Digital ID: What could actually go wrong if the privacy safeguards work?

In brief

• Govt.nz says digital credentials and verification histories remain encrypted on users' phones, beyond government access.

• Digital age checks can protect privacy by revealing less information than traditional identification.

• Businesses may retain separate records that, combined with other data, could reveal sensitive information.

• More verification could create unnecessary records and new conditions for participation, as New Zealand experienced with vaccine passes.

The biggest privacy risk with digital ID may not be government surveillance. It may be the growing expectation that we verify ourselves for everyday activities that previously required no identification.

Every additional verification creates the possibility of another record. By itself, it might reveal very little. But combined with other information, it could expose details of someone's activities, interests and associations that were never intended to be shared.

Centrist has previously examined the government's plans to collect communications metadata and the proposed digital Kiwi Access Card.

But what could go wrong even if the government's privacy safeguards work exactly as intended?

What the government can and cannot see

According to the government's published privacy policies, credentials and verification histories remain encrypted on users' phones. The government says it cannot see where or when credentials are used, and the organisation that issued them is not notified.

Its NZ Verify application also says it does not retain individual verification records, although it collects aggregated, non-identifying statistics.

The government says the wallet has undergone independent security and privacy assessments and received accreditation under the Digital Identity Services Trust Framework, although no system is immune to breaches or misuse.

But there is still a record

The Govt.nz wallet keeps an encrypted history of credential use on your phone.

The government says this allows people to review their verification activity while keeping the records beyond government access. But this doesn't explain why such a history needs to be maintained, how long it is retained or whether users can disable or delete it.

For someone simply proving they're old enough to buy a drink, the practical benefit is not immediately obvious.

If digital credentials become commonplace at venues, private services and online platforms, your phone could accumulate a history of those interactions.

For most people, that might be little more than an administrative record. But what if someone else gained access?

Consider someone in a controlling or abusive relationship whose partner pressures them into unlocking their digital wallet.

If the activity history reveals visits to particular venues or services, information intended solely for the user could become a means of monitoring or intimidation.

The wallet's biometric and PIN protections make unauthorised access difficult. They cannot necessarily protect someone who is coerced into granting access.

This is a hypothetical scenario. But it illustrates why information can remain sensitive even when it never leaves your device.

What happens at the other end?

The government's wallet might disclose only that you're over 18. But the business or website requesting verification has its own systems.

Imagine joining an age-restricted website. Your digital wallet confirms you're old enough without disclosing your name. But the website already has your username and email address and might retain a record of the verification.

If its database were breached, information about your activities and verification history could be exposed.

The government's wallet could have worked exactly as intended. The vulnerability would lie in the information retained by the website.

That doesn't mean businesses can collect or retain whatever they like. New Zealand's Privacy Act 2020 limits unnecessary collection, retention and use of personal information.

The government's proposed under-16 social-media legislation also includes restrictions on using and retaining information collected for age assurance, along with requirements for alternatives to formal identification and digital identity services. 

Those protections are proposed, not yet law. But safeguards depend on how organisations implement verification and comply with their obligations.

When small records add up

This brings us to a less obvious privacy risk, sometimes called the mosaic effect.

Consider separate records showing that you verified your age on a website, joined an online discussion, used a financial service or visited a particular venue.

Each record, taken alone, might reveal very little.

But combine those records with other information, such as account details, purchases, login times or existing customer databases, and a much more detailed picture of someone's activities, interests and associations could emerge.

The records would need to be accessible and capable of being linked. That is not something the Govt.nz wallet automatically enables. But as more organisations require verification, there may be more opportunities for records to be created, retained and potentially connected.

Businesses already collect considerable information through customer accounts, payments, loyalty schemes and online activity. Privacy-preserving digital credentials could actually reduce some of that collection.

The concern is whether adding verification to more everyday activities creates new information trails that wouldn't otherwise exist.

And whether, years from now, those records could be used in ways nobody anticipated when they were collected.

Do we need to verify everything?

There are good reasons to verify identity when opening a bank account, accessing confidential records or undertaking regulated transactions.

But what about wanting to comment on a news story, join an online discussion about your child's school or criticise a politician?

Today, a username and perhaps an email address might be sufficient.

If verification requirements spread, people could increasingly be asked to prove their age or some other personal attribute before participating.

Even if their identity remains private, verification would become a condition of participation in activities that previously required none.

And verification need not stop at age or identity. It can also establish whether someone meets other conditions imposed by governments or service providers.

New Zealand has already experienced this.

During COVID-19, My Vaccine Pass was used to verify vaccination status as a condition of entry to certain venues and events.

The technology behind those QR-code passes was supplied by MATTR, the Spark-owned company that the Department of Internal Affairs subsequently appointed to provide the digital wallet technology for Govt.nz. MATTR also worked with DIA on NZ Verify.

That does not mean the current system shares databases with My Vaccine Pass or that new vaccination requirements are planned.

But it illustrates how verifying who someone is and deciding whether they are eligible to participate are two different things.

A person could successfully prove their identity but still be denied access to a service because they cannot present a credential satisfying a particular requirement.

The government's current framework emphasises voluntary participation, user control and privacy-preserving technology. But who decides what must be verified, what information can be retained and what alternatives remain available?

A system can protect your identity when you prove something about yourself. That doesn't necessarily mean you should have to prove it in the first place.

Receive our free newsletter here