Submission by NZTech to the Office of the Privacy Commissioner
NZTech has submitted recommendations on the Draft Biometric Processing Privacy Code, emphasizing the need for balanced regulation that protects privacy while enabling technological innovation.
Key Concerns
- The proposed code could negatively impact business innovation and economic growth
- Definitions of “biometric characteristics” are too broad, potentially creating regulatory misalignment with international standards
- The “necessity test” creates an unreasonably high threshold for implementing biometric technologies
- Notification requirements exceed standard privacy principles, creating disproportionate compliance burdens
Recommended Improvements
- Limit the definition of “biometric characteristics” to unique biological patterns
- Modify Rule 2 to explicitly reference biometric processing purposes
- Amend Rule 1(b) to incorporate a “reasonable grounds” standard for greater flexibility
- Remove excessive notification requirements related to applicable laws and assessment summaries
Positive Developments
NZTech acknowledges improvements to the draft code, including:
- Extended implementation period (nine months) for existing biometric uses
- Simplified definitions and notification rules
- Clearer assessment criteria for biometric necessity and proportionality
- New provision for six-month trial periods to test effectiveness
NZTech’s submission reinforces that while regulation is important, the Privacy Act 2020 already provides adequate guardrails when supported by clear guidance from subject-matter experts with real-world operational experience.
