Digital Identity Services Trust Framework Bill

I present a legislative statement on the Digital Identity Services Trust Framework Bill.

ASSISTANT SPEAKER (Hon Jacqui Dean): That legislative statement is published under the authority of the House and can be found on the Parliament website.

I move, That the Digital Identity Services Trust Framework Bill be now read a first time. I nominate the Economic Development, Science and Innovation Committee to consider the bill.

As we move into an increasingly digital world, it’s important that Kiwis are able to prove who they are in a trusted, safe, consistent, and digital manner. We know that Kiwis find themselves more and more online, and sometimes there are challenges in proving who they are. We know that some folks don’t trust current systems; others are not sure how to use them. And sometimes the systems to operate digitally just do not yet exist, and people are required to turn up to prove their identity, in person, with physical copies of documents.

Digital identity services give people the ability to easily share trusted information about themselves so that they can access the services that they need. They basically give people more control over their own data: who they share it with, and what they choose to share about themselves. We’re talking, essentially, about critical infrastructure for the 21st century: the provision of secure, people-centred, interoperable digital services, such as social protection, healthcare, and finance. Digital identity has the potential, then, to deliver significant benefits to both the economy and to society, in both the public and private sectors.

We’ve seen this emphasized through the COVID-19 pandemic, when remote access to important services became critical. I think of things like the wage subsidy. For many New Zealanders, they learnt, they worked, and they were educated online. By modernising our approach to digital identity, we can build resilience in our system and set people up to be able to prove their identities online and share information online in a trusted way for future situations, no matter what they might be.

This framework set-up enabled by this bill creates a consistent, secure, and trusted approach to delivering digital identity services. One way of thinking about it, really, is as a set of agreed rules that accord with best practice, and if a provider wants to become accredited, they have to meet those standards to become an accredited provider of digital identity services under the framework. So those requirements that they’ll have to meet will be set out in rules and regulations, and the focus of those rules and regulations will be on privacy, confidentiality, security risk, information and data management, and the sharing and facilitation factors associated with it. To ensure that the rules reflect best practice, a governance board will be set up to oversee the administration of those rules and also to consult with the right stakeholders when any changes need to be made to those rules. That includes stakeholders like the Privacy Commissioner or others who have already been accredited as trust framework providers.

In the contemporary era, we also need to make sure that the digital identity system for our country takes account of and reflects Te Ao Māori perspectives and approaches to identity. To that end, the bill establishes a Māori advisory group to advise the board on Māori interests and knowledge. This is recognition that we want to have a partnership arrangement with Māori and to uphold Te Tiriti—the Treaty—in these arrangements. So the board is required to seek the advice of the Māori advisory group that will be set up on matters of tikanga Māori and Māori cultural perspectives, and it will also have to consult more widely with people or groups that have expertise in Te Ao Māori approaches to identity, so that they are considered in the ongoing development of the trust framework.

To guarantee enforcement and to protect the security and privacy of trust framework users, the bill also establishes a trust framework authority. Now, that authority will be responsible for reviewing accreditation applications, but also for conducting investigations into potential rule breaches. And, indeed, if it finds a rule has been breached, it will have the power to issue a public warning or to suspend or cancel the accreditation of someone who has already been accredited or an organisation that’s already been accredited to the trust framework.

The bill does also complement, I have to say, other work that I have under way in terms of a consumer data right, which will also give people more control over their own data and the way it’s shared and used. These two things will work hand in hand, and I expect to have more to say on that later this year. But you can think of use cases like banking and banking data being shared with third party applications. That’s one possible application of a consumer data right.

Through this legislation, though, we’re also supporting efforts to reduce harm to New Zealanders that are posed by cyber-threats. We know that malicious activity online is becoming more and more prevalent, so it will be important that digital identity services have sound, consistent security systems based on best practice, and that will be reflected in the accreditation standards that are to be met. It’s particularly important to note that because we are in Cyber Smart Week, this week—and I draw members of the House’s attention to that important week of the year, where we’re reminded to keep our cyber-hygiene up to date and to look at the advice that the Computer Emergency Response Team (CERT) provides for all members of the public and, of course, members of this House to follow to ensure that they are engaging in good cyber-hygiene practices. But I digress.

What we’re proposing here is a giant leap forward for the digital economy as a whole. It will enable things like the sharing of health information, providing proof of qualifications, making induction processes in workplaces, onboarding for new jobs, much easier. There are a range of use cases which will likely be enabled by the use of this trust framework. The digital identity sector is ready and willing to provide these services, but what we’ve heard is that for interoperability, innovation, and collaboration to work best, it’s important to have a clear, consistent, and coordinated approach. And that is what this trust framework achieves.

Part of what we’ll see as a result, of course, is a better user experience. There’ll be less need for physical documents for customers of institutions who are accredited to the framework. Customers will be able to be surer that their personal data is being handled safely, that shared information is in safe hands. Those things will be a real benefit to consumers.

It’s also a fact that not all sectors will be able to pick up the benefits of this framework immediately; they are moving at different paces. And so that’s why the bill makes accreditation to the trust framework an opt-in matter from the start. That ensures that providers can still deliver products to market while they work towards becoming accredited.

There is a wider benefit to this framework. It’s estimated that around $1.5 billion worth of value might be added to the economy just through the increased security that this framework would provide. That is without counting the potential productivity improvements that may result from using online tools that are associated with identity. Now, that $1.5 billion figure for improved security through avoided losses is a conservative estimate, so it may well be worth more than that to our economy. So I hope all members of the House recognise that both social and economic benefits accrue to the use of such a framework. This bill will help realise those benefits.

As I work to close, I want to also acknowledge that this digital trust framework bill brings about mutual recognition with the Australian Trusted Digital Identity Framework. There’s an attempt to coordinate to make sure there’s interoperability there, and that was a pledge made—that there was an intention for this to happen—between our Prime Minister and the Australian Prime Minister in 2019 and 2020. Overall, it’s fantastic news for the future of trade between our nations, that interoperability.

Finally, I want to stress that this bill is one part of a wider digital strategy for Aotearoa that’s being developed by this Government. It’s a crucial pillar, though, because it helps support trust, which is very important to that strategy. Kiwis can trust that such a framework will facilitate safe and secure handling of their personal data online. Many benefits accrue to that. I commend this bill to the House.

Members, the House is suspended, and I will resume the Chair at 9 a.m. tomorrow for the extended sitting.

Debate interrupted.

Sitting suspended from 9.58 p.m. to 9 a.m. (Wednesday)