One of the uncanny things about living in New Zealand is our two degrees of separation. That’s especially true somewhere like Otago, where even after decades you’ll recognise in the street the faces of the people you went to primary school with. While a person’s experiences can change them significantly over a lifetime, their unique identifiers like core facial features, fingerprints or even the way they move will largely remain the same.
Biometrics is the automated recognition of individuals from their biological or behavioural characteristics. There are many different types of biometric systems, based on characteristics as diverse as a person’s face, fingerprints, eyes, voice or even the way a person walks or smells. Then there are three broad types of uses for those.
Verification involves confirming the identity of an individual (is this person who they say they are?).
Identification involves determining the identity of an unknown individual (who is this person?).
Categorisation, or profiling, involves using biometrics to extract information and gain insights about individuals or groups (what type of person is this?).
It can sound like the distant future, but if you’re reading this on your phone, you likely unlocked your device using your face or fingerprint. If so, you’re one of a growing number of people who regularly interact with biometric technologies.
Biometrics can have major benefits, including convenience, efficiency and security. However, it can also create significant risks, including risks relating to surveillance and profiling, lack of transparency and control and accuracy, bias and discrimination.
Ask yourself, should stores use facial recognition to identify shoplifters or to monitor aggressive behaviour by shoppers? Can your workplace tell you that you need to use your thumbprint to clock in and out each day? Privacy regulators around the world are thinking about the appropriate collection and use of people’s biometric information, and that’s the same in New Zealand too.
The Privacy Act 2020 is a technology-neutral piece of legislation, which means it already covers biometrics. However, tools like facial recognition technology have such a significant impact for individuals and their privacy that we’re also investigating a separate biometrics code that could especially describe how biometrics needs to be handled within privacy rights. Biometrics differs from something like a licence or an ID card because you essentially get one set for life; they can’t be cancelled or reissued, which elevates the risk around their use.
The considerations we need to make are complex, but will help us potentially create a framework for adapting to the future while also ensuring people’s privacy is protected. Some of my team’s work includes listening to Māori data sovereignty advocates who have expressed concern about the impacts of facial recognition technology on Māori, taking into consideration a 2020 report funded by the Law Foundation that argued that greater regulation was needed and making connections with international colleagues who are also thinking about how this sensitive information is captured and used, and how long it is retained for.
Many of us know of families where the resemblance is so strong that siblings can use their faces to unlock each other’s phones, so you can see where the issues and grey areas might be. Even if facial recognition software is highly accurate, there will still be times when it can get things wrong.
The use of biometrics is growing and diversifying, and I want to ensure New Zealanders and New Zealand businesses can harness the benefits of this technology, but also be protected from potential harm.
We need to embrace technological advancement, but its vitally important to me that we also do the research, thinking and planning to keep people safe and protect their right to privacy.
May 8-14 is New Zealand’s Privacy Week. The Office of the Privacy Commissioner is running a series of free, online talks as part of the week, on the theme of privacy rights in the digital age. The programme of events can be found at www.privacy.org.nz/news/forums-and-seminars/privacy-week
— Michael Webster is the privacy commissioner.
