Biometrics are measurements of a person’s body or behaviour, such as their face, fingerprints, voice or gait, that are used to identify or analyse them.
For Māori, biometric information is not just personal data: the face and head are tapu, moko carries whakapapa, and identity is collective as well as individual.
Taiuru & Associates, led by Dr Karaitiana Taiuru, advises organisations in Aotearoa New Zealand on facial recognition, digital identity and biometric systems, including the cultural impacts on Māori that the Biometric Processing Privacy Code 2025 now requires them to assess.
What is biometric information?
Biometric information is information about a person’s physical or behavioural characteristics, such as their face, fingerprints, iris, voice, signature, keystrokes or the way they walk. Biometric processing is when a technological system compares or analyses that information, for example facial recognition in a supermarket, a face scan to verify identity online, or voice analysis in a call centre.
Why biometrics matter to Māori
- Tapu: the head and face are tapu in tikanga Māori. Capturing, storing and analysing images of them is not culturally neutral.
- Moko and whakapapa: mataora and moko kauae express whakapapa and identity. Reducing them to a biometric template, or using them to train AI, raises questions of consent, ownership and tikanga.
- Collective identity: Māori identity is relational, grounded in whānau, hapū, iwi and whenua. Systems built on “one person, one account” do not reflect this.
- Bias: facial recognition systems have higher error rates for darker-skinned people. Combined with existing over-policing and over-surveillance, misidentification can fall hardest on Māori.
- Sovereignty: biometric data is often processed by offshore vendors. Storing it in New Zealand is data residency; Māori Data Sovereignty requires Māori authority over how it is collected, used, shared and deleted.
The Biometric Processing Privacy Code 2025
The Biometric Processing Privacy Code 2025 is issued by the Privacy Commissioner under the Privacy Act 2020. It sets 13 rules for organisations that collect biometric information for automated biometric processing. It came into force on 3 November 2025 for new biometric processing, and on 3 August 2026 for processing that was already under way before 3 November 2025. It now applies to both.
Under Rule 1, an organisation may only collect biometric information if the processing is necessary and proportionate. The proportionality assessment must consider the cultural impacts and effects of biometric processing on Māori, including:
- cultural perspectives that affect how Māori view or are affected by the processing, such as tikanga Māori and Māori Data Sovereignty; and
- any different impact on Māori, such as bias in the system that leads to adverse decisions against Māori at a higher rate.
This is the first time a New Zealand privacy rule has required an explicit assessment of impacts on Māori. In our view, it is only meaningful if it changes decisions. A cultural impact section that could be deleted without changing whether or how a system is deployed is decoration, not compliance. A credible assessment needs Māori expertise, evidence of how the system performs for Māori, and engagement with the iwi and hapū of the area where the system operates.
Facial recognition technology (FRT)
Facial recognition is the most widely used and most contested biometric technology in New Zealand, from retail security trials to government identity checks. Dr Taiuru has analysed several New Zealand deployments from a Māori perspective, and has personally been misidentified by an AI face detection system that interchanged his images with those of two other Māori men.
- Introduction to facial recognition bias
- Facial recognition, algorithmic bias and compounded harm to Māori and Pacific communities: an analysis of the Foodstuffs South Island trial in Christchurch.
- Inconsistencies with the Foodstuffs North Island facial recognition trial
- DIA facial recognition trial report obscures risks to Māori
- AI face detection misidentified three Māori men
- Customary Māori values and copyright legislation for FRT
Digital identity
Digital identity systems, including the Digital Identity Services Trust Framework and digital credentials stored in phone wallets, increasingly rely on face scans to verify who someone is. Māori identity is relational and collective, so digital identity systems in Aotearoa need to recognise whakapapa, whānau, hapū and iwi rather than treating identity only as an attribute of an individual account.
Likeness, voice and deepfakes
Generative AI can now recreate a person’s face, voice and mannerisms from a small number of images or recordings. For Māori, this raises the risk of deepfakes, misuse of moko, voice cloning and digital likenesses that continue after death, without consent and outside tikanga.
- Deepfake harms: a real scenario and new legislation
- Tikanga and AI images of a person
- Meta’s digital ghost patent: a te ao Māori analysis
- Māori forensic deceased data
How we help
- Cultural impact assessments: assessing the cultural impacts and effects on Māori for Rule 1 proportionality assessments under the Biometric Processing Privacy Code.
- Privacy impact assessment review: independent review of biometric privacy impact assessments, from a Māori Data Sovereignty and tikanga perspective.
- Facial recognition trials and deployments: advice on trial design, site selection, accuracy for Māori and Pacific populations, and evaluation.
- Digital identity: advice on identity verification, digital credentials and collective Māori identity.
- Training and briefings: for boards, privacy officers, frontline staff and vendors on biometric bias and Māori cultural risk.
Biometrics FAQ
Does the Biometric Processing Privacy Code require organisations to consider Māori?
Yes. Under Rule 1, an organisation’s proportionality assessment must take into account the cultural impacts and effects of biometric processing on Māori. That includes cultural perspectives such as tikanga Māori and Māori Data Sovereignty, and any different impact on Māori, such as bias in the system.
When did the Biometric Processing Privacy Code come into force?
The Code came into force on 3 November 2025 for biometric processing that started on or after that date. Organisations that were already using biometric processing before 3 November 2025 had until 3 August 2026 to comply. It now applies to both.
Is facial recognition biased against Māori?
Facial recognition systems are known to have higher error rates for people with darker skin, and they are rarely tested on Māori populations before deployment in New Zealand. Without that testing, organisations cannot show that a system performs fairly for Māori, and misidentification risks falling hardest on communities that are already over-surveilled.
Why is biometric data culturally significant to Māori?
In tikanga Māori the head and face are tapu, moko carries whakapapa, and identity is collective as well as individual. Biometric data about Māori is therefore not just personal information, but a taonga that carries cultural obligations about how it is collected, used and protected.
What should a cultural impact assessment for biometrics include?
It should include evidence of how accurately the system performs for Māori, an analysis of where and on whom it will be used, the tikanga issues raised by capturing faces and moko, Māori Data Sovereignty considerations such as offshore processing and retention, engagement with local iwi and hapū, and how the findings change the decision to deploy.
Does storing biometric data in New Zealand protect Māori?
Not on its own. Storing data in New Zealand is data residency. Māori Data Sovereignty also requires Māori authority over who can access biometric data, how it is used and shared, whether it trains AI models, and when it is deleted.
Related
Māori Data Sovereignty →
Māori AI →
AI governance →
All digital identity, facial recognition and biometrics articles →
Last updated: 8 October 2026. This page is general information, not legal advice.