The New Zealand Privacy Commissioner has now issued the Biometric Processing Privacy Code, which will come into force on 3 November 2025 for new biometric processing activities. Agencies already undertaking biometric processing activities will have until 3 August 2026 to comply with the Code. 

You can access the Code here, and the Privacy Commissioner’s detailed guidance here.

Recap

The journey to the Code began in October 2021 when the Office of the Privacy Commissioner released a position paper on biometrics regulation. Following public consultation (on which we reported in September 2022: see here), the Privacy Commissioner released an exposure draft of the Code in April 2024 and issued an updated draft in December 2024. The Code has now been updated and finalised.

For more background on the development and application of the Code, see our previous articles on the topic:

• Every face you scan: Regulating facial recognition technologies in New Zealand
• The next chapter of regulating biometrics in Aotearoa, New Zealand is here
• Draft Biometrics Code is here!
• Privacy Commissioner resolves to tackle biometrics in 2025
• Deploying facial recognition technology (FRT) in New Zealand

What the Code applies to

The Code regulates applies to the activity of biometric processing and to ‘biometric information’ as a class of information.

Biometric information means personal information relating to a ‘biometric characteristic’, such as a physical feature or qualify (such as someone’s face, fingerprints, or iris), or how a person typically performs or responds to a task, action or decision with any part of their body (such as their gestures, gait, voice), or a combination of those distinctive attributes (such as the way that someone sounds when they speak).

Biometric processing means the comparison or analysis of biometric information by a technological system (regardless of whether the systems involve human input, assistance or oversight), by means of:

• Biometric identification: the automated recognition of a biometric characteristic, for the purposes of identifying someone.
• Biometric verification: the automated one-to-one verification of an individual’s claimed identity.
• Biometric categorisation, which may include the automated process of analysing biometric information:
  • To collect, obtain, created, infer or detect information about relating to a person’s personality, mood, emotion, intention or metal state, or state of fatigue, alertness or attention level.
  • To categorise the individual as part of a demographic category on the basis of a biometric characteristic.

What the Code does not apply to

The Code does not generally apply to:

• Biometric information that is also health information under the Health Information Privacy Code and the biometric processing is being done by a health agency (in which case the Health Information Privacy Code will continue to apply).
• Biometric categorisation undertaken through consumer wearables like smartwatches, fitness trackers, or VR headsets, and other devices designed solely for the purposes of providing individuals with their own information, or to provide an entertainment or immersive experience.

Key changes since the release of the exposure draft

The key changes to the exposure draft released in April 2024 that have made their way into the final Code including the following:

• Extended implementation timeline: The Code now comes into effect three months after publication, responding to requests for more implementation time, with a resulting change to the transition period.
• Simplified necessity test: The Code now allows agencies who are assessing whether biometric processing is necessary for them to achieve a particular purpose to take into account whether any alternative means of achieving that purpose that less privacy risk could help them achieve that purpose as effectively as biometric processing can.
• Expanded trial provisions: Agencies will now have more scope to conduct trials without having to confirm their compliance with the above necessity test (although other aspects of the Code will still apply to trials).
• Stricter rules on attention-tracking: The rules relating to the use of biometric information to obtain, infer or detect information about a person’s state of fatigue, alertness or attention level have been narrowed, so that such information may only be used where an agency believes that the use is necessary to prevent or less a risk to public health or public safety, or a person’s life or health.

Get in touch

With the Code coming into force in the next few months, agencies must quickly and carefully consider whether any biometric processing activities they undertake comply with the Code’s requirements.

If you are unsure whether the Code will be relevant to you or how it may affect you, we are on hand to assist. Get in touch with our experts Hayley Miller, Campbell Featherstone, Hayden Wilson, Güneş Haksever or Ashleigh Ooi. We have extensive experience advising on the legal aspects of the introduction of new technologies, including facial recognition; the collection, use and processing of all types of personal information including biometric information and some of the most cutting-edge biometric technologies.

This article was written by Campbell Featherstone, Partner and Güneş Haksever, Senior Associate in our Commercial and Technology team.