Internal Affairs lawfully allowed to use facial recognition system - Waka Kotahi

Waka Kotahi says the law allows Internal Affairs to use driver's licence photos to verify a person's identity. Photo / Getty

By Phil Pennington of RNZ

Drivers' licence photos will not be run through the One Time Identity facial recognition system unless a person chooses it, the Transport Agency says.

Waka Kotahi NZ Transport Agency has created an interface with the OTI system being developed since 2019 by the Department of Internal Affairs (DIA), to enable access to drivers' photos for Covid-19 records.

Waka Kotahi said it was for the vaccine passport.

The Ministry of Health (MOH) said it looked at using the licence photos to support My Covid Record but took no action to access them as "this was neither warranted nor practical".

Waka Kotahi said the law allowed DIA to use driver's licence photos to verify a person's identity, however, it did not say if the MOH was allowed to do so.

"DIA will only be permitted to access the driver's licence images of individuals who choose this as an option for verifying their identity," it said.

"There has been no 'delivery' of images from the Driver Licence Register to DIA or any other agency."

DIA has been briefing agencies on OTI as part of an all-of-government programme to build a digital identity system, underwritten by incoming legislation.

"A key part of the proposed new digital identity system is the sharing of verifiable digital identity information and key attributes [of people], and one of the core services is the OTI service," Waka Kotahi told RNZ, which made inquiries after coming across a reference to OTI in a digital update released by NZTA under the Official Information Act.

The OTI system had been expanded beyond passport photos to include drivers' licence photos because it was identified this would lead to "improved uptake of the service", it said.

The Ministry of Social Development (MSD) also aimed to use OTI to verify clients' identities, but said it had dropped its plans two years ago to use people's "selfies".

"MSD does not have a policy that allows for the use of 'selfies' to confirm a client's identity when they visit a service centre, nor have we ever," MSD group general manager income Jo Herewini said in a statement.

Instead, one of the ways clients would be offered to confirm their identity would be by MSD getting a "notification" pass back from DIA after matching their name, their date of birth, and their passport or driver's licence, against existing databases using OTI.

"A business case has been developed and approved," Herewini said.

This was satisfactory progress after MSD had spent more than two years looking at using OTI.

Clients' need to interact online was highlighted by lockdowns, and a key component of online services was allowing clients to confirm their identity online, she said.

"We have systems and safeguards in place to control how we collect, manage and use client information to ensure it is handled appropriately."

A DIA email, discussing a request to hold some facial recognition security data offshore, raised the risk rating of doing this in part because of "the fact that if biometric data is compromised, it can never be fixed for the individual".

DIA has used OTI - also known as Identity Check - since at least 2019 in its citizenship, passports and RealMe application processes.

It was a "pilot" - "services such as [this] can take several years to develop. It is not uncommon for there to be gaps between discussion while services are being developed," DIA said in a statement.

"Over the course of Identity Check's development, we have discussed the potential to share the customers' selfie photos with the relevant organisation using the service - including MSD and MOH, but this functionality is not yet in use.

"As with all other personal information that might be shared as part of identity confirmation, the customer's informed consent would be required to share the selfie photo.

"The provision of driver licence images for the Ministry of Health's vaccine passport should be directed to the relevant agencies - what you've suggested did not involve any DIA technology and was not done using Identity Check."

Te Whatu Ora Health New Zealand said during the initial design of pandemic services, the use of photos from drivers' licences or passports as part of setting up a person's My Health Account "was considered".

"But it was determined that for the purposes of supporting My Covid Record, this was neither warranted nor practical, so it was never adopted.

"Consequently no action was taken to access photographs.

"The only information we have access to is written drivers' licence information through a third-party verification service."

One Time Identity has been discussed at a cross-agency group set up by the Public Services Commissioner that also included Police and the Education Ministry.