Digital Identity Services Trust Framework Bill

Members, when we last considered this bill, we had completed call number two. We are now on call number three.

Thank you, Mr Speaker. I’m delighted to take a call on this bill, and I know other members are also very keen—which is great—to take calls on the Digital Identity Services Trust Framework Bill.

The bill is now in its second reading. As the chair of the Economic Development, Science and Innovation Committee, I’d like to acknowledge all of those who made submissions on this bill. I’d like to acknowledge the committee members, many of whom are in the House tonight, for their work on this bill. I’d like to acknowledge all of the officials and the staff in the parliamentary precinct who worked through 4,500 written submissions—so quite a lot of interest in this bill.

But to me, the most interesting aspect was that we received, like I said, 4,500 submissions. But an overwhelming majority—4,049—were received in the last two days. I attribute this to the influx of misinformation campaigns on social media that caused many submitters to believe that this bill was related to the COVID-19 vaccine passes, which it actually was not but it was about a new regime that would develop rules for the provision of safe, secure, and trusted digital identity services.

I’d like to acknowledge the Minister for bringing this bill to the House, and I know it had support of all parties in the first reading. I’m hopeful that that support will continue, because it is a really good, important piece of legislation in terms of people being safe online.

For the sake of time, I’ll leave my contribution there because I know others also want to contribute. A really important piece of legislation, as we become more online—you know, more digital—in the way we conduct our lives. I commend this bill to the House.

Thank you, Mr Speaker. What a pleasure to take a call on this important bill. And it is actually a very important bill because, as we should know, our identities, our digital identities, are becoming significantly more used in terms of just our normal access to Government agencies, to councils, to actually just part of banking and every other aspect of our lives. We as people tend to demand the best of services, and so many of those services now are provided through a digital network, it is important with the digital framework that people can have a real trust in it. And I note the comments of the member who’s just resumed his seat, Jamie Strange, from the Economic Development, Science and Innovation Committee, it’s really important that we understand that there are people who are very concerned about conspiracies. After some time in Parliament and many years as a lawyer, most conspiracies tend to end up being—and using a polite term—more like just mistakes. And what I would say to them is that this particular framework bill is nothing about getting more information on people, it’s actually focused on trying to make our information that we readily put on a digital medium safer for us, and to protect us from people who do want to misuse that information.

We had, when we were in Government, the RealMe system that was set up, and certainly it’s something that I use, and I think many people do. But it is probably something that, having been setup in 2018—technology is moving so fast—we need to be able to continuously keep up to date. This is not going to be the last bill on this sort of issue because technology is moving so fast. Certainly the advice that I’m hearing from people in the United Kingdom and Australia around things like open banking is going to mean that we are going to have to constantly keep this sort of technological advance at the forefront of our minds in Parliament.

This should not be a political issue; this is an issue that is actually about enabling New Zealanders to be safer on the internet. It should always be about understanding that, although politics tends to come into all things where resources are required and need to be used, this is not one of those areas, because this is like reading and writing. This is that basic now. Our children’s generation and the children after that, they will consider this the most basic thing that we should be putting in place.

So the National Party supports this bill. Obviously it will need to be amended at various stages, even after it’s enacted as a statue, but that will be for the future, as technology is changing. What we should never think is that a piece of law, but also a bill like this, is ever going to always be fit for purpose. It may be fit for purpose now; it may be fit for purpose the next few years. But we are going to end up having to revisit it, and we should do so, as a Parliament, with the sort of willingness that was shown on the select committee to actually work across and try and find the best answer for Kiwis. So I’m happy to support this bill and I commend it to the House.

Thank you, Mr Speaker. I also echo all of my colleagues who sit on the Economic Development, Science and Innovation Committee, one of the best select committees in Parliament. We work very collaboratively together, as the member who has just resumed her seat, the Hon Judith Collins, has spoken about.

Technology—we are really at the new frontier in terms of how we govern, how technology is used. I always talk about how technology is neutral, but it’s up to those people how we choose to use it and for what reason we use it, and then who uses it gives technology its definition in nature.

As the chair of the select committee has already mentioned, we received a large amount of submissions. However, I think the majority of them actually didn’t really submit in terms of relating to the real substance of this bill. I think this bill could have been one of the most misunderstood bills I have had the pleasure of dealing with in this House so far.

So I just wanted to put on record that this bill is about setting up a framework whereby the Government and the consequent board that was set up, the Trust Framework Board, will make sure that we have a set of criteria that we will judge a technology company or a place that issues a digital identity whereby the accreditations—if they meet those criteria we can accredit that person. Meaning that as a consumer, as a citizen here in New Zealand, you can trust websites, you can trust entities that have been accredited by this board with your personal information, with your own identity information.

So this bill is all about the safe governance of your own data of your digital identity online. On that note, I commend this bill to the House.

E te Māngai, tēnā koe. Tēnā koutou e te Whare. I’ll stand and begin my contribution late this Tuesday evening by reflecting on the comments of one Hon Judith Collins, when her statements were around how this will not be the last, kind of, piece of legislation that deals with the internet and identity and the challenges that we begin to unpack by grappling with this issue.

And on that, I’d just reflect, while we’re talking about great select committees, that the great select committee of the Finance and Expenditure Committee has been looking into a briefing that the Greens instigated on scams, particularly in the space of online scams. We’ve been learning a lot about the differences between authorised and non-authorised, about the kind of relationships that, obviously, people can formulate through these technological means, particularly in the context of the likes of a global pandemic where our relationships become all the more strained and people become all the more isolated.

Obviously, coming back to the substance of the legislation, this Digital Identity Services Trust Framework Bill, as Naisi Chen alluded to, there were nearly 4,500 submissions made to the select committee. However, a vast majority of those, I understand around 4,000 of them arrived in the final two days and were assessed as being in response to some of the—I believe it wouldn’t be inappropriate to call—misinformation campaigns. The bill closed for submissions the night before the red traffic light framework came into effect.

However, among those submissions there were a number of deeply substantive ones. However, obviously many did not necessarily relate to or misunderstood the content of the bill. So in response to those submissions, the select committee has added a new clause clarifying the Crown’s responsibility to give effect to the principles of Te Tiriti and explicitly outlining where, throughout the legislation. Of course, I’d note here on the record, as the Greens always do, that we believe that you should give effect to Te Tiriti, not just to those watered down principles.

The select committee has also included new provisions requiring that the trust framework board and its Māori advisory group set how and when they will consult with iwi and hapū, giving more specifics to the substance of the legislation there. They’ve renamed the “trust mark” the “accreditation mark”, and only allowed issue for services rather than for providers, for when an organisation offers multiple services, only some of which can end up being accredited. They’ve clarified that regulations must be made by Order in Council regarding setting rules for what can be accredited, such as the types of services and reporting requirements. This is, of course, just cleaning up what that process looks like. They have also ensured tikanga Māori as part of the complaints process from inception. It’s unique to design a system from inception that includes these things, and removing some of the complexity and processes for individuals in making complaints, which, of course, is critically important in streamlining that process.

They have increased transparency via removal of a secrecy clause, and increased accountability of providers by removing immunity from proceedings under the Privacy Act. They’ve also expanded the existing two-year review clause to require consideration of privacy and security outcomes and Māori engagement.

Now, reflecting on the earlier comments of the Hon Judith Collins, and to the effect of how this stuff will be used in practice, only time really will tell. We’re starting to see that with some of the other legislation that we have in place around, for example, the digital and harmful communications legislation. And here I’d just give a shout out to Councillor Sara Templeton down in Christchurch who, obviously, used that process and that relatively new and relatively untested piece of law to unmask those who had been harassing and bullying her online.

The department, in their recommendations to the select committee, pay particular attention to the submissions of the Data Iwi Leaders Group; many of their proposals, obviously, regarded strengthening recognition of Te Tiriti within the bill and Māori engagement. However, some of the proposals that were made by submitters that would have been supported by the Greens were unfortunately not implemented. So here I will foreshadow some of the things that we’ll be putting forward at the committee as a whole House. But here are some of those changes, firstly, that key submitters put forward which were not progressed but reflected on by the select committee, and in their report. Both Internet New Zealand and the Council of Civil Liberties suggested that the TFB or the trust framework board and the authority should be established as an independent Crown entity rather than run within the Department of Internal Affairs. They were contending that there is an inherent conflict of interest in Government agencies both administering and in regulating digital identity services, such as such as the infamous RealMe—for anybody who has ever gone through the process of getting a student allowance.

Internet New Zealand and the Council of Civil Liberties also suggested that the failure of the TFB or the trust framework board be required to consult with or appoint a member with expertise on accessibility for disabled people. Here I’d also shout out to another piece of associated legislation that is, of course, the Election Access Fund Act coming into effect, which members of the public can submit on and make sure it’s shaped up as best as possible so that we get a more diverse Parliament in the next election.

Internet New Zealand also suggested a longer list of required entities for consultation on rules, including the likes of the Human Rights Commission. The PSA similarly suggested workers’ representatives be consulted. Internet New Zealand also suggested limitation of non-accredited activity, a five-year transition period, which amounts to the full regulation of the sector rather than a more watered down opt-in approach to accreditation the department is taking initially.

Some of the submitters were also concerned that the bill does not prescribe security requirements, such as information access restrictions and data storage locations in the primary legislation. That, of course, relates to the point that I was making before about Order in Council and leaving these things to regulations and rules can, of course, mean that it is not afforded the adequate parliamentary scrutiny. However, the department rebuts that this allows flexibility for changing technologies, and, of course, as many in this House who’ve been around for a while would note, that it often has trouble grappling, particularly at pace, with developing technologies. I’d allude to an earlier transport select committee where Uber had to be explained to members of the committee.

Many submitters, including Internet New Zealand, suggested broader consultation with the public be undertaken on the bill. Again, in principle, this is something that the Greens would support. But the point remains that the underlying intention of this legislation to regulate the increasing prevalence of digital identity services here in Aotearoa, and providing a secure framework to do so that is trustworthy and accountable, is important and a policy principle that the Green Party wholeheartedly supports. We also wholeheartedly support those improvements that have been made throughout that select committee process on notably stronger mechanisms for Māori engagement through the process of designing rules.

I said that I would make points about those Supplementary Order Papers (SOPs) that will be coming everybody’s way in the committee of the whole House, although I can see that my colleague across there—Tāmati Coffey—is looking ready and raring to go in his contribution, so I hope that they will be substantive, Mr Coffey. But those SOPs—feel free. Feel free to reflect on them in your speech if we’d like to all take a moment and reflect on the pace of the House, the fastest lawmakers in the West here. Those SOPs—and I’d invite members who will speak after me to indicate, maybe, whether they’d contemplate them within their caucuses and maybe support them—are threefold.

The first is to include rainbow issues expertise on the trust framework board—surely something that Mr Coffey and other members of the rainbow Labour caucus could agree with. The second is to include accessibility for disabled people expertise on that trust framework board. And the third is to include a requirement to consider whether the trust framework board authority should be an independent Crown entity as part of the existing two-year review of the legislation. So just to clarify on that final point, it’s not about prescribing that that is the format that it should take. But per the submissions that I have alluded to throughout my contribution in this debate tonight, of course, this is about reflecting at that two-year mark—they’ve already baked into the legislation review—whether the format is appropriate to sit within the Department of Internal Affairs or whether it should be an independent Crown entity as, of course, was recommended by both Internet New Zealand and the Council for Civil Liberties.

So with that, the Greens are proud to see this progressing, but, of course, we’d like to see all the more improvements as is obviously the job of this place. And I hope to see other members of Parliament making points about exactly these things in their contributions to come.

I didn’t want to interrupt the member, but just regarding mentioning Supplementary Order Papers still to be debated that have not yet been seen, the strict rule around mentioning them in second readings is that you can mention them in passing, but they are not to be debated. So the invitation to other members to debate them, it’s not on the table. We’ll go to the next speaker—Dr James McDowall.

Thank you, Mr Speaker. It’s a pleasure to speak briefly on the Digital Identity Services Trust Framework Bill. As previous speakers have outlined, this is a new regulatory framework to establish the goalpost for a secure and trusted identity system, one that is interoperable and, most importantly, not mandatory, and hopefully it can improve services for those who choose to use it. The fact that this is opt in is incredibly important. Apart from the obvious issues around forcing companies and users to get on board, a mandatory regime would stifle innovation and seriously undermine innovation.

This legislation, this framework, is useful in a world where a much larger, much greater number of people are working remotely. Simple identity verification and other tools would be helpful in a lot of sectors, and especially in the legal sector—for instance, for when they are purchasing property, if you’re lucky enough to be able to do that, or verifying your identity in other ways, especially during lockdowns, although let’s just hope we’ve seen the back of those.

As others have noted, a lot of submissions came through, and I think a lot of concern has been aired on various social media platforms that this is some sort of quasi form of China’s social credit system, and I think these sorts of concerns have been absorbed into a range of implausible theories. Look, I’ve seen that system in person over in China, and I’m very certain that the Government here in New Zealand does not have the capability of running or creating such a scheme. If they could do that, they could probably manage KiwiBuild.

Compliance is one thing that has to be there, but it could cause issues with incentives or disincentives for companies and organisations to actually take part in the scheme. We’ve seen this in a lot of other sectors. I think one example is the anti-spam laws that we have in this country. You know, there’s pretty severe fines for breaking those rules, and how well has that enforcement actually been? I know that as a member of Parliament, we certainly get signed up to every newsletter on the planet, and technically that violates our anti-spam laws. So, who knows?

I think the way this has been set up—the three regulatory bodies, the governance board, the Māori advisory group, and accreditation authority—is a fairly sensible way and structure of going about it. I’m sure that in the committee stage, we will debate the Green Party’s Supplementary Order Papers. I think with the Māori advisory group, this is not a co-governance issue at all; this is actually a very good arrangement for ensuring that cultural awareness and engagement is integrated into the process in a way that is balanced and appropriate, and I think even just that attribute alone kind of counters this idea that this is some form of central control or some sort of secretive communist takeover.

So with that, we’re happy with the bill. Certainly, there’ll be some discussion, and I look forward to that in the committee stage. It’s a welcome development in our tech space, and I commend the bill to the House.

Thank you, Mr Speaker, and thank you for the opportunity to make a short contribution on a late Tuesday evening to the Digital Identity Services Trust Framework Bill. Now, as has been canvassed quite widely tonight, it is important that people absolutely trust the way that their identity and their identity data is handled. Providing people with greater control over that, over their identity data, will certainly help maintain and build on that trust as well. Currently, the digital identity environment in New Zealand is, as we have heard, largely unregulated, which really does expose people, and it also exposes businesses as well, to risks such as online fraud, and to privacy breaches as well.

Now, internationally, key trading partners like Australia and the United Kingdom are also modernising their digital identity services and their systems, and they’re taking a similar approach to what New Zealand is taking. So there’s international mutual recognition that our digital identity trust framework is a critical first step in full interoperability. As we all know, that sort of full interoperability, innovation, and collaboration on digital identity services is going to be difficult without clear and without really consistent and without a coordinated approach led by Government. Hence this bill.

Now, as a member of the coveted Economic Development, Science and Innovation Committee—so coveted, in fact, that I wasn’t actually a member at the time when the thousands of submissions were presented and heard, but I understand that many of them, as has been discussed, weren’t necessarily specifically relevant to this piece of legislation. Nevertheless, it does go to show that the general topic and the sphere of interest for many people is topical. I also understand that the select committee made several changes, including in response to concerns from Māori—a requirement has been to add and consult and invite some submissions from tikanga experts who have knowledge of Te Ao Māori approaches to identity.

And with that, and safe in that knowledge, I commend this bill to the House.

This is a split call. I call Harete Hipango.

Kia ora. Thank you, Mr Speaker. Look, I stand and speak on something that I know very little about, other than taking a keen interest this afternoon to read the report from the Economic Development, Science and Innovation Committee, and also some of the debate notes—actually, they were notes provided from the library, in terms of a debate pack. So following on from my colleague, Hon Judith Collins, who spoke first for the National Party to this bill this evening—Ms Collins is our spokesperson for research, science, innovation, and technology. I’m spokesperson for Māori development, so again, as I’ve done previously on many bills before the House and debates, I look at this through a Māori lens. So with the report that was provided by the select committee, and also looking at the bill itself, my eye has been drawn to the specific provisions in relation to the Treaty of Waitangi, Te Tiriti o Waitangi, and to the engagement, with a Māori context and perspective to this.

So the select committee report encapsulates ensuring that there is that inclusion, that inclusiveness, specifically at clause 8A of the bill. Again, of particular note is the commitment to the principles of the Treaty of Waitangi, or, as referenced within the select committee report, the Treaty of Waitangi/Te Tiriti o Waitangi. My legal eye will draw me to the legal principle of what’s known as contra proferentem. At clause 8 of the bill—clause 8A—there’s the juxtaposition in terms of the reference. It’s been referred to as Tiriti o Waitangi/Treaty of Waitangi. So for those who have a knowledge of what that principle or rule of contra proferentem is—and I’m going to bring up my phone, which is going to digitally recognise my face as recognition for me to be able to access to it. And I’m of a generation that this is all quite alien and something that I’ve yet to learn about.

So coming to learning about, for the benefit of members in this House this evening and members in the public, the contra proferentem rule—it’s a rule of contractual interpretation which provides that where a clause is ambiguous, then the preferred meaning should be the one that works against the interest of the party who drafted the clause. So I raise it as an issue because I’ve noted and detected with different pieces of proposed legislation, bills that have been brought before the House, there is an inconsistency in terms of the incorporation of reference to the Treaty of Waitangi or the principles of it. And the contra proferentem rule, from a legal perspective, gives priority to that party who didn’t draft the legislation or the contract or the agreement.

So turning to the Treaty of Waitangi, this legislation is making reference and giving priority to the interpretation of the Treaty of Waitangi and the meaning of that. Now, members of the public and members of this House may not be cognisant of that, but in terms of consistency of how this is applied within legislation or the bill, which will in time be legislation, that’s something that I think this House and members of the public should have their attention drawn to.

On that note, too, in looking at the material that had been sourced from the library, I note that the submitters—and I looked at the 4,000 submitters, and I looked through to see if there’d been any particular submissions made by Te Mana Rauranga, which is the Māori Data Sovereignty Network. It may have been; I’m not sure that it was, but I’m picking up on the comment from my colleague, Ms Collins, that this bill in its current form has been designed and has been scrutinised so that it’s fit for purpose at this particular time. Māori data sovereignty is a keen issue that will draw the eye of those who are there to ensure the protection of Māori data and the sovereignty, and the collection, the protection, the utilisation of it. So it may be that, in time, this bill, although it’s fit for purpose at this time, will need to be redesigned to incorporate the fact that the particular interests and issues of Māori data sovereignty have not been properly encapsulated within this bill. On that note, the National Party commends this bill to the House.

Thank you, Mr Speaker. We are living in a fast-paced world—te ao hurihuri. The world is turning and it needs us to catch up, and making sure that we’ve got a trusted digital services framework is incredibly important. Coming here for the second reading of this bill means that we’re another step closer towards making that happen. I congratulate the Economic Development, Science and Innovation Committee for going through the process of listening to the concerns of the people.

I also note that the work that’s been done to reflect Te Ao Māori perspectives in a digital identity system is actually crucial. We need to make sure that Māori have participation in that. We need to make sure that that’s reflected in our Treaty partnership, and, to give effect to that, the bill is going to establish a Māori advisory group with specialist information about Māori interests and knowledge. The board has applied to seek the advice of the group on matters of tikanga Māori and Māori cultural perspectives, and the board must also give effect to the group’s advice to the extent that it considers reasonable and practicable after taking into account other relevant considerations.

The work that’s being done here isn’t something that’s going to be forced on all New Zealanders. I know that that was a concern of some of the submitters during the process. This is something that is going to be quite straightforward for those people who choose to enter into it.

I think it bodes well for the future of digital identity services, and it will enable us to catch up to where other places around the rest of the world are currently heading. So I commend it to the House.

Kia ora, Mr Speaker. Back in 2019, research was carried out that found that 79 percent of New Zealanders did not feel in control of their personal information. They were concerned about their personal data and how organisations might use it. In this piece of research, they found that nine out of 10 people stated that the idea of being more in control of their digital identity was something that was really desirable. This is what this piece of legislation is about. It’s around ensuring that people have control of their online data; in this ever changing, ever moving world, where things are constantly happening, that they are in control. And so, being a member of this select committee—hearing submissions, hearing some challenging submissions, looking forward to one day being back on that select committee—the Digital Identity Services Trust Framework Bill I commend to the House.

Thank you very much, Mr Speaker. As others have done, I commend the bill to the House. Others have made comments about the nature of the bill, also commented on the process. I haven’t been part of that august body that is the EDSI committee, as it’s popularly known—and I do mean popularly—the Economic Development, Science and Innovation Committee. I started that acronym expansion not knowing how it would end up, but I think we got there in the end. That was dangerous stuff! The heart is racing!

So there has been a lot of interest in the bill. And as others have noted—and, indeed, it’s noted in the report itself—there was a lot of interest at very much the last minute—literally the eleventh hour, actually—with some huge number of submissions. I think I read some 3,600 between the period of 8 p.m. and midnight on the final night alone—so a huge amount of interest. And as a local MP, I was contacted by more than one constituent asking for National’s position, asking if I was aware of certain provisions and their effects. I will say that, of course, whenever a constituent contacts an MP—well, I would hope that that MP would take that very seriously, make sure to understand the bill and its effects and its meaning, and to be able to either share the outrage of the constituent and undertake to do something about it, or perhaps, as was the case in this instance, to be able to gently assure the constituent or constituents that, in fact, the meaning and effect of the bill was not as they’d been led to believe.

Others have referred to misinformation. Perhaps more kindly I think we might say that there was a degree of misunderstanding around what the bill was intending to do and is intending to do. Others have noted the purported connection between this bill and the COVID vaccine regime. It seems to me clear—and I’ve done my diligent best to understand and check—that there is no connection really in that regard. So, fair enough, of course, to raise that, but I think we’re in a position as a House to say that we shouldn’t attribute to malice that which can be explained in another way—and I paraphrase a famous saying there. And I do it respectfully, but I think the genuine misunderstandings that have been allowed to come up around this bill are something that we should take seriously, and take the opportunity as a House to reflect on and to place on the record our view and understanding of exactly what it actually does.

So others have done that pretty well—or very well, actually, I should say—and I don’t intend to rehearse the points that they’ve made. The Hon Judith Collins made the point I think very astutely that it will be changed in the future. It will need to be adapted, it will need to be amended. That’s common enough with Acts of Parliament. The law changes; practice changes. And of course the reason in this case we can say with confidence that there will be change is because the technology that underlies the legislation itself will change.

I don’t need to take much more of the time of the House, I think. We’re getting perilously close to the end of the evening’s entertainment. And I use the phrase “entertainment” rather loosely, of course, but others can be the judge of that. Anyway, the key point really is that at its heart this is a framework bill—the clue’s in the title. I think I’m right in saying that my colleague and friend Melissa Lee made this point in her own contribution: it’s a framework, it’s a foundation, it allows rules to be set under the primary legislation that this serves. And the way that that happens is a series of rules or regulations—and I use that phrase deliberately. The Regulations Review Committee—speaking of august bodies—wrote to the EDSI committee and made the point that rules could be made either by Order in Council or by the Minister. And the report does a pretty good job, I think, of explaining the distinction being based on the content of the rules. So that’s, I think, enough from me—quite enough from me, indeed. So with that I leave my contribution, except only to say that on this side of the House, we’ve made it tolerably clear we do continue to support the bill.

Thank you, Mr Speaker. It’s a pleasure to rise and take the final call on the Digital Identity Services Trust Framework Bill, following on from Mr Penk. The night is nigh, and so perhaps this will be the final contribution before the House is able to rise.

But I want to thank members of the Economic Development, Science and Innovation Committee. There is often, I think, quite a competitive nature in the House when it comes to references to select committees and wanting to be on particular ones. But when I read through the report from the select committee, what that one has identified is a number of changes that obviously came to light as a result of listening to the community submissions and identifying those.

I have to reflect that Harete Hipango referred to the contra proferentem rule, and I remember that, actually, from when I was teaching year 10 in a school when it concerned Te Tiriti. So it was a nice reminder to be reminded of that rule and what it means in terms of falling in favour of those, particularly in treaties, where it is constructed not perhaps in their favour.

Many colleagues have said this evening that digital identity is one of the most important things that is, I guess, significant in any state; in any opportunity. So this bill delivers on that, and I commend it to the House.

Motion agreed to.

Bill read a second time.

Members, the House stands adjourned until tomorrow at 2 p.m. Pō Mārie.

The House adjourned at 9.58 p.m.