Identity Information Confirmation Bill

I move, That the Identity Information Confirmation Bill be now read a first time. At the appropriate time I intend to move that the bill be referred to the Government Administration Committee.

The Identity Information Confirmation Bill makes the data validation service available not only to the public sector but also, importantly, to the private sector. The service is a new tool in the fight against identity fraud. In particular, the service will combat the creation of fictitious identities, as well as tombstone fraud and name-change fraud. The service is a web-based system run by the Department of Internal Affairs. It allows agencies to check whether the identity information presented to them is consistent with that held by the department. There are three sources of information the service can check: the citizenship registers, the passports database, and the various registers of the Births, Deaths and Marriages registry office.

Let me give an example to show how the service will work. Let us pick a name. Lindsay is a new customer for a bank, and the bank needs to be certain of who he is. The bank will ask for his details and whether he will consent to having a confirmation check made on those details. If Lindsay consents to that check, the bank employee will enter his information into the service website, and the service will respond that his information is consistent with the department’s database. The bank will then know that he is not using a fictitious identity; that knowledge, together with other processes the bank considers necessary, will give the bank confidence that the person being dealt with is actually Lindsay. Alternatively, the service could return a message that the information that he provided is not consistent with the department’s databases. It could be that Lindsay has adopted a different surname through marriage from that on his birth record, or it could be that someone is trying to conduct identity fraud using his name. The service can also provide an exception message in response to a search when a death or name change has been recorded against Lindsay’s birth record. The only other information that may be provided, for which there can be an exception message relates to the validity of the identity documents. For instance, when a passport presented by a customer has been reported as stolen, all of these exception results target specific identity fraud methods, and provide agencies using the service with an alert to a risk of fraud.

I would now like to take just a couple of moments to talk about the substance of the Identity Information Confirmation Bill. The bill will make the service available to the private sector and more widely available within the public sector. Organisations that wish to use the service will have to demonstrate a genuine need to use it. They will also have to demonstrate that they have appropriate security and privacy procedures in place.

Under the bill, organisations will need to seek the consent of the individual concerned before checking information. The bill provides that the agency must maintain another process for dealing with a person who does not consent to the check being made. This is to prevent people from being forced to consent through the withholding of access to a product or service. It also ensures that a person retains control over what happens with his or her information, and is aware of how his or her information is being used.

The bill establishes that organisations using the service will have to enter into an agreement with the appropriate statutory officer from the Department of Internal Affairs. The bill provides for the creation of a generic agreement so that its terms and conditions can be used as a template for agreements between the department and multiple organisations. The Privacy Commissioner will be consulted on the development of any generic agreement, as well as any agreement between the department and an agency using the service that does not use that template. Furthermore, the Privacy Commissioner will also be able to order regular reviews of the agreements as she thinks necessary.

The bill also protects privacy in a number of other ways. The Privacy Commissioner will have the power to require the department to provide reports to her on the operation of the service, such as statistics on how many people present information that is inconsistent with the records of the department. I have already mentioned that the organisations that want to use this service will need to show that they have a genuine need for the service, and have appropriate security and privacy practices. The organisations that enter into agreements to use the service will also be listed on the department’s website.

Finally, I want to give the House another example of where data validation would have been useful to fight identity fraud and save the taxpayer money. I refer to September 2006 when the Government was alerted by Kiwibank to some suspicious activity that was occurring across a number of bank accounts that were receiving deposits for the pension. On investigation it became apparent that the Government was giving $56,000 each fortnight to 123 false identities that had been created by Mr Wayne Patterson. Mr Wayne Patterson operated by creating false birth certificates. He took these certificates into various Work and Income offices throughout the country, and his operation was solely reliant on the fact that there were, at that time, no routine checks to ensure that these birth certificates had real information on them. Mr Patterson is now part-way through an 8-year prison sentence. Overall, the Government was defrauded of $3.4 million by Mr Patterson’s scheme. However, it is likely that Mr Patterson would never have received a single cent from the Government by these fraudulent means if this service had been available and had been used by Work and Income, banks, and other organisations.

Debate interrupted.

The House adjourned at 10 p.m.