Digital Identity Services Trust Framework Bill

I present a legislative statement on the Digital Identity Services Trust Framework Bill.

ASSISTANT SPEAKER (Hon Jenny Salesa): That legislative statement is published under the authority of the House and can be found on the Parliament website.

I move, That the Digital Identity Services Trust Framework Bill be now read a second time.

The Digital Identity Services Trust Framework Bill introduces a new regulatory framework which helps New Zealanders share their personal information via trusted and secure services. It’s a modernised system for a modern world, and, by passing through the second reading today in the House, we are one step closer to modernising our digital identity system, which is critical as we continue to work more online, socialise more online, and learn more online.

Digital identity services allow for user-authorised collection sharing and other uses of personal information. Now, an example of the kind of information that you provide with a digital identity service might include things like a person’s date of birth, name, employment history, medical records, qualifications, or other information that describes them. That’s the kind of data we’re talking about being protected in the trust framework. Now, a New Zealander who has this kind of data, using that trust framework, can then choose to authorise service providers to share this information, helping them to access services and entitlements or prove who they are, and so forth. So a person who has these details, has this information, can choose, in this trusted format, to share with others.

The bill is part of a wider programme of initiatives that support key Government priorities for the digital community and is another part of the digital strategy for Aotearoa. It’s also trade-enabling; digital identity can enable digital trade and other cross-border transactions. A mutual recognition of digital identity services with Australia is something that our Prime Minister and the Prime Minister of Australia have both signalled as a priority for the single economic market agenda. As I said when I first introduced the bill to the House, the trust framework bill introduces a rules-based, opt-in accreditation scheme for digital identity services.

I know that during the select committee process, some submitters expressed concern that the trust framework was establishing some kind of mandatory and centralised identity regime—and I want to be very clear with this House: this bill does no such thing. The trust framework does not establish a centralised identity system; in fact, it’s really distributing information with the users themselves to control. It does not create any new powers for the Government to collect or share people’s information without their consent—it does not do that. Instead, the trust framework consists of a set of minimum standards for security, privacy, information, and identification management that must be met when people choose to share their information through this mechanism. To labour the point, participation in the trust framework is optional. No one will be required to get a digital identity to access services, and the Government will continue to make services available to people on an in-person basis. The bill itself is also subject to the Privacy Act of 2020.

Now, in order to establish the trust framework, the bill establishes three regulatory bodies that will oversee different aspects of the trust framework. Now, those three bodies are: a governance board, a Māori advisory group, and an accreditation authority. The Governance board develops rules and engages with the public on future objectives for the trust framework. The Māori advisory group comes together to advise the board on Māori interests and knowledge as they relate to operation of the trust framework. The accreditation authority is responsible for accrediting organisations, but it also does the monitoring and enforcement parts that are necessary under the trust framework.

The bill also requires a consultation be undertaken with key stakeholders when potential changes to the rules are proposed, and it provides the accreditation authority with powers to investigate compliance and to issue remedies if it finds that there has been a breach of the trust framework.

I do want to thank the Economic Development, Science and Innovation Committee for its work on the bill. They’ve made a number of helpful suggestions to improve the operation of the trust framework once the bill’s passed by this House. I want to take the time also to acknowledge those submitters who took the time to engage with the technical aspects of the bill, because it is a bill that needs careful engagement, and those that took that time to make suggestions to ensure that the bill serves people well are to be thanked. And so I do that on behalf of the House.

I’d like, now, to touch on some of the amendments that the committee has recommended. Broadly, I think the committee—well, clearly—accepted the policy rationale and the purpose of the bill, but has made some suggested changes. Now, a number of these suggested amendments relate to ensuring that the trust framework gives better effect to Māori approaches to identity. These changes include amending the consultation requirements to include tikanga experts with knowledge of Te Ao Māori and identity, adding a positive obligation on the board to recognise and provide for Māori interests in the operation of the trust framework, and requiring the board and the Māori advisory group to collectively identify how they will consult with iwi and hapū.

Several submitters expressed concern that the bill provides immunity from liability in civil proceedings for accredited digital identity service providers over harms which have resulted from the use of their services, and the bill has been amended in response to this concern to establish that that immunity does not apply to any proceedings taken under the Privacy Act. A further amendment seeks to clarify who may make rules that comprise the trust framework. To make sure that the Minister’s powers are clearly prescribed, the bill has now been amended to clarify that the Minister’s power to make trust framework rules is limited to the technical standards set out in clause 19.

During the select committee process, submitters also expressed concern about the limitation of six months for people to make a complaint when they find out about a breach of the rules. Essentially, submitters found that that was too restrictive, and submitted as such, and the bill has therefore been amended to extend that time limit to 12 months.

The digital sector continues to grow and evolve rapidly, and the need to ensure people can access services in a straightforward way so that they can be sure that their information is protected and be sure to benefit from the ease of access that comes with faster digital ways of doing things has only grown in importance.

Before I close, I do want to acknowledge that it is Techweek this week, and, you know, we’ve made some announcements around supporting software as a service in our Budget, upcoming, and also put some money behind the tech story. And I would encourage people out there looking to the benefits that we will see from this digital economy to look at the We See Tomorrow First website, where assets around our tech story are stored—a very powerful story. Most people know the story of “100% Pure”—that is a story we’ve told about New Zealand for a long time and told clearly to overseas audiences. The tech story and its resources that are now available online and supported through the Budget will enable our entrepreneurs to tell the story of the great things that are happening in the digital economy in New Zealand. So in Techweek, can I thank those who contributed to the New Zealand story development and encourage New Zealand citizens to go and have a look at the We See Tomorrow First website to check these things out for themselves.

But it’s my pleasure to commend this bill, given that it introduces a regulatory framework that helps to keep people safe, that is optional to participate in, but that provides benefit to New Zealand citizens of knowing their data is safe and secure and they can choose who they share it with in a digital world, which brings them many benefits in the future.

The question is that the motion be agreed to.

Thank you, Madam Speaker, and I thank the Minister, the Hon Dr David Clark, who just took his seat, for bringing this bill to the House.

Right from the outset, I will say that National is supporting this bill in its second reading and will continue to do so, because I believe that it is actually a very important piece of work to get us started in this day and age, where digital is where we are. I want to traverse everything that the Minister has actually said, because he, basically, talked about most of the things that we actually dealt with in the select committee. But we support the best use of data to achieve better outcomes, and a trusted innovative digital economy and a digital identity framework will develop this actually further, I think.

One of the things that I find very interesting and completely support is what the Minister said, this is all about making sure that people’s data is actually secure. In this day and age, when we have to prove our identity, often people ask for several pieces of documentation to prove who we are—sometimes it’s usually a photo identification or a bill that actually has your home address; sometimes people actually feel really insecure about providing those personal details to protect their privacy. This framework will assist in that process where you literally will only have to do it once with a trusted framework provider who will, in effect, provide that security and also provide that identity identification, I guess. When I actually want to do something I don’t have to continually send in that documentation. When you send documentations to other people, whether via email or whatever, sometimes those documentations are not protected. People can actually steal your identity, and that’s been a problem.

We believe it is actually vital that the framework and digital identity services on offer in New Zealand must enshrine principles of privacy and digital safety, as I’ve actually just said. Having considered the issue in detail through a select committee—and, at this juncture, I’d like to thank my colleagues right across the House from the select committee led by Jamie Strange, who actually does a very, very good job as chair. As the spokesperson for the National Party for the digital economy and communications, I am really satisfied that the kinds of things that we’re actually talking about is going to be achieved through this bill out of the committee process.

In New Zealand, digital interactions between individuals, business, and Government are only going to increase. We must have resilience, and, you know, we must have resilient future-focused policies in place, and back innovative new technologies that exist now and actually will grow in the future. A framework for regulated entities to offer recognised digital identity services will add to the constantly changing evolution of our technological nation in a secure way is actually a step forward.

Recently, the New Zealand Parliament also addressed the topic of digital exclusion through select committee petitions, most notably the one by the Citizens Advice Bureau, which recently reported back to the House, and is soon to be debated in its own right, in several weeks’ time. I note that there are many New Zealanders who cannot, for many reasons, engage digitally. The issue is not just the rural-urban divide; there are cultural issues, there are socioeconomic and demographical reasons, and also the specific region that they live in where they actually have digital exclusion. It is vital to ensure public institutions continue to be able to engage with those people who cannot engage online as a part of a due process for all people in New Zealand. That is one aspect of select committee discussions that I’m glad that we have managed to put in the mind of the officials when we were actually working through this. The digital identity framework must be complementary to existing identity tools and not a tool for digital exclusion. It must not become a means to disregard New Zealanders’ access to Government and public services who prefer the traditional method of official identification, trusted for many, many decades.

When we talk about many decades, it actually reminds me, going back to probably some 20-odd years ago when I think it was the Hon Maurice Williamson who introduced the photo driver’s licence. At the time, it was to replace the paper driver’s licence that everybody used to have. I used to have a little blue driver’s licence that didn’t actually have a photo, so my mother could have potentially used it. Who would know the difference, you know? When the photo driver’s licence was introduced, everybody went absolutely wild and said, “You cannot do this. This is actually Big Brother spying on us. This is a travesty. You cannot do this.” Aren’t we so glad that the National Government back then had the foresight to actually provide the driver’s licence which also meant that people had to have their eye test? Immediately after the photo driver’s licences were instigated, there were many people who had to actually wear glasses to drive. That means our roads are safer as a result. How technology improves our lives, this bill will do that.

One further issue relating to digital identity services and legislation that Parliament is considering is also worth a comment. National members were quite concerned and I’m sure that members across were also concerned that the misinformation that circulated from untrusted digital sources regarding what the legislation will achieve and what it is actually about, and there were many, many submissions which were out of bounds for our consideration.

This legislation was debated during the heights of public discourse on the COVID vaccine passes, of a COVID mandate, and alongside channels of mal-information growing fear. This legislation was caught up in the storm of unassociated, disjointed commentary about wider conspiracy theories, fear of Government control, and similar topics. I have to actually quote the report from the committee—and I quote—“Many submissions also compared this bill to social credit systems, centralised state control of identity (for example, the removal of physical driver licences), and moving to a cashless society using digital currencies. None of these ideas are related to the content of this bill.” I have to agree wholeheartedly with this statement, fully, that this bill is not and will not be a mechanism for State control. That is misinformation. That is fake news.

We will not see the withdrawal of existing forms of official identity from circulation as a result of this legislation. As the Minister said, it is actually an opt-in kind of a system where people can choose whether to be in or not; they can choose what information they actually want to share.

I would also like to recognise, though, that some people will have some apprehension that this new option could be the start of a process to end physical identity documentation—this is not the case. These services will be complementary to the existing identity processes as part of the growing digital world that we live in, alongside physical human interactions.

National actually believes in New Zealand having a digital future. We also believe no one should be left behind. On that note, I’d like to request that the Minister for the Digital Economy and Communications be a little bit more ambitious and, perhaps, ask for more funding to actually grow your vision. I’m just a little bit disappointed with the $20 million.

A digital identity framework will allow our digital economy to embrace the next stage of innovation and technological opportunity. I look forward to furthering the discussion on this legislation in detail through the remaining stages of the bill over the weeks to come. In the committee stages, we could, potentially, discuss many other detailed bits in the legislation, and perhaps the Minister could answer some of those questions that we may have. On that note, I commend this bill to the House.

This debate is interrupted and is set down for resumption next sitting day. The House stands adjourned until 2 p.m. tomorrow.

Debate interrupted.

The House adjourned at 9.55 p.m.