The Office of the Privacy Commissioner recently ran a consultation about the use of biometric technology in New Zealand. As they point out:

Biometric information is personal information and is regulated by the Privacy Act. It is particularly sensitive and requires careful assessment before use.   

Biometric information is uniquely precious to each of us, and there is growing concern about the level of regulation covering its use.

The following is some of the highlights of our response.

Introduction

The NZ Council for Civil Liberties has been concerned about this issue for some years now, with particular concern around the collection and use of biometric data without meaningful consent. We identified it as one of the issues that we wanted to prioritise in 2022 as part of the wider issue of surveillance.

With surveillance technology getting cheaper and cheaper we have not just been worried about government use of this technology but also the increasing availability to private companies and individuals. Of course, with government agencies such as the Police increasingly accessing privately owned cameras and other surveillance systems, these can often end up one and the same thing.

We don’t have the same concerns when there is meaningful consent to use of biometric data – people unlocking their phones with their face, fingerprint-based locks, or rights-protecting regulatory implementations such as passport photo recognition at the border.

Privacy at risk

As well as the general issues around surveillance we also want to bring particular attention to two forms of privacy that are jeopardised by the use of biometrics:

• Privacy of location
• Privacy of identity

Privacy of location

We still have the idea that we can go to places without people knowing where we are. While this is already under attack with mobile phone location tracking, access to personal mobile data is quite limited and is subject to existing controls. And while many people see it as a necessary accessory of modern life, it is still possible to choose to not carry a mobile phone.

Biometrics changes this by allowing anyone with a camera and access to a suitable face database or identification service to determine who is at a location at a particular time.

Location information can reveal a lot about a person’s private life, especially when combined with other sources of personal information. We believe that people have a right to move around without the government or other people being able to track their location as a matter of course.

Privacy of identity

We are used to the idea that we ‘disappear’ in a crowd. There is a long tradition of people leaving their small town and enjoying the relative anonymity of living in the large city.

Biometrics and particularly facial recognition means that we can be identified and placed without us even knowing it. 

People often feel safer in anonymity and this is of particular importance to mass political action such as protest marches. While we don’t protest secretly, we also know that our identity is likely to remain private rather than being posted online for posterity. Unconsented facial recognition, by attacking privacy of identity, attacks our right to freedom of peaceful assembly.

Our policy

The Council recommends that the use of biometric technology to capture data about people is forbidden where meaningful consent is not explicitly given, as other jurisdictions have done, to control the harms of this potentially transformative technology.

For the avoidance of doubt, this ban would apply:

• To private places where the public has lawful access such as malls, shops, and entertainment venues.
• Consent would have to be explicit and meaningful, i.e. not just a sign at the door.

We believe that this position would still allow biometric technology to be used for other useful purposes under suitable controls while avoiding the worst consequences of unconstrained use.