NZ Privacy Regulators: Biometric Data Good for Society if Handled Right
Biometric information is the most personal information, but it holds benefits for society as long as there are guardrails against its risks, New Zealand officials from the Office of the Privacy Commissioner said Wednesday during an IAPP webinar. The discussion included social media bans for children and AI regulation.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
New Zealand's biometrics code takes effect Nov. 3, covering biometric processing that begins on or after that date; and Nov. 3, 2026, for processing already in use on or before Nov. 3 of this year. The code ensures that agencies that use biometric technologies are doing it safely and proportionately, said Privacy Commissioner Michael Webster.
Developing the code and its accompanying guidance required extensive consultation that led to changes and clarifications, said Webster and Deputy Privacy Commissioner Liz MacPherson. "We don't want to be a 'gotcha' privacy regulator," said Webster. Instead, the goal is ensuring that New Zealand agencies and the private sector do their best for citizens.
The office recently completed a review of the use of facial recognition technology by Supermarket Foodstuffs North Island, finding it was lawful (see Ref:2506040003]). Asked whether it would have reached the same conclusion if it had assessed the company under the biometrics code, Webster said yes. MacPherson said the central question she asked the supermarket was whether privacy risks were appropriately managed. The investigation found they were.
The biometrics code introduces a proportionality assessment. Asked if the office foresees problems with organizations conducting such assessments objectively themselves, MacPherson said the DPA trusts agencies. "We are not the privacy police" but the office can step in, and examine how the assessments are being handled.
There will likely be a period of adjustment with the biometric code, MacPherson said. The DPA is open to developing additional tools such as a proportionality template. There are already examples in the guidance that companies should stop and think about, but "it's not rocket science." The watchdog expects entities to clearly document how they arrived at their assessment, MacPherson added. Webster said he'd expect to see organizations bring data, statistics and evidence to their assessments.
Australia banned social media for children younger than 16 (see Ref:2510100005]). On whether New Zealand should follow, Webster said, "It's certainly on the radar here." Legislation has been proposed and there's a parliamentary inquiry into online harm during which age assurance and online bans were mentioned.
New Zealand has the luxury of being able to observe how bans work in Australia and elsewhere, Webster added. The country is working on innovative technological solutions that could be a better way of safeguarding privacy protections while maintaining platforms' obligations, he said.
A key issue for the Privacy Commissioner and other DPAs is AI regulation, said Webster, noting that whether regulators can or should stretch their respective privacy laws to cover AI issues was discussed at the Sept. 15-19 Global Privacy Assembly in Seoul (see Ref:2509230008]).
New Zealand's Privacy Act is technologically neutral and can be applied to AI, said Webster. Citing a national privacy survey finding that people are concerned about the use of AI by agencies and the public sector, the commissioner said the government must respond to that fear.
Regulators around the world are willing to test the boundaries of their privacy laws to see how far they can be used to address AI, noted MacPherson. There's also a move toward more cooperation among all regulators who have leverage in the digital space to use those levers in a coordinated way and to give the market more legal certainty about how the various systems interact, she added.