Why it’s too early for Biometrics regulation in Aotearoa

Kia ora e te whānau

‘Digital Identity NZ’s submission to the Office of the Privacy Commissioner on a potential code of practice for Biometrics is possibly the most comprehensive response to a submission on Biometrics ever done in Aotearoa in recent times’. In my message to DINZ’s Executive Council to confirm the submission, that was my assessment of the depth and quality of the mahi produced by DINZ’s Biometrics Special Interest Group (SIG) and two further experts – one an indigenous rights advocate working with Māori data experts in this space, the other with deep knowledge and insights into Māori tikanga and Māori Data Sovereignty – both of whom hugely informed this submission. Our subsequent press release was picked up by RNZ’s Midday Business News at 1’56” and a further post on its website.

Our submission maintained that the Privacy Act 2020 remains the most appropriate regulatory instrument for all personal information, provided Privacy Impact Assessments are made mandatory and that definitions are clear. Standards based clear guidance co-created with industry would both improve education, provide confidence for industry, and maintain convenience and benefits for people while avoiding unintended consequences for them such as increased friction in their online experience and hampering technological improvement for industry. It’s far better to regulate the rare exceptional use cases than regulate the whole domain and have a plethora of exceptions. To follow up our submission, one DINZ member has a blog/podcast in the works on how Privacy Enhancing Technologies can retain the benefits of biometrics while protecting people from potential harm. Look out for it in the coming months.

All of our submissions, reports and other mahi are published on our website under Our Work including yesterday’s submission to the Department of Internal Affairs’ Discussion Paper on the Digital Identity Services Trust Framework Regulations.

While the topic above is a case in point, it’s clear that in recent years there’s been a downward trend across public sector agencies in retaining deep technical expertise and operational experience in their respective knowledge domains they are responsible for. It’s understandable given the pressure to reduce public spending. Even workarounds to bring in experts on short-term contracts are caught up in spending cuts. Election rhetoric around public sector cuts oversimplifies the expertise vs budget challenge that agencies face. As a consequence we see high level material developed in-house by agencies put out for public consultation with the ensuing submission-consultation-submission back and forth. It’s not a great way to develop anything because it wastes all parties’ precious time and effort typically ending in suboptimal outcomes and unintended consequences. But it’s the symptom of a deeper cause rooted in how we have traditionally developed and implemented policy in Aotearoa. Simply put, we have to start ‘right-sizing’ for the reality of our public expenditure budget. The public sector co-creating with industry (just as more effort has been made in recent years to co-create with Māori) would motivate people and organisations to step up and deliver better outcomes for all. Of course this challenges long standing public sector policies to avoid conflicts of interest and bias that have led to the current approach but we simply have to think in more modern terms about how we deliver really good outcomes in technically complex domains with minimal budgets. It’s not just an issue and opportunity for digital identity and its related technical domains such as Biometrics. It’s a macro-economic issue though most easily observed in digital contexts. The NZTech Alliance, of which DINZ is a part, continues to press for change. Please support us to drive a co-creation agenda for better outcomes. 

Ngā Mihi

Colin Wallis
DINZ Executive Director

---

Read full news here: Why it’s too early for Biometrics regulation in Aotearoa