Biometric data is tapu

Note: This article was first prepared for offline presentations when the reports it discusses were released. It has since been updated and published online on the date shown.

In 2024, the Privacy Commissioner asked Māori about biometrics: facial recognition, fingerprints, voice, and other data drawn from our bodies and behaviour.

The 2024 privacy survey found a strong majority of Māori prioritise control (87%) and protection (79%) of their data. In hui with the Commissioner’s office that year, Māori consultants, privacy experts and people working with biometrics raised clear concerns:

• Biometric information relates to the tapu of a person’s physical and behavioural features.
• The impact of facial recognition on tamariki and rangatahi needs scrutiny.
• Mechanisms are needed to hold agencies accountable.
• Consent to share biometric information is supported, but consent alone isn’t enough. Other protections matter too.
• Facial recognition in retail stores raises concern about heightened surveillance of Māori. At the same time, Māori staff may benefit from protections.
• Māori are also exploring positive opportunities to use biometric information.

That last point is a demand that Māori have control over how our biometric data is used, by whom, and for what.

The Biometric Processing Privacy Code is now fully in force. Since August 2026, every organisation using biometrics in New Zealand, including systems that were already running, must assess the cultural impacts on Māori before and during use.

Some questions agencies and businesses should be able to answer now:

• Who did you engage with to assess the cultural impacts on Māori?
• Have you tested your system for bias on our population, including Māori with moko?
• What is the alternative for someone who says no? Without one, consent isn’t free, prior or informed.
• Who holds you accountable if you get it wrong?

Biometric data is tapu. Once it’s compromised, it can’t be replaced. In 2024, Māori told the Commissioner what we needed. Two years on, the test is whether the people using these systems are listening.

Source: Office of the Privacy Commissioner, Annual Report 2024.
https://www.privacy.org.nz/assets/New-order/Resources-/Publications/Corporate-reports/2024-annual-report/2021-26-11-OPC-Annual-Report-2024.pdf