Can I use facial recognition technology?

There are several of factors you need to consider carefully before deciding to use facial recognition technology (FRT) or any other biometric-collection technology.

Biometric information is sensitive personal information and is regulated by the Biometric Processing Privacy Code.

The Code applies to all organisations - businesses, government agencies, NGOs - that collect biometric information for biometric processing (with limited exceptions). 

Read the Code and see factsheets that give a general overview of the rules.
Read detailed guidance about each rule in the code, our complaints process, and use case examples.

Even if facial recognition software is highly accurate, there will still be times when it can get things wrong. Therefore, any organisation or business using facial recognition technology needs to undertake a high level of scrutiny over how accurate it is and how thoroughly it has been tested for use in New Zealand. 

One of the risks of facial recognition technology is that it may misidentify individuals. In cases of preventing shoplifting, if a person is misidentified, they may continue to be branded an offender by your business or organisation, when the information is wrong as happened in this case.

An organisation needs to take the risk of misidentification seriously and ask itself what controls and processes it can put in place to minimise that risk. When it comes to identifying people accused of a crime, getting it wrong can have a severe impact on the person affected. 

Read our report on Foodstuffs North Island’s FRT trial.
Read about how to use FRT well [PDF, 193 KB] (opens to PDF, 193 KB).

Updated October 2025