23 Nov 2023, 06:00

The Privacy Commissioner has announced that his Office will be consulting on new rules specifically for biometrics. Biometrics are increasingly collected by facial recognition technology (FRT), retinal scans, and voice recognition.

The Privacy Commissioner has announced that his Office will be consulting on new rules specifically for biometrics. Biometrics are increasingly collected by facial recognition technology (FRT), retinal scans, and voice recognition.

Michael Webster, Privacy Commissioner, said, “New Zealanders need to have trust and confidence in the use of biometrics by organisations and businesses.
“My Office will issue a biometrics code exposure draft in early 2024 that we’ll open for everyone to have their say on.

“Biometrics affects us all and I want to hear from the experts and other stakeholders we usually hear from, but also from the people going to the supermarket, or receiving marketing, who will have views on what parts of their personal information is collected and stored,” said the Commissioner. 

“Biometrics is a serious business because it relates to unique, and often irreplaceable, human features like a person’s face, fingerprints, voice, or how they walk. Biometric technologies (such as facial recognition or voice analysis) analyse biometric information to recognise who someone is, or to work out other things about them (such as their gender or mood).”

What will the biometrics privacy code exposure draft cover?

The Privacy Commissioner has decided the draft code will focus on requirements around proportionality, transparency and purpose limitation. It has three parts. 

1. A proportionality assessment would require agencies to carefully consider whether their reasons for using biometric technologies to analyse biometric information outweigh the privacy intrusion or risks.
2. Transparency and notification requirements would place clear obligations on agencies to be open and transparent with individuals and the public about their collection and use of biometric information.
3. Purpose limitations would put some restrictions on collecting and using biometric information. 

These rules would apply when agencies collect biometrics to use in automated processes, like facial recognition technologies. 
The code’s exposure draft will be available for review and comment in early 2024. 

How did we decide that a draft biometrics privacy code might be a good idea?

This year OPC tested ideas for a biometrics code by developing a discussion document then asking people and groups what they thought. Were our ideas effective and workable? What should we add or remove? What should be changed? 

The Commissioner says, “We’re taking a leadership position here because we need to develop ideas that are workable and effective but also take into account technological advancements.”

“We have looked at the privacy risks related to biometrics, analysed what is happening with laws in other countries, and heard from local stakeholders. It has shown us that consulting on new rules specifically for biometrics is the right way forward.”
“Māori especially have expressed significant concerns about the use of biometrics in New Zealand, particularly around the potential for bias and discrimination,” said the Commissioner.

What happens next? 

The exposure draft will be released early in 2024 and will be available for everyone to comment on.

“It’s important we get the right wording in the draft code to avoid any unintended consequences,” says the Commissioner. 

“Putting up an exposure draft then hearing what people think will tell us whether we’ve got the technical details correct and help us make further refinements. 
“Biometrics has been in the media a lot in 2023 so this is also a great opportunity to hear from people about what they think about biometrics and whether they think their biometric information is sufficiently protected,” says the Commissioner.

The process of making this law

After public consultation on the exposure draft, there will then be a further period of formal code consultation before any biometrics privacy code of practice can be issued. 

Further resources

Biometrics and privacy page
Short explainer -  exposure draft

ENDS

For more information:

Emma McCleary
021959050
media@privacy.org.nz