UPDATE — SEPTEMBER 2025: New Zealand’s Biometric Processing Privacy Code 2025 has been finalized and will officially take effect on November 3, 2025. Organizations already using biometric systems will have until August 3, 2026 to fully comply.
Key features of the final Code include:
-
13 New Rules: These replace the general Information Privacy Principles under the Privacy Act 2020 for biometric processing, creating a bespoke framework.
-
Necessity Test: Agencies must demonstrate that biometric processing is essential and that less privacy-intrusive alternatives were considered.
-
Trial Exemptions: Organizations may run limited biometric pilots with safeguards in place, allowing for innovation without immediate full compliance.
-
Scope Clarification: Consumer devices such as fitness trackers are excluded.
-
Use Restrictions: Intrusive practices, including emotion prediction and certain forms of biometric categorization, are prohibited. Safety-related uses (e.g., fatigue or alertness monitoring) may be permitted, but general workplace surveillance is not.
-
Transparency & Accountability: Public-facing assessments of biometric practices are mandatory. Agencies must clearly explain the benefits and risks of their use.
-
Guidance & Support: The Office of the Privacy Commissioner has published factsheets and compliance guidance to help organizations transition.
-
Future Review: The Commissioner will conduct a statutory review of the Code by November 3, 2028.
ORIGINAL NEWS STORY:
New Zealand Privacy Commissioner Proposes Biometrics Code for Public Consultation
The Privacy Commissioner of New Zealand, Michael Webster, has unveiled plans to introduce a Biometrics Code aimed at regulating the use of biometric technologies, including facial recognition, within the country. This proposed framework seeks to ensure safe and fair application of biometric processing while enhancing public confidence in its use.
A draft version of the Biometric Processing Privacy Code has been released for public consultation, with submissions invited from individuals and organizations subject to the proposed rules.
The Code introduces new obligations for agencies employing biometric technologies, including:
-
- Proportionality Assessments: Agencies must evaluate whether biometric processing is appropriate and implement necessary privacy safeguards.
-
- Enhanced Transparency: Stronger notification requirements ensure individuals are informed about how their biometric data is used.
- Restrictions on Use: Certain applications, such as emotion analysis and specific types of biometric categorization, are subject to limitations.
Following earlier consultations on an exposure draft in 2024, the revised version incorporates changes based on public and stakeholder feedback. The updated Code simplifies its scope to clarify which processes are covered and refines notice requirements. Additionally, restrictions have been narrowed to focus on the most intrusive and high-risk applications of biometrics.
A new requirement mandates organizations to make public assessments outlining the pros and cons of their biometric practices. The Code also extends the compliance timeline from six to nine months for organizations already using biometric technologies and introduces provisions for trial periods to assess biometric processing.
The press release goes on to say that the consultation period is open until March 2025, and the final version of the Biometrics Code is expected to take effect later that year.
Need Help?
If you have questions or concerns about any global guidelines, regulations and laws, don’t hesitate to reach out to BABL AI. Their Audit Experts can offer valuable insight, and ensure you’re informed and compliant.
