New Zealand biometrics code faces Māori criticism over consent

New Zealand’s upcoming biometrics rulebook is facing more criticism from members of the country’s indigenous groups, some of who have highlighted pressures from industry groups that want fewer restrictions on biometric technologies.

The Privacy Code of Practice for Biometrics is a step in the right direction but it’s much weaker than many Māori groups expected, according to Tahu Kukutai, a professor at the University of Waikato in Hamilton and co-director of the Māori Centre of Research Excellence.

Kukutai argues that the Privacy Commissioner has been facing pressure from industry groups such as NZTech. The Office initially considered including “free, prior and informed consent” into the Biometric Code but eventually decided against it, the researcher explains.

“Initially it looked really strong … there would be mechanisms like free, prior and informed consent, and prevention or exclusions of web scraping,” she told student newspaper Te Waha Nui. “But over time you can see that those things dropped out of the final code and cultural considerations as well.”

The Privacy Code of Practice for Biometrics is due to be published in mid-2025. Unlike the Privacy Act which sets out general guidelines, the new Code will be used to regulate the use of biometric data in more detail, including in facial recognition applications.

The rulebook has faced criticism not just from members of indigenous groups but also consumer and legal groups which have also highlighted the problem of consent.

In a LinkedIn post published last week, Kukutai also criticized the results of the Privacy Commissioner’s inquiry into the facial recognition system used by New Zealand’s supermarket chain Foodstuffs to prevent retail crime. The inquiry was published earlier this month, ruling that the system is compliant with the country’s Privacy Act.

One of the biggest concerns was the use of biometric technology in public spaces, according to the researcher.

“There are *many* concerns from Māori about the risks of biometric processing, including misuse of Māori biometric information, racial bias and profiling, lack of accuracy leading to misidentification, and surveillance overreach,” says Kukutai.

The Privacy Act also requires that the Privacy Commissioner take into account cultural perspectives on privacy. Here too, however, the Biometric Code falls short of Māori expectations, Kukutai argues in an article published in April by Science.

Meanwhile, Māori organizations are working on data solutions that would improve the well-being of their communities and achieve data sovereignty, per Te Waha Nui.

Article Topics

biometric data  |  biometric identifiers  |  biometrics  |  digital identity  |  Māori  |  New Zealand  |  New Zealand Privacy Commissioner  |  regulation