The Government is deciding whether the United States should get access to New Zealanders' biometric data. Photo / RNZ
By Keiller MacDuff of RNZ
New Zealanders’ biometric information and other sensitive data may be handed over to the United States government under a new border security agreement between the countries.
The Ministry of Foreign Affairs and Trade has confirmed officials were in talks with the US on the requirements and scope of an Enhanced Border Security Partnership (EBSP).
The US has given the 42 countries in its Visa Waiver Programme – a reciprocal agreement that allows citizens to visit for up to 90 days without a visa – until the end of the year to conclude EBSP negotiations or risk losing visa-free travel status.
Any information handed over to the US may end up with the country’s controversial Immigration and Customs Enforcement border force – or ICE as it is commonly known – and concerns have been raised about the opaque process, data sovereignty and surveillance overreach.
New Zealand’s Ministry of Foreign Affairs and Trade (MFAT) refused to clarify what safeguards were being considered to protect New Zealanders’ private information or if it was aware of any ICE personnel stationed in New Zealand at present.
Biometric sharing programmes already exist between Five Eyes countries (New Zealand, Australia, Canada, the United States and the United Kingdom) as part of Migration Five arrangements but typically operated on a “hit/no-hit” basis where initial biometric checks provided minimal information, and further data requests were considered on a case-by-case basis.
But EBSPs could provide full automated access to other countries’ national databases, according to critics and minutes from European Union member state negotiations.
The US Department of Homeland Security’s own privacy assessment noted biometric information could be used to vet any individual “encountered” during border inspections or immigration investigations.
European regulators warned this could extend to minors, victims or witnesses to crime.
The New Zealand Government had not stated what information might be shared, what safeguards would apply, or whether Parliament or the public would be consulted before any agreement was finalised.
MFAT offered RNZ a one-line statement regarding the negotiations: “New Zealand officials continue to discuss the requirements and scope of an Enhanced Border Security Partnership with the United States.”
However, the ministry refused to respond to follow-up questions including when negotiations began, what privacy impact assessments had been undertaken, what safeguards were being considered, and what limitations would apply to collection and use of data.
Foreign Affairs Minister Winston Peters’ office also declined to respond.
Green Party foreign affairs spokesperson Teanau Tuiono criticised the lack of information on the negotiations.
He wanted to see parliamentary oversight and public scrutiny of the agreement.
The Government should also disclose details of any privacy assessments it had carried out, he said.
Aotearoa needed to urgently reassess its relationship with the US, Tuiono said.
“We are seeing that alarm right across the world with the direction the US is going under the Trump administration. This is not a time for us to be seeking closer engagement and relationships with the US,” he said.
Council of Civil Liberties chair Thomas Beagle said the proposed scheme was much more invasive than existing data-sharing arrangements and officials should consider the Trump administration’s approach to immigration during negotiations.
“The US is obviously struggling at the moment with the rule of democracy and rights-based society. They have government-sponsored gangs of people wearing masks who refuse to identify themselves disappearing people off the streets,” Beagle said.
“This is seriously in the direction of heading towards fascism – the idea that we’re then going to give these people access to our private data and even the private data of people associated with travellers is very, very concerning.
“Some people are still locked in the past where the US was a reasonably benign ally of New Zealand, and that’s becoming less and less true.
“We wouldn’t give other countries like China or Russia full access into our police and biometrics databases, would we?”
New Zealand’s regulations included the right to have data held by public agencies corrected if it was wrong and the disposal of data after a certain time.
“Once this data passes out of our control, we don’t have that ability any more. It’s going to be there for five or 10 years and could come back and bite you years later.”
The risk also applied to New Zealanders living in the US, who could get caught up in “trawling expeditions”.
Beagle urged the Government to be more forthcoming about the agreement.
A report by the European Data Protection Supervisor – the European Union’s independent data protection watchdog – emphasised the unprecedented nature of such an agreement.
It would be first providing large-scale sharing of personal and biometric data with a non-EU country, and would have a significant impact on privacy rights and the protection of personal data, supervisor Wojciech Wiewiórowski said.
He called on European Union negotiators to narrow the agreement’s scope to just travellers and require clear justifications for every query, among other protections.
The report warned sharing sensitive data could lead to the detention or imprisonment of individuals.
Māori data sovereignty expert Dr Karaitiana Taiuru said there were specific concerns for Māori in relation to DNA, which is considered a taonga.
“For Māori and for many other indigenous peoples, our DNA is sacred to us. It’s not just this generation’s knowledge, it’s our previous generations and our future generations, so it’s very sacred,” he said.
Sharing police databases raised particular concerns given the overpolicing, profiling and surveillance Māori were subject to in Aotearoa, he said.
“We know from reports over decades there has been an institutional racism issue in the past with the New Zealand Police. So automatically, that data is going to be biased, it’s going to be racist,” he said.
“There’s going to be some very sensitive information in those police files. What happens if someone has been proven innocent by the police? Would that data show up if it’s shared overseas, for example. What about survivors and victims of abuse? They’re entitled to privacy as well.
“Some major questions need to be asked about people’s privacy and our own laws.”
A spokesperson for New Zealand’s Privacy Commission declined to answer questions on whether it had been consulted, what safeguards or limitations were or should be in place and whether a Privacy Impact Assessment had been carried out.
They said the Privacy Act and the new Biometric Processing Privacy Code contained rules around the collection, retention, sharing and security of personal information, including sending material overseas, however, other legislation could take precedence.
Saira Hussain, senior staff attorney at US digital civil rights group Electronic Frontier Foundation, said there had been a marked change under the Trump administration about how much and what type of data agencies were collecting at the border on “threadbare justifications”.
There was a “let’s grab everything first and ask questions later approach, which is really, really concerning about how that information may end up being used, where it’s being stored, the retention period”, she said.
It increased the possibility of information being breached, shared with other governments or used for unintended purposes, Hussain said.
She was “exceedingly concerned” about what information was changing hands, how US officials would be able to query databases, for how long, and if it was restricted to people who were travelling to the US, “which in and of itself is a very large ask, but the fact that it may be open to others beyond those travelling is seriously alarming”.
Auckland University law professor Gehan Gunasekara questioned how the information would be used.
“If it’s retained for border protection and visa status, that’s fine, but if it’s been shared for other ulterior purposes, maybe with ICE so that they can go after relatives of the people that are traveling or ... to build up profiles of people who have relatives in the United States who may be then imperiled that’s where we need to get safeguards,” he said.
While he would like to see more scrutiny of the agreement, New Zealand was not in a strong position to assert itself in negotiations.
“Unfortunately, that’s the reality when you’re dealing with powerful government agencies, especially foreign ones,” Gunasekara said.
“It’s only the very large, powerful trading blocs like the European Union that are in a position to negotiate some kinds of safeguards and we know there’s been perennial conflict between the United States and the European Union when it comes to personal data.”
New Zealand’s intelligence agencies had oversight in the form of the Inspector General of Intelligence and Security, Gunasekara said, referencing a highly critical 2018 report that criticised the agencies over a lack of transparency and possible breaches in the way information was collected.
“At that point, safeguards were adopted, and some checks put on that in terms of the intelligence agencies,” he said.
“So if the intelligence agencies can be made to have certain kinds of checks put in those kinds of situations, then one would expect other government agencies to be even more robust in the controls and checks they have – but it seems either that’s not happening or we haven’t been told what those safeguards are.”
The UK has neither confirmed nor denied finalising a deal, but in 2022 US Department of Homeland Security representatives told the European Union home affairs committee three EU member states and the UK had signed on.
Israel signed an agreement in March 2022, entering the programme in 2023.
A DHS press release touted the signing of an agreement with Bahrain in late 2025, which it said would allow for “the automated exchange of biometric data”
In December, the European Union formally approved negotiations for an overall framework, which allowed member states to negotiate their own agreements beneath the overarching framework.
Australia has not publicly announced negotiations, but has not denied them when asked.
Late last year, the Trump administration announced plans to require visitors from visa waiver countries to disclose five years of social media history, email addresses from the past decade, five years of phone numbers, personal details of family members, face, fingerprint, DNA, iris and other data when using the Electronic System for Travel Authorization process – an automated system visa-waiver members use instead of applying for a visa.
- RNZ