Processes biometric data, in New Zealand

Privacy Act 2020 (NZ), No 31, ss. 4, 7, 22 (IPP 1, 2) · Read the law's page

• Do not collect personal information, including personal information scraped from a public website, unless it is for a lawful purpose connected with a function or activity of your organisation and the collection is necessary for that purpose.
• Collecting personal information other than directly from the individual, including by scraping, is excused from the source-of-collection principle where the source is a publicly available publication, but the information remains subject to every other duty the Act imposes.

Biometric Processing Privacy Code 2025 (NZ), rules 1 to 13 · Read the law's page

• Before collecting biometric information, check that biometric processing serves a lawful purpose connected with your function or activity, is necessary and effective for that purpose, cannot reasonably be achieved as effectively by an alternative with less privacy risk, is backed by the privacy safeguards that are reasonable in the circumstances, and that you believe on reasonable grounds it is proportionate to its likely impacts on individuals, weighing the privacy risk against the benefit and the cultural impacts on Māori (rule 1).
• You may run a trial for no longer than needed to meet its objectives, with an initial period of at most 6 months and at most one further period of at most 6 months, and defer the necessity and alternatives check until the trial ends (rules 1(2) and 10(3)).
• Collect a biometric sample from the individual concerned unless an exception applies, and collect biometric information only by lawful means that are fair and do not intrude to an unreasonable extent on the individual's personal affairs, particularly where children or young persons are involved (rules 2 and 4).
• Take reasonable steps to make each individual aware, clearly and conspicuously and before or at the time of collection, that their biometric information is being collected, each specific purpose, and whether an alternative to biometric processing is available, with a way to get further information; and, before collection or as soon as practicable after, the intended recipients, who collects and holds the information, any legal authority, the consequences of not providing it, their access and correction rights, your retention period, how to raise a concern or complain, their right to complain to the Privacy Commissioner, and where your proportionality assessment or a summary of it can be viewed (rule 3).
• If you collect biometric information other than from the individual concerned, take reasonable steps to make them aware of the same matters as soon as reasonably practicable after collection; this applies to information collected on or after 1 May 2026, or on or after 3 August 2026 for processing that began on or before 3 November 2025 (rule 3A).
• Do not use biometric information for biometric categorisation, meaning inferring health information or an individual's personality, mood, emotion, intention, mental state, fatigue, alertness or attention level, or placing them in a demographic category such as sex, ethnicity or sexual orientation, unless an exception applies: categorising by age or by a demographic category that is not a prohibited ground of discrimination, assisting accessibility, preventing or lessening a serious threat to public health or safety or to someone's life or health, ethically approved research, fatigue or alertness detection necessary to prevent risk to health or safety, or detecting health information the individual has expressly authorised (rule 10(5) to (9)).
• Detecting a readily apparent expression is not biometric categorisation, nor is analysis built into a commercial service solely to give individuals their own health or personal information or an entertainment or immersive experience (clause 3(1)).
• Do not use personal information that was not collected under rule 1 for biometric processing, and do not use biometric information held for one type of biometric processing for another type, unless the necessity, safeguards and proportionality checks in rule 10(2) are met; use biometric information for a different purpose only on a ground rule 10(10) lists (rule 10).
• Protect biometric information with reasonable security safeguards against loss, unauthorised access, use, modification or disclosure and other misuse, and do not keep it longer than the purposes for which it may lawfully be used require (rules 5 and 9).
• Give an individual, on request, confirmation of whether you hold biometric information about them, its type and access to it, and correct it or attach their statement of correction on request (rules 6 and 7).
• Take reasonable steps to ensure biometric information is accurate, up to date, complete, relevant and not misleading before you use or disclose it, and disclose it only on a ground rule 11 lists (rules 8 and 11).
• Disclose biometric information to a foreign person or entity in reliance on rule 11 only if the individual authorises it after being told the recipient may not provide comparable safeguards, or you believe on reasonable grounds the recipient is subject to the Privacy Act 2020 as modified by the code, to comparable privacy laws, to a prescribed binding scheme or a prescribed country's laws, or is otherwise required to protect the information comparably (rule 12).
• Assign a biometric template as a unique identifier only if necessary for your functions, and do not assign one the same as another agency's identifier for that individual unless an exception applies (rule 13).