Speaker 1: Kyoda.
Speaker 2: I'm Chelsea Daniels and this is the Front Page, a
Speaker 2: daily podcast presented by the New Zealand Herald. New Zealand's
Speaker 2: Privacy Commissioner has issued new rules around the automated use
Speaker 2: of biometrics. Biometric processing is the use of tech like
Speaker 2: a facial recognition to collect and process people's biometric information.
Speaker 2: The code comes into force on the third of November
Speaker 2: twenty twenty five today, but agencies already using it have
Speaker 2: until the third of August next year to align themselves
Speaker 2: with the new rules. Today on the Front Page, Privacy
Speaker 2: Commissioner Michael Webster is with us to take us through
Speaker 2: what all of this actually means and how we can
Speaker 2: protect ourselves. First off, my well, You're probably asked this
Speaker 2: a lot, but what exactly is biometric information?
Speaker 3: Well, I guess that the simplest way to describe it
Speaker 3: is each individual's physical and behavioral characteristics, personal.
Speaker 4: Information about them and the ones I think most people
Speaker 4: will be familiar with things like fingerprint scans, iris scanning,
Speaker 4: and of course increasingly we've seen here in New Zealand
Speaker 4: facial recognition technology or FRT. Those are the sorts of
Speaker 4: biometric information processings that we have seen here in this.
Speaker 2: Country, right, So instead of something that only happens in
Speaker 2: a Tom Cruise movie, it's increasingly happening in real life.
Speaker 2: Can you give us some examples, sure.
Speaker 4: I guess two of the most common are there's a
Speaker 4: number of workplaces, for example, where there are sensitive areas,
Speaker 4: and some workplaces are now using fingerprint scanning for people
Speaker 4: to be able to eat into those places. I think
Speaker 4: many people will be already familiar with the use of
Speaker 4: IRIS scanning to unlock IT programs or devices that sort
Speaker 4: of thing. And of course in New Zealand will be
Speaker 4: familiar with the recent trial that Foodstuffs Northilent did of
Speaker 4: the use of FRT to address some serious harm retail
Speaker 4: crime issues that they were having.
Speaker 2: So what prompted the introduction of this new biometric code.
Speaker 4: Well, we've been scanning both what's happening internationally and here
Speaker 4: in New Zealand, and increasingly businesses other agencies are using
Speaker 4: technological developments to either improve their customer service or to
Speaker 4: deliver on their objectives. And so inevitably there's going to
Speaker 4: be we think a greater use of BIOMESHP technologies by
Speaker 4: organizations out there.
Speaker 3: And we wanted to make sure that both in the
Speaker 3: public and the.
Speaker 4: Private sector, that this country was ready for that coming
Speaker 4: wave of a bit of uses of this sort of technology.
Speaker 2: Right, So I'm walking around the supermarket and obviously all
Speaker 2: the cameras are catching me what I'm picking up, and
Speaker 2: how I'm walking, and what I look like and everything.
Speaker 2: What can the supermarket then now do with that information
Speaker 2: now that there's a code in place.
Speaker 4: Well, in the past, of course, you would have been
Speaker 4: watched by a CCTV which would have just been recording you,
Speaker 4: and then a person would have been looking at that
Speaker 4: to see what you're up to. Now, for example, if
Speaker 4: someone has threatened a staff member or engaged in assault
Speaker 4: at for example, a supermarket or a hardware store, they
Speaker 4: might go onto what's called a watch list, a group
Speaker 4: of people who, for example, have been trespassed and are
Speaker 4: not allowed to back in. And so when you come
Speaker 4: in again, what the biometric technology can do through the
Speaker 4: camera system is match your face with the face that's
Speaker 4: on the watch list. So that kind of I guess
Speaker 4: verification process there, identification process, and then the store because
Speaker 4: there always needs to be human oversight the stalk and
Speaker 4: then decide what to do about that.
Speaker 3: Whether to call the police to approach you directly. Those
Speaker 3: are the choices open to them.
Speaker 2: Right, So if I go back in wearing a fake
Speaker 2: mustache and a wig, and will it pick me up?
Speaker 3: Is it that good?
Speaker 4: Some models of facial recognition technology, some biometric technology is
Speaker 4: that good? It comes back to a question about what
Speaker 4: level do you set the accuracy reading? And one of
Speaker 4: the discussions we've had with New zeal organizations is ensuring
Speaker 4: that you don't leave yourself at the risk of misidentification
Speaker 4: or incorrectly accusing somebody of being on a watch list
Speaker 4: when they're not, because that is incredibly harmful and damaging
Speaker 4: and upsetting for individuals. And so you want to be
Speaker 4: able to set the match I guess criteria quite high,
Speaker 4: and you want to be able to use a very
Speaker 4: reliable and good biometric technology product software that sort of thing. Unfortunately,
Speaker 4: even if you could make it through every other security measure,
Speaker 4: you won't be the last one. That's because it's protected
Speaker 4: by gait analysis, the step beyond facial recognition.
Speaker 1: These cameras actually know how the agent walks, how he talks,
Speaker 1: how he moves, write down to facial tics.
Speaker 3: So what you're saying is no mask can be to.
Speaker 1: A right.
Speaker 2: How does this code differ from privacy laws we already
Speaker 2: have in place.
Speaker 4: Sure, so we already have here in New Zealand our
Speaker 4: own New Zealand Privacy Act in biometric technology, biometric information,
Speaker 4: like all personal information, was already gaverned under the Privacy Act.
Speaker 4: What this does though, is I guess clarify and strength
Speaker 4: and some of the requirements on organizations thinking about using
Speaker 4: this technology.
Speaker 3: So now, for example, they need to go through a
Speaker 3: deliberate process of.
Speaker 4: Considering whether they have privacy safeguards in place. For example,
Speaker 4: with facial recognition technology, the Footsteps Northland trial had a
Speaker 4: system of immediate deletion of non matches, so they didn't
Speaker 4: build up this giant database of Kiley spaces if you
Speaker 4: see what I mean, they would immediately deleted. That would
Speaker 4: be a privacy safeguard. We expect under the code greater transparency.
Speaker 4: So if you go into a business that's using biometric technology,
Speaker 4: we would expect there to be very visible signage, whether
Speaker 4: it's from employees or customers, saying that it's in use.
Speaker 4: And we also want people to go through a very
Speaker 4: careful process of working out whether the proposed used is
Speaker 4: actually proportionate to the problem or the gain that you're
Speaker 4: looking to achieve. So will the privacy risks be outweighed
Speaker 4: by the benefits from using that technology? Is it basically necessary?
Speaker 4: Is it justified? Is it effective for your to use?
Speaker 4: Is it proportionate?
Speaker 2: I'm going to play Devil's advocate here because the first
Speaker 2: thing that comes into my mind with this kind of
Speaker 2: technology is brands looking at customers and seeing who picks
Speaker 2: up their product. Who, you know, what their customer base
Speaker 2: would be. So would this code protect your biometric information
Speaker 2: from being used, say via marketing.
Speaker 4: So there's a couple of things. That one is again
Speaker 4: we should always remember that people have always been watched
Speaker 4: while they're in stores with CCTV. That has always been
Speaker 4: a feature as well as the people in the store
Speaker 4: as well. One of the things we've done with this
Speaker 4: code is that we've said there needs to be some
Speaker 4: particular limits on its use, and one of those limits
Speaker 4: is around what we would call inferential biometrics, such as
Speaker 4: I guess, trying to read people's emotions or their mental state. So,
Speaker 4: for example, have they appeared to be more excited when
Speaker 4: they walk past the particular item of clothing then when
Speaker 4: they walk past something else, those sorts of things, and
Speaker 4: we've said, actually, unless there are particular exceptions in place,
Speaker 4: we don't think biometric technology should be used for those purposes.
Speaker 2: How does the code address particularly sensitive uses I suppose,
Speaker 2: like profiling based on ethnicity or health even I.
Speaker 4: Guess there's a couple of issues there that I mean.
Speaker 4: The first is that there is always a risk with
Speaker 4: the use of biometric technology around bias and profiling, and
Speaker 4: that is why, for.
Speaker 3: Example, to come.
Speaker 4: Back to that earlier the ashue I talked about, you
Speaker 4: need to be able to set the match criteria quite
Speaker 4: a higher level. A lot of the biometric tools that
Speaker 4: have been developed overseas aren't representative or reflectives of New
Speaker 4: Zealand's population. They're not very good at recognizing people with
Speaker 4: darker skin types as well, for example, And so you
Speaker 4: need to be able to assure your customers because at
Speaker 4: the end of the day, you want the trust and
Speaker 4: confidence of your customtomers. You need to be able to
Speaker 4: assure them that those that are matched are matched accurately.
Speaker 3: And you also need to have pretty strict criteria if.
Speaker 4: You're using it for say retail crime reasons around who
Speaker 4: ends up on a watch list and why they end
Speaker 4: up on a watch list. You've got to watch out
Speaker 4: for any human bias coming into how the systems are.
Speaker 2: Used, how will compliance be monitored or even enforced, and
Speaker 2: what penalties might there be in place once the code
Speaker 2: is enacted.
Speaker 4: So the Code includes the same requirements and obligations on
Speaker 4: businesses and organizations that exist in the current Privacy Act
Speaker 4: at the moment. For example, if you feel that your
Speaker 4: privacy rights have been intruded on or you've been treated
Speaker 4: unfairly in terms of the management and protection of your
Speaker 4: personal information, what we say is that you should first
Speaker 4: approach the organization concerned and if you can't resolve your
Speaker 4: concerns with them, you can and this is the same
Speaker 4: under the code as well. You can complain to our
Speaker 4: office and if we feel that your complaint has merit
Speaker 4: in it, we will investigate further. We also have a
Speaker 4: compliance and enforcement team and one of the roles that
Speaker 4: they carry out is just generally doing proactive schemes across
Speaker 4: what's going on.
Speaker 3: In New Zealand.
Speaker 4: One of the things about New Zealand is that they're
Speaker 4: not shy these days about complaining and so if we
Speaker 4: see for example, that there's an uptick and media stories
Speaker 4: about a particular organization and how it's used. In biometric technology,
Speaker 4: we have the right and the ability to go and
Speaker 4: see what's going on.
Speaker 2: What rights do individuals have regarding their biometric information?
Speaker 4: Again, individuals have the same rights as they have under
Speaker 4: the privacy X. So, for example, you have the right
Speaker 4: for your information to be held securely. We don't want
Speaker 4: people building up databases of personal information and then that
Speaker 4: information being at risk from a cyber attack.
Speaker 3: And I guess the key point here is that, for.
Speaker 4: Example, I had my driver's license stolen through a cyber attack,
Speaker 4: I can go and get a new driver's license, right,
Speaker 4: I can get a new driver's license number.
Speaker 3: That's okay. If I have my fingerprints stolen, or my
Speaker 3: iris akain stolen, or my face stolen through a cyber attack,
Speaker 3: that's not just information about me, that is me. If
Speaker 3: you know what I mean, and you can't replace that,
Speaker 3: it's gone.
Speaker 4: It's out there, probably being sold on the dark web.
Speaker 4: So individuals need to know and have the right to
Speaker 4: head information looked at as securely. Information that has held
Speaker 4: you also have a right to access as well. You
Speaker 4: can ask organizations for the information they hold about you.
Speaker 2: And you said that you looked internationally at what other
Speaker 2: countries have been doing around these kind of codes and
Speaker 2: this information. What kind of lessons did you guys learn,
Speaker 2: either good or bad from what others are doing elsewhere.
Speaker 4: Well, we're actually in a little bit of a catch
Speaker 4: up mode here with this code. Other countries have for
Speaker 4: quite a while now treated biometric information as sensitive personal
Speaker 4: information because of its inherent nature that it is you,
Speaker 4: not just about you, and so they've already had their own.
Speaker 3: Rules and regulations in place.
Speaker 4: A number of the countries that we are particularly close
Speaker 4: with and compare ourselves with, if you think of Australia,
Speaker 4: the UK, Canada, those sorts of countries they are have
Speaker 4: been and are currently looking at how.
Speaker 3: They regulate this information as well. So it's not just us.
Speaker 4: All around the world privacy regulators are looking at the
Speaker 4: issue of the increasing use of this technology and ensuring
Speaker 4: that when it is used that trust and confidence and
Speaker 4: people's privacy rights are not impacted by that.
Speaker 2: It's funny you say that they were in catch up mode,
Speaker 2: because when I read about this code, I thought, finally
Speaker 2: New Zealand is getting ahead of the curve because we're
Speaker 2: always talking about, especially on this podcast as well, when
Speaker 2: it comes to AI or anything tech, really how far
Speaker 2: behind we are, how far behind the laws are. For example,
Speaker 2: you know, there are some laws that don't even really
Speaker 2: understand that a phone is in our pocket these days,
Speaker 2: you know what I mean. So it really does feel
Speaker 2: like even for a lay person that we are getting
Speaker 2: ahead of this. Are we that behind?
Speaker 4: First that the Privacy Act itself is actually technology neutral,
Speaker 4: it's not kind of like, you know, anti technology, and
Speaker 4: you know, at the end of the day, we want
Speaker 4: New Zealand to benefit from the use of innoventive technologies,
Speaker 4: but what it's about is creating I guess guardrails for
Speaker 4: how that technology is used, because that at the end
Speaker 4: of the day, and doing privacy well is going to
Speaker 4: be good for the individual, but it's also good for business.
Speaker 4: One of the things we're increasingly seeing in overseas surveys,
Speaker 4: and this reflects perhaps a younger, more digitally savvy group
Speaker 4: of people growing up, is that if people are unhappy
Speaker 4: about how that personal information is being managed by a company,
Speaker 4: by an organization, they can quite easily pick up and
Speaker 4: leave and go somewhere else and we see that happen
Speaker 4: increasingly in New Zealand as well, and so businesses are
Speaker 4: now becoming more and more aware of that.
Speaker 3: And so.
Speaker 4: As long as any new regulatory frameworks like this code
Speaker 4: are practical for them to use that we provide as
Speaker 4: we have lots of guidance about how to do it well,
Speaker 4: they're accepting of that as a way to help ensure
Speaker 4: that when they do use this new innovative technology that
Speaker 4: it is, as I say, good for them as well
Speaker 4: as good for the individual.
Speaker 1: Another thing we can do to protect though, is never
Speaker 1: rely on a biometric as a single factor of authentication.
Speaker 1: It should be part of multi factor authentication. So that way,
Speaker 1: even if my fingerprint does get compromised, well, I have
Speaker 1: more fingers, But even if that were the case, I'm
Speaker 1: still relying on more than just that alone. I'm relying
Speaker 1: on a password, something I know, or something I have,
Speaker 1: like a particular device. So with multi factoring authentication, we're
Speaker 1: reducing that risk surface by spreading out the different security
Speaker 1: mechanisms we're using.
Speaker 2: And I note that businesses already using this biometric information
Speaker 2: one way or another have until August next year. Is
Speaker 2: that just logistics wise? Does it just take a while
Speaker 2: to I guess, recalibrate the technology that they're using at
Speaker 2: the moment.
Speaker 3: That's right.
Speaker 4: We wanted to ensure again from a practical point of view,
Speaker 4: that any business that is already using biometric technology had
Speaker 4: a period of time just to reassess these systems against
Speaker 4: the requirements and the code, to seek any further advice
Speaker 4: they needed to carry out, for example, and updated what
Speaker 4: we call obviously impact assessment, to relook at the privacy
Speaker 4: safeguards they've got in place, to think about whether they
Speaker 4: might want to add in some more for example, to
Speaker 4: ensure that they are consistent with the expectations that are
Speaker 4: set out in the code.
Speaker 2: And it's really incredible what biometric information we do carry.
Speaker 2: I mean, you mentioned the iris scan and the fingerprint.
Speaker 2: That's what people are kind of used to seeing, but
Speaker 2: you've also got things like the way someone walks, the
Speaker 2: way someone moves. That's you know, things that we may
Speaker 2: not think of. Did you ever think when you first
Speaker 2: became Privacy Commissioner or related into this space that you
Speaker 2: would be speaking about people's iris scans, fingerprints and the
Speaker 2: way they walk, talk and get excited when they see
Speaker 2: a product or something.
Speaker 3: Yes, I did.
Speaker 4: And interestingly enough, we've been through quite consultative process in
Speaker 4: developing this code. So it start actually a little while
Speaker 4: ago now, a few years ago now, but increasingly both overseas.
Speaker 4: But you see the sort of information used, and you
Speaker 4: even of course can see it heralded in popular literature,
Speaker 4: particularly say, for example, the sort of sci fi literature
Speaker 4: you've talked about.
Speaker 3: It is a reality.
Speaker 4: New Zealand wants to benefit from and use digital innovation,
Speaker 4: new technology.
Speaker 3: And part of my role is with our.
Speaker 4: Technology Neutral Privacy Act and our regulatory framework is ensuring
Speaker 4: that new technology can be used in a way that
Speaker 4: is safely used and is protective of people's privacy rights as.
Speaker 3: It can be.
Speaker 2: Thanks for joining us, Michael, you to thank you that
Speaker 2: said for this episode of The Front Page. You can
Speaker 2: read more about today's stories and extensive news coverage at
Speaker 2: enzadherld dot co dot nz. The Front Page is produced
Speaker 2: by Jay and Richard Martin, who is also our editor.
Speaker 2: I'm Chelsea Daniels. Subscribe to the Front Page on iHeartRadio
Speaker 2: or wherever you get your podcasts, and tune in tomorrow
Speaker 2: for another look behind the headlines.