerprint data and criminal record information under title IX of part 3 of the TCA, and for non-EU countries via INTERPOL and country to country agreements.

Out of Scope

The following matters fall outside the scope of this policy:

1.Any DNA profiling and interpretation of an international DNA sample by a UK provider.

2.Any case involving the exchange of DNA and Fingerprint related information on the Counter Terrorist DNA Database^{[footnote 2]};

3.Any covert case involving the exchange of DNA profiles and Fingerprint related information^{[footnote 3]}.

4.DNA Profiles or Fingerprints not shared to the NDNAD or IDENT1 respectively by the Police Service of Northern Ireland but retained on the Northern Ireland DNA Database through relevant local legislative frameworks.

5.DNA Profiles or Fingerprints not shared to the NDNAD or IDENT1 respectively by the Scottish Police Authority but retained on the Scottish DNA Database through relevant local legislative frameworks.

6.Local formal agreements made by Scotland or Northern Ireland for direct exchange of DNA and/or Fingerprint data owned by each Authority.

7.The provision of evidential reports and/or the extradition of persons based on the results of a DNA and/or Fingerprint exchange.

8.DNA Profiles or fingerprints held on the NDNAD or IDENT1 that was obtained under the jurisdiction of the Crown Dependencies

Responsibilities

The following have responsibilities associated with this Policy

Body	Responsibilities
ACRO	The ACPO Criminal Records Office (ACRO) was established in 2006. ACRO manages criminal record information and improves the exchange of criminal records and biometric information via the Exchange Criminal Records mechanism and the Exchange of fingerprint data and criminal record information under title IX of part 3of the TCA.
Biometrics Commissioner	The Biometric Commissioner provides independent oversight of the retention and use of DNA and Fingerprints by the police in England and Wales.
Forensic Information Databases Service	The Forensic Information Databases Service (FINDS) (part of the Home Office) is defined as processor on behalf of the NPCC lead. As defined within the Strategy Board governance rules (please refer to the section below), FINDS are responsible for the integrity and protection of the data held on the NDNAD and IDENT1 [footnote 4], and any associated database or collection relating to missing persons, vulnerable persons, or contamination elimination databases. The NDNAD and the MPDD are the UK databases for the storage, searching, matching and match reporting of DNA profiles generated for the UK. The IDENT1 and Missing Persons’ ORD are the UK databases for the storage, searching, matching and match reporting of fingerprints generated for the UK. To provide Metropolitan Police Service - Forensic Services Department with DNA profiles from subjects, unsolved crime stains and unidentified body/part(s). This will allow for the DNA profiles to be automatically populated to the MPS CODIS system which will facilitate the TCA searches. To provide the MPS with access to ad-hoc containers within the IDENT1 Special Collections capability to manage the UK outbound TCA fingerprint searches.
Forensic Information Databases Strategy Board (FIND SB)	The Chief Officer (or Chief Executive or equivalent) of the Law Enforcement Agency (LEA) where the sampling event took place and the lead for the National Police Chiefs’ Council (NPCC) will be joint controllers for the purposes of Part 3 of the DPA 2018, in respect of personal data for Forensic Information Databases (FIND) purposes. It is the responsibility of the FIND Strategy Board to define the policy on how data derived from sampling events taken under PACE powers or volunteer sampling events should be accessed and used. The full responsibilities of the Strategy Board are detailed in The Governance Rules of the Forensic Information Databases Strategy Board
Forensic Service Providers	Accredited Forensic Service Providers (FSPs) are those who are approved by the FIND Strategy Board. FSPs carry out DNA profiling on behalf of LEAs and submit profiles to the NDNAD and the MPDD for loading or NRSS. They are also responsible for the interpretation and production of statements of evidence relating to matches between DNA profiles involved in cases investigated in the UK.
UK Central Authority (UKCA)	The UK Central Authority (UKCA) is the central authority for international cooperation in criminal matters for England and Wales and Northern Ireland, considering and coordinating incoming and outgoing requests for Mutual Legal Assistance (MLA) [footnote 5]. The UKCA also deals with extradition requests to and from England, Wales and Northern Ireland. It does not deal with extradition requests to and from EU Member States.
Information Commissioner	The Information Commissioner is the independent regulator of data protection law in the UK and the processing of personal data under Part 3 of the TCA. This includes the processing of DNA and fingerprints by law enforcement authorities.
International Unit at the Crown Office - Scotland	The International Unit at the Crown Office is the central authority for mutual legal assistance in Scotland. Central authorities have the function of receiving, acceding to and ensuring the execution of requests for MLA.
INTERPOL	INTERPOL is the world’s largest international police organization, with 196 member countries working together to ensure that police around the world have access to the tools and services necessary to do their jobs effectively, by providing targeted training, expert investigative support and relevant data and secure communications channels. This combined framework helps police on the ground understand crime trends, analyse information, conduct operations and, ultimately, arrest as many criminals as possible. The INTERPOL Secretariat General (IPSG) is a permanent body of the organisation headquartered in Lyon, France.
Judicial Cooperation Desk (JCOP)	The Judicial Cooperation (JCOP) desk is one of four central desks in the JICC’s Police & Partner Engagement Unit (PPEU); the desks work alongside the International Tactical Advisor network in regional forces across the UK and the National Extradition Unit. JCOP are responsible for providing advice and guidance to UK policing around exchanging evidence internationally through mutual legal assistance (MLA) or Joint Investigation Teams (JIT). The JCOP team are instrumental to the success of multi-jurisdiction evidence sharing. JCOP work closely with their key partners at the UK Central Authority & CPS International; reviewing complex, often high- profile, referrals to forces and providing essential advice and support. JCOP also provides tactical advice to UK policing in relation to incoming and outgoing requests for evidence.
Law Enforcement Agencies	UK Law Enforcement Agencies (LEAs) undertake criminal and missing person’s investigations. Their interaction with individuals (including the ability to take DNA and fingerprints from an arrested person) is governed by PACE as amended. Investigating LEA will receive the Step 2 EU Member State Subject data under the TCA and be responsible for the correct use and retention of that data, according to the TCA.
Metropolitan Police Service (MPS) – Forensic Services Department	The MPS Forensic Services Directorate will be responsible for undertaking the automated exchange of DNA in compliance with the TCA on behalf of the Home Office. The MPS is responsible for infrastructure set-up, all subsequent technical compliance and verification of DNA matches, prior to any exchange of identifiable demographic data.
Missing Persons’ Unit	The UK Missing Persons Unit is a part of the National Crime Agency and is the UK national and international point of contact for all UK missing person and unidentified body investigations. They provide support and advice to police forces in order to resolve cases and act as a hub for the exchange of information and expertise in this area.
National Crime Agency	The NCA is a 24/7 operational crime-fighting agency with specialist capabilities to undertake and support operations, covering a broad range of complex areas, including: 1. carrying out activities to combat serious and organised crime 2. Strengthening our borders; fighting fraud and cybercrime 3. Protecting children and young people from sexual abuse and exploitation 4. Responding to a broad range of complex and national threats and risks. NCA hosts the United Kingdom National Central Bureau (NCB) for INTERPOL through its UK Joint International Crime Centre (JICC) and co-ordinates UK activities for missing person’s investigations through its Missing Persons Unit (MPU).
Scottish Biometrics Commissioner	The office of Scottish Biometrics Commissioner was established by the Scottish Biometrics Commissioner Act 2020. The Commissioner’s functions are in relation to the oversight of the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes by Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner. The Scottish Biometrics Commissioner conducts assurance reviews into the acquisition, retention, use, and destruction of Scottish DNA, Fingerprint and images records. The Commissioner also maintains a statutory Code of Practice in Scotland and has the power to receive and investigate complaints from data subjects relative to adherence to the Scottish Code of Practice.
UK Joint International Crime Centre (JICC)	The JICC within the NCA is the national focal point for international DNA and fingerprint searches[footnote 6] and should be contacted if advice on the conduct of an international search is needed. Except for requests for Mutual Legal Assistance, all international exchange requests covered by this Policy for the release and/or searching of DNA profile information must be notified and managed by JICC. JICC are responsible for requesting and receiving the Subject Data profile through the Step 2 process following an outbound Step 1 DNA or Fingerprint hit under Title II of Part 3 of the TCA. JICC will receive the EUMS responses including Subject Profile in electronic format that may include various file types with fingerprints and Imagery records and disseminate to the investigating LEA. Delegated authority has been given to NCA and the MPS to act as joint controllers for the management of biometrics (DNA and fingerprint data) exchanged within Title II of Part 3 of the TCA mechanism. MPS will be responsible for Step 1 (DNA only) and NCA for Step 2. Delegated authority has also been given to NCA for the management of biometrics (DNA and fingerprint data) exchanged via INTERPOL and MLA.

1. Principles of Exchange

a) All exchanges must abide by national and international law. In particular, in respect of exchanges of data between the UK and third countries (including with EU Member States) for law enforcement purposes: prevention, investigation, detection, or prosecution of criminal offences, as well as the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; there must be compliance with Part 3 of the Data Protection Act 2018 (Law Enforcement Processing^{[footnote 7]} - including Chapter 5 of Part 3, which relates to international transfers of personal data) and the Criminal Procedure (Scotland) Act 1995 (applies to authorities undertaking procedures in Scotland).

b) Before the UK left the European Union, requests for law enforcement information were received from EU Member States under Council Framework Decision 2006/960/JHA (“the Swedish Initiative”) and processed under Part 5 of the Criminal Justice and Data Protection (Protocol No 36) Regulations 2014 (“the 2014 Regulations”), but post-exit the UK no longer participates in the Swedish Initiative and so the 2014 Regulations were revoked. The 2014 Regulations still apply (with certain modifications) in respect of requests for information received from EU member States prior to 01/01/2021 – see Part 12 of the Law Enforcement and Security (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/742) for more details.

c) The exchange of DNA profiles and/or fingerprint records amounts to sensitive processing, so is subject to additional safeguards under the Data Protection Act 2018. DNA profiles and/or fingerprint records should only be exported when such a course is strictly necessary, reasonable and proportionate, is in line with section 63A of PACE (as amended) (England), section 19C of Criminal Procedure (Scotland) Act 1995 (as amended) (Scotland) or Article 63A PACE NI Order 1989 (as amended) (Northern Ireland). It must also meet one or more of the following criteria, namely it is:

• for purposes related to the prevention, investigation, detection or prosecution of crime, or the execution of criminal penalties.

• for purposes related to the identification of a deceased person.

• in the interests of National Security.

DNA and fingerprints can also be exchanged in support of a missing person’s investigation if doing so is considered strictly necessary, reasonable and proportionate. The UK Missing Persons Unit must be consulted and have registered the case prior to the international exchange of biometric information relating to a missing persons investigation.

d) NCA and MPS (acting on behalf of Home Office) have been designated as the national contact points (NCPs) under article 535 of the TCA and are joint controllers for the DNA data exchange activities within Title II of Part 3 of the TCA mechanism; specifically MPS are the NCP for Step 1 and NCA are the NCP for Step 2.

The Home Office is the NCP for the fingerprint data exchange activities within Title II of Part 3 of the TCA mechanism.

NCA are controller for the activities involved in assessing and conducting DNA and fingerprint exchanges via INTERPOL

e) With the exception of Title II of Part 3 of the TCA mechanism, INTERPOL and MLA, the outbound exchange of DNA person profiles and fingerprints must be approved by the Data Controller for either the DNA profile and/or the fingerprints.

f) DNA profile/fingerprint exchanges and/or searches in or out of the UK must only be undertaken when they have been properly assessed by the Officer in the Case or on their behalf by ACRO ^{[footnote 8]}. Any risks that have been identified adequately mitigated and where the relevant exchanges and/or searches are strictly necessary, reasonable and proportionate.

g) Prior to an international search, all DNA profiles generated within the UK must be loaded and searched against the NDNAD and/or MPDD (with the exceptions being elimination DNA profiles and in the case of direct comparisons, please refer to sections 2.8 and 2.9 respectively) prior to export from the UK. All unidentified crime stain DNA profiles loaded to the NDNAD, and unidentified body/parts DNA profiles loaded to the MPDD will be automatically searched via the TCA mechanism.

h) Prior to an international search, all fingerprints generated within the UK must be loaded and searched against IDENT1 and searched against the Immigration and Asylum Biometric System (IABS) and additionally for fingerprints recovered from deceased, the Missing Persons’ ORD^{[footnote 9]} prior to being exported from the UK.

i) DNA and fingerprint profiles to be exported for an international search must have been submitted by a laboratory being ISO17025 accredited. For any measure taken in a laboratory when locating and recovering traces on items, as well as developing, analysing and interpreting forensic evidence regarding DNA profiles and dactyloscopic data, with a view to providing expert opinions or exchanging forensic evidence ^{[footnote 10]}.

j) The outbound exchange of DNA profile(s) or fingerprints where the individual is unknown (e.g. profile(s)/fingerprints from a crime stain/ scene of crime mark or an unidentified body) must always be preferred to the outbound exchange of profile(s)/fingerprints from a named individual for intelligence purposes via INTERPOL.

For example, where an unidentified body is located abroad, rather than exporting the profile/fingerprints of a person whose identity is known, it is preferred that the DNA profile or fingerprints of the unidentified body are sent to the UK for comparison against the known person. This principle does not apply to exchanges under the TCA. Where a DNA or fingerprint match has been confirmed to a known UK person via an INTERPOL exchange, the Member State should be provided with the personal data and other relevant information upon request.

k) All DNA profiles to be sent internationally via INTERPOL must be inputted by FINDS- DNA, to ensure that the profiles are currently held on a FINDS-DNA maintained database and to ensure that the most up to date profile is captured. The exception will be for an elimination DNA profile where FINDS-DNA will not contain this information.

l) For DNA profiles searched via the exchange under the TCA mechanism, FINDS-DNA will send electronic data-feeds to ensure that the system is regularly updated. This is managed through a data interchange agreement between MPS and FINDS-DNA.

m) In relation to exchanges of DNA and fingerprint data under the TCA mechanism or INTERPOL, DNA profiles and fingerprint samples from all convicted subjects and suspects (i.e. suspected but not convicted of an offence) held on the NDNAD or IDENT1 will be made searchable for international partners (for the TCA mechanism those connected with the UK).

n) Unidentified DNA crime stains (including unidentified body/part DNA profiles) will also be made searchable under INTERPOL exchanges or the TCA mechanism if the DNA profile has at least six full loci present.

o) For both the TCA mechanism and INTERPOL exchanges, DNA profiles of subject profiles must have at least 6 full loci present from the European Standard Set^{[footnote 11]}. For crime stain profiles the searching criteria is any 6 full loci. A match is only reported when 6 full overlapping loci are present.

p) Tenprint records to be exchanged via INTERPOL channels will be retrieved directly from IDENT1 by JICC and ACRO^{[footnote 12]}. For crime marks, the law enforcement authority will provide marks in an acceptable INTERPOL format to JICC. ACRO are also able to retrieve Tenprint records.

q) .

r) For fingerprint exchanges via the TCA mechanism, the Tenprint as well as the scene of crime mark will be directly retrieved from IDENT1 and will be made searchable for Member States connected with the UK. UK LEAs can request searches of unidentified crime scene marks or arrestee Tenprint records of known individuals against Member States’ data through their own law enforcement fingerprint bureau.

s) An inbound DNA profile or Fingerprints (person or crime stain) which is searched against a UK database will normally be subject to a single non-routine speculative search (NRSS) only, and will not be retained on the NDNAD or Fingerprints on IDENT1 (any international scene of crime marks or Tenprint records stored on IDENT1 will need to apply by FINDS-SB-P-002 The Forensic Information Databases Strategy Board Policy for Access and Use of DNA Samples, DNA Profiles, Fingerprint Images, and Associated Data) unless it is received via INTERPOL for the purposes of arrest pending surrender or extradition under title VII of Part 3 of the TCA or the Extradition Act 2003.

t) Inbound fingerprints which are submitted for verification of identity for searching against a UK database will normally be subject to a single NRSS only ^{[footnote 13]}, fingerprints which are submitted with a notification of convictions ^{[footnote 14]} may be stored and retained on IDENT1. Sections 63F to 63N of PACE allows retention of fingerprints taken in England and Wales based on convictions in other jurisdictions, if these are for reciprocal offences recognised in England and Wales.

u) For DNA and Fingerprints requested that have a hit in Scotland, MPS on behalf of JICC will send a formal request to TCA mechanism Coordinator, International Bureau (Police Scotland) in order for legality checks to be carried out. This function requires Forensic Services to search for DNA profile and Tenprint for Fingerprints to comment officially on whether the data is legally held. They then consider relevance and proportionality in relation to providing the Demographic Data. On a case-by-case basis Forensic Services for DNA and fingerprints may request the sample held by the other country, for comparison, to ensure that the match would meet Crown Office and Procurator Fiscal Service evidential requirements for identification purposes.

v) Verification of identity of either a foreign national by another country or of a foreign national by the UK as permitted in accordance with Title IX of Part 3 of the TCA and Part 1 of the Future Relationship Act, and INTERPOL protocols. Unless in exceptional circumstances, any foreign country/entity to which a UK DNA profile/fingerprints are sent for searching must be required to delete or destroy that profile/fingerprints as soon as it has been searched against the relevant database. Therefore, when a DNA profile/fingerprints are sent out of the UK a caveat must be included stating that the profile/fingerprints must only be used for that investigation for which it is exported. Repeat searches can be requested if deemed necessary.

w) Familial DNA searching (for unsolved crimes) will not normally be permitted. Exceptional cases will be considered by the FIND Strategy Board to ensure sufficient justification, control, and approval and, where appropriate, consent.

x) Authorisation by the Chair (or their nominee) of the FIND Strategy Board is only required when stated within the policy or if there is a deviation from the principles.

y) Genetic Genealogy DNA sample/profile usage for Forensic Investigative Genetic Genealogy (FIGG) - the NPCC Homicide Working Group does not endorse the use of commercial genealogy databases in UK criminal investigations as standard, considering the significant ethical and operational risks that this technique may involve. In the event that an LEA Senior Investigating Officer, recognising the risks and challenges to this investigative technique, still chooses to embark upon such a course of action, they should notify the Chair of the Homicide Working Group and the Chair of the FIND Strategy Board before any international dissemination.

2. What Can Be Exchanged

2.1. DNA Subject Profiles for Criminal Investigations

2.1.1 Inbound Profiles

INTERPOL

Inbound subject profiles received via INTERPOL in the UK must meet a lawful policing purpose and be necessary, justified and proportionate for searching against the NDNAD. If the profile meets UK requirements, it will be searched against the NDNAD to identify if the subject is associated with any unsolved crimes in the UK.

Any matches identified to a UK subject profile will be reviewed by the NCA JICC for the appropriateness of reporting the match. The NCA JICC will manage UK safeguarding measures, initiate a match investigation and a status check process of UK Law Enforcement databases prior to the release of any associated demographic data outside of the UK.

A request to confirm the identity of an individual through a subject-to-subject match will not be dealt with by way of a NDNAD search; any such request must be dealt with by way of a comparison of fingerprints^{[footnote 15]}. See 2.2.

Exchanges under Title II of Part 3 of the TCA Mechanism

For exchanges under the TCA mechanism, any arrestee subject profile uploaded to the NDNAD regardless of the convicted or non-convicted status will be available for automated search initiated by countries the UK is connected to.

Exchanges under Mutual Legal Assistance

Requests not in relation to Title II of Part 3 of the TCA Mechanism

UKCA will refer the request to search the NDNAD directly to FINDS-DNA. FINDS-DNA will perform a search of the NDNAD and produce a report of the outcome of the search in the form of a factual report detailing information from the requested database. Dependent on the requirements of the ILOR, the result of a search(es) may require additional review by a DNA Expert (for evidential reporting) and may require referral to an appropriate LEA(s) in the UK for review – this will be determined on case-by-case basis and will be led by UKCA. The factual report will detail a match/no match response; if there is a match, this information will then be forwarded to JICC, who will undertake the appropriate checks. Once the checks are complete JICC will then forward the information to UKCA for consideration and transmission.

Requests in relation to Step 1 of Title II of Part 3 of the TCA Mechanism

UKCA will refer the ILOR to JCOP who will liaise with the MPS if the match requires verification. JCOP will then complete the status check and issue a statement of fact back to the requestor.

2.1.2.Outbound Profiles

All DNA subject profile releases via INTERPOL and via Mutual Legal Assistance must be approved by the Data Controller for either the DNA profile or the fingerprints^{[footnote 16]}.

Should there be circumstances that require the individual’s profile and demographic data to be released together this must be authorised by the Chair (or their nominee) of the FIND Strategy Board. Such an authorisation will be reported to Biometrics Commissioners’ office.

INTERPOL

When consideration is being given to exporting the DNA profile of an identified individual, via INTERPOL, contact should be made with JICC at the earliest opportunity.

Any arrestee subject profiles regardless of their convicted and non-convicted status can be searched against international databases to identify if the subject matches any unsolved crime stains internationally.

A subject’s DNA profile will only be exported for a non-routine speculative search against another country’s DNA database through the JICC via an intelligence package, which will detail the case circumstances, the subject’s DNA profile but not the demographic data.

Exchanges under Title II of Part 3 of the TCA Mechanism

For exchanges under the TCA mechanism, any arrestee subject profiles regardless of their convicted or non-convicted status uploaded to the NDNAD will automatically be searched against databases of countries the UK is connected to.

In circumstances where an EU Member State has a confirmed DNA match to a UK subject on the NDNAD, an intelligence package of information including the subject Tenprint can be sent to the Member State as part of step 2 of this mechanism. See DNA and Fingerprint Exchange under Title II of Part 3 of the TCA.

Exchanges under Mutual Legal Assistance

The relevant Central Authority will refer requests for the release of UK subject DNA profiles to the JICC. JICC will liaise with the appropriate LEA/owner to ensure that a response to the MLA request is agreed by the owner of the DNA profile and demographic data. The Central Authority will ensure appropriate authorisations are in place (section 1) and in circumstances that require the individual’s profile and demographic data to be released together.

2.2. Tenprints Records for Criminal Investigations

With both INTERPOL and exchanges under the TCA, UK Tenprints of convicted and non- convicted persons can be searched against international databases to confirm identity of a subject or to identify if the subject has committed crimes internationally which have not been solved.

Both INTERPOL and step 2 exchanges under Title II of Part 3 of the TCA need to be triggered by an LEA.

2.2.1.Inbound Tenprints Records

INTERPOL

An inbound named person’s Tenprint record will only be searched against IDENT1 as a non-routine speculative search with a view to establishing if there is a match with a UK criminal record or an unidentified UK scene of crime mark filed to the IDENT1 database. Any matches identified to a UK person or scene of crime mark will be reviewed by the NCA JICC for the appropriateness of reporting a match. The NCA JICC will initiate a match investigation and a status check process of UK Law Enforcement databases prior to the release of any associated demographic data outside of the UK.

Exchanges under Title II of Part 3 of the TCA Mechanism

For exchanges under the TCA mechanism, any arrestee subject fingerprint record uploaded to IDENT1 regardless of the convicted or non-convicted status will be available for automated search initiated by countries the UK is connected to.

A Tenprint record may also be received with Step 2 Exchange under the TCA when there is a confirmed match to a subject’s record on a member states’ database.

Fingerprints received under Step 2 of the TCA mechanism can be used in the UK whilst they serve the purpose for which they were received and processed in accordance with the TCA mechanism. This includes the comparison and speculative searching of fingerprint samples obtained domestically for a law enforcement purpose.

Fingerprints received under Step 2 of the TCA mechanism are not stored on IDENT1.

Exchanges under Mutual Legal Assistance

The relevant Central Authority will refer the request to search to JICC who will facilitate a search of IDENT1 and the processing and communication of any results.

2.2.2.Outbound Tenprints Records

Both INTERPOL and exchanges under Title II of Part 3 of the TCA need to be triggered by an LEA.

All outbound Tenprint releases via INTERPOL must be approved by the Data Controller for either the DNA profile or the fingerprints^{[footnote 17]}.

INTERPOL

When consideration is being given to exporting the Tenprint record of an identified individual, contact must be made with JICC at the earliest opportunity. This applies

whether the export arises because of a decision made by a UK authority or as a result of a request made by an authority from outside of the UK.

If assessed as necessary and proportionate, the Tenprint record will be exported for a non-routine speculative search only against another country’s database through the JICC via an intelligence package. This will detail the case circumstances and the named person’s fingerprints, see INTERPOL Search Request Network (SRN)

Exchanges under Title II of Part 3 of the TCA Mechanism

For exchanges under the TCA mechanism, any arrestee subject fingerprint record uploaded to IDENT1 regardless of the convicted or non-convicted status can be searched against the fingerprint databases in the countries the UK is connected to. Each search must be initiated by a LEA fingerprint bureau.

As part of an intelligence package a UK Tenprint record may also be exported under TCA Step 2 Exchange following either a DNA or Fingerprint match to the IDENT1 or NDNAD databases at TCA Step 1. See DNA and Fingerprint Exchange under Title II of Part 3 of the TCA

Chair (or their nominee) of the FIND Strategy Board’s approval is not required for the exchange of Tenprints.

Exchanges under Mutual Legal Assistance

The relevant Central Authority will refer the requests for the release of a UK named person’s Tenprint record to the JICC.

2.3 Crime Stain DNA Profiles for Criminal Investigations

2.3.1 Inbound Profiles

Inbound crime stain DNA profiles for criminal investigations can be received via INTERPOL or Title II of Part 3 of the TCA with a view to establishing whether there is a match to a subject or crime stain DNA profile held.

Searches of inbound crime stain DNA profiles may be undertaken on the NDNAD/ MPS CODIS System dependant on the exchange mechanism used, with a view to establishing whether there is a match to a subject or crime stain DNA profile held.

In addition to any reference data that is sent in an automated way, where there is a match or matches that cannot be eliminated, the NDNAD/ MPS (Prüm) match report can be sent to the requestor via the NCA JICC (detailing the profile information only).^{[footnote 18]} The NCA

JICC, in conjunction with the relevant LEA(s), will initiate a match investigation and a status check process of UK Law Enforcement databases prior to the release of any associated demographic data outside of the UK.

Using the TCA mechanism, the release of personal data and other information is only permitted after there has been a specific Step 2 request from the country making the request, following a verified match.

Status Check conducted there are UK triggers on our systems for those flagged or of interest to specific organisations. As such there will have to be a delay in response to allow time for those who hold the flags to respond/take action to prevent compromise.

2.3.2 Outbound Profiles

DNA Crime Stain profiles from crime scenes may be sent from the UK for searching on another country’s DNA database(s) at the request of the LEA investigating the crime.

If the request for an international search does not meet the principles (section 1) but is deemed necessary and proportionate, a request for the export of a crime stain DNA profile may be referred by the NCA JICC for review and approval by the Chair (or their nominee) of the FIND Strategy Board. The exception being the TCA mechanism where all unidentified crime stains on the NDNAD will be automatically searched abroad using the TCA mechanism.

Any subsequent matches referred to the LEA investigating the crime as to whether to progress any subsequent matches.

Exchanges under Mutual Legal Assistance

The relevant Central Authority will liaise with the appropriate LEA(s) to ensure that a response to the MLA request is agreed by the owner of the crime stain profile. The Central Authority will ensure appropriate authorisations are in place (section 1).

2.4 Scene of Crime (finger or palm) Mark for Criminal investigations

2.4.1 Inbound Scene of Crime Mark

Inbound scene of crime marks for criminal investigations can be received via INTERPOL or Title II of Part 3 of the TCA.

INTERPOL

Searches of inbound scene of crime mark may be undertaken on the IDENT1 with a view to establishing whether or not there is a match to a named person or crime scene mark held in the UK. The UK retains the right not to report the outcome of any such search and any report that is made must be approved by the JICC and communicated by them to the requestor.

Any decision to release demographic data relating to a match to Member States must be relevant and proportionate^{[footnote 19]}, with respect for the person whose fingerprints are being released and without unlawful discrimination. The decision must be documented with reasoning and justification.

Exchanges under Title II of Part 3 of the TCA.

For the TCA mechanism, all unidentified scene of crime marks held on IDENT1 are available for search by countries the UK is connected to. The JICC will manage the release of demographic and biometric data to EU Member States at Step 2 following a TCA Step1 scene of crime mark match to either an IDENT1 subject Tenprint record or an unidentified scene of crime mark.

2.4.2 Outbound Scene of Crime Mark

Crime marks may be sent from the UK via INTERPOL or under Title II of Part 3 of the TCA for searching on another country’s Fingerprint database(s) at the request of the LEA investigating the crime.

INTERPOL

If the request for an international search does not meet the principles (section 1) but is deemed necessary and proportionate, a request for the export of a crime mark may be referred by the NCA JICC for review and approval by the Chair (or their nominee) of the FIND Strategy Board.

Exchanges under Title II of Part 3 of the TCA

The LEA’s fingerprint bureaux are responsible for conducting outbound scene of crime searches against EU Member States’.

Exchanges under Mutual Legal Assistance

The Central Authority will refer requests for the release of UK scene of crime mark to the JICC.

2.5 Missing Person’s Reference DNA Profile

This section is specific to Missing Persons as opposed to ‘wanted missing’ persons (or suspected criminals).

2.5.1 Inbound Profiles

INTERPOL

All Inbound Missing Persons cases (including kinship cases - relatives from the missing person) will be submitted via the JICC who will register the request and forward on to the Missing Persons’ Unit (MPU) for their recording and management. The MPU will forward to FINDS-DNA for searching, the outcome of a search will then be forwarded to the MPU who will report back via JICC for international dissemination.

Any search of a DNA profile relating to a Missing Person shall be restricted to a search against the profiles of unidentified bodies and crime stains^{[footnote 20]} relating to possible missing persons retained on the MPDD.

Retention of International DNA profiles on the MPDD

In some cases, there may be a desire to permanently load an international DNA profile relating to missing person’s investigation on the MPDD. The following criteria must be satisfied:

• The submitting laboratory should be ISO17025 accredited

• There must be a strong UK link

• The case must be registered on HERMES

• The case must be approved by the Chair (or their nominee) of the FIND Strategy Board

• Appropriate consent must be in place in writing from the volunteer for retention, i.e. if the submission pertains to a kinship submission. Inferred kinship submissions will not be accepted.

Exchanges under Title II of Part 3 of the TCA Mechanism

Some countries exchange their missing persons cases through the TCA mechanism, as such these profiles will be searched against the data feed from the NDNAD to MPS. Any matches will be reported to the MPU.

2.5.2 Outbound Profiles

INTERPOL

A DNA profile relating to a Missing Person must only be exported when the Missing Person’s case has been registered with the MPU.

When consideration is being given to exporting a DNA profile relating to a Missing Person contact must be made with MPU^{[footnote 21]} at the earliest opportunity. This is the case whether the possible export of the profile arises because of a decision made by a UK authority or as a result of a request made by an authority from outside the UK.

Where possible, arrangements should be made for such profiles to be searched against specific countries/zones and limited to searches of Missing Persons DNA Databases rather than of Criminal DNA Databases.

The searching of Missing Persons DNA profiles is restricted within the UK. Before a DNA profile relating to a Missing Person is exported, consideration should be given to the possibility that the rights^{[footnote 22]} of the individual to go missing may in consequence be breached (proof-of-life searching). Prior to sending a Missing Person’s reference DNA profile outside of the UK, a search of the DNA profile on the NDNAD must be carried out^{[footnote 23]}. Please note it is not currently possible to search a Missing Person’s reference profile derived from a kinship reference profile(s) against the NDNAD.

When a Missing Person’s DNA profile is to be exported due to it matching an unidentified body or crime stain from another country, this match should be confirmed locally before release.

Where a PACE or pre-PACE reference DNA profile has been copied to the MPDD for storage and searching, and then is subsequently required to be searched internationally as a missing person’s case. The reference DNA profile will not require the Chair (or their nominee) of the FIND Strategy Board’s approval for international searching. The same applies for surrogate reference profiles.

INTERPOL Kinship DNA profile(s) – consent

In circumstances where the DNA profile of a missing person is derived from the DNA profiles of relatives of the Missing Person, informed consent will be required from the donors of those DNA profiles. Therefore, the person providing the kinship DNA profile must, consent for their DNA profile to be circulated internationally. FINDS-F-120 Volunteer Kinship Consent Form version 3 or above can be used to obtain consent from the volunteer^{[footnote 24]}.

Where the case circumstances recommend that it is necessary to retain a kinship DNA profile on an international DNA database then the volunteer in addition to the above must also provide written consent for their DNA profile being retained on the Missing Persons DNA Database of the country/countries concerned.

Approval from the Chair (or their nominee) of the FIND Strategy Board is not required for exporting kinship profiles, but is required when records are to be loaded to an international DNA Database.

Please see section 3.3 in relation to I-Familia.

Loading a record to an international DNA Database

There may be specific cases where a Missing Person’s reference DNA profile may be required to be loaded to an international DNA Database, this will require authorisation from the Chair (or their nominee) of the FIND Strategy Board. In such cases, it would be the LEA’s responsibility for requesting the deletion of the record from the international DNA Database once the case has been confirmed as closed on HERMES.

Exchanges under the TCA Mechanism

Missing persons’ DNA profiles are not included in the TCA mechanism for the UK. In exceptional cases, a Missing persons reference DNA profile may have been permitted to be loaded to the NDNAD, for example in a no body murder investigation, and only with the approval of the Chair (or their nominee of) the FIND Strategy Board. In such cases, these DNA profiles are included as part of the exchange.

2.6 Missing Person Fingerprints

This section is specific to Missing Persons as opposed to ‘wanted missing’ persons (or suspected criminals).

2.6.1 Inbound Fingerprints

All Inbound Missing Persons’ cases will be submitted via the JICC who will register the request and forward on to the Missing Persons’ Unit (MPU) for their recording and management. The MPU will forward to FINDS-Fingerprint for searching. The outcome of a search will then be forwarded to the MPU who will report back via JICC for international dissemination.

Any search of the fingerprints relating to a Missing Person shall be restricted to a search against records of unidentified bodies retained on the Missing Persons’ ORD. Authorisation by the Chair (or their nominee) of the FIND Strategy Board will be required to search fingerprints relating to a Missing Person on IDENT1 and/or the Immigration database.

Retention of International Fingerprints on the Missing Persons’ ORD

In some cases, there may be a desire to permanently load fingerprints relating to Missing Person’s investigation on the Missing Persons’ ORD. The Missing Person’s Unit will conduct regular review of the ongoing need for retention as part of the ongoing case management. The following criteria must be satisfied:

• There must be a strong UK link

• The case must be registered on HERMES

• The case must be approved by the Chair (or their nominee) of the FIND Strategy Board.

Exchanges under Title II of Part 3 of the TCA Mechanism

Some countries exchange their missing persons cases through the TCA mechanism, as such these fingerprints will be searched against IDENT1. Any matches will be reported to the MPU.

2.6.2 Outbound Fingerprints

Fingerprints relating to a Missing Person must only be exported when the Missing Persons case has been registered with the MPU.

When consideration is being given to exporting fingerprints relating to a Missing Person contact must be made with JICC^{[footnote 25]} at the earliest opportunity. This is the case whether the possible export of the fingerprints arises because of a decision made by a UK authority or as a result of a request made by an authority from outside the UK.

Where possible, arrangements should be made for such fingerprints to be searched against specific countries/zones and limited to searches of Missing Persons Fingerprint Databases rather than Criminal Fingerprint Databases.

The searching of Missing Persons fingerprints is restricted within the UK. Before fingerprints relating to a Missing Person are exported consideration should be given to the possibility that the individual has the right to go missing. As such, this may in consequence be breached (proof-of-life searching).

Outbound search of Fingerprints relating to a Missing Person is not permitted via exchange under Title II of Part 3 of the TCA.

Note; if a UK missing person has an arrestee set of fingerprints held on IDENT1 it will be available for inbound search under the TCA. If there is a step 2 request for the subject data following a confirmed fingerprint match at Step 1, the JICC will assess whether release of the subject profile is appropriate and proportionate. The UK is not obliged to release information at Step 2.

2.7 DNA profiles and fingerprints relating to unidentified bodies and Crime Stain DNA Profiles/Marks relating to possible Missing Persons

2.7.1 Inbound Profiles

The exchange of DNA profiles and fingerprints of unidentified bodies and crime stains relating to missing persons have no restrictions.

2.7.2 Outbound Profiles

DNA profiles and fingerprints relating to unidentified bodies and crime stains/marks must only be exported when the profiles have been registered with the MPU; and have no restrictions.

All unidentified body DNA profiles that are loaded to the NDNAD and the MPDD will be exchanged through the TCA mechanism automatically. However, through this mechanism the DNA profiles will only be compared to other countries’ national DNA databases as opposed to missing persons DNA databases. As such, it is advisable that the Officer in the Case requests that the unidentified body DNA profile is also routed via INTERPOL to ensure all avenues are covered. This can be requested by the MPU.

2.8. DNA profile for elimination purposes

For an elimination DNA profile to be sent via INTERPOL, in addition to the consent provided on the elimination form, the individual must also consent for their DNA profile to be circulated aboard. It is essential that they have understood and agreed to the following:

That my DNA profile may be circulated aboard and maybe used for comparison with any crime stain profile(s) from this enquiry.

Approval by the Chair (or their nominee) of the FIND Strategy Board is not required.

2.9 DNA profiles for direct comparisons

Where reference DNA profiles are requested to be sent internationally due to Disaster Victim Identifications, such as, but not limited to: a conflict, war, an act of terrorism, natural disaster or even when intelligence suggests that an unidentified body is located internationally. The DNA profiles can be released without the requirement to load to or search DNA databases such as the NDNAD and the MPDD. This is to allow for the identification as soon as possible.

Please note that the approved mechanism for this is via INTERPOL, once registered with JICC, Chair (or their nominee) of the FIND Strategy Board approval is required - for the appropriateness and proportionality of the release.

2.9.1 International Commission on Missing Persons (ICMP)

ICMP will be the organisation involved in excavating sites of forensic interest, identifying missing persons, and supporting families of the missing in the War in Ukraine. You can find further information on the scope of their work on the ICMP’s Ukraine information page

Families of the missing in the War of Ukraine should be directed to ICMP’s report a missing person’s page

2.10 DNA Samples

2.10.1 Inbound Samples

Forensic DNA samples may be imported into the UK for use in connection with UK investigations. It should be noted, however, that in the context of criminal investigations or investigations relating to missing persons, care should always be taken to cater for issues such as evidential continuity, chain-of-custody and the stability of the relevant samples. These must be considered from the outset in liaison with appropriate experts.

2.10.2 Outbound Samples

DNA samples should only be exported from the UK as a ‘last resort’ action. Once a DNA sample has left the UK, the UK has no further physical control over the way in which that sample is used. Any request for a DNA sample to be exported must be challenged and the requestor must be required to demonstrate that the export of a DNA sample is strictly necessary and that no other course which allows the DNA sample to remain in the UK (such as the export of a DNA profile) would suffice. It should be noted that it may, for example, be required for the sample to be subjected to a non-standard DNA test^{[footnote 26]} in the UK. Advice should be sought from Forensic Service Providers in the UK as to what can be achieved for non-standard DNA tests in the UK.

The export of any DNA sample from the UK must be authorised by the Chair (or their nominee) of the FIND Strategy Board.

2.10.3 Identified Person DNA Samples

DNA Samples collected from those arrested but not charged or informed they will be reported for an offence under PACE or PACE (Northern Ireland) must not be exported outside of the UK without the individual’s consent. Specific legal advice should be sought regarding DNA samples collected from arrestees under relevant local legislation for Scotland.

A volunteer DNA sample can only be exported from the UK with the specific written informed consent of the individual from whom the DNA sample is collected. The donor must be reminded that the UK will have no physical control over the way in which that sample is used after it leaves the UK. All other possible courses (such as profiling the DNA sample in the UK) must first have been considered and, where appropriate, exhausted.

Where a sample is required to be exported from the UK, this can be done for intelligence purposes and to aid an investigation. Other than Mutual Legal Assistance where evidence for a case may be requested, the exchange of DNA information through the mechanisms of this Policy may not be used for evidence for a case (without consent). Overseas Security Justice Assistance considerations are particularly important here.

Any application to the Chair (or their nominee) of the FIND Strategy Board for authorisation to export a named person’s DNA sample must detail all the factors and reasons that are said to make it appropriate for such authorisation to be granted and all the ‘control measures’^{[footnote 27]} that are proposed. The Office of the Biometrics Commissioner will be informed of such approvals.

2.10.4 Unidentified Body or Crime Stain DNA Samples from unknown individuals

Unidentified DNA samples (NB: this does not include samples taken from known individuals that are anonymised) can in some circumstances be exported for the purposes of progressing investigations. Such circumstances would include the processing of the DNA sample with an alternative forensic DNA test (that cannot be carried out in the UK) for the resulting DNA profile to be more compatible with a DNA profile from another country.

Any application to the Chair (or their nominee) of the FIND Strategy Board for authorisation to export an ‘unidentified’ DNA sample must detail all the factors and reasons that are said to make it appropriate for such authorisation to be granted and all the ‘control measures’^{[footnote 27]} that are proposed.

2.11 Fingerprints related to International Criminal Conviction Exchange

ACRO has the delegated responsibility of managing the UK Central Authority for the Exchange of Criminal Records with EU Member States and are the national police unit responsible for managing requests from UK police forces and other law enforcement agencies

Title IX of Part 3 of the TCA applies to the exchange of criminal records within the EU which is conducted via a shared technical infrastructure.

Exchange of criminal records with non-EU countries is conducted via INTERPOL or through specific country to country agreements.

2.11.1 Inbound fingerprints

Tenprints can be received by the UK when either; there is a request from overseas for conviction information held in the UK or when a UK national has been convicted of an offence overseas.

In both circumstances the conviction information and the Tenprint record will be loaded to UK databases (PNC and IDENT1) providing the relevant proportionality criteria are met.

2.11.2 Outbound fingerprints

Tenprints obtained in the UK relating to a criminal conviction can be exchanged when either a country requests conviction information from the UK, or, if the conviction relates to a national of a country participating in the exchange.

2.12 Fingerprints related to extradition

The JICC manages the exchange of fingerprints and nominal data in relation to the location of individuals for extradition to, or from the UK as part of an ongoing law enforcement investigation.

Exchange of information for extradition purposes is conducted by the JICC via Interpol SRN. See INTERPOL Search Request Network (SRN)

2.12.1 Outbound fingerprints

All requests to raise an INTERPOL Red Notice or Diffusion to locate an individual within another country via the JICC for the purposes of extradition must be requested by the investigating LEA and approved by the CPS. If the request is proportionate the JICC will send a subject profile including the nominal data and Tenprint record to the member state. The data will be retained by that member until it has served its purpose.

2.12.2 Inbound fingerprints

All requests to the UK to locate an individual from other countries are assessed by the JICC. If proportionate the nominal data and Tenprints received will be loaded to UK databases (PNC and IDENT1) and will be available for search until JICC are requested to delete the data by the sending country or the data has served its purpose.

3. Mechanisms of Exchange

All exchanges covered by the Policy must be notified to, and managed by, at least one of the following (to ensure the appropriateness and justification of an exchange):

a. UK Joint International Crime Centre (JICC) via NCB Manchester INTERPOL

b. MPS – Forensic Services Directorate (TCA mechanism only)

c. ACRO Criminal Records Office

d. Home Office UK Central Authority (UKCA)

e. Scotland’s Crown Office; or

f. Northern Ireland Department of Justice

in liaison with the processor for the database which the exchange is to be with as either:

a. Forensic Information Databases Service (FINDS) - for the NDNAD, IDENT1, and the MPDD (specific liaison with the Missing Persons’ Unit (MPU) also needed).

b. Scottish Government and/or Scottish Police Authority and/or Police Scotland in matters relating to exchanges of or policy regarding Scottish profiles, samples and fingerprints; or

c. Department of Justice (Northern Ireland) and/or Police Service of Northern Ireland (PSNI) in matters relating to exchanges of or policy regarding Northern Ireland profiles, samples and fingerprints.

Exchange mechanisms are as follows:

1. INTERPOL Search Request Network (via JICC) – these include Europol exchanges

2. MLA requests (via UKCA or Scotland’s Crown Office)

3. Direct Country to Country exchanges as per service level agreements signed by ACRO and the Home Office.

4. DNA and fingerprint exchange under Title II of Part 3 of the TCA

3.1 INTERPOL Search Request Network (SRN)

The INTERPOL SRN is maintained and managed by INTERPOL. It provides a world-wide network for the exchange of criminal intelligence between all member states. Each Member State has a nominated central bureau through which data can only be exchanged on the secure INTERPOL I-24/7 global police communications system (I-24/7 network).

If during a criminal investigation a crime stain/mark is loaded to NDNAD/IDENT1 to establish whether a matching DNA profile or fingerprint exists in the UK. If there is no match in the UK, LEAs have the facility to use INTERPOL via JICC to process an international DNA/Fingerprint search against certain specified countries. This would need to be risk assessed accordingly. This is a manual process triggered by the LEA.

DNA and fingerprint international searches are sent for a ‘One-off Non-Routine Speculative Search’. INTERPOL countries will manage the request under their judicial process according to their own legislation. Some INTERPOL countries will not conduct ‘One-off non routine speculative searches’ and will require an International Letter of Request (ILOR) to be managed via competent judicial authorities.

Repeat searches and retention of UK DNA profiles and fingerprints on the databases of INTERPOL countries are not allowed as standard. Therefore, repeat searches exercise should be repeated if a ‘no match’ occurs.

3.2 INTERPOL DNA Database

The INTERPOL Secrétariat Général (IPSG) runs an International DNA database known as the DNA Gateway on behalf of member countries. This holds DNA profiles from offenders (anonymised with a country reference), crime scenes, missing persons and unidentified bodies. Member countries may access the database via the I-24/7 network. Access to this database for all UK LEA is via JICC. INTERPOL restrict the retention of DNA records on the INTERPOL DNA database to 5 years for subject profiles and 15 years for unidentified DNA profiles, after which time an alert will be sent to the NCB for a review of the record retention.

The following sections cover the retention of DNA profiles on the INTERPOL DNA Database. The responsibility for the management (e.g. deletion or amendment) of DNA profiles retained on the INTERPOL DNA database resides with JICC.

FINDS-DNA will undertake a review of all profiles retained on the INTERPOL DNA database at the request of JICC, twice a year to ensure cases are still active.

Please note, kinship inferred profiles are unable to be loaded this database but can be loaded to I-Familia, please refer to 3.3.

3.2.1 Retention of Subject DNA Profiles

With justifiable reasoning and assessment, of investigative value and following the completion of the requirements detailed in section 1, requests can be made to the Chair (or their nominee) of the FIND Strategy Board for authorisation for the retention of a UK National’s DNA profile on the DNA database(s) of INTERPOL or its member states. Requests will be treated on a case-by-case basis. This applies to both Criminal (convicted person) and Missing Persons DNA profiles.

Where applicable, subject DNA profiles retained on the INTERPOL DNA Database must adhere to the requirements of the Data Protection Act 2018, the Protection of Freedoms Act 2012 or Criminal Justice (Northern Ireland) Act 2013 (once commenced) or the corresponding legislation for Scotland. The responsibility for this is with JICC.

3.2.2 Retention of Unidentified Crime Stain Profiles

The retention of unidentified (crime stain or body) DNA profiles on the INTERPOL DNA database is permitted^{[footnote 28]}. All UK crime stains or body DNA profiles that are searched against the INTERPOL DNA database are automatically retained if there is no match. If the outgoing DNA profile is not to be retained on the INTERPOL DNA database this should be stated at the time of making the request.

3.3 INTERPOL Family-Associated Matching to Identify Lost Individuals Abroad (I-Familia)

This service was launched in 2021 and allows for relatives of missing persons (kinship DNA profiles) from one country to be compared with the unidentified body/part(s) DNA profiles from that of another country.

When considering using this service, contact should be made with MPU at the earliest opportunity. You can find more information on this service on the INTERPOL I-Familia page.

FINDS-F-120 Volunteer Kinship Consent Form version 3 or above can be used to obtain consent from the volunteers.

Unidentified body DNA profiles will be bulk uploaded twice a year at the request of the MPU to FINDS. Should an unidentified body DNA profile be required to be loaded prior to the bulk upload, the LEA should make contact with the MPU at the earliest opportunity.

3.4 Interpol Fingerprints Database

The INTERPOL Secrétariat Général (IPSG) runs an International Fingerprint database known as the AFIS INTERPOL Biometric Hub on behalf of member countries. This holds fingerprints from offenders, crime scenes, missing persons and unidentified bodies. Member countries may access the database via the I-24/7 network. Access to this database for all UK LEAs is via JICC and ACRO. INTERPOL restrict the retention of fingerprints records on the INTERPOL fingerprint database 5 years for known fingerprints and 15 years for unidentified marks, after which time an alert will be sent to the NCB for a review of the record retention.

The following sections cover the retention of fingerprints on the INTERPOL Fingerprint Database. The responsibility for the management (e.g. deletion or amendment) of fingerprints originating in the UK retained on the INTERPOL Fingerprint Database resides with JICC and ACRO. ^{[footnote 29]}

3.4.1 Retention of Subject’s Fingerprints

All outbound UK named foreign offenders can be automatically searched against and retained on the INTERPOL Fingerprint Database without approval from the Chair (or their nominee) of the FIND Strategy Board. This is in accordance with INTERPOL Resolution AG-2009-RES-08.

With justifiable reasoning, and assessment of investigative value and following the completion of the requirements detailed at section 1, requests can be made to the Chair (or their nominee) of FIND Strategy Board for authorisation for the retention of a UK National’s fingerprints on the Fingerprint Database(s) of INTERPOL or its member states. Requests will be treated on a case-by-case basis.

The retention of subject’s fingerprints retained on the INTERPOL Fingerprint Database must adhere to applicable domestic legislation including the requirements of the Data Protection Act, the Protection of Freedoms act 2012 or the corresponding legislation for Northern Ireland and Scotland. The responsibility for this is with JICC and ACRO.

3.4.2 Retention of scene of crime mark

The retention of unidentified (crime scene or body) fingerprints on the INTERPOL Fingerprint Database is permitted.

3.5 Mutual Legal Assistance

Mutual Legal Assistance (MLA) requests, normally through an International Letter of Request (ILOR) are received by the relevant Central Authority. The Central Authority will coordinate any aspects of a request, including requests for:

• the search of the NDNAD or IDENT1

• the release of a Subject DNA profile or Tenprint record

• the release of a crime stain profile or scene of crime mark.

MLA is for the purpose of obtaining assistance in the investigation or prosecution of criminal offences and is traditionally used for the transfer of evidence. Enquiries should be made of the requesting authority as to what is required to satisfy their evidential requirements as continuity statements from the LEA(s) or the forensic provider may be required in addition to the DNA profiles or fingerprints. The Central Authority should clarify with the JICC and/or FINDS-DNA regarding whether material is evidential or intelligence only.

3.6 Exchange of Criminal Records through Title IX of Part 3 of the TCA and Part 1 of the Future Relationship Act.

Title IX of the TCA and Part 1 of the Future Relationship Act 2020 along with the use of a shared technical infrastructure creates an exchange mechanism facilitating the exchange of information on criminal records between the UK and EU member states. ACRO co- ordinate this exchange within the UK. Four primary processes are completed, and fingerprints can be exchanged for identification purposes, however the inclusion of fingerprints is not mandatory. The four processes are outlined below.

• Requests received from within the UK for overseas criminal conviction information held overseas (known as ‘requests out’)

• Requests received from overseas for criminal conviction information held in the UK (known as ‘requests in’)

• Notification messages sent overseas about foreign nationals convicted in the UK (known as ‘notifications out’)

• Notification messages received about UK nationals convicted overseas (known as ‘notifications in’)

3.7 DNA and Fingerprint Exchange under Title II of Part 3 of the TCA

Title II of Part 3 of the TCA mechanism is carried out using a two-step process. At Step 1, parties grant each other limited access to the reference data in their national DNA and fingerprint databases in a hit/no-hit manner. For fingerprint exchange, each TCA participating State sets a quota for daily inbound search volumes from other States. Requesting States are expected to manage outbound search requests within these limits.

Personal information relating to the reference data is not available to the requesting party at Step 1. The UK response to the TCA mechanism is centralised through the Metropolitan Police Service as a national function on behalf of the Home Office for DNA exchange and run through the Home Office for fingerprint exchange.

DNA profiles and fingerprint samples from all arrested subjects whether they have been convicted or suspected but not convicted of an offence (‘suspects’) held on the NDNAD or IDENT1 will be made searchable for other States. DNA profiles from Northern Ireland, Scotland, England and Wales will be included in this automated exchange. DNA profiles from unidentified crime stains loaded to the NDNAD (that contain at least six full loci) will be automatically populated to the MPS CODIS system which will facilitate the international searches. All unidentified scene of crime marks retained on IDENT1 will be made available for search under the TCA mechanism. DNA data will be updated on a daily basis to ensure the data is live and relevant; IDENT1 is updated in real time. DNA profiles and fingerprint samples from Northern Ireland, Scotland, England and Wales will be included in this automated exchange.

For the UK, the reference data for the TCA mechanism is wholly limited to DNA profiles from crime stains (from the NDNAD), unidentified bodies/part(s) (from the MPDD) and from subjects who have been either convicted of a recordable offence in the UK or suspected but not convicted of an offence (‘suspects’) where the corresponding DNA profiles are present on the NDNAD30. However, other countries may also include missing people, elimination and other DNA in their reference data in accordance with their domestic law. The processing and use of information received from other countries must be fully in accordance with UK domestic legislation for criminal investigations, data protection law and the TCA.

The first step is the exchange of individual DNA profiles to establish a match or ‘hit’, which is estimated to take no longer than 15 minutes for both incoming and outgoing requests, but which does not reveal the identity of the data subject. Any match will be returned with a unique reference number. Once a match has been established and verified by the appropriate laboratories, the second step is for the requesting country to request the personal information relating to that match, using the unique reference number, and in accordance with their national laws.

For Step 1 fingerprint exchange, the requesting State initiates a fingerprint search of a fingerprint subject or scene of crime mark directly into another States’ fingerprint system and will receive a list of anonymised candidate fingerprint records for comparison. The requesting State determines if the candidates returned are a hit or not.

It should be noted that not all matches under Step 1 will result in a request for further information. Personal information under Step 2 may only be provided following a separate and specific request for that information from the requesting country – it must not be supplied proactively. Such requests will be serviced via NCA.

The out-going UK Step 2 package will include the following (this is in line with what is expected for incoming Step 2 packages):

Name

D.O.B

Arrest date/ arrest offence

Custody image

Fingerprints from arrest

Any request for personal information that relates to a minor – someone who was under the age of 18 years when their biometrics were taken, regardless of their age now – may only be released following a formal Letter of request for Mutual Legal Assistance for any DNA standard of match (6 loci and above) or a fingerprint match under the TCA and regardless of any other factor. Requests via any other mechanism will be refused.

Personal data may be processed only:

• for the purposes for which the data has been supplied - processing for other purposes shall be permitted solely with the prior and express authorisation of the country administering the file (the data ‘controller’) and subject to UK national law; and

• by competent law enforcement authorities with responsibility for a task in furtherance of the investigation - data may be supplied to other entities only with the prior authorisation of the supplying country (the ‘data controller’) and in compliance with UK national law.

With regards to the retention of personal data received by the UK from other countries:

• If it transpires that incorrect data, or data which should not have been supplied, have been supplied, the UK is obliged to correct or delete the data. If this transpires, the UK must inform the supplying body.

• Data should be deleted:

  (a) if they are not, or are no longer necessary for the purpose for which they were supplied

  (b) following the expiry of the maximum period for keeping data in the national law of the supplying member state, where the supplying body informed the receiving body of that maximum period at the time of supplying the data.

• Where there is reason to believe that deletion would prejudice the interests of the data subject, the data shall be blocked instead of being deleted in compliance with national law. Blocked data may be supplied or used solely for the purpose which prevented their deletion.

4. Record Keeping

JICC, UKCA, International Unit at the Crown Office - Scotland, ACRO, FINDS-Fingerprints, MPS and FINDS-DNA must maintain records of both inbound and outbound requests. As a minimum the following records must be available:

4.1 Outbound

The number of requests for the export of DNA and/or Fingerprints from authorities within the UK and received from outside of the UK broken down as:

1.The requestor.

2.Number received.

3.Number authorised.

4.Results of the data transfer.

4.2 Inbound

The number of requests for the search of DNA and/or fingerprints from authorities within the UK and from authorities outside of the UK, broken down as:

1.Country or authority of origin.

2.Number received.

3.Number authorised.

4.The database(s) searched.

5.Results of the search.

This information must be reported, on an annual basis, to the FIND Strategy Board and may be included in the FIND Strategy Board Annual Report.

References

The following references should be used for additional information to this Policy:

Title	Link/contact details
INTERPOL DNA Data Exchange and Practice Handbook	https://publicintelligence.net/interpol-dna-data-exchange-and-
INTERPOL Resolution AG-2009-RES-08 Standard operating procedures to systematically compare unidentified fingerprints and DNA profiles taken from crime scenes against INTERPOL’s databases	https://www.interpol.int/contentinterpol/search?SearchText=AG-2009-RES-08&x=2&y=7
INTERPOL’s Rules on Processing Data	https://www.interpol.int/en
The Forensic Information Databases Strategy Board Policy for Access and Use of DNA Samples, DNA Profiles, Fingerprint Images, and Associated Data	FINDS-SB-P-002 The Forensic Information Databases Strategy Board policy for access and use of DNA samples, DNA profiles, fingerprint images, and associated data (publishing.service.gov.uk)
Procedure for Administering the DNA Profile Comparison Service for The National Crime Agency – UK Missing Persons’ Unit	FINDS-P-019 Email: [email protected]
NCA JICC – INTERPOL DNA Crime Investigations Internal Operating Procedure	T: +44 (0) 207 238 8115 24hrs [email protected]
NCA JICC – INTERPOL DNA Missing Persons & Unidentified Bodies Internal Operating Procedure	T: +44 (0) 207 238 8115 24hrs [email protected]
NCA JICC – INTERPOL Fingerprints Internal Operating Procedure	T: +44 (0) 207 238 8115 24hrs [email protected]
NCA JICC – Prüm DNA Internal Operating Procedure	T: +44 (0) 207 238 8115 24hrs [email protected]
NCA JICC – Prüm Fingerprints Internal Operating Procedure	T: +44 (0) 207 238 8115 24hrs [email protected]
NCA JICC – Senior Investigating Officer Guide for International Fingerprint Exchange	T: +44 (0) 207 238 8115 24hrs [email protected]
NCA JICC – Senior Investigating Officer Guide for International DNA Exchange	T: +44 (0) 207 238 8115 24hrs [email protected]
Requests for Mutual Legal Assistance in Criminal Matters Guidelines for Authorities Outside of the United Kingdom	https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/415038/MLA_Guidelines_2015.pdf
ACRO Criminal Records Office	www.acro.police.uk
Law enforcement processing means any processing carried out under Part 3 of the Data Protection Act 2018 which makes provision about the processing of personal data by competent authorities for law enforcement purposes.	Further guidance on the “law enforcement processing” regime set out in Part 3 of the Data Protection Act 2018 may be found at: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-law-enforcement-processing/
International transfers: Chapter 5 of Part 3 of the Data Protection Act 2018	https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-law-enforcement-processing/international-transfers/
Data protection legislation - For the purposes of this document Data Protection Legislation is defined as: - The UK General Data Protection Regulation (“UK GDPR”); and - the Data Protection Act 2018 (and Regulations made under that Act). The vast majority of processing of personal data under this Policy is likely to fall under Part 3 of the Data Protection Act 2018.	UKGDPR (showing changes to the GDPR post-EU Exit). The Data Protection Act 2018
Article 8 of the European Convention on Human Rights (ECHR): Respect for private and family life	https://www.equalityhumanrights.com/en/human-rights-act/article-8-respect-your-private-and-family-life
Human Rights Act 1998	https://www.legislation.gov.uk/ukpga/1998/42/contents
Information and guidance on the Equality Act 2010, including age discrimination and public sector Equality Duty.	https://www.gov.uk/guidance/equality-act-2010-guidance
Criminal Justice and Data Protection (Protocol No 36) Regulations 2014 (Now revoked) = The 2014 Regulations still apply (with certain modifications) in respect of requests for information received from EU member States prior to 01/01/2021 – see Part 12 of the Law Enforcement and Security (Amendment) (EU Exit) Regulations 2019 (S.I.2019/742) for more details.	The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (legislation.gov.uk)
Part 12 of the Law Enforcement and Security (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/742)	https://www.legislation.gov.uk/uksi/2019/742/made
The Accreditation of Forensic Service Providers Regulations 2018 (S.I. 2018/1276)	http://www.legislation.gov.uk/uksi/2018/1276/contents/made
The Trade and Cooperation Agreement Between the European Union and The European Atomic Energy Community, Of the One Part, And the United Kingdom of Great Britain And Northern Ireland, Of the Other Part.	Trade and Cooperation Agreement between UK and EU – CP 426 (publishing.service.gov.uk)
Volunteer Kinship Consent Form	FINDS-F-120 Email: FINDS_Quality_Management @homeoffice.pnn.police.uk
Scottish Biometrics Commissioner Act 2020	Scottish Biometrics Commissioner Act 2020
The statutory Scottish Code of Practice under the Scottish Biometrics Commissioner Act 2020	Statutory Code of Practice
Forensic Science Regulator Act 2021	Forensic Science Regulator Act 2021 (legislation.gov.uk)

Full Revision History

Issue Number	Issue Date	Summary of changes
1	13/6/18	Replaces CUSTP-GP-010 - for expansion to coverage for FIND
2	21/6/19	DCR161- Minor updates and the implementation of the Prüm Council Decisions
3	29/12/20	DCR436 – General review and Prüm updates including the addition of sharing suspects data and Step 2 process responsibilities
4	14/01/22	DCR633 – complete re-write including, 1) Change to legal basis due to EU EXIT, 2) Restructure of the policy to aid readability, 3) Update of the speculatively searching criteria for INTERPOL searches against the NDNAD and the MPDD, 4) JICC were given delegated authority by the FIND Strategy Board to approve the export of DNA profiles via INTERPOL on behalf of the Data Controller. 5) Fingerprints received for the purposes of arrest for surrender or extradition from SIS2 countries are now loaded to the IDENT1 unified policing collection.

1. Please note that some requests from Belgium and Ireland for DNA Step 2 are made using MLA but are still ultimately processed by the NCA. ↩

2. With the exception of data exchange through the TCA mechanism. ↩

3. For points 2 and 3, in this case the controller is responsible to ensure that full instruction is given to the processor to enable only those DNA and Fingerprints records with the appropriate legal authority are distributed internationally. ↩

4. Specifically, the fingerprint collections in IDENT1 used for law enforcement purposes ↩

5. Except for tax and fiscal customs criminal matters which are co-ordinated by HM Revenue and Customs (HMRC) ↩

6. The MPU also within the NCA are the national focal point for cases relating to unidentified bodies and missing persons ↩

7. Only applies to personal data of an identified or identifiable living individual. ↩

8. The international exchanges as carried out by ACRO under the Exchange of Criminal Records through Title IX of Part 3 of the TCA and part 1 of the Future Relationship Act and those carried out on behalf of NCA. ↩

9. Must be in line with FINDS-SB-P-002 ‘The Forensic Information Databases Strategy Board Policy for Access and Use of DNA Samples, DNA Profiles, Fingerprint Images, and Associated Data’ ↩

10. As described in Article 528 of the TCA. ↩

11. TH01, vWA, FGA, D21S11, D3S1358, D8S1179 and D18S51. ↩

12. This is carried out on the behalf of the NCA and is covered by a memorandum of understanding. ↩

13. Received under Title II of Part 3 of the TCA or via Interpol. ↩

14. Received under Title IX of Part 3 of the TCA or via Interpol or specific country to country agreements. ↩

15. The UK uses fingerprints to confirm identity as fingerprints are unique to a person and the outcome of a fingerprint comparison is a definitive match/no match. A DNA match on the other hand is not a definitive match/no match and is based on a probabilistic approach. ↩

16. NCA has delegated authority to act as Joint Controller for the management of biometrics (DNA and fingerprint data) exchanged via INTERPOL, Title II of Part 3 the TCA Mechanism and MLA. ↩

17. NCA has delegated authority to act as Joint Controller for the management of biometrics (DNA and fingerprint data) exchanged via INTERPOL, Title II of Part 3 the TCA Mechanism and MLA. ↩

18. In regard to EU Members states, should there be a request to receive the demographic data at the same time as the profile information, this will be considered on a case by case basis. It should be noted that with any ↩

19. In respect to countries that are not Member States, the test is whether it would be clearly irrelevant or disproportionate. ↩

20. For example, no body murders, DNA taken from a pool of blood left at a crime scene where an individual would not have been able to sustain life. ↩

21. MPU will then liaise with JICC. ↩

22. Including the right to privacy provided for by Article 8 of the European Convention on Human Right - Respect for private and family life ↩

23. This is without Chair (or nominee) of the FINDS Strategy Board authorisation. ↩

24. This form has been distributed to all forces by FINDS. ↩

25. Please ensure the MPU are also informed on the intent to export. ↩

26. A standard DNA test is defined as a DNA-17 test that is used for the majority of forensic DNA Applications in the UK ↩

27. Includes, but not exhaustive to handling restrictions on the intended recipient as well as specifying the limited purpose for which it has been shared. ↩ ↩²

28. Approval from approved by the Chair (or their nominee) of the FIND Strategy Board is not required. ↩

29. The Forensic Information Databases Strategy Board Policy for Access and Use of DNA Samples, DNA Profiles, Fingerprint Images, and Associated Data, FINDS-SB-P-002 describes the data processing responsibilities under UK data protection legislation. For INTERPOL processing JICC are the data controller and ACRO data processor. ↩