What is Biometric Information? A Beginner’s Guide
Brendan Marks, Hauora Health Privacy Working Group
You might have heard of biometric information previously, maybe from a sci fi movie like Gattaca or The Demolition Man (both great watches!) or perhaps more recently in the local headlines with Food Stuffs North Island looking to use facial recognition software in their stores. Maybe you’ve heard of it before but don’t really understand what exactly biometric information covers. Either way this article aims to give a broad understanding of biometrics within the New Zealand context.
The Office of the Privacy Commissioner describes biometric information as personal information that relates to the unique physical and behavioral characteristics you possess. The basic idea behind biometrics is that we have intrinsic physical and behavioural traits that can accurately identify us. Derived from the Greek words “bios” or “life” and “metron” or “to measure”, biometrics quite literally means “to measure from life”. Under the NZ Privacy Act biometric information is deemed as sensitive personal information, the reason for this sensitivity is that biometric information is unique, based off the human body, and fundamental to the individual.
So what specifically would classify as biometric information? The obvious ones are items like: your finger print, your finger and hand geometry, your facial geometry, your retina, your voice print (how you sound and the cadence of your speech). Then we get to some of the lesser known types; The way you walk (your gait), the patterning of veins in your hands, and the keyboard stroke and mouse patterns you use when at a computer. These are just examples as and a full list would be extensive. The main purpose for collecting such information is personal identification and each agency will have reasons for seeing the need for this.
As you can imagine such information has powerful application across the public and privacy sectors as a unique identifier. We’ve already seen NZ Customs Service using facial scanning as a method of verifying the individual against their passport at airports, companies utilising fingerprint scanning to verify time and attendance of their employees, and the aforementioned Food Stuffs use of facial recognition to keep employees safe in their workplace. It is widely expected that the use of this information type will expand as businesses and public sector agencies look towards new ways to leveraging biometrics to enhance or protect their offerings. As an example, the ANZ Bank informs customers when they log in to internet banking that “we collect behavioural information about how you use ANZ Internet Banking (eg typing speed).” This is not new: during WW2, Morse keying rate was used to identify whether sending equipment was being used by a known sender or by an enemy.
With the expanding use of biometric information, there has been growing concern that increased regulation is needed. Although the use of biometric information is covered under the NZ Privacy Act, there are no specific provisions to govern the fair and appropriate use of this data type. To this end the OPC has been working on a biometric code and announced in November 2023 the release of an exposure draft of the code, which is in review after recent public consultation.
The best thing for you is that when it comes to protecting your privacy you are informed of your privacy rights and the obligations of the businesses you use. Look out for more of these bite sized articles to keep across the hot topics of Privacy in New Zealand.