Privacy Commissioner better placed to consider behavioural biometrics complaint

Categories:

Service channel, Bank decisions,

Summary:

In November 2025, Ryan complained that his bank said he had to accept behavioural biometric monitoring if he wanted to keep using online banking, which he considered unfair. He said this amounted to excessive data collection and that the alternative banking channels to online banking were not equivalent.

Published:

April 2026

Our investigation

Our terms of reference, or rules, require us to not consider a complaint if another body is better placed to do so. Questions about privacy obligations, including whether data collection is proportionate, transparent or compliant with privacy laws, sit with the Office of the Privacy Commissioner, and we thus found it to be the more appropriate authority to consider Ryan’s data collection complaint.

The Code of Banking Practice requires all banks to keep the ways customers bank secure, and having fraud-detection systems in place is a recognised part of fulfilling that obligation. The bank’s implementation of fraud-detection technology to protect its customers from fraud was not unfair or unreasonable, provided it complies with its obligations under the Privacy Act.