New ZealandBiometric Processing Privacy Code 2025 (Biometric Processing Privacy Rules)
Biometric Processing Privacy Code 2025 (NZ), rules 1 to 13
In force since .
A biometric privacy rule binding public and private bodies.
- Enforcement body
- Office of the Privacy Commissioner
- Audit expectation
- none
What it requires
- Before collecting biometric information, check that biometric processing serves a lawful purpose connected with your function or activity, is necessary and effective for that purpose, cannot reasonably be achieved as effectively by an alternative with less privacy risk, is backed by the privacy safeguards that are reasonable in the circumstances, and that you believe on reasonable grounds it is proportionate to its likely impacts on individuals, weighing the privacy risk against the benefit and the cultural impacts on Māori (rule 1).
- You may run a trial for no longer than needed to meet its objectives, with an initial period of at most 6 months and at most one further period of at most 6 months, and defer the necessity and alternatives check until the trial ends (rules 1(2) and 10(3)).
- Collect a biometric sample from the individual concerned unless an exception applies, and collect biometric information only by lawful means that are fair and do not intrude to an unreasonable extent on the individual's personal affairs, particularly where children or young persons are involved (rules 2 and 4).
- Take reasonable steps to make each individual aware, clearly and conspicuously and before or at the time of collection, that their biometric information is being collected, each specific purpose, and whether an alternative to biometric processing is available, with a way to get further information; and, before collection or as soon as practicable after, the intended recipients, who collects and holds the information, any legal authority, the consequences of not providing it, their access and correction rights, your retention period, how to raise a concern or complain, their right to complain to the Privacy Commissioner, and where your proportionality assessment or a summary of it can be viewed (rule 3).
- If you collect biometric information other than from the individual concerned, take reasonable steps to make them aware of the same matters as soon as reasonably practicable after collection; this applies to information collected on or after , or on or after for processing that began on or before (rule 3A).
- Do not use biometric information for biometric categorisation, meaning inferring health information or an individual's personality, mood, emotion, intention, mental state, fatigue, alertness or attention level, or placing them in a demographic category such as sex, ethnicity or sexual orientation, unless an exception applies: categorising by age or by a demographic category that is not a prohibited ground of discrimination, assisting accessibility, preventing or lessening a serious threat to public health or safety or to someone's life or health, ethically approved research, fatigue or alertness detection necessary to prevent risk to health or safety, or detecting health information the individual has expressly authorised (rule 10(5) to (9)).
- Detecting a readily apparent expression is not biometric categorisation, nor is analysis built into a commercial service solely to give individuals their own health or personal information or an entertainment or immersive experience (clause 3(1)).
- Do not use personal information that was not collected under rule 1 for biometric processing, and do not use biometric information held for one type of biometric processing for another type, unless the necessity, safeguards and proportionality checks in rule 10(2) are met; use biometric information for a different purpose only on a ground rule 10(10) lists (rule 10).
- Protect biometric information with reasonable security safeguards against loss, unauthorised access, use, modification or disclosure and other misuse, and do not keep it longer than the purposes for which it may lawfully be used require (rules 5 and 9).
- Give an individual, on request, confirmation of whether you hold biometric information about them, its type and access to it, and correct it or attach their statement of correction on request (rules 6 and 7).
- Take reasonable steps to ensure biometric information is accurate, up to date, complete, relevant and not misleading before you use or disclose it, and disclose it only on a ground rule 11 lists (rules 8 and 11).
- Disclose biometric information to a foreign person or entity in reliance on rule 11 only if the individual authorises it after being told the recipient may not provide comparable safeguards, or you believe on reasonable grounds the recipient is subject to the Privacy Act 2020 as modified by the code, to comparable privacy laws, to a prescribed binding scheme or a prescribed country's laws, or is otherwise required to protect the information comparably (rule 12).
- Assign a biometric template as a unique identifier only if necessary for your functions, and do not assign one the same as another agency's identifier for that individual unless an exception applies (rule 13).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Rule 3 requires an agency to tell individuals where its proportionality assessment, or a summary of it, can be viewed, and rule 5 requires reasonable security safeguards. None of the rules requires an agency to make or keep a log of its biometric processing, and the code states no territorial clause.
- Kind
- None
- As of
What this law does
The Privacy Commissioner's Biometric Processing Privacy Code 2025 sets biometric processing privacy rules that modify how the information privacy principles apply to an agency's biometric processing. Biometric processing means the comparison or analysis of biometric information by a technological system to identify, verify or categorise an individual. A biometric characteristic includes an individual's face, fingerprints, palmprints, iris, retina, voice or vein patterns.
An agency may collect biometric information only where the processing is necessary and effective for a lawful purpose, cannot reasonably be achieved as effectively by a less intrusive alternative, rests on reasonable privacy safeguards and is believed on reasonable grounds to be proportionate to its likely impacts on individuals. An agency holding biometric information may not use it for biometric categorisation unless one of the exceptions in rule 10 applies.
Biometric categorisation includes inferring an individual's emotion, mood, intention or mental state from biometric information. Biometric categorisation also includes placing an individual in a demographic category on the basis of a biometric characteristic, such as sex, age, ethnicity or sexual orientation. The code does not apply to a health agency's biometric processing where the information is health information.
The code applies from to biometric processing that had not begun by that date, and from to processing that began on or before . Rule 3A, which covers biometric information collected other than from the individual concerned, was inserted by Amendment No 1 on .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .