Māori concern over data privacy puts spotlight on Privacy Commissioner

The Office of the Privacy Commissioner (OPC) is finalising a code of practice for biometric data processing, but one Waikato professor fears it will not give enough power to indigenous privacy concerns.

The Biometric Processing Privacy Code aims to plug a regulatory gap around emerging biometric technologies, aiding organisations in implementing the tech safely and fairly.

Biometrics include biological characteristics such as genetics, fingerprints and facial features, as well as behavioural characteristics like the way we walk and talk.

Professor Tahu Kukutai (Waikato, Ngāti Maniapoto, Te Aupōuri) has kept a close eye on the development of the code since it was first proposed in 2021.

In Science Magazine, the co-director of Ngā Pae o te Māramatanga (NPM) called a recent draft of the code “a step back on its initial ambition of being a world-leading biometrics regulation".

Kukutai told TWN that while the code was a step in the right direction, it was looking weaker than many Māori groups and individuals involved in consultation wanted it to be.

“Initially it looked really strong … there would be mechanisms like free, prior and informed consent, and prevention or exclusions of web scraping.

“But over time you can see that those things dropped out of the final code, and cultural considerations as well.”

Section 21c of the Privacy Act requires the Privacy Commissioner to “take account of cultural perspectives on privacy".

Kukutai said one of her biggest concerns was the use of biometric technology in public spaces.

She said Māori had a keen interest in the issue after being over-surveilled for generations — concerns included the misuse of biometric information, racial bias and profiling, poor accuracy leading to misidentification, and surveillance overreach.

A 2024 trial of facial-tech in 25 Foodstuffs supermarkets complied with the Privacy Act, according to a recent post-inquiry statement from Privacy Commissioner Michael Webster.

A review of the trial found 100 serious harm incidents were prevented by the technology, a 16 per cent reduction.

25 Foodstuffs supermarkets, including this Pak’nsave in Silverdale, have continued to use facial recognition technology since the six-month trial concluded in September 2024. Photo: Luke Fisher

Responding with a LinkedIn post on Thursday, Kukutai called the findings “precedent setting".

“I reckon we can all expect to be surveilled while out buying our overpriced ham from the local supermarket duopoly this Xmas, or next.”

Kukutai says community-led efforts can still be made to protect data important to Māori without the help of government or regulators.

“We’ve sort of focused on our genealogical data and just digitising it in any space that we could find and bringing it back to our own local communities.

“We've repurposed and put it back together in ways that give it new meaning, more coherence and higher quality, and we're locking that up.”

Te Tihi o Ruahine Whānau Ora Alliance— a collective of nine hapū, iwi, and Māori organisations — works towards data solutions to improve the overall wellbeing of whānau, hapori and iwi, as well as restoring Māori data sovereignty.

Felicity Te Whata (Ngāpuhi) and Nathaniel Pihama (Waikato, Patuharakeke) from Te Tihi told TWN in an email they were concerned about consent requirements, data misuse perpetuating harmful stereotypes, and access for whānau-led decision making.

“[Data] carries our whakapapa, our connections, our histories, and the aspirations we hold for our mokopuna. It is a taonga.

“Those who work with Māori data must act as kaitiaki – not just managing information, but honouring a responsibility to return it with integrity, context, and meaning.”

The OPC does not wish to comment on the code until it is issued in the coming months.