Police currently retain more than a million mugshots including an unknown number of people never charged with a crime.
A report by an independent advisory group on biometric data such as fingerprints, DNA and photographs said some custody images are being held by Police Scotland for up to seven years.
The report’s author, John Scott, called for the establishment of a code of practice to cover the acquisition, retention and disposal of biometrics and the creation of a new biometrics commissioner.
According to the report, there are more than 633,000 photographs of around 362,000 individuals held in Police Scotland’s Criminal History System (CHS), where all records and images of charged and convicted persons are stored.
But there are also one million custody photographs held in computer systems which originally belonged to the eight legacy police forces merged in 2013 to form Police Scotland.
The report said it was not known how many of these images are of people who were not charged or convicted of any offence.
It noted that while it has been common practice for police in Scotland to take custody photographs for over 100 years, there is no legislation regulating how long they are retained or how they are used.
And it said the retention of custody photos for up to seven years contrasted with the retention of fingerprints, DNA and CHS images which are all destroyed if no further proceedings are taken against the person.
Justice secretary Michael Matheson, who established the independent advisory group last year, said: “The Scottish Government accepts the group’s report and the thrust of its recommendations.
“While the creation of a new biometrics commissioner to monitor compliance with a new code will require careful consideration and discussions with the parliamentary authorities, it is one that we accept in principle.
“The public should continue to have confidence in how their information is held and I hope that the publication of this report will kick-start a wider debate on biometric data and how it is best used to help keep our communities safe.”
Assistant Chief Constable Gillian MacDonald said: “Biometric data, particularly DNA, fingerprints and photographs, is a critical tool in the investigation and prevention of crime. We recognise the importance of ensuring that the public has trust and confidence in the procedures which govern its use.”