Privacy Commissioner Michael Webster will issue a draft code of practice for regulating how “unique and often irreplaceable” biometric information is collected. Expected in early 2024, the exposure draft, which will be open for consultation, proposes three new rules for collecting and using biometric information, centered on proportionality, transparency and purpose.
Biometric information, typically collected by facial recognition technology (FRT), retinal scans, voice recognition and other technologies, is “serious business because it relates to unique, and often irreplaceable, human features like a person’s face, fingerprints, voice or how they walk”, says Webster.
“New Zealanders need to have trust and confidence in the use of biometrics by organisations and businesses. My office will issue a biometrics code exposure draft in early 2024 that we’ll open for everyone to have their say on.”
Codes of practice change how some of the privacy principles in the Privacy Act 2020 apply in specific situations; in this case, when organisations use technology to analyse biometric information.
The announcement follows a round of targeted consultation that the privacy watchdog held mid-year on a proposed biometrics code, testing with a limited set of key stakeholders whether the Office of the Privacy Commissioner’s (OPC) ideas can work in safeguarding biometric information. The feedback, the office says, has informed its focus on the three key proposals.
The three rules
Under the exposure draft, agencies collecting and using biometric information will have to decide whether their reasons for using biometric technologies outweigh the privacy intrusion, or risks of intrusion. Such agencies must be transparent and open about when they will collect and use biometric information and, under the proposed “purpose limitations” rule, some reasons for collecting and using biometric information will be ruled out.
In September, the privacy watchdog earmarked banning the use of smart billboards that scan shoppers’ faces in order to target them with personalised advertising. The practice of targeted marketing has most recently been linked with Westfield shopping malls across New Zealand. The OPC considered it posed too many risks or used sensitive personal information inappropriately.
The proposed rules target what the OPC sees are the key privacy risks associated with biometric information: “unnecessary or high-risk collection and use”, “function and scope creep” and “a lack of control or knowledge about when and how biometrics are collected and used”. The rules would apply when agencies collect biometrics to use in automated processes that verify, identify or classify individuals.
The right way forward
“We’re taking a leadership position here because we need to develop ideas that are workable and effective but also take into account technological advancements,” Webster says. “We have looked at the privacy risks related to biometrics, analysed what is happening with laws in other countries and heard from local stakeholders. It has shown us that consulting on new rules specifically for biometrics is the right way forward.”
In addition to the privacy risks, significant concerns have been raised about the potential for bias, discrimination and surveillance that biometrics pose to Māori. And the OPC is conscious that it can take “compliance action” to protect individuals’ privacy rights where agencies aren’t complying with the code of practice.
The OPC is “especially keen” to ensure it gets the technical aspects of the code right, with the commissioner saying that getting the right wording in the draft code is important to avoid any unintended consequences.
Users and providers of biometric technology, advocates for privacy, human rights and consumer rights and the broader public are being encouraged to have their say on the draft code.
An evolving landscape
The exposure draft has signalled the OPC recognises the significance of the evolving landscape of biometric technology and its potential implications for individual privacy, says Bell Gully in a recent insights update.
Businesses should carefully review any current biometric data practices, write partner Richard Massey and summer intern Abbie Pool, and assess the types of biometric information they collect, their purposes and existing transparency measures to identify any areas for potential change.
Massey and Pool recommend that businesses should also take note of overseas developments, including the EU’s draft artificial intelligence statute proposing to restrict certain uses of biometric technology, including live facial recognition technology in public places and a recent executive order made by US President Joe Biden, warning of the risks of those living with disabilities receiving “unequal treatment from the use of biometric data like gaze direction, eye tracking, gait analysis and hand motions”.
Before any biometrics code is issued, the OPC says it will run a further period of formal consultation. Comprehensive guidance will be developed for agencies using biometrics, covering how they can comply with the proposed code rules and the information privacy principles in the Act.
0 Comments