Will a new border deal with the US open a backdoor into Kiwis’ personal data?

Anyone who has recently travelled to the United States will be familiar with biometric checks – facial and fingerprint scans – used at the border.

It is the same technology platform that is used in airports elsewhere in the world. New Zealand’s passports, for instance, are among those that now carry encrypted biometric information^[1], matched to a traveller’s face as they pass through border smart gates^[2].

Because the data is used for a specific purpose and remains tightly controlled by the countries that hold it, these advanced systems have been relatively uncontroversial.

But that could change. The US Department of Homeland Security (DHS) is now requiring countries including New Zealand to enter a new arrangement – known as an Enhanced Border Security Partnership^[3] – as a condition of keeping visa-free travel to America^[4].

Countries that do not sign on risk losing that access, placing them under pressure to agree despite unresolved questions.

Documents released by the DHS^[5] suggest the arrangement could involve direct access to other countries’ government databases, including law enforcement and biometric data – raising serious privacy concerns.

Biometric data is especially sensitive: if compromised, it cannot be replaced like a credit card. Around the world, it is regulated through bespoke rules such as New Zealand’s recently adopted Biometric Processing Privacy Code^[6].

However, the US proposal is largely shrouded in secrecy and may be exempt from privacy and freedom of information laws due to carve-outs in immigration legislation.

Given the stakes involved, it is clear the US proposal should be transparent, enabling countries such as New Zealand the opportunity for public debate and scrutiny before signing on.

Europe pushes back

The New Zealand government has confirmed^[7] it is in talks with the US, but has so far provided little detail on what information might be shared or what protections would be in place.

It is not alone in confronting this challenge. The European Union has been able to push back^[8] and is likely to negotiate compromises that preserve strong privacy protections aligned with European norms.

Its independent European Data Protection Supervisor^[9] recently issued an opinion statement^[10] outlining key concerns, as well as the minimum safeguards needed to protect privacy and human rights.

Earlier agreements between the two blocs show that such safeguards are possible.

One example is the Passenger Name Record^[11] (PNR) agreement established after the September 11 attacks. This requires airlines to transfer certain data before a passenger boards a flight to the United States.

Its many provisions include limiting the use of data to combating terrorism or serious transnational crime, masking identifiable personal information after six months and placing data in a dormant database with restricted access.

What’s now on the table is a very different proposition. Unlike PNR – which involves sharing a single dataset for a specific purpose – DHS documents suggest large-scale transfers of biometric and other data to the US.

In response, the European Data Protection Supervisor has demanded explicit authorisation and access logging requirements, rather than granting automatic access. It has also stressed the need for strict necessity.

What cards can NZ play?

For New Zealand, the US proposal is troubling because it could potentially enable access to law enforcement data currently governed by the Privacy Act^[12], with strict rules on transparency and who can access it.

There is a risk this could extend to police vetting^[13] data, which includes not only criminal convictions but also information on potential suspects, such as intelligence photos of individuals. If so, this could undermine the presumption of innocence where no charges have been laid.

What can New Zealand do? It might turn to protections that were set out in a Ministerial Policy Statement^[14] governing cooperation between domestic intelligence agencies and their overseas counterparts.

Following a critical 2019 report^[15] by the Inspector-General of Intelligence and Security – which highlighted risks of shared information being used in ways that could contribute to human rights abuses – this statement was strengthened with tighter safeguards.

But for now it is unclear what steps New Zealand will take – or how the US will respond to any issues it raises. It is also concerning that, compared with the much larger European Union, the country is in a weak position to negotiate how this new partnership is applied.

One can only hope it does not prove to be a Trojan horse for New Zealanders’ data privacy.

References

1. ^{^} biometric information (www.rnz.co.nz)
2. ^{^} border smart gates (www.customs.govt.nz)
3. ^{^} Enhanced Border Security Partnership (www.statewatch.org)
4. ^{^} visa-free travel to America (www.dhs.gov)
5. ^{^} Documents released by the DHS (www.dhs.gov)
6. ^{^} Biometric Processing Privacy Code (www.privacy.org.nz)
7. ^{^} has confirmed (www.rnz.co.nz)
8. ^{^} has been able to push back (www.politico.eu)
9. ^{^} European Data Protection Supervisor (www.edps.europa.eu)
10. ^{^} an opinion statement (www.edps.europa.eu)
11. ^{^} Passenger Name Record (www.cbp.gov)
12. ^{^} Privacy Act (www.legislation.govt.nz)
13. ^{^} police vetting (www.police.govt.nz)
14. ^{^} Ministerial Policy Statement (www.nzsis.govt.nz)
15. ^{^} a critical 2019 report (www.rnz.co.nz)