In this episode, Partner Richard Wells and Senior Associate Suzy McMillan from our firm's Corporate and Commercial team, provide valuable insights on the draft Biometric Processing Privacy Code (Code) proposed by the Office of the Privacy Commissioner (OPC).
[01:09] Suzy begins the episode outlining the background to the proposed Code, discussing the OPC’s exposure draft, the current draft of the Code and the consultation process that is now underway.
[02:15] Suzy and Richard discuss the purpose of the Code; to establish clear rules for the collection, use, storage, and processing of biometric information. They outline the types of data the Code will capture, including facial recognition and fingerprint scanning, emphasising that its application is limited to the processing of biometric information by a machine-based system.
[03:38] Richard highlights the important interplay between the Code and existing IPP principles under the Privacy Act 2020. They analyse certain rules under the Code that will modify existing information privacy principles, focusing first on Rule 1 which requires organizations to justify the necessity of collecting biometric information by undertaking a proportionality test and ensuring adequate privacy safeguards are in place to protect the information. Suzy and Richard consider the potential impacts this may have on organisations who collect and use biometric information.
[07:48] Richard then examines the transparency and disclosure requirements imposed by the Code, noting how these new obligations for organisations to clearly inform individuals about biometric information processing, represent an elevated standard of disclosure from existing privacy laws.
[10:55] Suzy explains Rule 10 of the Code, which sets restrictions on how biometric information can be used and outlines prohibited uses, such as inferring sensitive personal attributes.
[12:40] Richard summarises the Code’s status with the OPC, highlighting the submission deadline of 14 March 2025. They mention the Code’s potential compliance burden, retrospective nature and the nine-month grace period for compliance.
[14:37] Richard closes out the episode reflecting on the balance between technological innovation and privacy protection, noting how the Code marks one of the most significant developments in New Zealand privacy law in recent years.
Information in this episode is accurate as at the date of recording, 20 February 2025.
Please contact Richard Wells, Suzy McMillan or our Corporate and Commercial team if you need legal advice and guidance on any of the topics discussed in the episode.
Please get in touch to receive an episode transcript. Please don’t forget to rate, review or follow MinterEllisonRuddWatts wherever you get your podcasts.
You can also email us directly at [email protected] and sign up to receive technology updates via your inbox here.
