A data specialist is questioning where his sensitive personal data has ended up after he applied for a government job.
The company that ran a criminal history check on him says on its website it is connected to government databases, uses facial recognition technology, stores the personal data in Australia and can share it with recipients in the United States.
When Dr Karaitiana Taiuru applied for a position in a government agency recently, he said he was asked by the recruitment consultant to submit a selfie from his phone, and also snap his passport or driver licence photo.
He did not think much about it - until later.
"Just my own professional background and curiosity made me suspect there was some sort of AI process going on," he said.
"Then I became aware it was either facial recognition or some sort of AI ... and that the data wasn't being stored in New Zealand, nor was it being stored by the Ministry of Justice, but by an international company."
The US-owned and Australia-based National Crime Check runs criminal history checks on or for thousands of New Zealanders each year, and the same in Australia.
It is one of more than 3000 entities registered to request the checks on behalf of others, through a system run by the Justice Ministry.
Each signs a ministry contract to follow New Zealand privacy laws and other rules, in what is a largely self-regulated system.
Taiuru questioned how the system was running.
"My initial thought was, 'it's the Ministry of Justice, knowing the controversy with facial recognition, the issues with Māori data sovereignty'.
"To start with, I just assumed it was stored in New Zealand and I would have privacy."
He had to get the application done quickly, so carried on, he said.
National Crime Check's website says applicants have to send in a selfie of them holding up their ID.
This is for its "cutting-edge verification tool that will perform a biometric facial recognition analysis by comparing your face/selfie with the picture shown on your driver's licence and/or passport".
Data security was its top priority, it said.
"Our systems are connected to the New Zealand Government databases, so you can quickly obtain accredited criminal record, visa and right to work checks," its website said.
In response to an RNZ query, the Ministry of Justice said it "did not know they had made that claim".
"Being a registered third party does not provide a direct connection with Ministry's systems," acting group manager of national service delivery, Tracey Baguley, said in a statement.
Rather, it allowed the use to submit up to 200 check requests at a time.
"If an incorrect statement being advertised by a registered third party is brought to our attention, we may take action to ensure that it is corrected.
"In this case, the Ministry will follow up with National Crime Check," she said.
RNZ asked National Crime Check about this.
The company declined an interview.
In a statement it said: "No one actually has access to the Ministry of Justice system".
It had authority to submit criminal checks on behalf of individuals via the Ministry of Justice system, it said.
It also offers identity verification services, its website said.
The ministry is in charge of compliance but said it did not monitor what organisations say about their services.
Organisations assess themselves for compliance once a year.
While the criminal history check system did require a valid form of photo identification, the ministry said it did not use facial recognition and that it could not comment on any registered third party that does.
National Crime Check told RNZ it uses something called "liveness detection" to check the person in the selfie is a real person, and that they are the person on the passport or driver's licence.
Its online privacy policy said the company may store biometric data.
"As at the date of this privacy policy, any personal information we possess about you will only be stored in Australia," it said.
However, it also added the data may also be shared, disclosed or processed elsewhere such as in the US for certain purposes.
Having already shared his details and selfie via the ministry's official system, Karaitiana Taiuru is not happy.
"I find it very disturbing," he said.
"All of our government departments have an obligation to ensure our privacy to protect their data.
"And this almost seems as though by not having any knowledge, they can't have any liability for what's happening to our data. And I certainly expect a lot more from our government agencies."
National Crime Check's parent company in the US, Sterling Check, says it conducts more than 95 million background checks a year, most are completed in just one day.
In a statement on Tuesday, Sterling Check said it and its companies took data privacy and compliance very seriously.
"We do not sell to third parties any information collected from their clients, prospects, sources, workers and or website visitors," the statement said.
"Any information collected is used to market and sell their services, operate our business and to provide background screening and identity services."
It has just been certified in the UK to provide digital identity checks on British and Irish citizens, including criminal background screening for employment.
The British government says it "is working to develop the digital identity market without the need for national identity cards".
New Zealand is doing a lot of work on a digital identity framework and implementation, with new laws and technology imminent.
RNZ
