FutureFive New Zealand logo
Consumer technology news from the future
Story image

It's time for Kiwis to define the meaning of digital identity in Aotearoa

By Sara Barker
Thu 28 Oct 2021

In late September, the government introduced a new bill to parliament that would fundamentally pave the way to digital identity for citizens in Aotearoa, New Zealand. 

The Digital Identity Services Trust Framework (DISTF) Bill is the brainchild of Minister of Digital Economy and Communications, David Clark. Last week, the bill passed its first reading. So what is it, and what does it stand for?

Digital identity - an overview

Digital identity is any piece of data or information that helps to identify you as a person through digital services, particularly over the internet. For example, most people will have a digital identity linked to their bank account, Inland Revenue login, passport applications, and online shopping.

In May 2021, Clark said that digital identity is a crucial enabler to the overall Digital Strategy for Aotearoa. This strategy strives to turn New Zealand into a 'world class digital nation'. He believes that New Zealand can bank on its reputation as a nation of 'ethical innovators'.

He notes that other countries with mature economies have pegged the value of digital identity between 0.5%-3% of GDP. In New Zealand dollars, that could be between $1.5 billion to $9 billion.

"Whether it's opening a bank account, sharing our medical history, conducting business online, or applying for Government services like the wage subsidy, it's vital we trust the systems we use, and that service providers know what's expected of them."

But, he admits, it has been hard to roll out digital services because there are no consistent standards that govern digital identity.

"Without these solutions, people will continue to face difficulties sharing information about themselves. They are also more exposed to risks including online fraud and other privacy breaches."

The bill is designed to achieve a clear path to identity regulation and information security both for New Zealanders and the broader digital economy.

"We are working closely with our international partners so that New Zealanders' digital identities are recognised overseas, including places like Australia. A trusted modern digital identity system will help grow our digital economy, transform government services and ensure all New Zealanders can take part in the digital world," says Clark.

The business community also feels that the path to digital identity has been anything but straightforward because there isn't enough collaboration, innovation or interoperability within identity services.

We've had government services like the online verification platform RealMe since 2013, there aren't too many examples of strong digital identity services. However, the upcoming COVID-19 vaccine certificate and passport system will be linked to digital identity and the details are yet to be fully explored. 

Clark has a vision in which businesses and individuals can prove more things online, cutting down on paperwork. This is where the proposed legislation comes into play.

A closer look at the Digital Identity Services Trust Framework Bill

The bill aims to take digital identity services further by rolling out requirements for all service providers, both the public and private sectors, who need to use identity verification services as part of their business. The bill works hand-in-hand with the legislation set out in the Privacy Act 2020, and it gives digital identity service providers to opt-in once their systems are ready.

"The Government is committed to enhancing trust and confidence in how organisations handle personal and business identity information. The legislation will ensure that everyone is clear on their rights and obligations," says Clark.

The bill has four aims:

  • To help drive consistency, trust, and efficiency in the provision of digital identity services
  • To support the development of interoperable digital identity services
  • To provide people with more control over their personal information and how it is used
  • To enable the user-authorised sharing of personal and organisational information digitally to access public and private sector services.

According to the government, the bill means that Kiwis can have more trust that their data is protected and private, and it also provides more control over how and when they share their information. And, of course, it aims to provide easier access to digital services from from the public and private sector.

The DISTF bill also aims to boost business efficiency and deliver better, more accurate information with higher trust and lower risk, as well as giving businesses more confidence meet regulations as they invest in digital services.

The government also promises to better detect and prevent security and privacy breaches, deliver better services for citizen-consented information sharing, and provide better alignment with international peers.

A vital part of this is the bill is the Trust Framework (TF) - a set of legislation, rules and regulations that all accredited digital identity service providers must follow. A governance board will be responsible for educating, shaping, and monitoring the framework. Some of these board members need to understand te ao Māori approaches to identity, technology, and identity data management. The board will also work with the Office of the Privacy Commissioner, TF providers, and te ao Māori stakeholders to address identity, technology, and identity data management.

It's early days, but feedback is cautiously optimistic

Supporting the push for digital identity is Digital Identity New Zealand (DINZ), a member consortium of New Zealand technology and other businesses including Air New Zealand, Auckland Transport, Callaghan Innovation, Centrality, Google, IBM, Inland Revenue, The Ministry of Business, Innovation and Employment, the Ministry of Education, The University of Otago, and security firms including Okta and Red Hat, as well as many others.

Collectively, DINZ sees a future in which "people can express their identity using validated and trusted digital means in order to fully participate in a digital economy and society". To do that, a digital identity ecosystem must follow three criteria: It must enhance privacy, it must enhance trust, and it must improve access for all New Zealanders.

When we approached DINZ for this story, several DINZ members contributed their thoughts. However, due to tight deadlines, we quote DINZ in this story based on responses from individual, unnamed members. These responses do not represent a consensus from the membership as a whole.

Overall, feedback on the bill from DINZ members has been positive, but it will need tweaking. That is exactly what the consultation process is designed to achieve.

"It's exciting to see this take shape, and success will come through community and industry collaboration and consultation with government. Several of our members and stakeholders from their organisations took part in the mahi that resulted in the bill's formation. We're eager to keep contributing our members' ideas and experiences to the Select Committee process and what follows from it."

DINZ says the bill is on the right track, although it comes from a more 'government-centric perspective'.

"Some industry observers have already indicated the need for clarity between the role of the regulator providing the guardrails (assumed to be the government) and RealMe's participation in the ecosystem as an identity provider or verifier." 

"It's a small market, RealMe is a dominant player, and the government will be acutely aware of not only the need to separate its own interests, but also be open to suggestions that 'counter-balance' the understandable government-centricity."

That means the DISTF's scope needs to be adaptable and support many different use cases - it can't just be limited to government thinking.

DINZ also wants to encourage national and international service providers to get involved in the bill's consultation to ensure it works from an operational and people perspective. That could mean public-private investment partnerships in a similar vein to the Ministry of Business, Innovation and Employment (MBIE), which seeks assistance from IT professionals to understand what skills and experience potential immigrants in IT need to have.

"Members would like to see reflected in a future relationship between government agencies and the digital identity industry - for example, research, information & education dissemination to the private sector and wider community, perhaps extending to some role in the accreditation/certification function. "

Karaitiana Taiuru, a Māori academic, is at the forefront of Māori data sovereignty advocacy and change.

Taiuru says the bill is a great start and has potential, but it needs comprehensive and transparent consultation with communities, as well as Māori, hapū, iwi and Māori organisations. 

"In te ao Māori, our identity is our whakapapa – the most sacred aspect of all things that we are entrusting to a government framework."

"For those of us who are connected to the internet, it will be great to not have to fill in the same details multiple times in multiple forms and security checks should be a lot easier in addition to greater individual protections against things like fraud."

"I expect this will create a more streamlined process without the need to physically visit government agencies where staff may not have the cultural knowledge to be able to understand needs or provide the best services," says Taiuru.

How the bill wants to incorporate te ao Māori, values and culture

If there is one thing that sets this bill apart from other countries' digital identity systems: It considers how te ao Māori approaches to identity are considered in trust framework governance and decision making.

David Clark remains committed to ensuring that the digital identity system reflects Māori perspectives.

"Put simply, identity means different things to different people and cultures. That's why, my officials are engaging extensively with iwi to deliver this framework in a way that supports tikanga Māori."

DINZ believes it could be a once-in-a-lifetime opportunity to create a people-centric system underpinned by Te Tiriti (The Treaty of Waitangi) and indigenous values. Not only does it bring a Māori worldview to a discussion about digital identity and the country as a digital nation, but it also opens a door to other values and principles that represent who and what Aotearoa, New Zealand means for all communities.

"It's also important for Māori to be empowered to have Kāwantanga (governance) and Rangatiratanga (self-determination) regarding their digital identity. So it was good to see this aspect explicitly focussed on. Identifying oneself in terms of one's whakapapa, sensitivities and acknowledging 'rangatiratanga' in Article 2 of the Te Tiriti o Waitangi are all woven into the fabric of Māori culture."

"Consider the case of identity-related information form fields when enrolling with a service provider online today. Do they take these factors into account? One of the clearest themes emerging from hui on the digital strategy is that trust in digital services is earned by actively co-creating with communities on these services' design, delivery, and accountability mechanisms. 'Everything happens at the speed of trust.'

However, Taiuru notes, "The COVID-19 lockdowns are a reminder to some that Aotearoa, New Zealand still has a digital divide that primarily consists of Māori and Polynesian families and other low socio-economic groups as well as the elderly and some rural communities. My primary concern is for those in the digital divide and the potential to miss out on government services and benefits."

"At first glance, there are a lot of positives to the Bill, and we are increasingly seeing Māori and Te Tiriti being considered into new legislation and bills. Te Ao Māori perspectives have been partially included and the opportunity for genuine co-design and some other Te Tiriti principles are recognised. However, I would have preferred to see a much wider acknowledgement and protection to Māori rights to data including the recognition of tikanga Māori/Māori philosophies than what is currently in the draft bill."

Taiuru believes that the government has missed an opportunity to recognise and legislate for Māori Data Sovereignty Principles.

"Some of the Te Tiriti principles are included in the Trust Framework principles, but not all, and they are not clearly identifiable. The principles do not mention Māori data sovereignty, even in the te ao Māori approaches to identity principle."

"The principles need some major rethinking from a te ao Māori perspective, and the principle should explicitly state that Māori data is a taonga. Instead, it will be left to Māori to at some stage make a Waitangi Tribunal claim to have Māori data recognised as a taonga."

"There is also no mention of the United Nations Declaration on the Rights of Indigenous Peoples, despite it being very relevant here and little consideration of the ongoing consultations of WAI 262 in the Waitangi Tribunal."

Taiuru also touches on another issue that the bill does not clarify: data storage, particularly in cases where data is stored overseas and subject to other countries security and privacy laws.

"It would be beneficial to have it legislated that the data would be stored in New Zealand, recognising Māori Data Sovereignty principles," argues Taiuru.

This brings up an important point about the role of Māori data sovereignty, which is a multi-faceted topic in its own right. It needs to be weaved into any conversation about digital identity.

Taiuru highlights the potential for issues around data use and misuse if the government requires all personal information to be in one place.

"There are risks of passport and driver licence photos being used and then for facial recognition, noting the current biases for Māori and Polynesians. There is also the risk that at some stage further bioinformatics such as Guthrie Cards could be sequenced for DNA and added to the system, noting this would be the safest way to prove the identity of an individual and their family."

"Births Deaths and Marriages are consulting about whether to use Māori individuals' iwi and hapū information on birth certificates. This just adds another complex layer of potential discrimination and Māori identity issues to a government that has intergenerationally not been trusted by Māori."

Trust, data use (and potential misuse) are valid concerns, which leads to another point - how data is used and protected.

What this all means for cybersecurity

As with any discussion about digital identity, there are important questions to be raised about cybersecurity, data privacy, and preventing potentially life-destroying issues such as identity theft and security breaches. The Trust Framework (TF) rules call for minimum security and risk requirements - namely, "ensuring that information is secure and protected from unauthorised modification, use, or loss". 

 DINZ says cybersecurity is a 'moving target' as attackers go after data at rest, and in transit. On top of that, legitimate businesses are trying to find new ways to use data they've already collected.

"People will need to be able to trust digital systems with their identities. They will need to see robust measures to monitor, notify, and remedy potential abuses of data inside any service provider's system. They will also need to know about specific social risks related to personal identification information such as biometric data capture. Further, the potential abuse of consent within personal relationships and guardianships should also be catered for."

Those participating in the TF must also analyse those within the digital identity scheme based on ensuring security, confidentiality and privacy of their information. That means those joining the scheme will be analysed based on their information and data security. If there are holes in these areas, likely, they would not be accredited.

In cases of identity fraud, economic loss, physical, or emotional harm caused by a TF provider, the TF authority could issue a public warning. However, in the event of security breaches, the TF authority won't post details of any vulnerabilities because people could exploit them.

DINZ also points to potential discrepancies and service levels between providers who adopt the TF within their businesses, and providers that choose not to.

"It's a delicate balancing act between raising the bar high enough to achieve trust through security and privacy, without unduly compromising levels of adoption by service providers in sufficient numbers to ensure the DISTF's success."

"Overseas there are examples of non-accredited/certified service providers typically with significant brand presence having higher adoption rates than accredited/certified service providers. It's in Aotearoa New Zealand's interest to see global brands that already operate here and those that are yet to arrive, be accredited/certified."

DINZ continues, "The interoperability with other Trust Frameworks and standards in force internationally is acknowledged in the bill. This is typically done as a series of mappings that help assessors determine the relative conformance of a service provider's service accredited/certified to one Trust Framework to another, such as the DISTF."

"Developing and maintaining these mappings helps international service providers by reducing the incremental time and cost for compliance with an additional Trust Framework - whether it is international seeking to operate in New Zealand, or a local business seeking to operate internationally. This is another area where members are keen to discuss industry's operational knowledge and experience."

Submissions for the DISTF bill close at 11PM on Thursday, 2nd December 2021. More information here.

Public Interest Journalism Fund logo
Public Interest Journalism funded through NZ On Air.
Related stories
Top stories
Story image
Could New Zealanders initiate a cyber attack from within?
The threat landscape is significantly increasing worldwide, and the opportunities it presents are a growing concern in Aotearoa.
Story image
The path to bolstering supply chain security in New Zealand
A significant amount of today's business and leisure activity relies on IT supply chains. From complex international freight trades to local small business distribution channels, any supply chain that involves IT infrastructure serves as a crucial tool in our daily lives. 
Story image
Digital Transformation
SAP partners with New Zealand Rugby for digital transformation
The multi-year partnership will see SAP advance NZR with its organisational operations, team performance, fan experience and sustainability goals.
Story image
Microsoft NZ and TupuToa to boost diversity in cybersecurity sector
Microsoft NZ has teamed up with TupuToa to co-develop a cyber security employment programme specifically aimed at creating more diversity in Aotearoa's cybersecurity sector.
Story image
Poly introduces new smart devices and announces Amazon e-store in Australia
Poly is introducing two new pro-grade devices to the market and announcing its first official Australian e-store on Amazon.
Story image
New digital traffic light system to tackle construction defects
Smarter Defects Management launches its PaaS digital system and says it will revolutionise managing defects in the construction industry.
Story image
Hands-on-review: GoPro Hero 10
I have a long history with GoPro; I still remember getting my first camera when I was 16, using it to film Parkour and the day I lost it down a dingey crag. 
Story image
Sony to bring new 1000X series WH-1000XM5 headphones to the market
Sony has announced the newest edition of its award-winning wireless headphones, with the 1000X series WH-1000XM5 noise-cancelling model.
Story image
TUANZ to address rural connectivity at 2022 symposium
TUANZ is hosting the Rural Connectivity Symposium for the first time in person since 2019, providing a forum to discuss the state of rural connectivity.
Story image
Chorus and Nokia launches first trial of 25G PON broadband
Chorus and Nokia have announced the successful demonstration of 25 gigabit per second fibre (Gbps) broadband technology at the Chorus Fibre Lab in Auckland. 
Story image
PNY launches XLR8 Gaming EPIX memory products in A/NZ
PNY has launched its XLR8 Gaming EPIC-X RGB™ DDR4 Silver 3200MHz and 3600MHz memory products in Australia and New Zealand.
Story image
TikTok launches community-inspired effect capability
TikTok has announced the launch of its Effect House feature to allow its users to create and share Community Effects.
Story image
Microsoft backing Māori and Pacific wāhine in tech industry
A new initiative focused on getting Māori and Pacific wāhine into the tech industry and backed by Microsoft, NZTech and the government is calling for tech companies to get involved.
Story image
Hands-on-review: Creative Outlier Air V3
Creative is back with the third version of its affordable Outlier Air wireless earbuds range - aptly named the ‘V3’. And this time, they come boasting ambient mode and active noise reduction.
Story image
Mastercard users can now use rewards points in gaming
Mastercard has launched Mastercard Gamer Xchange (MGX), allowing APAC consumers to convert their rewards points into gaming currency.
Story image
Dynabook launches new Tecra A40-K and A50-K models
Dynabook has announced two new additions to its Tecra range, with both said to help promote flexible working solutions while also reducing the strain on IT managers.
Story image
Jabra reveals its latest portable headset Engage 55
Jabra has launched the Engage 55, the newest product in Jabra's Engage series designed for ultimate call security and quality.
Story image
WhatsApp and QR codes the next scam threat - report
KnowBe4 has warned it expects to see an increase in QR Codes and the WhatsApp chat platform being used for phishing and other scams. 
Story image
First Table
First Table set to revive restaurant commerce in NZ with platform launch
A new restaurant booking platform has launched in New Zealand, giving Kiwi diners the opportunity to save and book at a variety of restaurants around the country.
Story image
Artificial Intelligence
Google to enter the smartwatch market with the Google Pixel Watch
Google has provided a first look at its new Google Pixel Watch, which is set to make an entry into the competitive smartwatch market.
Story image
The AI Forum helps NZ pave the way with AI sustainability practices
Non-profit organisation The AI Forum is helping Kiwis learn about addressing climate change issues through the use of AI technology.
Story image
Apple previews new features for users with disabilities
Apple says new software features that offer users with disabilities new tools for navigation, health and communication, are set to come out later this year.
Story image
Hands-on review: Technics EAH-A800 Noise Cancelling Wireless Headphones
Designed in Osaka, Japan, these headphones just exude quality. They aren’t heavy, but they feel well built and solid.
Story image
D-Link launches new G415 Smart Router as part of EAGLE PRO AI range
D-Link A/NZ has announced the launch of its new G415 AX1500 4G Smart Router as part of the new EAGLE PRO AI Series.
Story image
Hands-on review: 32GB PNY XLR8 Gaming MAKO 6000MHz DDR5 memory kit
PNY’s XLR8 Gaming MAKO DDR5 memory modules are designed to get the most out of systems based on Intel’s 12th generation Alder Lake CPUs.
Story image
Wireless Nation
Wireless Nation, N4L provide 4G network to remote NZ schools
Wireless Nation and Network for Learning (N4L) have rolled out the Rural Connectivity Group’s (RCG) new 4G network to better connect three Chatham Islands schools.
Story image
Digital Marketing
Getty Images delves into the world of NFTs with Candy Digital
Getty Images and Candy Digital, the next-generation digital collectible company, have announced a new multi-year partnership agreement.
Story image
Hands-on review: Steelseries Aerox 9 Wireless and Aerox 5 gaming mice
Steelseries offered two interesting mice for review, the Aerox 9 Wireless, aimed at MMO/MOBA players, and the Aerox 5, a wired mouse for multi-genre use.
Story image
IDC finds 3.9% decline in worldwide tablet shipments
Preliminary data from IDC's Worldwide Quarterly Personal Computing Device Tracker has found tablet shipments reached 38.4 million units during Q1 2022, a year-over-year decline of 3.9%.
Story image
Hands-on review: STM laptop bags
The advent of hybrid working has meant we need laptop bags. We got our hands on two of the most popular laptop bags from STM.
Story image
Microsoft unveils adaptive accessories for disability access
Microsoft is introducing an expansive Inclusive Tech Lab to give people with disabilities greater access to technology through new software features and adaptive accessories.
Story image
i-PRO releases smallest AI-based surveillance camera on the market
The new i-PRO mini network camera is now available, with a pocket-sized form factor and full AI analytics functionality.
Story image
Hands-on review: MSI MPG Z690 Carbon WIFI motherboard
It’s all change with Intel’s 12th generation CPUs. We have a new chipset in the 600-series, a new socket with the LGA 1700, and new DDR5 memory.
Story image
WolfVision announces new range of visualisers
WolfVision has announced a new range of visualisers to help meet multiple industry demands for remote learning and educational solutions.
Story image
Hands-on review: HyperX Pulsefire Haste wireless mouse and HyperX Pulsefire XL Mat
With its lightweight Pulsefire Haste wireless mouse and RGB lit Pulsefire XL Mat, HyperX sets out to up your game and add a little colour to your desktop.
Story image
Dynabook refreshes Portégé X30L series with the Portégé X30L-K
The new model contains hybrid-architecture Intel 12th Gen Core P-Series 28W processor options, Wi-Fi 6E, along with Intel Iris Xe graphics.
Story image
Tyson Beckford partners with Element Case on new AppleWatch band
Celebrity Tyson Beckford has collaborated with STM Brands' Element Case brand to create a rugged new accessory.
Story image
Digital Signage
MAXHUB's Digital Signage range to bolster boardroom productivity
The new MAXHUB Digital Signage technology is purpose-built to make every kind of team meeting more effective.
Story image
Hands-on review: Corsair 32GB Vengeance 5200MHz DDR5 DRAM kit
Corsair’s Vengeance 5200MHz DDR5 DRAM offers PC users an entry-level upgrade to the new memory standard allowing them to get a little bit more out of their new Alder Lake CPUs.
Story image
Hands-on review: Amazon Kindle Paperwhite Signature Edition
In almost every respect it works like a book, apart from the fact that it weighs next to nothing, fits in my hand perfectly, and is soothing on my eyes.
Story image
i-Pro announces newest solutions as rebranded enterprise
i-PRO APAC Oceania has introduced its newest high-resolution mid-range cameras, with combined edge AI analytics and resolutions of up to 4K.
Story image
Hands-on review: Norton Anti Track 19 software
We get hands on with Norton's new privacy tool that was introduced in March 2022.
Story image
Logitech releases new mouse with ergonomic and sustainable focus
Logitech has announced the Logitech Signature M650 Mouse and the Signature M650 for Business Wireless Mouse, both with new ergonomic features and capabilities.
Story image
Hands-on review: WD_Black SN770 NVMe SSD Game Drive
Western Digital expands its WD_Black range of NVMe solid-state drives with the WD_Black SN770 Game Drive.