Ever wondered why you need to wait in line at the bank to open a new account, or send your passport photo to your new employer, to prove you are who you say you are? A new partnership between the public and private sectors may mean that those days could soon be over.

Te Tari Taiwhenua Department of Internal Affairs (‘DIA’) has announced the beginning of a 12-month pilot with Hospitality New Zealand, as it prepares to roll out its identity verification service across private sector organisations. This service uses biometric (facial recognition) technology to match live image captures with official identity documents, enabling identity verification requirements to be met through online processes.

What is Identity Check?

Identity Check is a service that enables individuals to verify their identity with participating service providers by submitting a facial recognition check (using a phone or computer camera) when applying to use a service. An image of the individual’s face, including underlying biometric information, is compared against identity documents stored in DIA databases, such as New Zealand passports and driver licences, using DIA’s facial recognition technology. If the facial capture matches the stored images for that individual, Identity Check sends a notification to the service provider confirming that the individual’s identity has been verified. The service provider never receives a copy of the facial capture, nor the proof of identity documents, but is able to rely on Identity Check’s confirmation given the backing by DIA.

Identity Check is currently used by DIA as a public sector agency resource only. Its technology forms the backbone of online application processes for New Zealand passports, citizenship and the RealMe identity verification service used by many public sector agencies.

The hope is that, if implemented more widely across private sector organisations, Identity Check will be able to replace existing processes for identity verification which would ordinarily require an individual to visit a physical store or upload copies of proof of identity documents to a service provider website.

Hospitality New Zealand pilot

The Hospitality New Zealand pilot is a limited application of Identity Check technology to the application process for the Kiwi Access Card. The Kiwi Access Card (previously known as the 18+ card) is an approved evidence of age document under sale and supply of alcohol legislation, which can be used in place of a New Zealand driver licence or passport. The Kiwi Access Card removes a potential barrier to accessibility of age-restricted services – not all New Zealanders have the financial or other means to obtain a driver licence or passport.

Applicants are ordinarily required to visit a participating NZ PostShop or AA Centre in person for verification of their identity against their chosen photo ID. However, the Identity Check pilot will enable an online application and identity verification process, removing a further barrier to access to services as Kiwi Access Cards can be obtained from a person’s own home.

Following this initial pilot, and consultation with affected stakeholders, the Identity Check service may be expanded to a wider range of private sector organisations. It is important to note that DIA does not propose licensing the underlying biometric technology to service providers – rather DIA would provide Identity Check as a ‘service’ that providers may access. The RealMe identity verification service may provide a useful model for how a private sector partnership could work.

Security advantages or security risks?

At the outset, Identity Check has the potential to reduce the privacy and security risks associated with current identity verification processes. DIA explains that Identity Check ensures individual privacy by:

• not permitting partner organisations to have access to the New Zealand passport or driver licence databases;
• not permitting anyone to have access to the databases that compare the facial capture images with passport or driver licence photos – the process is entirely automated;
• only retaining individual transaction data for a limited time; and
• removing the need for individuals to carry around physical copies of important identity documents, which can be lost by an individual or, if supplied to a service provider, may sit on physical files which are vulnerable to theft and misuse.

However, the use of biometric technology comes with inherent risks that must be carefully weighed against the benefits of using such technology.

Biometric technology is technology that relies upon the use of biometric information, being information about an individual’s biological or behavioural characteristics: for example, a facial image, a fingerprint pattern or a digital template of that image or pattern. Biometric information is considered ‘personal information’ for the purposes of the Privacy Act and must be collected, stored, used and disclosed in accordance with the Information Privacy Principles (‘IPPs’) in the Act.

Common concerns about the increasing use of biometric technologies include the risks associated with loss or compromise of information connected to a person’s identity (which could range from fraud and financial harm to emotional trauma), the risks of biometric data being used for ulterior purposes such as mass surveillance and profiling, and the potential for bias and discrimination where gender or ethnic groups are over-represented in biometric databases. Engagement with cultural groups – in New Zealand, acknowledging Te Ao Māori and Te Tiriti o Waitangi perspectives – is also critical when using biometric technologies to ensure that such technologies do not cause harm to the dignity, emotional wellbeing and bodily sovereignty of data subjects.

The Office of the Privacy Commissioner (‘OPC’) considers biometric information to be ‘sensitive’ personal information and discusses the implications of this in a recently-released consultation paper – see our commentary on that paper here. The OPC considers that, while the Privacy Act does not distinguish between sensitive and non-sensitive personal information, organisations using biometric information may need to take a stricter approach to compliance with the IPPs. For example:

• where an organisation collects biometric information from an individual, it might be required to take further ‘steps’ than might otherwise be required to ensure that the individual concerned is aware of the fact of the collection, the purpose for which the information is being collected and the intended recipients of the information; and
• where an organisation stores biometric information, the security safeguards that it is ‘reasonable in the circumstances’ to take might require even more robust organisational and technical measures to prevent against loss, unauthorised access or other misuse than might otherwise be the case.

Where biometric systems rely upon robust, ‘industry best practice’ security measures (as we expect will be the case for a Government-backed system) the risks of data loss or unauthorised access may be low. However, it is important that the purposes for which biometric information may be used are clearly communicated to individuals at the point of collection, and ideally these purposes should be limited to only those that are reasonably necessary in order to provide the relevant service. Otherwise, it could be difficult to build trust in biometric technologies and get sufficient public buy-in to enable the benefits of these technologies to be enjoyed more widely.

Future of biometrics and digital services in New Zealand

Biometric technologies are an evolving industry in New Zealand and present significant opportunities for increasing access to services, including access to digital services.

It is likely that we will see significant legislative and regulatory change over the next decade as the Government seeks to take advantage of these opportunities while mitigating the associated risks. Developments are already underway in this respect with the Government’s proposal to introduce a Digital Identity Services Trust Framework, which would establish rules and a liability framework for the use of digital identity services. A bill to establish a formal legal framework has been introduced and passed its second reading in July.

The Digital Identity Services Trust Framework is one of the many initiatives grouped under the Government’s recently released Digital Strategy for Aotearoa, which sets out the Government’s 10-year vision for expanding the use of digital technologies and data in Aotearoa. Privacy issues will sit at the core of many of the proposed initiatives and it is likely that the legal landscape will need to evolve in response to the shift to a digital-focused society.

From a human rights perspective, as use of biometric technology becomes more widespread in New Zealand it will be important to ensure that biometric-backed services are accessible to all. Service providers (and providers of biometric technologies) should consider whether the nature of their services requires them to address any financial, social, cultural, physical and age-related barriers to access to biometric services. This may be relevant where certain services, or a certain quality of service, are only accessible to individuals with smart devices, or where biometric technology is not designed to accommodate an individual’s physical characteristics. A recent example of the latter has been reported recently from individuals bearing moko kanohi (Māori facial tattoos) who allege they have been unable to use certain facial recognition functions on smartphones.

Start a conversation

Talk to the experts. Our privacy law specialists, Hayley Miller, Campbell Featherstone, Hayden Wilson and their teams are on hand to assist and have extensive experience advising on the introduction of new technologies and the lawful collection, use and processing of all types of personal information, including advising on some of the most cutting-edge biometric technologies. We can help conduct privacy impact assessments, advise on all elements of compliance with privacy law, draft privacy disclosures – and provide any other advice you require in connection with the implementation and use of biometric technologies.