The government is intent on popularising Identity Check with both public services and private companies. File image Photo: 123RF
The government says there is strong demand for its new Identity Check system - even though half the cornerstone ministries are not interested.
Officials are defending the digital identity verification tool and the technology behind it, Google Analytics, which has been copping flak in Europe.
The government was intent on popularising the system with both public services and private companies.
It was already piloting it among young pub-goers.
"Demand is strong," lead agency the Department of Internal Affairs (DIA), told ministers in May, in a briefing released under the Official Information Act (OIA).
"The ability for customers to prove their identity in a fully digital channel in real-time has mass appeal."
DIA named the Ministry of Business, Innovation and Employment (MBIE), Waka Kotahi and the Ministry of Health among six "early adopters" of the tech it hoped would become ubiquitous for New Zealanders to access hundreds, if not thousands, of services online in the next few years.
But MBIE told RNZ it "has no current plans to use Identity Check".
"In mid-2022, MBIE determined that the proposed service in its current form is not suitable for use with the data collected by MBIE."
And the Ministry of Health said Internal Affairs never came back to it with anything to evaluate.
"The Department of Internal Affairs did not make a formal offer of a service as a result of any preliminary discussions," it said.
Another of the big six, the Ministry of Education, was also not on board.
Identity Check relied on verifying a selfie someone sent in, using facial recognition, against the driver licence and passport photo databases - and most children did not have those, it said.
"Any system the ministry investigates for digital identity or digital enrolment will be considered against the framework of inclusiveness and there being as few barriers as possible," the Ministry of Education told RNZ.
Waka Kotahi helped DIA test the new $125,000 portal that looked into driver licences, but that appeared to be it.
"Waka Kotahi does not plan to provide any further testing support," it said on Tuesday.
So why did DIA name-check to ministers agencies that are not, in fact, on board?
"While the service was being developed, we had discussions about Identity Check and its benefits with several agencies," it said yesterday on Tuesday.
"While some of the agencies we spoke to have advised they are not planning on using the service, we continue to hold discussions with a number of organisations."
Back in May, it told ministers the system had "been tested with some public and private agencies and demand is strong".
There was "active interest" from the University of Auckland, and telecommunications companies and banks, and from public agencies, such as Waka Kotahi, MBIE and the Ministry of Social Development (MSD).
MSD - one of the six - was taking it up.
In July it restarted its Covid-disrupted work on a new system to link with Identity Check, from June 2023, MSD told RNZ.
The documents show officials are still trying to figure out what to charge and if they should bill other government agencies.
A 12-month pilot in the private sector began in September, allowing people to go online to get a card to prove at the pub they are over 18.
"Customer feedback so far has been very positive," Hospitality New Zealand said.
Google in behind
Cabinet has backed a strategy of "driving uptake of modernised digital identity services", the ministerial briefing said in May.
As part of this multimillion-dollar, all-of-government programme, Internal Affairs had been shopping Identity Check around. Singapore has such a system already.
In behind Identity Check runs Google Analytics, the go-to tool that about half of all websites use to track and report on traffic; it creates metadata about who goes looking where for how long.
The way Google Analytics sends metadata back to the US for processing has fallen foul of regulators in Austria, Denmark, Italy, France, and the Netherlands this year.
Another two dozen other European countries were investigating companies using US providers that also transfer data Stateside - exposing it to access by US intelligence agencies.
DIA did not respond to if Google would send data from Identity Check to the US.
"DIA has not explored these concerns around overseas data transfers," it said.
This was because New Zealand privacy laws differed from Europe, and because it was using a licensed version of Google Analytics 360 so "all the information collected is held by Google as an agent of DIA, which prohibits Google from using it for their own purposes".
This is written into Google's contract, and the contract with multinational Daon, which runs facial recognition for Identity Check and RealMe.
Google Analytics 360 was up to 60 times more powerful than the basic version.
DIA said it needed to use it "to understand the customer experience".
A privacy impact assessment said: "This information is collected for the purpose of identifying pain points in the individual journey so that improvements can be made.
"Although this information is collected at an identifiable level it is always used at an aggregate level."
New Zealand was trying to stay on the right side of Europe's cornerstone data protection rule (called the GDPR) - and some reports suggest Google Analytics breaches the rule.
But Internal Affairs said, "Because we don't use the free version of Google Analytics, we don't believe this is relevant."
