What came before?

Welcome to our latest update on the regulation of biometrics in Aotearoa, New Zealand. 

To recap:

• In October 2021, the OPC released a position paper on how the Privacy Act 2020 currently regulates biometrics. For more background about the history of the OPC’s developments, you can read our September 2022 summary of the OPC’s proposals. We also touched on the growing desire for regulation again in April this year.
• The OPC has decided regulation will take the form of a biometrics Code of Practice. The Code will go through a round of public submissions, Individuals will be able to provide feedback about the draft Code and their views about how privacy obligations should apply to agencies collecting and using biometric information. The OPC produced a full discussion document in July 2023, and more recently, a short explainer document detailing the proposed regulations.
• In November 2023, the Office of the Privacy Commissioner (OPC) announced it was developing a Biometrics Privacy Code Exposure Draft which would refresh the requirements for agencies collecting and using biometric information (for example, through facial recognition technology, retinal scans and voice recognition).

Why do we need to regulate biometrics?

The OPC is concerned about the misuse of biometric information in automated processes for the recognition and categorisation of people. The OPC defines Biometric information as “information about people’s physical or behavioural characteristics (such as a person’s face, fingerprints, voice or how they walk)”. 

The draft Code is a response to local stakeholders, changing laws in other countries and interested groups – including concerns by Māori that biometrics could perpetuate biases. The Privacy Comissioner, Michael Webster, described the OPC’s progress as “a chance to consider, not only biometric systems, but also what sort of country we want to be in terms of safeguarding our free and democratic society.”

The Code is intended to create a framework for the Government and agencies to use biometric information safely, if they have good reasons to do so. 

How will they regulate biometrics?

The draft Code will include the following three key proposals which will shape how agencies collect and use biometric information:

1. A proportionality assessment requiring agencies to consider whether the benefit of using biometrics outweighs the privacy intrusion. 
2. Transparency and notification requirements for agencies to be open with individuals about the collection and use of biometric information. 
3. Limitations on the purpose of using biometric information which would place restrictions on agencies using biometrics for certain purposes such as to make inferences about a person’s mood or health information. 

In its discussion document, the OPC set out some specific proposals that they might adopt in the draft Code, including requiring agencies to:  

• obtain a person’s consent before collecting biometric information about them. An agency would need to ensure people understand how their information will be used and handled, with the offer of an adequate alternative that does not involve the collection of their biometric information;
• be able to show that the information will be used in a way that is effective and justified;
• NOT collect biometric information for certain purposes such as targeted marketing, classifying people in discriminatory categories (i.e., gender, ethnicity, disability, sex, etc), or to learn about a person’s emotions or state of health;
• have strong safeguards to ensure biometric information is securely kept and the accuracy of it is routinely checked.

There are exceptions to these requirements, for example, where collection is:

• allowed under another law;
• in an employment context and covered in an employment agreement;
• needed for the maintenance of the law or to protect health and safety; and
• for identifying people on a watchlist, for reasons such as controlling problem gambling or protecting staff and customers from people who engage in violent or threatening behaviour in a store or other premises.

Although these proposals place more stringent obligations on agencies dealing with biometric information, the biometrics Code would still have a rather limited scope. 

Based on the discussion document released July 2023, the OPC proposes to exclude the following from the draft Code:

• biometric information that is to be used in manual processes;
• the collection of information not used for categorisation, verification or identification;
• health information collected and used by health agencies; and
• genetic information such as information from human tissue and neurodata.

What next?

The OPC will invite public discourse on the exposure draft in early 2024, followed by a formal Code consultation process. After making these refinements, the OPC will look at issuing the Biometrics Privacy Code of Practice. 

Talk to us

Hayley Miller, Campbell Featherstone, Hayden Wilson, Gunes Haksever and Ashleigh Ooi are on hand to assist and have extensive experience advising on:

• the introduction of new technologies;
• the collection, use and processing of all types of personal information;
• some of the most cutting-edge biometric technologies.

If you are interested in how these proposals may apply to you or your agency, we can conduct a privacy impact assessment or offer any other guidance you may need. Additionally, we can also assist you in crafting a response to the Code’s exposure draft in early 2024.

This article was written by Emily Barea, a summer clerk, Lavi Abitbol, a law graduate, and Gunes Haksever, a senior associate in our commercial, technology and privacy team.