A new facial recognition technology expected for the web
By RNZ’s Phil Pennington
A series of legal opinions have paved the way for greater use of facial recognition technology to prove who you are online, as the government moves to introduce a common identity verification service.
Big agencies are trying to come up with a “fundamentally different” approach that they say will make your online identity easier to prove, more secure – and much, much more useful.
The activation of the new technology is planned for the next year.
A Cabinet committee paper in June 2021 said legal hurdles faced the new technology – but it has since been designed to allow a facial recognition tool run by Internal Affairs to search the database of driver’s license pictures.
Five legal opinions said no change to the law was necessary.
Internal Affairs now says its tool, Identity Check (formerly called One Time Identity), could become the common service used to verify the identity online of anyone opting in to potentially access hundreds, if not thousands, of services, benefits banking, health checks. in student records.
“No legislative changes have been identified as necessary to support the future operation of identity screening,” the department said.
Singapore has such a service that 2.7 million people use to access 1,400 public and private services online but also at service counters, such as the local library. It compares a photo and identifying information someone submits to a massive government biometric database.
The proactively released Cabinet committee document and RNZ investigations show that seven major agencies here, led by Home Affairs, have been working on a new approach for the past year.
He asked DIA to prepare a business case for investing in a “fundamentally different” approach to digital identity, to unlock $1.5 billion to $9 billion in economic benefits. Three options have been described, but are hidden in the document.
“The Cabinet paper instructed officials to explore this as a consent-based online identity verification option for citizens,” Home Affairs told RNZ.
The newspaper said: “The department will develop an implementation plan for verifiable credentials and the common verification service.
“The department will prepare to implement the technical solutions.”
The current government system, RealMe, has 870,000 users – it was modernized recently but has a reputation for being cumbersome and is little used.
The new approach involves six “early adopters”: ACC, MBIE, MSD, Waka Kotahi, Health and Education.
Any new system will depend on a person sharing their personal “key attributes”. Biometrics about you, such as your image, is a key attribute.
The paper said, “The proposed approach… will allow a wider range of identifying attributes to be considered part of a person’s digital identity.”
The agencies were asked to “investigate the possibility of making more attributes available by consent”.
MSD told RNZ that its use of the new technology would involve sending customers who wish to use identity verification to internal affairs to run the facial recognition verification, and DIA would then return a “notification pass”. at MSD.
The Cabinet document said the new technology for digital identity changes should be available from mid-2023, which is also the date Internal Affairs told RNZ that it planned to activate the identity check.
However, there are problems: a detailed business case is seven months overdue, there is no sign of an internal affairs implementation plan, and the privacy impact assessment is still in development.
The cabinet paper says legislative changes would be needed in addition to a bill currently before parliament that will establish a digital trust framework to regulate the operation of public and private identity services and who is authorized to do so. to manage.
Digital Economy Minister David Clark did not respond to multiple requests for comment.
He previously said the trust framework is vital: “We know that proactive technology adoption will only happen when people have confidence that the information they share online is being treated securely.”
The Office of the Privacy Commissioner, in its opinion on biometrics, says concerns remain about the sensitivity of the information and general lack of transparency, potential uses for surveillance or profiling, whether whether the information people consent to give is then shared for use in new roles, and risks related to bias and discrimination.
The Cabinet Committee paper talks about the possible “reuse” of information in digital identity systems by agencies.
The possibility of Identity Check becoming the nation’s common verification service has increased now that Waka Kotahi has built a portal or interface. This allows him access to the huge pool of driver’s license photos. Home Affairs said it was the “appropriate” agency to run the joint service.
The cabinet committee document provided for this by saying:
“Waka Kotahi could take on a bigger role in the digital identity system by providing better access to driver’s license information while also leveraging modernized digital identity services to improve its identity verification processes. identity when issuing permits.
“This would involve significant changes to Waka Kotahi’s technology systems, application processes and the legislation that governs some of its services.
“Waka Kotahi has indicated that it is not in a good position to pay for this transformation from existing funding.”
NZTA told RNZ “there is no basis in fact” for any claim that its work represents a significant expansion of facial recognition.
Internal Affairs requested five legal opinions, including that of the Privacy Commissioner, one on the search for passport photos, four on driver’s license photos.
“To be clear, nothing has been significantly extended or brought online, what we have done is background work,” he told RNZ.
Beyond the work of the NZTA, “legislative changes in some cases [will be] necessary,” the cabinet committee document reads.
Internal Affairs “has worked with a range of agencies to identify potential legislative implications for agencies improving services using digital identity solutions and/or making the information they hold available for consent-based reuse.”
The department has also created a “confirmation agreement” for organizations that want to use Identity Check.
The Cabinet document said there had “already been proof-of-concept testing for some of these capabilities”.
The work of the NZTA portal has been spurred by the Department of Health’s interest in using the identity verification system around Covid-19 services, according to a document and statements.
Internal Affairs said a privacy impact assessment had been updated to identify risks related to driver’s license photos.
The NZTA has not carried out its own privacy impact assessment.
Although Internal Affairs has told RNZ that the assessments “should be readily available to the public once they are completed”, the driving license assessment is not, as it is still in development. .
The most recent assessment available on the Internal Affairs webpage that lists them is from 2018.
A tender notice from the NZTA says it wanted driver’s license processing to be interoperable with Australia.
Interoperability between digital identity systems is one of the main goals of a group of eight countries, including New Zealand, created in 2020 to boost trade.
The Cabinet committee paper also stresses that Maori must be consulted on digital identity changes. RNZ has contacted iwi data experts for comment.