Further steps toward a national identity system in New Zealand

The New Zealand Government is moving forward in the development of a system for authenticating the identity of people accessing government services online.

The Government has decided that there will be a single agency responsible for the authentication and registration of individuals who wish to access government online services that require the identification of users.

This agency will issue password-based credentials for those whose identity has been authenticated and will make those credentials available to a service agency. The service agency would then link those credentials with an existing customer number to enable verification of identity.

The authentication agency will not hold any information on the individual itself, apart from authentication records and the password based identity credentials. It is thought about a third of government online services will require authentication of identity.

The Government has now directed that work proceed on the detailed design of this authentication model. It is likely that an existing government organisation largely independent of any direct service obligations will be selected as the authentication agency. Details of the authentication processes also have to be decided.

There is also talk of an appeal or review authority, which can intervene if an individual considers that he or she has been adversely affected by a decision made by an agency as part of the authentication process. A security certification procedure will also be established to check that service agencies have appropriate security processes in place before linking to the authentication system.

Privacy issues will also need to be addressed. In New Zealand, data matching between government organisations is prohibited unless authorised under the Privacy Act's information matching rules or authorised by statute. In addition, the use of a unique identifier across government agencies is currently prohibited. Legislative changes to the Privacy Act 1993 may therefore be required.

The design phase will be followed by a period of system development and various pilots. The system's detailed design is due to be completed in the first part of 2004.