New Zealand govt reviews privacy law amid battle over biometrics regulation

The government of New Zealand has been quietly reviewing the country’s privacy laws to identify legal barriers to the use of facial recognition surveillance to prevent retail crime.

In September last year, the Ministry of Justice conducted a “rapid review” of the Privacy Act 2020 without consultation outside the public sector, media outlet Newsroom revealed on Friday.

It is still unclear whether any recommendations were made to change the law. Justice Minister Paul Goldsmith has declined to release the results of the review, noting that it was still under active consideration, but promised to make announcements connected to retail crime soon.

However, critics such as Gehan Gunasekara from the civil rights group Privacy Foundation suggested the government could be using the review to stall the introduction of the Privacy Code of Practice for Biometrics. Unlike the Privacy Act which sets out general guidelines, the new Code will be used to regulate the use of biometric data in more detail, including in facial recognition applications.

“It sounds to me like this could be stalling tactics or an attempt to stop the biometric code coming in,” says Gunasekara, who also works as an associate professor at the University of Auckland.

The review indicates that the government wants to use more, rather than less facial recognition and biometric technology, he adds.

News of the Privacy Act review comes amid arguments between two camps, one consisting of the Privacy Commissioner’s Office and privacy advocates, the other including retailers and business groups.

The Privacy Commissioner is currently conducting an open consultation on the Privacy Code of Practice for Biometrics, designed to fill a gap in New Zealand’s regulatory landscape by introducing stronger privacy and transparency requirements for biometric technologies.

The new regulation is being introduced amid rising public concerns over the deployment of facial recognition. Grocery cooperative Foodstuffs, for instance, concluded its trial of the system in September last year, citing positive outcomes. Consumer and civil rights groups, however, have been questioning Foodstuff’s results, noting that the supermarket chain is missing data on misidentification, including the ethnicity of misidentified individuals.

The Biometrics Code of Practice is expected to be adopted later this year. Business groups such as Digital Identity NZ (DINZ) and NZTech, however, have been pushing back against the Code and questioning the Privacy Commissioner’s authority to write the regulation. Issues identified by DINZ include the use of multiple definitions for biometrics, and inconsistency with the ISO definition of “biometric sample.”

Meanwhile, earlier this week Minister Goldsmith promised “big” measures against retail crime, including higher penalties. The government has created an advisory group to solve the issue with an operating budget of NZ$1.8 million (US$1 million) a year. The group involves stakeholders from retailers and business groups, including grocery cooperative Woolworths which has also been deploying facial recognition surveillance.

Article Topics

biometrics  |  Biometrics Code of Practice  |  data privacy  |  Digital Identity New Zealand (DINZ)  |  facial recognition  |  New Zealand  |  New Zealand Privacy Commissioner  |  retail biometrics