Digital Identity Services Trust Framework Bill

Fakaalofa lahi atu. Mōrena mai tātou. The House is resumed for the extended sitting. Members, when we concluded business last night, the Minister for the Digital Economy and Communications had moved the first reading motion and just finished his speech on the Digital Identity Services Trust Framework Bill. Therefore, the question is that the motion be agreed to.

Thank you, Mr Speaker. It’s a pleasure to be speaking at 9 o’clock in the morning on the financial sector digital—I’ve got the wrong notes in front of me. That’s not a help. Mind you, I think I could still do a good job on that one as well. It is quite interesting that we are talking about digital identity, and it’s great; it’s very timely, I think. Certainly, on the Finance and Expenditure Committee we are doing an inquiry into cryptocurrency, so it actually fits very well with this. However, I do have one little issue, and it’s great to talk about this—and, Mr Speaker, you may have seen one of these. This Government’s talking about digital identity and when you get a vaccination you get this little bit of card that a 10-year-old could design on their home computer and print off. We really need to get our priorities right. This should have been dealt with months ago, right at the beginning, actually, with some sort of digital solution, but we didn’t have one. Instead, we get a bit of card, quite a flimsy bit of card. We’re going to talk about a passport at some point—well, we’ve got to get these things right and get our priorities right. We should have been doing that right at the beginning.

But this bill, the Digital Identity Services Trust Framework Bill, will actually make some significant difference for us. We absolutely have to take care of our digital identities. I was just having a chat before with the Hon Todd McClay and he said that actually the biggest risk that a lot of people face is all the information they put up quite willingly on social media platforms, and that comes back often to bite people later on in life. However, this bill won’t deal with that in particular. We need to have a good awareness of what it is that’s important in the digital space. If we’d like to use a motoring analogy, when cars first came out they didn’t have seat belts and they didn’t have airbags and all those sorts of things. Those things developed over time at a much slower pace. In the digital world, these things are happening at a much higher pace, and we simply are playing catch-up, and I think that’s always going to be the case. We’re playing catch-up to put good regulatory controls around the things that really matter, and this really matters—getting this right.

I was speaking yesterday to a constituent who is doing quite a bit of work in the blockchain space in terms of the authentication of digital material, and I think that’s also going to be a key part of all of this. But it was back in 2013, I believe, when RealMe came into existence—and I’m trying to think of the name of the bill that it came out under. That was a fantastic step forward but that’s now completely out of date, and I don’t think many of us actually use RealMe that much. I remember using it on two occasions, and I think it was quite an effort to use it at the time. It was quite clunky. So we do need to have those sorts of things. We all have our digital signature that our staff will use on the bottom of a newsletter or a letter that we write, and I’m sure the Minister doesn’t sign personally all of the letters that come out of his office and nor should he. But that is not exactly what we’re talking about here. What we’re talking about are transactions in the digital space and how we get security in that area.

I think the banking sector is going through that very issue at the moment, and they’ve got quite good processes in place. But there’s a heck of a lot that we can learn from cryptocurrency, actually. The individual market is ahead of central banks in this space by a long way, and I think that central banks are playing catch-up, trying to bring in their own digital currencies. But all the processes around that are being innovative, and that innovation has come from a market. And we have to be sure with all these legislative changes that we make that we allow for that innovation, which will come from competition. It certainly won’t come from a central bank. They are conservative by nature. They don’t take risks, and that’s good for us. We don’t want them to be out there taking risks that are significant.

It is quite a thing for us to spend all this time on these important areas, and the Minister talked quite a bit about it last night. I think it was actually a full 10 minutes that you took last night, Minister. I was quite looking forward to giving my speech before 10 o’clock last night, but he stole my thunder. I couldn’t get anywhere near it, but he was enjoying himself, and quite clearly it’s something that interests the Minister, and I think that’s a very positive sign for us all, because this can make a lot of people’s eyes glaze over. But it’s very important that we have somebody who knows the subject and who is going to drive it from behind. I know you’re going to do a lot of work in this space, Minister, and you’ll no doubt stay in close touch with the select committee as it works through the process because I think a lot of good evidence will come in from industry and interested parties that will help inform the forming of this bill. There is no doubt that with all the best intentions in the world, there’ll be something missing in the bill that can be improved by industry experience, and that’s what the whole select committee process is all about.

I guess you’ve got to really, as I said, get the balance right about innovation and the Government as a steward of this process. You did speak a little bit about that last night, Minister, and I’m sure you’ll have done quite a bit of work on it, but I think that’s something where we should have the main focus in our select committee roles, to see that we get that balance where it needs to be.

The leaking of personal information is, I think, where this issue comes to public attention the most. I think the Waikato DHB losing all of its digital records and being held to ransom is what the public hear about most often, and I think that’s where they see the most fear, other than losing their bank accounts. But those sorts of things have to be worked through as well as much as possible. I’m sure there’ll be strong buy-in from the sector and those companies. I am certain that the ministry will have spent some engaging with the sector in the drafting of this bill. I guess the basic principles of privacy and data protection are what are underpinning this, but whenever you have protections, of course, that also limits freedoms, and that’s something that I would like to explore more to make sure that freedoms aren’t in fact impinged on by this bill. I’m not sure how that would happen but it’s possible.

Actually, it was the Electronic Identity Verification Act 2012 that was the genesis for RealMe, which I think was introduced in 2013—I found my notes, which is quite helpful.

💬 Hon Member: With about a minute and 47 to go.

Well, yeah. That was quite a big moment in time and that was only eight years ago—only eight years ago—and it’s already outdated. It didn’t take me eight years to find my notes.

I go back to my starting point. Actually, the biggest risk people have in the digital space is what they put up there willingly, sharing information with not a thought to the future, and that’s mostly in the social media space. But it’s also with email platforms where people are exposing their private information to the possibility of a hacker in particular.

I don’t have a lot more to say on this. I’ve had my good turn on it. I congratulate Dr Clark on bringing this bill to Parliament. I think it is something that’s timely. It came out of, of course, the iterative process, right back to the Electronic Identity Verification Act in 2012. We need it, most certainly, but we also want it to work and not impinge on innovation from the private sector where we know all the best innovations do in fact come from. So with that, I commend the bill to the House.

Kia ora, Mr Speaker. Thank you to our previous speaker across the House, the member Stuart Smith, for that 10 minutes which did almost feel like eight years, actually. It was amazing—incredible. But here this evening—it’s still evening, isn’t it, wherever we are? I rise as a member of the Economic Development, Science and Innovation Committee, which is going to be taking this piece of legislation on, and I look forward to that, and I thank the Hon David Clark for bringing this up. As he mentioned last night, this is just one piece of our Government’s digital strategy which we are progressing with.

Now, I was listening to a podcast over the weekend, and it was around the iPhone. In 2007, I know some of us were a bit younger back then—but how quickly technology has changed, how quickly our digital footprint has changed in that time, when, once upon a time, in your bag, you had a laptop and a GPS and a camera and an iPod and some kind of mobile phone, and suddenly it was all in your pocket. We are now having to ensure that this piece of legislation, which is around our digital footprint and our identity and the framework that it brings, is fit for standard in 2021 and beyond.

This bill is about our digital identity services, giving people the ability to easily share trusted information about themselves to access the services that they need. This will also help with our consistencies, our trust, and the efficiencies of our digital identity services. It’s important work, and I look forward as a member of the select committee to hearing submissions from the public, and I commend this bill to the House.

Thank you. National supports this bill, as members know.

I reflected on what the member opposite has just said; it is amazing how far we’ve come. I remember in the late 1990s being very chuffed to have a Bosch—[Interruption]—it was a wee while ago—flip-top phone, and I lost it, actually, after a big night at the Loaded Hog, but that’s another story. Today, of course, we’re worlds away from that. I grew up—and I’m not that old, turned 45 a week or two ago—in an age where emails were a new thing, text messages were exciting, and now, of course, with virtual reality, alternative realities, artificial intelligence, the internet of things, it is a brave new world, as they say.

I think this bill is good. It establishes a framework, as I understand it. There’s detail in the bill about that—obviously it will need to be worked through at select committee—but it establishes a framework over digital, personal, and organisational information, and how it’s shared, it’s stored, and it’s used. In the end, that can only be a good thing if it’s done well. So the intention, I’m suggesting, is very good because it’ll provide certainty, efficiency, and a sense of trust, and even more than that, probably most importantly, a confidence if this bill hits the mark in its intent of creating that framework for digital personal information. So the intent’s good. We support that, and that’s why we support it at this stage. The how and the details will be worked through; that’s critically important.

What I think’s worth just noting though, is that that confidence and so on that comes from doing this well and providing that framework around digital personal information is hugely important because if it’s got right—and I’ll come to that actually. But if it’s got wrong, if we do that wrong, if New Zealanders, whether as individuals doing their personal banking, their tax, buying books or shoes or make up online—all of those things, and multiple other uses that New Zealanders will know about—don’t have trust and confidence in that, well, we’ve got a problem, and that is a really big deal. The undermining of the privacy and security of people’s settings would create a situation where we wouldn’t get the innovation, the creativity from the digital world and the digital economy that we want. I suppose at an extreme, if we don’t have confidence in those things in New Zealand, well, people will keep money under the bed. If people don’t have confidence, they won’t do their transactions and their interactions online, as I say, in terms of tax, purchases, trusts, and services—those sorts of things are simply not going to happen. New Zealand, at that level, wouldn’t be a part of it, and I know this is not where we’re at in New Zealand, but we wouldn’t be part of that modern global digital economy that is borderless, or should be, which is where we want to be.

So that’s, in a sense, the negative; the worry here if it’s not done well. But there is a positive. The positive, the potential, the opportunities for New Zealand if there is a great online world that New Zealanders both individually and as organisations and businesses have a trust and confidence in is limitless; it’s boundless. I’m really proud that National laid the groundwork for this in, I think, one of the most significant projects New Zealand’s had in decades, and that’s in the ultra-fast broadband (UFB) roll-out. All of this would be theoretical, talking about a framework for trust and confidence in digital settings, if we didn’t have that UFB. Of course, success has many parents—John Key, Steven Joyce, and Amy Adams, and I was the last communications Minister in that Government, and played a role in it as well, in its roll-out. It’s been revolutionary.

The future is digital—I think of New Zealand’s economy and the, as I say, boundless opportunities we have there if we have the platforms and the trust and confidence to get on and innovate and be creative. When I think of the primary sector, we obviously, I think, increasingly as a country, understand the importance to New Zealand of our farmers, our foresters, people in viticulture and horticulture, and many other areas. I think it’s a great irony, actually, of COVID that the Government has come around to farming at some level. I appreciate my colleagues laugh, but at a level we are actually more dependent on farming as a part of our economy than we’ve been for some time. Because on the other side of it we’ve got tourism, another prong, a huge, vital, exciting sector, but fundamentally in the doldrums at the moment for reasons that aren’t any Government’s fault at a level, although they could be doing much, much more to support it. Then there’s the digital, or what I would sometimes call the creative, economy, and that’s where this bill comes in to play.

I, for one, and, I know, my colleagues on this side of the House—and everyone in this House, actually—are aspirational, although the issue is how and why and getting on to it; we believe it is a hugely exciting area for New Zealand. When I was economic development Minister, it was amazing to see just the growth in—I was going to say little sectors. They’re not that little, like gaming. From $50 million, $60 million, $70 million, $80 million—and now, look, I don’t know—but by the end of the National-led Government it was a quarter-of-a-billion, $300 million sector, mainly, not entirely, but mainly here in Wellington. That is just one area where actually having trust and confidence in the platforms, in the frameworks, and personal privacy settings really matters. That’s but one example. Of course, there’s the movie sector, there’s multiple other areas where New Zealand has so much potential if we do the right things.

Of course we’ve got to get some parts of it right, and I’d argue this Government isn’t, in terms of encouraging and sometimes importing the required skilled workers that we need in that area, the capital, the tax, the regulatory settings. I was very disappointed to see under this Government Amazon’s The Lord of the Rings move off shore. I think we should’ve, personally, moved heaven and Earth to try and keep it, because it’s a multi-billion dollar deal, it has huge reputational advantages for the entire creative sector, not to mention the tourism sector in New Zealand. Set in the UK, by the way—they’re scoffing. It’s a crying shame.

My simple point of all that is this. In the end this bill isn’t the solve-all for all of that, but it’s a well-intentioned, good component of that massive digital creative sector and part of New Zealand’s way of life, fundamentally If the framework is done well it will enhance the trust and confidence New Zealanders have in that sector and the ability to keep on doing, and, in fact, grow our creativity and innovation. If it’s not there, well, as I say, at one extreme people, will keep their money under the bed.

We support the intent. There’s detail in this bill to be worked through, but I’m sure it will be, and it will help, albeit there are many other things, like I say, like skilled workers, tax settings, and the like to ensure that the third prong, in my view, of New Zealand’s economy, the digital and creative sector, goes from strength to strength to strength, and helps pay for our hospitals, our education systems, and so on to make this one of the greatest little countries in the world to live in.

Good morning, Mr Speaker. I stand to speak on this bill, and must say that as the digital environment goes from strength to strength in the world that we live in today, this bill will touch the lives of every single New Zealander, young and old, as we work through how we connect in and protect our information.

What I think is significant with this legislation is the framework where we will have a choice as a consumer, from what I’ve read, in being able to choose the information that we wish to share. The digital side of technology is going to change in light years. As we put those protections forward—and I was talking to the Minister earlier this morning around what this bill will actually practically mean, how every single one of us will be using the technology to ensure that our information is shared quickly and efficiently. It will save on paperwork. It’ll enable us to do a whole lot of things faster and smarter.

But we do have some work to do still in connecting every single New Zealander to the digital world. We have work to do around rural connectivity, and ensuring that all schools and people in various suburbs of New Zealand are able to connect in cost-effectively and efficiently, and keeping up with the speed of sharing that digital data. So I’m looking forward to seeing the discussion that comes through on this bill, as it’s going to be one that, as I said, will be important to every New Zealander as we live in this very advanced digital world. Thank you, Mr Speaker.

Tēnā koe e te Māngai o te Whare. One of the, I guess, advantages of lockdown and the fact that colleagues are in Auckland is that other MPs get to speak on legislation and have to come up to speed with legislation that they did not know a lot about, or anything about, half an hour ago. I appreciate that opportunity because it does expand one’s knowledge, so I’m pleased to take a short call on the Digital Identity Services Trust Framework Bill.

I think this bill will really highlight the importance, once again, of the select committee process—and the Green Party is supporting the bill to select committee—and the contribution that submitters will make, because in looking at the regulatory impact statement, I understand there has been an exposure draft of the bill, but because it is setting up a framework where people can trust the mechanisms by which they provide information about their identity, the contribution of businesses, individuals, Māori, and others to ensuring that this framework really does have the confidence of New Zealanders is really important. Digital identity is critical to our society. It enables both citizens and businesses to participate in the digital economy and to access Government services, but, as the regulatory impact statement points out, there are no consistently applied standards. In fact, it goes as far as saying—and I quote—“the digital identity ecosystem is characterised by incoherence, ad hoc regulation and lack of interoperability; and the way identity related information is shared is inefficient.”

I note the comments by Stuart Smith, and I would agree with him, about RealMe. That is set up as a Government service. I think it’s got about 750,000 people who verified their identity through it. It was a very good initiative at the time, but things have moved on since, and certainly my experience with it is that it is quite clunky. So this trust framework that the bill sets up, with a governance board to oversee that, is about enabling a much more consistent and secure digital identity environment for both people, businesses, and other organisations in Aotearoa and ensuring that those digital identity services are secure and that they are trusted.

One of the issues that the Green Party has with the bill—and it would benefit from submissions—is in terms of the way it incorporates Te Ao Māori approaches to identity. We acknowledge the Minister and the provisions in the bill which make sure that there is a Māori advisory organisation to the governance board ensuring that there is expertise in Māori identity in that whole Te Ao Māori perspective, because from the regulatory impact statement and the research that has been done, it’s very clear that there’s a much lower level of trust about the Government holding and sharing information amongst Māori than other sectors of the community, and the whole history of colonisation in New Zealand would make that not a surprise. There is also a major concern about misuse and abuse of information, so it’s really critical that this Te Ao Māori perspective shapes the way the trust framework develops and ensures that people can really have confidence in it through the work of the Māori advisory board. I note, I think, that there is a test in the legislation that the advice of the Māori advisory board has to be implemented unless it’s not reasonably practicable. So we know that there has been an effort there, but we would welcome submissions to just further develop and scope that out.

We note too that digital identity is potentially really important for our voting system. There has been provision made for online voting at local authority level for trials, but I don’t think any local authority took that up because of concerns about hacking and insecurity of information. So the work in this space may assist with that. With everything moving online—particularly for people—now, it seems a bit incongruous to go to a polling station or to fill out something that is on paper and send that back.

So this whole issue of identity verification should be treated as a public good because it does facilitate the inclusion of individuals in commerce, in society, and in interacting with the Government. Therefore, the funding for the development of the framework should come through general taxation, rather than through some sort of a user charge, and we hope that there’s been a commitment to do that.

The Green Party will be supporting this bill to select committee. Kia ora.

Thank you very much, Mr Speaker. With the risk of turning the debate into a hate on RealMe session, I would say that I’m glad to hear I’m not the only one. We are going to give the benefit of the doubt on this and support it to select committee, albeit cautiously, because we think the direction of travel is right. The intent is right. This is what has been going on overseas and I can understand why they are doing it, although I would go about it in a slightly different way. So this bill seeks to modernise identity standards, which will, in theory, give people a choice as to what services they use, if they are certified or not. I’m a little sceptical about that, but we’ll get to it.

As I say, the objectives are right, but one of the main issues that I have with this bill is just the detail. It’s the technical detail; it also relates to fees and so on. In terms of how to approach this bill—I’ve been reading through it and reading through the statements, and I’ve sort of thought, “Do I come in here as a politician or do I put my IT hat on?” having spent the majority of my career in IT or IT related fields.

💬 Barbara Kuriger: A bit of personal experience is always good.

It is. Thank you, Barbara.

I’ve also been involved in a lot of pen testing and security testing, cyber-security, white hat hacking, and all that sort of thing. So seeing the bits, and especially in the legislative statement last night about cyber-security, left me with some questions that I hope the select committee can have a look at as well. So it intends to provide verification services by implementing standard rules. It’ll be opt-in, and those that opt-in and meet those and are certified will have to follow those rules or they will face penalties. So this isn’t about centralisation of identity as some might think; it is just about rules and standards, but it’s not completely clear what best practice actually is. Again, it is lacking in detail.

Regarding the penalties—in the legislative statement tabled yesterday, I’ll just point out that it was said that there’d be a public warning and/or a cancellation of accreditation if rules are broken. It didn’t actually mention that there are, in fact, quite substantial fines. I think that is something that needs to be communicated quite well through this process so that people who may be interested or organisations that may be interested in signing up are fully aware of what they’re getting into.

I’m not entirely certain that this will deliver better services at the other end. Proof will be in the pudding. I’m not sure, based on the bill, if Application Programming Interfaces are going to be used to share data between private and public organisations. And I wonder, you know; in theory, this could lead to a situation where a Government agency could, the police, for instance, issue a driver’s licence on your phone and that would be a trustworthy piece of ID. So is that the direction we’re going in? That would be quite interesting for that to happen.

Regarding application fees, again, this is one thing where some more clarity would be nice. It says in the bill, in clause 23(1)(d), “be accompanied by the fee prescribed by the regulations (if any).” So it’s a fee, if any, and that the fee, whatever it is, if there is one, may vary in amount over time. I’m sure the committee that’s being put together will decide that. So, yeah, a little bit more sort of transparency around that would be good.

I think my concern is that the intent here is right, but that the Government is trying to micromanage the economy just a little bit. And, in any case, look, the storing and using of people’s private information is a sensitive topic and trustmark or not, for lack of a better word, any database can be compromised. So what happens then? What does the risk profile look like? Who is accountable if a service provider who has opted in and meets that standard does get a breach, and how far does that breach go? What is the interoperability between databases and so on?

There are two additional issues I’d like the select committee to examine at a high level. Will organisations actually want to opt into this, given there are fines, there are penalties, because there’s nothing stopping them from just continuing as they are at present and operating like that? And secondly, will users or the customers actually care if an organisation has a trustmark or not? Because many online services are offshore anyway and they will not be a part of this. If you’ve signed up to Spotify and Netflix, that is not going to come into this. This is the selling point here—you know, the this will certify this process, the framework, you meet those requirements in terms of how you store that data identity and how you share it, how you use it and in return with that certification, you might get more customers or something along those lines. So this is pretty important to make sure this actually works.

So in addition to privacy and security concerns, I’ve had one person ask me, “What about visa status?” Being in the immigration shadow portfolio, of course, I have to slip that in there. So what about visa status? If you’re unlawful or if your visa is expiring, or your residency, or not, how does that kind of data information get shared when you sign up to something?

I’ll just move a little bit to the legislative statement, and one of the opening lines, in terms of justification for this bill, was that some people don’t trust current systems, and that sounds very anecdotal. I would actually like to know what they mean fully there and what kind of research has gone behind that. Sometimes systems do not yet exist—that was an interesting statement. And the thing about remote use, and that was another one of the cases behind this, because it increases flexibility in theory and you can prove things digitally; that sounds great. Hopefully, it works out. During the pandemic, many organisations were able to increase their flexibility. I think of lawyers, for instance. They could actually certify documents over Zoom, and I never thought that they would be able to do that and certainly not in recent times, but that’s a possibility. So there is a bit of flexibility out there already. But I do acknowledge that this kind of bill and this kind of framework will make that a little bit easier and a bit less ad hoc.

There would be more control over your data—that was another statement yesterday evening. Again, just reflecting on my cyber-security background and my white hat hacking—we’ll call it that—background, I’d like to know what that’s going to look like—having more control of your data. So, as I said, the reality is everything is hackable, everything is interceptable, etc. Another line is from the legislation: “Opt-in accreditation will allow the digital identity service providers [time] to upgrade their systems to comply with the … rules at their own pace”. Yes, I get that. My only concern there—devil’s advocate—is what kind of pressure will be applied from the State for organisations to actually sign up to this? So, you know, they’ll have time, but then will there be a bit of a marketing campaign to try and convince users, you know, customers in New Zealand, that they should be using certified services because they’re the ones that are trustworthy and those that don’t have it aren’t? You’ve got to be careful of that because it kind of sounds like a bit of a good racket in the making.

So I think, in conclusion, I wonder if we should be doing this slightly differently, as they’ve done overseas, starting with the public sector first, Government agencies, because it makes sense there. And, you know, rolling that out, seeing how the framework is used and what standards are used and what is best practice and then turning to the private sector, if they wish, at a secondary bill and giving them the option. Because I think what we’ll find—and again, the Minister referred to banks, I think, in his example yesterday—is that banks treat customers’ information very seriously. And the other thing here is you might have four or five different banks and if they’re all operating under the same standards as per this bill, you know, does just one singular point become, you know; you figure one security measure out and then suddenly you can attack all of them? So does it make it better or worse than what they’re already currently doing? So we’ve got some reservations and some concerns, but I think the direction of travel is right and we’re happy to commend this to the House.

Thank you, Mr Speaker. I’m also happy to stand in support of this bill, the Digital Identity Services Trust Framework Bill, currently being debated before the House. We have heard from previous members about the need for a digital presence, for digital identification services, to better service us in the Government of New Zealand but also our Public Service and how that works, and also the ability for people to have confidence in that system too. We’ve already heard some people and their experiences with the current RealMe service that has been rolled out, and I’ve heard frustrations from a lot of people about their inability to be able to access that service. But this isn’t necessarily just about that; this is about creating a trusted framework that New Zealanders can have faith in—that’s going to help them protect their data but also give them control over their own data as well.

One thing that I was incredibly impressed about when I saw the detail of this bill was around clause 46, which talks about the establishment of the actual board itself. It provides that “The chief executive must appoint the members of the … board. The members may include public service employees and individuals from outside the public service.” And: “When selecting the board’s members, the chief executive must ensure that members of the board include people with expert knowledge of te ao Māori approaches to identity”.

That will give a lot of whānau out there that are listening to this some comfort that, actually, we’re going to be proceeding, but with caution, especially when it comes to the identity issue. On top of that board, you’ll also have a Māori advisory group, and their advice—the advice that comes from them—must be given effect to by the board. The Māori advisory group is going to specifically focus on looking after Māori interests, Māori knowledge as they relate to the framework, and also all considerations around the identity of people in here. This is a good piece of legislation, and I support it to the House.

It is great to be back in the House and taking a call. It has been a few months. A bit of water has gone under the bridge, so it’s great to be here and taking a cue from Eugenie Sage. It’s even greater to be talking about something that one hasn’t has had a huge amount of experience in, apart from setting up a RealMe account years ago when I was totally absorbed on that sort of electronic garage sale they call TradeMe—in its early days; I’m sure it is far more sophisticated now.

The merits of this bill have been well traversed by all members and it has the support of the entire House, which, I think, again reinforces the view that is perhaps not always understood out in the public—that there are issues of moment for this country that actually have significant support from both sides of the House, that it is very much a cross-party issue. It doesn’t have the profile, unfortunately, Minister, of the very good announcement yesterday on housing, but it does talk to the fact that as legislators we are focused on where we can see an obvious area to improve; let’s bring the best of our thinking to it.

I have just one simple observation that I’d like to add to the debate this morning, and that is that we have spent quite a lot of time in the last hour reflecting on how fast technology changes, particularly when we look back over a decade. It was less than a decade ago when the enabling legislation for RealMe was put in, and at the time it was seen as very far-sighted legislation, and it was a mechanism that would give security to New Zealanders in terms of their data protection.

Here we are, eight years later, arguing that, actually, it is very deficient and that for a whole raft of reasons—mainly the impact of the industrial revolution, technology and artificial intelligence, and all the new ways of thinking and operating and engaging through the cloud—that framework is now redundant. My caution is that here we are in 2021, saying that we have now established a new framework that should give us the confidence that we will be able to provide secure platforms for New Zealanders to transact with each other and with the Government, and that their information—their critical personal and commercial information—will be secure. I think that all of us in this House know that the reality is that in five years’ time technologies will have emerged that have made this point in time seem somewhat quaint.

So the question must be—and I want to build on Tāmati Coffey’s point where he talked about the board being established with a perspective of Te Ao Māori, and we support that, I think that makes sense. But the real trick in establishing this establishment board and this framework is: does it have an inbuilt culture of flexibility, an inbuilt culture to test its current norms and sense of what the future could hold, and the ability as a bureaucratic institution to breathe and adjust and move at the pace that the technology and the consumers of this country expect? That is actually a very large test and a hard test, regardless of your political persuasion: bureaucracies, once established, have an inbuilt bias for the status quo, and the inbuilt bias over time appears to look to be risk-averse, as opposed to embrace innovation, because innovation and change are uncertain.

My, I guess, request in my short contribution here this morning, as we pull this together—and it will get done because it has the support not only of the Government but of the entire House—and as this framework is operationalised, is that that culture of fleet-of-foot innovation, the capacity to imagine what tomorrow will be and actually build systems to be able to respond to those changes sits at the very core of what we are trying to establish today. Thank you very much.

Fakaue, Mr Speaker. Faahi tapu he vagahau Niue. Happy Niue Language Week. It’s always a privilege and an honour to take a call in the House. However, given this is my first time in some time, can I just really quickly thank and acknowledge the people of the Ōtaki electorate who turned out to get vaccinated on Super Saturday before and beyond, so thank you.

COVID-19 is a really good example of why this Digital Identity Services Trust Framework Bill is timely and critical. Our Kāpiti people are 70 percent fully vaccinated and our Horowhenua people are 62 percent fully vaccinated. It’s a good start but we’ve got a really long way to go. I just also want to really quickly acknowledge and thank our health workers, volunteers, iwi and Pasifika providers, and providers as a whole who have been working tirelessly to serve our people—the people of the Ōtaki electorate included—to keep our health needs going as well as vaccinating. So kia ora for that as well.

But specifically to the bill: to ensure uptake and trust from New Zealanders who are providing their information online. New Zealanders want to know how and where their information is going, and how it will be stored. These are all online security concerns that New Zealanders will have when providing their information online, and rightly so. It’s really important that we have a digital platform or framework that is trustworthy and that New Zealanders can rely on to store their information securely.

This bill and framework gives New Zealanders that online trust, but also it modernises the approach to digital identity and it’ll provide a resilience to unexpected events like the situation we find ourselves in at the moment with COVID. And we still need to access those essential services online, so this framework provides that trust for us. Again, it’s really timely and I commend this bill to the House.

The digital landscape is hugely exciting, as has already been mentioned by other members. It’s democratising, as we’ve seen with the innovation around blockchain and cryptocurrency—we’re looking at that at the moment in the Finance and Expenditure Committee. It’s really empowering bringing many voices to the table, and it’s exciting in terms of the new virtual realities that are available to people. But it’s almost wholly unregulated, and we’ve seen one of the biggest challenges for our country has been the misinformation that has led to vaccine hesitancy. We’ve seen misinformation in the recent US, or not so recent US elections, and of course there’s online fraud and privacy breaches. At the heart of these issues is digital identity. It’s absolutely crucial that we are able to keep our digital identity safe so that we’re not exposed to fiscal issues around banking, that we can move freely and restrict movement where necessary, and just enjoy our freedoms in the non-digital world.

So what this bill does, really, is it provides trust, as has been mentioned. And my view is that trust is really becoming the new currency, as we move into more and more digital spaces where we need to be able to understand the authenticity of what we’re navigating. This bill gives us more control over our own information and how we share that information, whom we can trust. It also means people can access new services without having to go through a whole lot of paperwork, so it has pragmatic elements as well.

As a member of the Foreign Affairs, Defence and Trade Committee it’s also crucial we have systems that align with our friends when it comes to being able to keep our world secure and have systems that complement each other, where information can be shared safely. Security is crucial at this time, and, actually, COVID has been another reason for us to see that we need to be able to be nimble to access essential services and do so in a digital way.

Cyber-security is the key issue of our time, and digital identity and protecting that is a critical element that we need to get right as we start to navigate this brave new world. So this is a very timely and important initiative, and I commend the bill to the House.

It’s quite an experience to get up in the House and speak on a bill where, clearly, all parties are in violent agreement. I trust that will happen again in future, and I’ll look forward to that occasion as well. But we’re all clearly in agreement that there is an essential need for a legislative framework that protects our online information and data.

I think every person in this House has recently experienced the need for robust data-protection and cyber-access in the recent environment of having been locked down at home and working at home on Zoom and all those online platforms that we’ve become so used to. We’ve also seen the need for legislation like this to be brought before the House because, again, this COVID environment has really thrown into sharp relief the exposure that New Zealand has to international cyber-attacks, and the fact that our borders are not as watertight and secure as we would like them to be.

All of this brings me to the point that it’s essential that a piece of legislation like this is watertight and robust, but, as a couple of other people have mentioned, it must be futureproofed. The rapid pace of change that we’re seeing in the technological environment is quite extraordinary, and, one would assume, will only continue at that pace, if not faster. I actually made some comments in the House last night on another bill that was around enabling regulations to prevent the live streaming of objectionable material, and I also made the comment that we must ensure that bills like this are written in such a way that they can adapt to the changing nature of these environments and are as flexible as the environment that they’re there to regulate.

So, of course, as my friends on this side of the House have previously mentioned, we in the National Party obviously do support a bill like this, because it is supporting the best use of data to achieve outcomes, as well as growing trust and innovation in that digital economy. And this digital economy is a growing economy. The Minister mentioned in his own comments something very close to my heart, which is the opportunity for export market potential here. His own figures had it at likely to be worth about $17 billion by 2026, and I’m certain that it could be that and more. I saw, in my time with New Zealand Trade and Enterprise—I know Simon Bridges liked to claim that most of the digital technology and innovation is coming out of Wellington, but I would argue that a lot of it is coming out of Christchurch and Canterbury. We’re seeing a number of really innovative small businesses starting up as a result of the loss of infrastructure and physical office environments from the earthquake. Everybody decided and saw that things needed to move online more, and that has seen the genesis of a huge amount of digitally based businesses coming out of Canterbury, and so I do hope that a framework like this will enable those businesses, and, indeed, enable their export opportunity offshore.

A couple of people have mentioned the need for the select committee to play a role in this, in scrutinising things, and I think one of the considerations should be ensuring that this legislation aligns with similar international jurisdictions. As I mentioned, a lot of these businesses are looking at export potential, given the multinational nature of the digital economy and environment. We do know—and, look, I am analogue, I have to confess to this House; I’m a digital dinosaur—that more and more of our data is moving into that digital cloud environment, and as other nations innovate, New Zealand needs to be proactive in regulating this evolving technological sector and aligning our legislation with countries.

I think someone else made mention earlier of the prospect of digital driver licences. I don’t know about everyone else in this House, but the only reason I carry a physical wallet nowadays is for my driver licence. Everything else is on my phone: my EFTPOS cards, my ability to pay online, my Flybuys—that’s very essential; I use that regularly as well. But the only thing that’s not on my phone is my driver licence, so I do wonder about the potential for that, and that would be a classic example of the essential need to be able to protect essential information like that.

It will also be important, on State-held information, to balance the role of the State as a digital steward with opportunities that innovative New Zealand companies can offer New Zealanders in developing new tools to verify identities online, and I do wonder as well whether the select committee might want to consider how this particular bill will interact with the Electronic Identity Verification Act, that’s been mentioned earlier.

The wonderful thing about this is that it is industry-led. Many people have mentioned the Government-led RealMe platform, and the dinosaur that that has become. But the industry-led innovation is, I would hazard a guess, as up with the play as anything else. And so the plan for a digital identity framework, I believe, has had very strong buy-in from the digital sector and New Zealand companies, most of whom are already developing in this space.

So a framework that will ensure consistency in the basic principles of privacy and data protection is welcomed by us on this side of the House, and indeed all sides of the House, and in a very quickly changing and evolving digital world it is going to be essential to incorporate a framework that will engender trust in the public. So we are pleased to commend this bill to the House.

Fakaalofa lahi atu, Mr Speaker. Thank you very much for taking my call. Now, as a member of the Finance and Expenditure Committee, I won’t have the ability to analyse this bill further because, I understand, it’s being referred to the Economic Development, Science and Innovation Committee.

But having a look at this bill, like many members of the House who have to fill in for other committee members, this morning in the House the one word that stuck out for me was in the title of the bill, and that is “trust”—Digital Identity Services Trust Framework Bill. It’s important that Kiwis need to trust that their personal data is handled securely, and this legislation hopes to be able to achieve that. Now, when I went through the bill this morning, what really stuck out for me was that this is actually the introduction of quite a fundamental regime for our country. We look at the Official Information Act regime that was brought in in 1981 or 1982. We look at the Privacy Act regime that was brought in in 1993. There are very key elements in this bill which will be—I’m looking forward to seeing what submissions come out and I want to be able to point to a number of those aspects within the particular part of the bill.

One other really key point when I was reading the regulatory impact statement was what was happening overseas. A member from the ACT Party referred to it—this legislation, if passed, obviously affects the domestic acquisition or holding of digital information, identity information. But what does that mean for the likes of Netflix and overseas jurisdictions that have digital identification information for Kiwis? So what’s really important, which I note from the regulatory impact statement, is that it talks about the international key partners like Australia and the United Kingdom, who are also modernising their digital identity systems and taking a similar approach to New Zealand. That’ll be really important to ensure that there is some sort of interoperability if we look to align with other countries. So having other countries across the world have similar frameworks means that when it comes to New Zealand establishing our framework, we can work closely with them, such as you’re seeing in other types of regimes like the base erosion profit shifting rules that happened for tax, where the OECD led that and there was consistency and alignment of rules to prevent arbitration of those rules.

So how will this bill benefit New Zealanders? Well, looking at it, obviously it provides that trusted framework for Kiwis. What is important is what the previous member from ACT also referred to: the enforcement elements of this bill; that’s in Part 6 of the bill. That’s something that I think that submitters should really provide some comment on, because you want to know whether the offences and penalties that are covered within this bill are too hard or too soft. Is that what you expect as a Kiwi if somebody breaches these particular rules if they’re passed?

The other part that’s actually quite interesting in here is that the trust framework board, a governance board which also has a Māori framework board—the secrecy and the immunity provisions that are in Part 7 of this bill. Now, to be able to have secrecy and immunity from other Acts, to be able to make sure that the information that they use in relation to enforcing this Act cannot be released in other circumstances, is really key and really quite important because in order to have secrecy and immunity, there has to be a high threshold, a high bar for it. So I’m really looking forward to seeing what the select committee and what submitters come with in relation to that particular part, Part 7.

But going back to the main key point of my speech, this is about trust. It is a fundamental new regime. It does require good scrutiny at the select committee. I’m really keen to understand how the international interoperability works with Australia and the UK and whether other international country partners are going to it, in order to protect our Kiwis’ identification or information. I’d be really interested to see how the enforcement powers sit; again, submitters being able to see whether they are too hard or too soft; and, again, has this bill met the threshold where members of that board should have secrecy and immunity from releasing any of that information? So on those points, I’d like to commend this bill to the House.

Motion agreed to.

Bill read a first time.

The question is, That the Digital Identity Services Trust Framework Bill be considered by the Economic Development, Science and Innovation Committee.

Motion agreed to.

Bill referred to the Economic Development, Science and Innovation Committee.