Biometrics Processing Privacy Code 2025
In last summer’s edition of Commercial eSpeaking (#69), we reported on the draft Biometrics Processing Privacy Code. Since then, the Office of the Privacy Commissioner has finalised the Code; this will take effect on 3 November 2025. Organisations already using biometric technologies will have until 3 August 2026 to ensure full compliance.
The Code applies to organisations using automated processes to collect and use biometric information – that is, information about a person’s physical features or behavioural traits, such as facial features, fingerprints, voice or eye patterns.
The Code introduces 13 rules that go beyond the general information privacy principles in the Privacy Act 2020, requiring businesses that collect biometric data to take a more rigorous and transparent approach. These rules can be broadly categorised in the following way:
• Purpose: Organisations must clearly identify why they are collecting biometric information and ensure that collection is necessary, effective and proportionate to that purpose
• Safeguards: Adequate privacy protections must be in place before collection, including measures to reduce privacy risks, ensure system accuracy and strengthen security
• Proportionality: Biometric data should only be collected where there are reasonable grounds to believe that the benefits of collection outweigh the potential privacy impacts on individuals
• Openness: Individuals must be informed about how their biometric data will be used and disclosed so they can make an informed decision about providing it, and
• Use limits: The Code places clear limitations on how biometric data can be used and when it may be disclosed.
Each rule contains specific obligations that may impact how your business collects, uses and protects biometric information. As a result, it is important that businesses review their biometric systems and policies to ensure compliance with the Code as the effective date (3 November) approaches.
If you need any guidance on any of the above topics, please don’t hesitate to contact us.
DISCLAIMER: All the information published is true and accurate to the best of the authors’ knowledge. It should not be a substitute for legal advice. No liability is assumed by the authors or publisher for losses suffered by any person or organisation relying directly or indirectly on this article. Views expressed are those of individual authors, and do not necessarily reflect the view of this firm. Articles appearing in this newsletter may be reproduced with prior approval from the editor and credit given to the source. Copyright, NZ LAW Limited, 2019. Editor: Adrienne Olsen. E-mail: adrienne@adroite.co.nz. Ph: 029 286 3650 or 04 496 5513.