In a world where advanced aging software locates missing children and deep learning uncovers the cringiest pictures on your phone, facial recognition technology (FRT) blurs the lines between sci-fi and reality. Amid this rapid evolution, privacy concerns surrounding FRTs, a staple of dystopian tales, are growing more pressing than ever.

According to MIT scientist Karen Hao, the largest ever study of facial recognition data found that FRTs, particularly with the increasing need for data and use of deep learning, has eroded our privacy. Amba Kak, Executive Director at AI Now Institute pointed out that deep learning has “thrown up all these issues that we now are quite familiar with: consent, extraction, IP issues, privacy”.

Following on from looking into further regulating the use of biometric technologies (see our report from last September), Privacy Commissioner Michael Webster recently restressed the need for tighter regulation on the use of biometric information to ensure that New Zealanders can harness the benefits of biometric technologies in a safe manner. However, we will have to wait until 2024 to see whether the regulation will be in the form of a code of practice.

In this article, we examine the recent developments in the public eye that tingled Michael Webster’s spider senses and prompted heightened interest in the use of FRTs. 

Every breath you take – The Police updates its manual

The New Zealand Police actively work to develop a policy framework for its use of emergent policing technologies. The “Trial or adoption of new policing technology” policy and the New Technology Framework highlight the importance of making sure appropriate approvals are sought and given.

They should be based on a demonstrable fair and transparent balancing of policing requirements and public safety, against privacy and other impacts before testing or implementing new technologies. Furthermore, the Police recognised the significance of such policies in promoting public discourse on the involvement of technology-enabled capabilities in policing throughout New Zealand. 

Every move you make – The Police halts the use of FRTs

Following their Policy, the Police commissioned experts to undertake a six-month review of FRT and its use. The resulting expert report: “Facial Recognition Technology: Considerations For Use In Policing” found a general lack of awareness among the Police of their obligations under the Privacy Act 2020, and that accuracy and bias were the key concerns with the use of FRTs. FRTs are  notorious for being less accurate in black and brown faces, in one case leading to the arrest of three Black men who were misidentified by the tech.

The Joint Inquiry by the Independent Police Conduct Authority (“IPCA”) and Office of the Privacy Commissioner (“OPC”) recommended that the Police revise and enhance their policy, procedures, and training to ensure the lawful and effective collection and retention of personal information, including photographs. The recommendations include a commitment to: 

• Continue the pause on the development of live FRTs;
• reviewing their current collection and retention processes of facial images;
• developing clear policies on the use of FRT;
• implementing ethical commissioning of technology;
• upholding the principles of the Treaty of Waitangi in partnership with Māori; and
• ensuring transparency.

At the time, the Police confirmed that they did not use live FRTs and that they had decided not to use live FRTs without further detailed analysis, considering legal, privacy, and human rights concerns specific to the New Zealand context.

Every bond you break – Police uses FRTs anyway

As recently reported, the Police had been using ABIS2, a new tool matching unknown suspects and people of interest against the databases of photographs they hold – including people previously arrested and firearms licence holders for firearms-related offences. The technology, which scans databases of photographs and recognises facial features, scars, and tattoos, was introduced despite stark warnings and suggested steps in their own Privacy Impact Assessment (PIA) in February 2022.

The PIA provides a good starting point for identifying the primary risk factors when using FRTs and the potential ways to manage those risks. In particular, the PIA highlights several information privacy principles (IPPs) to assess the inherent risks represented by FRTs. In particular, IPP 3 (Notification Requirements), IPP 5 (Security), IPP 10 and IPP 11 (Appropriate use and Disclosure) are relevant to the risks associated with FRTs.

Every step you take – the OPC steps up

The OPC and the IPCA launched a joint inquiry in March 2021 following complaints and media reports that Police officers were photographing rangatahi (young people) in circumstances they felt were unfair or unjustified. The inquiry initially considered five complaints but was then extended to an examination of the way the Police took, used, and retained photographs or video recordings of members of the public in a variety of policing contexts.

The report found that the Police had developed a "widespread" and "systemic" unlawful practice of taking duplicate sets of "voluntary" fingerprints and photographs from youths in custody for suspected offending and keeping the fingerprints and photographs for longer than legally allowed.

Following the inquiry, the OPC issued a compliance notice to the Police in December 2021, requiring 14 actions from the Police in order to comply with the Privacy Act 2020, to be fully completed by December 2023.

We’ll be watching you – Regulation is coming (y)our way

As we reported last year, the OPC is looking into what can be done to further regulate the use of biometric technologies such as facial recognition and plans to engage with interested parties to discuss the potential contents and implementation of a Code of Practice in the future. The OPC is considering a code of practice to regulate biometric information in response to growing privacy concerns and media attention on the use of FRTs. A decision on whether to proceed with a code of practice is expected in 2024.

The recent events show that New Zealand’s privacy laws are highly tectonic, just like New Zealand itself. They particularly highlight the challenges and concerns surrounding the use of biometric information in New Zealand. The review into Police practices, the OPC position paper, and the consultation process, all indicate that the OPC is more than willing to answer the demand for more robust regulation and oversight of biometric technologies, most likely in the form of a code of practice in 2024.

As the use of biometric technology continues to grow, so too does the need for a balanced approach that respects privacy, human rights, and cultural concerns while harnessing the potential benefits of these technologies. Organisations using or planning to use biometric technology should:

• consult with experts,
• conduct thorough analyses for compliance, and
• ensure their practices are future proofed against upcoming regulatory changes.

The Te Tiriti aspect in terms of collecting, using and disclosing Māori biometric information in the context of FRTs is an important consideration. As highlighted by Auckland District Law Society, personal information, particularly biometric information is sacred to individuals for it is taken from the mauri they carry. As it is a taonga, it should be protected according to tikanga and mātauranga, including by taking care when disposing of biometric samples and ensuring data of the living is not stored with that of the dead.

Other concerns from Māori included the collection, storage and use of images of moko and that using biometric technology can perpetuate entrenched biases against tangata whenua by misidentifying them in alleged criminal activity or exacerbating their over-surveillance.

Talk to the specialists

Hayley Miller, Campbell Featherstone, Hayden Wilson, Gunes Haksever and Ashleigh Ooi are on hand to assist and have extensive experience advising on:

• the introduction of new technologies;
• the lawful collection, use and processing of all types of personal information;
• some of the most cutting-edge biometric technologies.

We can help conduct privacy impact assessments, advise on all elements of compliance with privacy law, draft privacy disclosures – and also assist you to engage in the OPCs upcoming ‘targeted engagement’ with agencies and people who are interested in this field about what might be in a code.

This article was written by Gunes Haksever, a senior associate in our commercial, technology and privacy team.