Privacy Commissioner in New Zealand Opens Consultation on Stricter Biometric Data Laws

Privacy Commissioner Paves the Way for Biometric Code: Consultation Open

The Privacy Commissioner of New Zealand has taken a decisive step in regulating the use of biometric technologies with the release of a draft Biometric Processing Privacy Code.

Open for consultation until 14 March 2025, the proposed code aims to strengthen privacy protections under the Privacy Act 2020 by introducing stricter rules for the collection, use, and storage of biometric data.

A New Era for Biometrics

Biometric technologies, such as facial recognition and voice authentication, are rapidly becoming integral to various sectors, from banking to border control.

While these technologies offer benefits such as enhanced security and efficiency, they also raise significant privacy concerns. The draft code is designed to ensure that the use of such sensitive data is not only lawful but also necessary and proportionate.

“Biometric systems often take agency away from individuals,” the Commissioner stated in the consultation paper. “These systems can collect information without people’s knowledge and make inferences that may be difficult to challenge.”

Proportionality at the Heart of the Code

One of the key innovations of the draft code is the requirement for organisations to conduct a proportionality assessment before deploying biometric technologies.

This assessment mandates a careful weighing of the benefits of biometric processing against the privacy risks it poses.

For instance, a bank using facial recognition to verify client identity must demonstrate that no less intrusive alternative exists to achieve the same purpose.

Transparent and Inclusive

The draft code introduces enhanced transparency obligations, requiring organisations to inform individuals about the purpose of biometric data collection, the duration of data retention, and available alternatives.

This transparency is particularly critical for processes like emotion recognition or categorisation into sensitive demographic groups, which the code limits due to their invasive nature and potential for misuse.

The Privacy Commissioner has also considered the cultural implications of biometric data for Māori communities, emphasising its connection to whakapapa and the mauri of individuals.

The code includes provisions that require organisations to assess cultural impacts and ensure the ethical handling of Māori biometric information, reflecting its status as a taonga (treasured possession).

Balancing Innovation and Regulation

While many countries focus primarily on the verification and identification aspects of biometrics, New Zealand’s draft code takes a broader approach. It includes the emerging area of biometric categorisation, which encompasses activities such as inferring emotions, health status, or even attention levels.

By addressing these uses, the draft code positions New Zealand at the forefront of biometric regulation.

Key Questions for Stakeholders

As the consultation unfolds, the Commissioner invites diverse feedback from businesses, government agencies, and the public.

Stakeholders are encouraged to reflect on questions such as whether the rules strike the right balance and how the proposed safeguards could impact innovation.

With the code expected to come into force later in 2025, this consultation marks a critical moment in shaping the future of biometric technologies in New Zealand. Submissions can be sent to biometrics@privacy.org.nz.