printer icon
September 11, 2023 Digital Identity New Zealand

Digital Identity New Zealand (DINZ) advocates for a thoughtful approach to potential biometric regulation in New Zealand

Digital Identity New Zealand (DINZ) has submitted a comprehensive response to the Office of the Privacy Commissioner (OPC) on its consideration of a code of practice for biometrics. DINZ is Aotearoa’s only community dedicated to digital identity, delivering trustworthy and recognised thought leadership that influences digital identity decision-making for the common good. DINZ’s deep insight into the operating environment for biometrics highlights the complexities and potential unintended consequences of introducing regulation through a code rather than starting with strong guidance, awareness, and education in this field.

Biometric information encompasses physical and behavioural features such as faces, fingerprints, voices, and walking patterns. Some examples of its use include identity verification online, border control, law enforcement, retail security, access control, and attendance monitoring in workplaces and schools.

The increasing role of biometric technologies in the lives of New Zealanders has led to calls for greater regulation of biometrics. Other countries are also considering how best to minimise potential harm to people caused by improper use of these technologies and some have enacted specific regulatory frameworks for biometrics. A code (if taken forward) could change how the privacy principles in the Privacy Act apply when organisations use technology to analyse biometric information.

DINZ Executive Director Colin Wallis says, “Our response focuses on striking a balance between protecting individuals’ privacy and allowing responsible government and business use of biometric data. We emphasise the importance of a thoughtful and well-informed approach to considering the potential for regulation of the use of biometrics, tailored to the unique challenges of this technology.

“Biometrics improves the digital experiences of New Zealanders every day in both the public and private sectors. Demonstrable privacy and technical expertise, alongside practical experience combined with good design and implementation, are keys to great outcomes,” says Colin.

Key Points from DINZ’s Response:

  1. Privacy Protection: DINZ believes that the Privacy Act 2020 can provide people with adequate privacy protections for biometrics if Privacy Impact Assessments become mandatory and high-quality, clear industry co-created guidance is issued under the oversight of OPC. This approach aims to avoid unintended consequences, elevate industry standards and prevent subpar practices.
  1. Clarity on Definitions: DINZ emphasises the need for consensus on which of the international definitions of biometrics will apply in New Zealand before considering a code of practice. Clear definitions across the entire domain are essential to prevent confusion and ensure alignment with global standards.
  1. Focus on Identification, Verification and Classification: DINZ suggests that regulatory changes should primarily safeguard individuals’ privacy in identification and verification processes, avoiding overlap with other regulatory authorities or areas outside the Privacy Act’s jurisdiction.
  1. Measured Approach: DINZ advises OPC to exercise caution and avoid rushing into implementing a code of practice. The roughly equal support for further guidance and a code indicates concerns that a rush to a code will result in a change towards ‘compliance behaviour’ that will stifle innovation, have unintended consequences, and negatively affect the positive outcomes sought by a code’s introduction.
  1. Industry Expertise: DINZ recommends that OPC collaborates with industry experts to co-create guidance on biometric information’s use in identification and verification. Such collaboration ensures informed and practical guidance while enhancing OPC’s expertise in this complex field.

View the Privacy Commission Consultation: A potential biometrics code of practice here.

View DINZ’s Submission here.

For media inquiries, please contact:

Colin Wallis
DINZ Executive Director

colin.wallis@digitalidentity.nz

021 961 955

About Digital Identity NZ

Digital Identity NZ was formed to help New Zealand’s transformation as a digital nation, where everyone can prove who they are digitally to organisations in a secure and trusted way.

Digital Identity NZ is a purpose-driven, membership-funded organisation whose members have deep expertise and shared passion for the opportunities that digital identity can offer. Digital Identity NZ provides the primary independent voice advocating for a sustainable, inclusive, and trustworthy digital future for all New Zealanders

For more information, visit our website:  https://digitalidentity.nz/

Digital Identity New Zealand A purpose driven, inclusive, membership funded organisation, whose members have a shared passion for the opportunities that digital identity can offer. Digital Identity NZ supports a sustainable, inclusive and trustworthy digital future for all New Zealanders.