The Office of the Privacy Commissioner (OPC) has released a consultation paper on the regulation of biometrics in Aotearoa New Zealand. The OPC is calling for submissions in response to growing concern around the use of biometric technology, following the OPC’s release last year of a position paper on how the Privacy Act 2020 currently regulates biometrics.

What is biometric information?

The paper defines biometric information as information about an individual’s biological or behavioural characteristics: for example, a facial image, a fingerprint pattern or a digital template of that image or pattern.

Why is this important?

Technology relying on the use of biometric information is becoming more and more prevalent, as agencies seek to benefit from the use of hard-to-emulate biometric information to – at least ostensibly – improve security and remote access to services.

However, as the paper acknowledges, the reliance on biometric information brings with it many challenges, including:

• a lack of accuracy, with significant implications for individuals when the technology doesn’t work;
• security risks;
• racial and other profiling;
• function creep (that is, the use of biometric information for a different purpose to that for which it was collected);
• lack of transparency; and
• bias and discrimination.

In the New Zealand context, the sensitivity of biometric information is specifically relevant to Māori, who have inherent whakapapa links to biometric data (particularly facial moko). The principle of manaakitanga as it applies to biometric information adds an extra layer of obligations on agencies to ensure that collection and use of data will uphold mana and avoid stigmatisation. 

Current protections

Biometric information is considered ‘personal information’ for the purposes of the Privacy Act. Accordingly, the collection, use, disclosure and storage of personal information is governed by the information privacy principles (or ‘IPPs’).

The OPC considers biometric information to be ‘sensitive’ in nature. While the Privacy Act does not expressly distinguish between personal information that is ‘sensitive’ and other classes of personal information, the fact that personal information is considered ‘sensitive’ can be relevant in the context of a number of the IPPs. These include:

• IPP 3, in that, taking into account the sensitivity of the information being collected, an agency might be required to take further ‘steps’ than the agency might otherwise be required to take to ensure that the individual concerned is aware of various matters (including the purpose for which the information is being collected and the intended recipients of the information). In this regard, the transparency of disclosures made to individuals at or prior to collection of biometric information is of critical importance.
• IPP 4, in that the sensitivity and deeply ‘personal’ nature of biometric information is particularly relevant in the context of assessing whether the collection ‘does not intrude to an unreasonable extent’ upon the personal affairs of the person from whom it is being collected.
• IPP 5, in that the security safeguards that it is ‘reasonable in the circumstances’ for an agency to take might – in the circumstances where biometric information is concerned – require even more robust organisational and technical measures to prevent against loss, unauthorised access or other misuse than might otherwise be the case.
• IPPs 10 and 11, in that the circumstances in which biometric information can be lawfully used or disclosed are likely to be narrower, given the correspondingly narrow purpose for which (in most cases) biometric information will be collected.

The OPC’s proposals

While the OPC’s position paper and the existing law is a good starting point, the OPC thinks that it is no longer enough on its own, and that further regulatory action is required. Ideally, further regulation would deliver clarity for agencies and individuals on their rights and obligations, and would implement a more appropriate framework for the use and collection of biometric information so as to ensure that it is subject to safeguards that are appropriate in light of its inherently sensitive nature.

The OPC is seeking feedback on the following proposals:

• Non-legislative options, including additional specific guidance from the OPC, introducing biometrics standards and principles, and/or directives or expectations for government departments and agencies looking to collect and use biometric information.
• A biometrics code of practice issued by the OPC under the Privacy Act (which would modify the operation of the Privacy Act as it applies to biometric information). A code under the Act could apply to biometric information generally, regulate biometric technology in a particular context, or implement both approaches.
• Advocating for legislative change to specifically deal with the regulation of biometric technology and data protection.

What should you do

If you do use, or intend to use, biometric technology in your business, or you have concerns around how your biometric information might be collected or stored, take this opportunity to contribute to the future regulation of biometric technology as it develops and adapts to the particular circumstances of Aotearoa: anyone can submit a response to the consultation paper.

Submissions on the consultation paper are due by Friday 30 September 2022.

In any case, anyone using or intending to use biometric technology in their business needs to be aware of not only the potential for regulatory change, but also the application of existing legislation and regulation, and the OPC’s approach to regulation, in the Aotearoa New Zealand context. Like any project which involves the deployment of new technology or the collection of new personal information, a project which deploys biometric technology or which will result in the collection or processing of biometric information requires careful analysis, so as to ensure compliance with existing laws, and to future proof the project against likely changes to the law.

Start a conversation

Talk to the experts. Our privacy law specialists, Hayley Miller, Campbell Featherstone, Hayden Wilson and their teams are on hand to assist and have extensive experience advising on the introduction of new technologies and the lawful collection, use and processing of all types of personal information, including advising on some of the most cutting-edge biometric technologies. We can help conduct privacy impact assessments, advise on all elements of compliance with privacy law, draft privacy disclosures – and also assist you to craft a submission in response to the consultation paper.