Following several years of consultation, a Biometrics Processing Code 2025 (Code) has been released under the Privacy Act 2020. Organisations that want to start collecting biometric information (ie information about how an individual looks, moves or behaves) will need to consider and apply the Code from 3 November 2025. Organisations that already collect biometric information will have until 3 August 2026 to align with the Code.
What does the Code apply to?
The Code will replace the information privacy principles in the Privacy Act where organisations use technologies like facial recognition to collect and process individuals' biometric information to identify or classify them. Biometric information will capture, for example, the physical features of an individual (such as their face or fingerprints), how they type, speak or walk.
There are, however, some important exclusions to the scope of the Code. For example, the Code does not apply to health agencies as health information continues to be covered by the Health Information Privacy Code. The Code also doesn’t generally apply to personal consumer devices such as smart watches, fitness trackers or virtual "try-on" filters, on the basis that devices of this nature are solely for providing a user with their own personal information.
What's changed since the last version?
Since the last draft that we commented on earlier this year, there have been a few changes to reflect submitters' feedback. Most of these changes are focussed on clarifying how the Code should apply. For example (and in summary):
- The necessity test has been clarified
- The provisions in relation to biometric trials have been clarified, so that organisations who do opt to do a trial can defer compliance with both parts of the necessity test. The rest of the Code continues to apply to a trial, including requirements in rules 1 and 10 that the trial must be proportionate and appropriate safeguards must be adopted
- The consumer device and personal use exclusion has been clarified.
If you would like any assistance with considering how the Code could impact your business, then please get in touch with one of our team.
