Digital Identity Services Trust Framework Bill

I present a legislative statement on the Digital Identity Services Trust Framework Bill.

SPEAKER: That legislative statement is published under the authority of the House and can be found on the Parliament website.

Hon GINNY ANDERSEN: I move, That the Digital Identity Services Trust Framework Bill be now read a third time.

Madam Speaker, I am pleased to present for a third reading the Digital Identity Services Trust Framework Bill. I would first of all like to acknowledge the work that the Economic Development, Science and Innovation Committee has done in this space. I’d like to acknowledge those select committee members and officials who have put much time into getting this bill this far. As the new Minister for the Digital Economy and Communications, I would like to thank the previous Minister, the Hon Dr David Clark, for his work on this bill, including starting the bill’s committee stage back in December 2022.

I have just a few comments to make following the debate that’s pursued in the second reading. This bill sets up the digital identity services trust framework, which is an opt-in regulatory framework for the digital identity service industry. Digital identity services give people the ability to easily share information about themselves, such as name, date, and birth. This enables access to services like setting up a bank account online, providing a new employer with information—basic day-to-day things that will make life easier for people.

The bill is part of a wider programme of initiatives that support key Government priorities in the digital community, and is the cornerstone of the Digital Strategy for Aotearoa New Zealand. It’s also trade enabling, as a digital identity can enable digital trade in other cross-border transactions. A mutual recognition of digital identity services with Australia is something that our Prime Minister and the Prime Minister of Australia have both signalled as a high priority for the Single Economic Market agenda.

During the select committee process, some submitters expressed concern that the trust framework was establishing a mandatory centralised identity regime. I want to reiterate, at this point, that the bill does no such thing. The trust framework does not establish a centralised identity system. In fact, it enables users to choose what information is being stored and shared with third parties. It does not create any new powers for the Government to collect or share people’s information without their express consent.

The trust framework introduces minimum standards for security, privacy, information, and identification management that must be met when people choose to share information through this mechanism. The bill, and all actors within the trust framework system, will be subject to the Privacy Act and the privacy requirements.

The new regulatory framework will be overseen by the Trust Framework Authority, Trust Framework Board, and also the Māori Advisory Group. We are very proud of the Government’s arrangements, and particularly want to acknowledge the input of the Data Iwi Leaders Group in this area, and the time they’ve put into refining this work. The debate on the make-up of the Trust Framework Board in the committee stage was particularly interesting, but I am confident that we have a system that will ensure that there are diverse perspectives and expertise while also creating a board that has the appropriate technical understanding of digital identity—this is incredibly important. We are creating a system which, through board appointments and consultation requirements, will enable those to have an interest in specific issues, and also be able to be heard on the matter. The trust framework regulations and rules being developed will round out the technical and administrative requirements to implement the trust framework.

I would like to wrap up by saying that this bill introduces a regulatory framework that establishes standards for the provision of secure digital identity services and gives New Zealanders more control over their own data, including what they choose to share about themselves, and also, most importantly, who they share it with. It is a pleasure to commend this bill to the House.

The question is that the motion be agreed to.

Thank you, Madam Speaker. I start by saying on this side of the House, we obviously support—and it is wonderful to actually note that the whole House supports this.

I start by congratulating the new Minister for the Digital Economy and Communications, and I’d like to thank the previous Minister, the Hon Dr David Clark. I have to say that this may be the first bill for which he has support from all of Parliament in his tenure as the Minister.

I don’t really want to take too long on the third reading, because it is something that is actually required. I echo what the Minister said in the end, which is about the protection of data and the fact that through this bill, New Zealanders can have more control over their data, how that data is going to be used, and how much control they actually have.

The world is becoming more digital, and strong protections are needed. Having a framework that we are actually setting up in this Parliament today will make a huge difference to New Zealanders as they navigate the world of digital. I commend the bill to the House.

Kia ora, Madam Speaker. It’s been an interesting journey to be part of this select committee, the Economic Development, Science and Innovation Committee. Moving through this piece of legislation, and as has already been spoken, congratulations to the Hon Ginny Andersen for her new role, and honouring and respecting the previous Minister, the Hon Dr David Clark, who originally brought this into the House.

Now, if anything in this legislation, timing is everything, and part of it, I think, as a select committee, was—and Melissa Lee can vouch for this—the time when we started hearing submissions actually was obviously at a very heightened time in our country’s history.

Melissa Lee: Seems like a long time ago.

GLEN BENNETT: It does seem like a long time ago, and it was 2021 that we were hearing submissions. We received a lot of submissions, but they came in really late and I do note that the advisers noted that—I think it was of the 4,000-plus, 3,000-plus of those were form submissions that were last minute and said very little. But what they did say was obviously a lack of, I’d say, understanding of what this piece of legislation was about because this is actually—as Melissa Lee and others have said in this House—around protection, it’s around safety measures, it’s actually around the trust framework. And it was unfortunate, through the select committee process, to have the misinformation come through that people were concerned, whereas what this bill does is protects what’s going on online, protects our digital integrity, protects people in terms of their information—whether it’s your name or your licence or your date of birth, those sorts of things that are there. It’s actually around the protection and the trust of the framework.

This gives people more control—more control over how they share information about themselves and when they share it. If you look at the internet, it was something invented 40-plus years ago, and as it’s come through over the years there are many things that haven’t been put in place around protections. Many regulations haven’t been put in place because it’s in many ways an experiment that has exploded and is growing. So for us to have things put in place like the Digital Identity Services Trust Framework Bill is very important for us in this House, and, as has been said, I’m glad that we all support this legislation this morning so that we can see it through.

Now, RealMe was also brought up in select committee, and I don’t want to talk too much about that, because we’ve got a lot of work to do still and I’m glad that this is part of making it better, and because I know that everyone loves a good RealMe account. We will keep moving on this. I support this and I commend this bill to the House.

Thank you, Madam Speaker—what an excellent choice. I commend this bill to the House. It is absolutely crucial in a digital age that we have a trust framework around identity, and it is absolutely going to be incredibly important for our digitising of Government when we have to come in and pick up the mess that the current Government has made.

We know that there are people who worry about what might be happening to their identity and yet still go on to things like Facebook and other platforms and go to very dodgy platforms where they end up with conspiracy theories. It is important that people have control over their own identity, their own information, but it is going to be absolutely crucial for the provision of Government services in particular, that people can have trust in the digitisation of their information and to be able to rely on it.

I will just mention RealMe, just for one moment, and that is simply to say that that was, what, 2013—it’s been 10 years since anything has been done to improve that, and 10 years in the digital space is like a century anywhere else. It is a shame it has taken this long for this bill to come through. It was first being talked about, actually, in a 2020 Cabinet decision, back in, I think, July 2020. It is very important that the whole of Parliament supports it. I just think that that’s a great way forward, and I’m very pleased to be able to support it as well.

This bill for me has two main impacts, and many speakers today have spoken about the protective elements, but it’s also about the ability to have ease of functioning in the digital world, both as individuals and as other person entities in the digital space. So there are two big benefits there, and, as others have said, we are moving increasingly into the digital space, whether it’s around accessing medical records or being able to have them handed, say, from one medical provider to another, or whether it’s setting up bank accounts, or whether it’s doing business or even contracts in the international space. There is a need to be able to have one consistent, safe, and easy way of establishing a digital identity, being able to trust it, and being able to work effectively. And I have to say that at times when I’ve forgotten my RealMe password, it has not been that easy to use that particular platform that the previous speaker raised.

There are also inconsistent standards currently, and so that is one of the things that makes it onerous for people—having one way of doing a secure digital identity for one function, such as banking, and then having to have a different one for a different thing, such as accessing Government services. So what this bill will do is create a framework, a regulatory framework, in secondary legislation that will enable that to happen, but also give it the flexibility so that as technology changes, the ability for the digital identity to keep up with technology will also be able to change.

That brings me to another element, which is around the need for good governance and the ability for the trust board to be able to access expertise. There are already functions in place to ensure that there will be diversity on that board, but, actually, what this framework will do is enable the board to be able to call in specialists, whether it’s Māori, whether it’s women, whether it’s Pasifika, children’s experts, and so on, so that as technology changes the board will be able to get the expertise it needs in order to ensure that there is inclusive considerations in the digital identity space.

The last part is really just a little bit more on the regulatory body, which the bill sets up in Part 5, and that is really also to monitor the performance and effectiveness of the accreditation regime, to undertake compliance and monitoring of the trust framework providers, receive and assess complaints, and investigate breaches. These are all fundamental elements of a good governance structure that oversees a framework to ensure that there is continual monitoring, evaluation, and learning from that so that we can be sure that as we move into this ever-evolving world, our digital identity keeps up with technology and continues to keep people safe but also allows ease of access of doing business and conducting day-to-day life. It’s a great bill. I commend it to the House.

E te Māngai, tēnā koe. Tēnā koutou e te Whare. I guess, just to outline for those who are following along this very fast-paced House this morning, that there are three key things that this legislation seeks to do, or three pillars of it.

The first in establishing the framework is for an opt-in Government accreditation scheme, which is, obviously, as outlined by other speakers, for digital identity providers across all sectors. But, notably, it is opt-in. The second thing that is does is establish a Trust Framework Board, that is the governance group that many others have alluded to, with responsibility for developing the rules for the accreditation scheme and running wider education and potentially guidance campaigns. The third thing that it does is set up that Trust Framework Authority to run the accreditation scheme, which involves approving accreditations, enforcement and compliance, and maintaining the registry.

So while I am stoked to see that we’ve support across the House and consensus on this really important framework, what it’s important to note is that this doesn’t quite go far enough to grapple with some of the challenges of our time, which some of the other speakers have also alluded to.

To that effect, it doesn’t look anywhere near as far as entrenching digital rights in the form of, kind of, a digital bill of rights format. It doesn’t grapple with the likes of people’s identity online and their digital footprint. It doesn’t grapple with, as we’ve sometimes discussed in this House, the issues around deepfakes and utilisation of people’s face or voice or identity in those places and spaces. This simply sets up a framework of accreditation for those who are utilising and providing services and the accreditation of identity to that effect.

So it’s a great start, but there’s so much more to do in this ecosystem. I just want to say that I agree with the sentiment, as expressed by the Hon Judith Collins, that there is so much more to do here. So frequently we see that this House is just catching up five or 10 years after we’ve seen that technological evolution. So perhaps there’s some work to do in a cross-party manner to that effect.

Throughout the committee of the whole House but also through the select committee stage, we’ve heard that there was a number of submissions from those who perhaps didn’t quite understand the purpose of this legislation. To that effect, we did, however, see that there were some quite substantive submissions from stakeholders who are really involved in this space. We had InternetNZ and the Council for Civil Liberties suggesting that this authority and this board should not exist within the Department of Internal Affairs (DIA) as it currently does. This is something which I alluded to in my second reading speech, and I’m stoked to see that the Minister has actually taken that on board, and what we now have here is the potential in the amended legislation that we’re debating at third reading to have this review after two years to ascertain whether it should be that the digital identity agency becomes its own stand-alone Crown entity, because, of course, it’s currently contained within DIA, and this did raise the spectre of concern for some of those stakeholders. I think when InternetNZ and the Council for Civil Liberties are raising those concerns, they are the things that should be paid due notice to.

We also obviously heard from InternetNZ and the Council for Civil Liberties that there should be broader requirements of consultation and appointments of, for example, people with disability or accessibility needs. We also heard from those who were suggesting that perhaps there should be rainbow representation.

I’d note that, as the Minister herself has outlined, there is, of course, the opportunity, or the discretion, for the Minister to appoint people with those skills or those lived experiences to the board. None the less, by virtue of what’s played out at committee of the whole House and the Greens’ proposals to that effect, there’s no guarantee.

So, once again, what we’re talking about here is a welcome step in the right direction, but it is an opt-in accreditation framework for digital identity. It doesn’t grapple with those far bigger issues of one’s rights online, of one’s digital footprint and the right to be forgotten, for example. So there’s still so much more work to do, and we continue to encourage the form of consensus that we’ve seen break out celebratoriously in the House this morning on this to the future challenges of our time in that technological space and the rights of citizens in Aotearoa New Zealand.

Thank you, Madam Speaker. I’ll just start by giving my thanks to the Economic Development, Science and Innovation Committee, as others have. I know it’s obviously a very technical bill, but also just, I guess, the huge number of submissions that came in at the eleventh hour, which were quite interesting in terms of what they were saying the bill was about. So, hopefully, we’ve allayed some of those fears, and convinced them that there’s just no way that the New Zealand Government is capable of actually doing what they’re worried about.

I’d also give my congratulations to the new Minister for the Digital Economy and Communications, and my commiserations to the old Minister—Hon David Clark—who’s here in the House to see it through, but, I guess, hey, it could be worse, right?

This bill establishes a framework that has been well traversed in this House. It enables secure user-authorised sharing of personal information. I’ll note from the legislative statement that it sets minimum standards for security and privacy, and ensures that those taking part in the scheme demonstrate that they meet the requirements for handling information.

Now, I think it will be very interesting to see how this all plays out—obviously, we support the bill—in practice, because the world of cyber-security is getting fairly ugly if we look at what happened over the last few weeks—being made aware of the hack on Latitude, as one example; we’ve got over a million New Zealanders who had their licence details hacked and leaked, passport information and addresses and those sorts of things. So it’s very personal information that’s been part of that. Now, I guess there’s a hypothetical question: what if this framework were in place and what if Latitude were a part of that framework? What would the ongoing effects of that be? What would the consequences be? And how would that affect the stability of the whole framework, of all those different participants that were in it? So if a company’s doing their best to comply and they’ve been certified, these things are going to happen, unfortunately, even once this is in effect. It will be very interesting to see how this plays out, since the consequences of these security intrusions are quite significant.

The consultation requirements in the bill with various stakeholders is well set out, well-thought-out, and we support that—how it’s done in the legislation.

I guess I’ll just finish by saying that it’s good to see that this bill is, at long last, going through the House, albeit under unusual circumstances. I’m guessing that the previous Minister is very proud that it’s doing so. So it will be very interesting to see how this plays out in practice. We shall support it. Thank you.

Motion agreed to.

Bill read a third time.

I declare the House in committee for further consideration of the Organic Products and Production Bill.