File pic Photo: 123RF
New rules have been introduced to govern how agencies can use people's biometric data, like facial recognition, fingerprints and iris scanning.
The biometric privacy processing code will come into force in November, although agencies already using biometric technology will have until August 2026 to comply.
Privacy Commissioner Michael Webster said agencies would need to weigh up the effectiveness and appropriateness of their biometrics use, put privacy safeguards in place and let people know when their biometric information was being collected.
He said the use of biometric data was increasing in New Zealand but should only be used if it was necessary, effective and proportionate.
"Because of its sensitivity - it is the most sensitive personal information - we thought it was timely to create some stronger and clearer rules about the use of biometric technology," he said.
"We want New Zealanders to use technology well and in a privacy protective way to get both the benefit of new technology but to do it in a way that ensures that New Zealanders feel that their personal information, that their privacy, is being protected and respected."
Businesses using biometric technology would have to comply with the Privacy Act and would be barred from some "particularly intrusive" uses of biometric technologies, like using them to predict people's emotions or infer information like ethnicity or sex, or other information protected under the Human Rights Act, Webster said.
He said agencies introducing biometric technology would also need to assess the impact on Māori.
"We know from research done before that there are concerns around bias and misidentification with the use of some biometric technologies, facial recognition technologies," he said.
The code also set out specific rules for children, he said.
"The code itself makes it clear that children need to have special attention paid to them in terms of the collection and stewardship and management of their personal information," he said.
Webster said many people would be aware of the Foodstuffs North Island had been trialling facial recognition technology (FRT) in supermarkets.
An Office of the Privacy Commissioner inquiry earlier this year found it raised privacy concerns, like the unnecessary or unfair collection of a customer's information, misidentification, technical bias and its ability to be used for surveillance.
Webster said the business had taken strong steps to protect privacy and would likely meet the new code, although further improvements might be needed.
"I think one of the things that Foodstuffs North Island will have to do is again assess the way it's running the use of FRT," he said.
He said the code would not cover the health sector, which would continue to be governed by the health code.
It also excluded people's use of entertainment devices or personal health devices like virtual reality headsets or Fitbits.
Webster said the commission had prepared detailed guidance for public sector agencies, businesses and organisations.
"We've tried to anticipate the sorts of questions that they might have, and written guidance to support them and ensure that if they do decide to use biometric technology, it is governed under the code...in a way that is lawful," he said.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
