Digital Identity Services Trust Framework Bill

Members, we come now to the Digital Identity Services Trust Framework Bill. We come first to the debate on Part 1. This is the debate on clauses 3 to 7 and the Schedule, “Preliminary provisions” The question is that Part 1 stand part.

Point of order. Thank you, Mr Chair. I seek leave for all provisions to be taken as one debate.

CHAIRPERSON (Greg O’Connor): Leave is sought. Is there any objection? There’s no objection. We will hear this as one part. The question is that Parts 1 to 7, the Schedule, and clauses 1 and 2 stand part.

In an increasingly digital world, it is important that people can prove who they are online in a trusted and consistent way. Digital identity services give people the ability to securely share information about themselves, such as their date of birth and name, and that enables access to services like setting up a bank account online or providing a new employer with information. However, the digital identity environment currently lacks consistent standards, making it difficult to provide genuine and secure services.

This bill introduces a new regulatory framework, being the trust framework, which will establish standards for the provision of secure digital identity services. These standards will give people more control over their own data. That includes what they choose to share about themselves and who they share it with. Digital identity is essential to the development of more effective and efficient online services, making us as a society more resilient.

If a digital identity service provider wants to become accredited, they will have to meet the requirements under the trust framework. The trust framework introduced in this bill will be opt-in, and I do want to stress that for the committee. There has been a degree of dis- and misinformation about this, which I know the Economic Development, Science and Innovation Committee heard too. This is an opt-in framework. So if consumers want to use digital identity services, they will be able to choose to use a regulated service marked with a trust mark that assures their information has been stored and shared in a way that protects their privacy and security.

Importantly, for people who don’t have access to or choose not to use digital identity services, the Government will continue to make in-person services available. We had a debate on that in the House earlier this year. I want to acknowledge the Citizens Advice Bureau, who often are there on behalf of folk who either don’t want to or are unable to be online currently.

The trust framework doesn’t establish a centralised identity system. It doesn’t create any new powers for the Government to collect or share people’s information without their consent. It’s really important to be clear on that. If they authorise it, information about a person’s identity will be verified against the information recorded in the Births, Deaths and Marriages registry, similar to how identity is currently verified when applying for a passport. Personal information cannot be accessed or shared without the person’s consent. Information will only be stored for as long as it’s needed, and it will be securely encrypted while stored and in use. Information cannot be sold on to third parties.

There has been confusion over the technical operation of the trust framework, and I would like to take this opportunity to dispel it. There has been an increase in online services which require proof of identity—accessing a bank account, applying for a student loan, or completing a rental application are a few examples that come to mind. Consumers want to be able to provide this information easily and securely. Businesses want to be able to use this information to make decisions about eligibility and entitlement with a high level of confidence. A secure digital identity credential will enable these services to be provided online without the need for personal information, such as a passport, to be shared. This makes the transaction more secure, with it being encrypted and only necessary information being provided—for example, a proof of identity may not always need to include a person’s birth date. This system will enable sharing of only the minimum information needed, and nothing more.

Valuable and personal and organisational information exists in a range of locations across the public and private sector. Some of these locations are the authoritative source of information they hold, such as the Births, Deaths and Marriages registry; other sources may hold non-authoritative information, such as a utility company holding on to a person’s address—they have a level of confidence that the person lives at the address, but the utility company is not the authority for addresses in New Zealand. Any organisations holding information may choose to participate in the trust framework as an information provider. Under the trust framework system, this information will remain where it is currently stored, and there will be no centralised data repository.

I might leave my initial contribution there. There is a lot to say about this. I’m looking forward to members’ contributions as we set up something that will be of great use to New Zealand citizens.

I want to actually start with the question of disinformation—a very important topic because, in the last 20 minutes, coming across my newsfeed is information saying Dr David Clark may be not coming back after the election in 2023. I want to know if that’s disinformation or not, because he’s been a good man in this House, and I just want him to acknowledge that is true and not disinformation. To acknowledge, in all seriousness, his work, and, obviously, he’s got things in the future, but to just acknowledge him in that announcement today. If that be true, he’s allowed to sit me down for dis- or misinformation.

Look, this is a large bill—

CHAIRPERSON (Greg O’Connor): So tempting, Mr O’Connor.

Sorry?

CHAIRPERSON (Greg O’Connor): Carry on.

I was being nice for a change, Mr Chair.

💬 Hon Member: Who is this guy?

“Who is this?”, that’s right!

💬 Barbara Edmonds: For a change.

For a change. That’s right; I don’t want to mislead the committee.

Look, a couple of very basic questions, and I want to admit to the Minister, I’m not an expert in this space. So first and foremost: which is going to be the primary ministry responsible for overseeing this? I take on board what the Minister’s indicated. This is not one great central database which the Crown is controlling; it’s a framework of a set of regulations which, if I heard correctly, outside organisations can, if you will, accredit to and follow through. But it would be interesting to know which is going to be the primary ministry, if that is even in the correct question.

💬 Secondly: who actually, ultimately, owns the data? I suppose, fundamentally, it’s up to each organisation with their terms and conditions. I certainly know in the medical space, we—the patient, I understand—are meant to own our own records, even though a doctor, for example, or medical practice might manage it. So that may not be a particularly relevant question.

Coming out of that, because I expect it’s not specifically in this legislation: as this framework is set up, can he give the committee some confidence that he’s already engaging with his ministerial colleagues, with their responsibilities, that Crown agencies will be signing up to this framework? Is that something we expect, Minister, Government agencies will be signing up to? So I acknowledge the Minister of Health here; would we be seeing Health New Zealand swiftly signing up to this framework or do they already work within their own? I genuinely don’t know. But it would be good to give us some surety that if this framework is in place—we would imagine some in the private sector, for example, would accredit themselves to it. Is there work being done to swiftly bring on the likes of Health New Zealand and other entities?

Then the broader question—and it’s something that I’ve seen in the Economic Development, Science and Innovation Committee report; you referenced it, Minister, in your opening comments. There’s a lot of misunderstanding out here around what all parts of this bill do. A lot of people think this is, again, about a massive central repository of information, and I think it would help me and help the committee if the Minister could speak to that misunderstanding. I want to be really, really clear: it’s the misunderstanding of some in the public; it’s not the misunderstanding of the Minister, the select committee, myself, or the House. But I think it would be useful if the Minister could just elaborate on how this is not a central repository of information.

And if it’s not overloading the Minister and his officials at 7 minutes to 5, what’s going to happen to the likes of RealMe? I know that is more of a singular Government-run system. Is that going to continue in parallel or will we see a whole new system, in his mind, coming into being that this not so much replaces it but sets in a new framework? Can RealMe continue on or should some other work be developing? Thank you.

I thank the member for many of his questions. Look, in terms of the governance arrangements, I do want to discuss them, but I’ll first—just about RealMe. Some of the tools involved in RealMe will actually, I guess, be recycled into this framework, some of the protection mechanisms that are enabled through the framework. So some of that technology will contribute to this.

I think it’s fair to say that that mechanism is not as contemporary as others out there. It is effective, and it is secure. Today, people share data online all the time using Facebook and social media and on various platforms out there. Having a secure mechanism for doing that in a modern way is what this is attempting to do and to ensure that the person whose data it is is in control of that sharing, rather than it being permission between Government agencies or whatever; that the person whose data it is owns that data and gets to say who gets to use it and what parts of it—I think that’s a really important principle for privacy reasons. It is something that is now possible because of the way that technologies have developed.

In terms of where does this sit, does this sit in a Government department and so on, I think that’s important to explain to the House. The Trust Framework Board is described in Part 4 of the bill. There are three bodies responsible for overseeing different aspects of the trust framework. This work has been driven out of the Department of Internal Affairs, and I do want to acknowledge and thank the officials who’ve done the hard work, first, of bringing me up to speed on it when I was a new Minister in this portfolio—I thank them for their patience. I also acknowledge the expertise that sits there in the development of this framework.

The Trust Framework Board develops the trust framework rules that service providers will need to comply with. There’s a Māori Advisory Group established, as well, which will advise the board on Māori interests and knowledge on digital identity and the operation of the trust framework. So that’s an advisory board that sits alongside.

There’s also the Trust Framework Authority which is responsible for accrediting organisations against the rules, so it’s a more operational, if you like, aspect of it; monitoring, enforcing compliance of the rules, and complaints and dispute resolution.

So there’s quite a structure around it; that’s important. We want to get the thing right in principle. We want there to be a board that oversees, governs, this new mechanism we’re putting in place, and we also want some real operational muscle in there as well.

The time has come for me to report progress.

Progress to be reported.

House resumed.