Resources and learning
Rule 13 largely replicates IPP13 from the Privacy Act.
Unique identifiers can be used to easily track individuals across systems, link unrelated datasets about a person, or facilitate identity theft or fraud. There are also clear benefits to organisations in assigning identifiers to efficiently administer their functions. Rule 13 allows the use of biometric information as unique identifiers, subject to certain limits on their use and re-assignment to reduce the risk to privacy.
What is a unique identifier?
A unique identifier is a number, symbol or other particular that an agency can use to uniquely identify a person in their system (other than the person’s name). Examples of non-biometric unique identifiers are IRD numbers or National Health Index (NHI) numbers.
A biometric template is a mathematical representation of a biometric characteristic (like a fingerprint) generated by a biometric system. It may look like a unique string of numbers that relate to the biometric characteristic e.g. a set of coordinates.
Biometric templates are capable of being assigned as unique identifiers. How organisations use the biometric template and how the biometric system operates will determine whether the organisation is assigning the template as a unique identifier.
When will a biometric template be a unique identifier that is assigned?
Assigning a unique identifier means that you are using a unique identifier (e.g. a number) as the primary means of identifying a specific person in your systems. For example, you use it to bring up the person’s file or other key information about them.
- For a biometric template to be assigned as a unique identifier, it must be central to how your system identifies and organises information about people.
- Generating a biometric template temporarily (e.g. for a one-time comparison) does not count as assignment.
- Recording a unique identifier to communicate with another organisation about that person is not assigning it.
The examples below explain when a biometric template is assigned as a unique identifier.
What controls does rule 13 place on using unique identifiers?
Rule 13 requires that:
|
You only assign a unique identifier if it is necessary to enable you to carry out your functions efficiently (rule 13(1)).
|
- Ask: Is assigning a biometric template genuinely needed to help your organisation run smoothly, avoid confusion, or manage your operations more effectively? What other options are there to organise the way you identify individuals in your systems?
- While this test is more focused on operational efficiency, if you have determined under rule 1 that using biometric processing is necessary and proportionate, you will likely comply with this rule if your use case relies on using a biometric template to organise the way you identify individuals in your systems.
|
|
You must not assign the same unique identifier that you know another organisation has already assigned to the same person.
|
- This means you must not assign a biometric template that you know has been generated by another agency’s biometric system and used as a unique identifier in their system for the relevant person.
- In practice, this is unlikely to happen unless another agency directly shares a template with you. Differences in biometric systems and variations in the biometric sample used will produce different templates, and two agencies separately assigning different biometric templates to the same person is not a breach of rule 13.
|
|
If you are assigning a biometric template as a unique identifier, you must take reasonable steps to ensure it is only assigned to an individual whose identity is clearly established.
|
- This requirement helps mitigate the risk of misidentification.
- You don’t necessarily need to know their name or other biographic details to establish the person’s identity.
|
|
You must take reasonable steps to minimise the risk of misuse of that unique identifier (e.g. to mitigate the risk of privacy breaches or identify theft).
|
|
|
You generally can’t require that an individual disclose their unique identifier, including when that unique identifier is a biometric template. In practice, this is unlikely to be an issue in most biometrics contexts.
|
|
Read our example scenarios of how an organisation might apply rule 13 in context.
