New Zealanders have voiced their opinions on potential new rules for biometric processing, which the Office of the Privacy Commissioner (OPC) is now sharing.

Biometric processing involves technologies such as facial recognition to collect and process individuals’ biometric information for identification.

In May, the OPC publicly released draft rules for biometric usage for consultation and received 250 submissions from the public, businesses, government agencies, and advocacy organisations.

Privacy Commissioner Michael Webster reported that nearly all public submissions expressed concerns about the use of biometrics in New Zealand.

“There was broad support for the proposals in the exposure draft code,” Webster said.

The submissions included 180 from individuals and 70 from various agencies, representing sectors from banking to border security, biometrics vendors, and retailers. Māori stakeholders also provided input.

Webster said “That will help my office to continue working on the proposals. We heard that the proposals need to be clear and purposeful, practical to apply, and avoid creating an unreasonable compliance burden.”

The proposals were part of an exposure draft code of practice, intended to give people an idea of potential rules and the chance to provide feedback. If adopted, the biometrics code would modify some privacy principles in the Privacy Act 2020, creating specific privacy rules for agencies using biometric technologies. The draft included three main proposals:

1. A requirement to conduct a proportionality test and implement appropriate privacy safeguards.
2. Additional notification and transparency obligations.
3. Fair processing limits to restrict certain uses of biometric classification.

Despite the technical nature of the biometrics code, a key theme from the feedback was the need for the rules to be simple, easy to understand and implement, and supported by clear guidance.

The Privacy Commissioner is considering the feedback and expects to announce a decision on whether to proceed with a code later this year.

New Zealand already has six codes under the Privacy Act, including the Health Information Privacy Code 2020, which governs the collection and handling of health information by health agencies, and the Civil Defence National Emergencies (Information Sharing) Code 2020, which allows agencies to collect, use, or share personal information to assist in the government response to a national emergency.