AI note-takers arrive as something deceptively simple: tools that listen, transcribe, and organize. They promise clarity, efficiency, a kind of external memory that doesn’t tire or drift. But in doing so, they don’t just capture words, they capture voices. A voice is not just data, it can also be biometric information. That distinction matters more than it first appears.

In the span of just a few years, the way we authenticate ourselves has undergone a quiet but profound transformation. Passwords, once the cornerstone of digital security, are increasingly being replaced by something far more personal, our faces. From unlocking smartphones to boarding flights and authorising payments, facial recognition has become a seamless part of everyday life.

The Biometric Code is already in force. But the real deadline for many organisations is still ahead. The Biometric Processing Privacy Code 2025 came into force on 3 November 2025 for any new biometric processing. However, organisations that were already using biometric systems before that date have until 3 August 2026 to comply. Biometric processing is not always visible, sometimes it appears in very ordinary workplace tools.  

In an age where cameras are everywhere, from shop ceilings to street corners, the question isn’t whether we can watch, but whether we should and to what extent.

Walk into a New Zealand supermarket today and it’s no longer unusual to see CCTV cameras silently watching over the aisles. Increasingly though, those cameras aren’t just recording, they may also be recognising individuals. Facial recognition technology (FRT) is shifting from futuristic possibility to everyday reality in retail.

The Biometric Processing Privacy Code has now been issued. It will come into force in two tranches:

• 3 November 2025 – for biometric processing that starts after 3 November 2025

• 3 August 2026 – for biometric processing already in use on or before 3 November 2025