Report Back on Consultation

1 Report back on consultation Summary of submissions received between April and May 2024 in response to the Office of the Privacy Commissioner’s consultation on an exposure draft of a biometric processing code of practice. [...] Background In November 2023, following a targeted consultation testing proposals to regulate biometrics, the Privacy Commissioner announced his Office would release an exposure draft of a biometrics code for a consultation in early 2024 (read announcement). [...] Application of code In the exposure draft, we proposed that, if a code is issued, there would be a six- month transition period so that organisations already using biometric processing could bring their activities into compliance. [...] Submitters agreed that more time should be given to organisations already using biometrics to align their biometric processing with the rules in the code. [...] Submitters were broadly supportive of the main definitions in the code but recommended these definitions be revised to make them simpler and less technical. [...] Submitters made many specific suggestions for amending the definitions, including removing ‘nested’ definitions and aligning with industry terms. Requirement to assess proportionality and adopt safeguards The exposure draft outlined an explicit requirement for organisations to assess the proportionality of their biometrics processing in the circumstances, by considering whether the benefi [...] We proposed organisations would also be required to adopt and implement any relevant and reasonable privacy safeguards to ensure the biometric processing was carried out safely (we outlined eight different safeguards1). [...] Submitters generally supported the new obligation for organisations to tell individuals what form of biometrics they hold about them. [...] Protections for Māori biometric information We proposed that, as part of assessing proportionality, an organisation would be required to understand any cultural impacts of the biometric processing on Māori before going ahead. [...] Of the submitters who responded to these questions, some were concerned that the protections for Māori and their biometrics information outlined in the code are not sufficient.