NZ is moving closer to digital IDs – it’s time to rethink how we protect our valuable data: Markus Luczak-Roesch

The digital ID scheme aims to ease transactions such as opening a bank account or accessing government services. Photo / Getty Images

THREE KEY FACTS:

• The Digital Identity Services Trust Framework Act 2023 came into effect on July 1. Its purpose is to create a digital identity environment that is safe and trusted by the people who use it.
• The framework includes rules and regulations for accredited digital identity services to help protect people’s information and privacy.
• The regulations require that consent is always needed and someone’s information is not stored or held by an accredited digital identity service provider in a way that breaches privacy.

Markus Luczak-Roesch is a professor of informatics and chairman in complexity science at Victoria University of Wellington.

OPINION

New Zealand shifted closer towards digital credentials for access to online services this month with the launch of the Trust Framework Authority. It will determine which organisations are verified to provide digital identity services.

The digital ID scheme aims to ease transactions such as opening a bank account or accessing government services by moving identity verification away from physical documents.

This has the potential to transform New Zealand’s digital economy, and Minister for Digitising Government Judith Collins has already suggested she wants to expand the Government’s use of artificial intelligence (AI), including in health and education.

But both the launch of the authority and the push to expand AI are significant developments that need to be considered in the wider context of the principles on which our digital economy runs.

While digital ID is key to access and trust in digital services, it needs to be protected and managed in accordance with our values, including personal, community and national perspectives.

Digital ID is only one aspect of a wider digital economy. We have to consider more systemically how we develop new digital services and who develops them.

Our new report, collaboratively produced by researchers from the Veracity Technology Spearhead project and the domestic cloud provider Catalyst Cloud, shows how digital ID is tightly interwoven with data management and information flow more generally.

We highlight how the latest developments open a window of opportunity to fundamentally adjust how we build digital systems towards a decentralised model that disentangles data management from data processing.

According to a recent OECD report, such an adjustment is urgently required to ensure citizens and businesses have choices and are safe in a digital world.

Global developments in data infrastructure

Many countries are recognising the importance of having their own national data infrastructures.

In Estonia, the X-Road system has been a pioneer in this field. Launched in 2001, it is the foundation of the country’s e-government services, allowing secure data exchanges between public and private sector databases.

This infrastructure has enabled Estonia to become a leader in digital government services, from online voting to digital health records.

The European Union’s Gaia-X project aims to create a federated data infrastructure for Europe, promoting sovereign and interoperable data spaces. Recently, the EU launched a pilot phase of its digital identity wallet initiative, with uses ranging from banking to mobile driving licences and electronic prescriptions.

The Flanders region in Belgium is the first in the world to establish a data utility provider to drive adoption of and innovation around so-called data vaults, using the Solid platform. This includes a service that allows citizens to take full control over data they accumulate throughout their professional careers, from qualifications to payroll data from various employers.

Future applications for digital ID schemes will include transactions such as opening a bank account.

Local businesses give away their data

While these global developments are promising, many local businesses find themselves in a difficult position. They rely on services provided by large tech companies for their digital operations, inadvertently handing over data in the process.

Small retailers, for instance, may use e-commerce platforms that collect and analyse customer data. While these platforms provide valuable services, they also leak insights that can be used to compete with the very businesses they serve.

A prominent example of the risk of uncontrolled data outflow is Samsung’s ban on the use of ChatGPT. Concerns arose that sensitive information would be leaked through the prompts employees used. This would become accessible to OpenAI and other users of ChatGPT by becoming part of the foundational language model that underpins it.

Similarly, farmers using smart agriculture techniques may be sharing data about their crops, yields or soil quality with the service providers. This information becomes a valuable asset, but farmers cannot access or leverage it independently.

The challenge for local businesses is clear. They need digital tools to remain competitive, but using these tools often means surrendering control over the data they collect. These data, in turn, fuel the growth and dominance of large tech companies, creating a cycle that’s difficult to break.

Rebalancing the playing field

AI start-ups should have more options for accessing a competitive foundation model than to adopt one that has been created by multinational companies under unclear conditions.

This carries the risk of building technology that unknowingly imports components that may have been developed unethically, or which embed values that are incompatible with the local context.

Norway has demonstrated leadership in this area. Its research centre for AI innovation, NorwAI, develops and maintains a suite of Norwegian Large Language Models built on Norwegian data and values.

NorwAI and the data utility company in Flanders are two examples of the potential for completely new organisational forms that generate value in a data infrastructure ecosystem. They exemplify that data infrastructures are key to rebalancing the digital economy for the benefit of everyone.

They also show data infrastructures are not about creating walled gardens or preventing free flow of data when necessary. Instead, they provide protections so data flow happens only on agreed terms, and under full disclosure of what occurs once data have been transferred.

The path to creating equitable national data infrastructures is complex and will require collaboration between governments, businesses and civil society.

However, the potential benefits — increased innovation, fair competition and democratised access to the digital economy — make it a journey worth undertaking.