Domestic law and policy

New Zealand’s digital ID is regulated by the Digital Identity Services Trust Framework (DISTF). ^[18]Under the DISTF, a digital identity service is defined as a “service or product that […] enables a user to share personal or organizational information in digital form”. ^[19]Examples of these services include verifying the accuracy of personal or organizational data, confirming its connection to an individual or entity, and securely facilitating information-sharing between trust framework participants. ^[20]This framework is designed to ensure privacy, security, and user control over personal data while fostering a trusted digital identity environment. ^[21]

The Digital Identity Services Trust Framework Regulations (2024) establish assessment criteria for providers, define digital identity services, and outline a complaints process. ^[22]The legislation mandates that accredited providers maintain an accessible, fair and timely complaints process and considers tikanga Māori principles where applicable. ^[23]Additionally, the Trust Framework Authority oversees compliance and ensures that accredited providers adhere to the established rules and regulations. ^[24]The government initially drafted the Digital Identity Services Trust Framework Bill as a stepping stone to the DISTF, which was referred to the Economic Development, Science, and Innovation Committee for further review and to incorporate Māori consultation and participation into the legislation. ^[25]

Data Protection

New Zealand’s primary data protection legislation is the Privacy Act (2020). ^[26]The Act governs the collection, use, storage, retention, and transfer of personal information to ensure individuals’ privacy rights are safeguarded. ^[27]The Act outlines 13 Information Privacy Principles (IPPs) that guide the processing of personal data, including information collected through digital identity systems. ^[28]

Several provisions of the Privacy Act offer safeguards for personal information within the digital ID framework. ^[29]IPP 1 mandates that personal information may only be collected if necessary for a legitimate agency function, ^[30]and IPP 2 requires that such information be collected directly from the individual concerned. ^[31]While the Act does not explicitly require encryption of digital ID data, Principle 5 states that personal information must be protected with reasonable safeguards to prevent loss, unauthorized disclosure, or misuse. ^[32]Additionally, IPP 10 prohibits the use of personal information for purposes other than those for which it was originally collected, except with the individual’s consent. ^[33]

Regarding government access to digital ID data, IPPs 10 and 11 impose restrictions on data usage and disclosure. ^[34]However, these principles also include exceptions that allow government agencies some discretion to share personal data for purposes such as public health, public safety, or to protect public revenue. ^[35]Similarly, IPP 9 requires that agencies do not retain personal information longer than necessary for its intended use, but it does not specify a specific time limit for data storage. ^[36]

The Digital Identity Services Trust Framework Rules (2024) outline operational requirements for accredited service providers, covering areas such as identification management, privacy and confidentiality, security, information and data management, and data-sharing protocols. ^[37]To become accredited, digital identity service providers must comply with these rules based on the services they offer. ^[38]

New Zealand is also in the process of establishing the Biometric Processing Privacy Code, expected to be completed by mid-2025, which will introduce stronger privacy safeguards, notification and transparency obligations and limits on some uses of biometric information. citation_39 This Code has also undergone public consultation. ^[40] There have been some concerns raised about the draft Code not including provisions for proper oversight and excluding the consent safeguard for users’ biometric data. ^[41]New Zealand’s Council for Civil Liberties also raised concerns about the potential for creeping surveillance due to the lack of a consent safeguard. ^[42]

International Commitments

New Zealand is part of the Digital Identity Working Group (DIWG), which includes eight member states working toward interoperable digital identity systems. ^[43] The DIWG has developed a set of interoperability principles to guide the development of digital identity infrastructure that is mutually recognized across borders. ^[44]

New Zealand is also a member of the Organisation for Economic Co-operation and Development (OECD), and aligns with the OECD Recommendation on the Governance of Digital Identity. ^[45]These recommendations emphasize the importance of user-centered and inclusive digital ID systems, strong governance mechanisms, and cross-border recognition of digital IDs. ^[46]

In relation to New Zealand’s human rights treaty obligations, legal frameworks and policies for New Zealand’s digital ID have not been found to contradict such obligations due to the optional nature of the digital ID and the relatively robust data protection frameworks mentioned in the above section. ^[47]

To comply with its human rights obligations, it is important for the country to continually ensure that the digital ID system does not become a barrier to essential services and access to legal identity, particularly for vulnerable populations.