New Zealand releases Biometrics Code for public consultation

New Zealand is getting a Biometrics Code. An announcement from the office of Privacy Commissioner Michael Webster states his intention to issue the Biometric Processing Privacy Code in 2025.

The 124-page draft Biometrics Code is now available for consultation. Members of the public and “any agencies it would apply to” are invited to submit input.

Webster says the Code will help agencies implement biometric technology, “while giving people confidence it’s being done safely and fairly.”

It fills a gap in New Zealand’s regulatory landscape, which covers biometrics – but not, according to Webster, in enough specific detail.

“New Zealand doesn’t currently have special rules for biometrics,” he says. “The Privacy Act regulates the use of personal information in New Zealand, including biometric information, but biometrics needs special protections especially in specific circumstances.”

Changes cover transparency, fair use limits 

Amendments to address that need include requirements to do a proportionality test and implement privacy safeguards, stronger notification and transparency obligations, and “limits on some uses of biometric information (e.g. emotion analysis and types of biometric categorization).”

They come after the Office of the Privacy Commissioner (OPC) consulted on an exposure draft version earlier in the year, which garnered broad support but noted the need for certain changes, specifically around what processes are included and what organizations need to tell people.

Webster says those changes are reflected in the latest version.

A new requirement says that organizations must be clear in informing people where to find a public document listing “their assessment of the pros and cons of using biometrics.” And restrictions on collecting biometrics, defined as fair use limits, are “now targeted to the most intrusive and highest risk uses.” In keeping with this, the Code has exceptions for individuals and “will generally not apply to consumer products.”

The draft includes a comprehensive definition of biometrics and biometric processing. It covers rules around specific purposes and practices in collecting biometric data, to ensure that “generally, collection is for a lawful purpose, there are no alternatives with lower privacy risk, the collection is proportionate and appropriate privacy safeguards are in place.”

(Per the draft, “you cannot collect information just in case you may want to use it later.”)

The Code and its accompanying draft guidance material on compliance are open to feedback through March 2025. It is projected to come into force later in the year.

The rules are likely to intertwine with New Zealand’s new Digital Identity Services Trust Framework (DISTF) rules, part of its larger push to roll out a suite of national digital identity services.

Article Topics

best practices  |  biometric identifiers  |  biometrics  |  data collection  |  data protection  |  digital identity  |  New Zealand  |  New Zealand Privacy Commissioner