A Cabinet committee paper in June 2021 said legal barriers had been expected to face the new technology - but it has since been built to let a facial recognition tool run by Internal Affairs search the driver licence photo database.
Five legal opinions said no law change was needed.
Internal Affairs now says its tool, Identity Check (formerly called One Time Identity), could become the common service used to verify online the identity of anyone opting in to access potentially hundreds if not thousands of services, from banking to benefits, from health checks to student records.
"There have been no legislative changes identified as being required to support the future operation of Identity Check," the department said.
Singapore has such a service that 2.7 million people use to access 1400 public and private services online but also at service counters, such as the local library. It compares a photo and identifying information someone submits to a massive government biometric database.
The proactively released Cabinet committee paper, and RNZ inquiries, show that seven major agencies here, led by Internal Affairs, have been working on a new approach for a year.
It directed DIA prepare a business case for investing in a "fundamentally different" approach to digital identity, to unlock $1.5-9 billion of economic benefits. Three options were outlined, but are blanked out in the paper.
"The Cabinet paper asked officials to explore this as a consent-based online identity verification option for citizens," Internal Affairs told RNZ.
The paper said: "The department will develop an implementation plan for verifiable identity credentials and the common verification service.
"The department will prepare to implement the technical solutions."
The current Government system, RealMe, has 870,000 users - it has been modernised recently but has a reputation for being cumbersome, and it gets little actual use.
The new approach involves six "early adopters": ACC, MBIE, MSD, Waka Kotahi, Health and Education.
Any new system will depend on a person sharing their personal "key attributes." Biometrics about you, such as your image, are a key attribute.
The paper said: "The approach proposed ... will enable a wider range of identifying attributes to be considered as part of a person's digital identity."
The agencies were told "to investigate making more attributes available by consent".
MSD told RNZ its use of the new tech will involve sending clients who want to use Identity Check to Internal Affairs to run the facial recognition verification, and DIA would then give a "notification pass" back to MSD.
The Cabinet paper said the new technology for digital identity changes should be available from mid-2023, which is also the date Internal Affairs told RNZ it expected to activate Identity Check.
However, there are snarl-ups: A detailed business case is seven months overdue, there is no sign of an implementation plan from Internal Affairs, and the privacy impact assessment is still being worked on.
The cabinet paper said legislative changes would be needed in addition to a bill currently before Parliament that will set up a Digital Trust Framework to regulate how public and private identity services work, and who is allowed to run them.
Digital Economy Minister David Clark did not respond to multiple requests for comment.
He has previously said the trust framework is vital: "We know proactive uptake of technologies will only happen when people trust the information they part with online is being safely handled."
The Office of the Privacy Commissioner in its biometrics advice says concerns remain about the sensitivity of information and a general lack of transparency, about potential uses for surveillance or profiling, about whether information people consent to give is then shared to use in new functions, and risks around bias and discrimination.
The Cabinet committee paper talks about the possible "reuse" of information within digital identity systems by agencies.
The possibility Identity Check will become the country's common verification service has increased now that Waka Kotahi has built a portal or interface. This allows it to access the huge pool of driver licence photos. Internal Affairs has said it was the "suitable" agency to run the common service.
The Cabinet committee paper foresaw this, saying:
"Waka Kotahi could undertake a greater role in the digital identity system by providing greater access to driver licensing information while also relying on modernised digital identity services to improve its identity verification processes when issuing licences.
"This would involve significant changes to Waka Kotahi's technology systems, application processes and the legislation that governs some of its services.
"Waka Kotahi has indicated that it is not in a good position to pay for this transformation out of existing funding."
NZTA told RNZ "there is no basis in fact" to any assertion that its work represents a significant expansion in facial recognition.
Internal Affairs sought five legal opinions including from the Privacy Commissioner, one about searching passport photos, four about the driver licence photos.
"To be clear, nothing has been significantly expanded or gone live, what we have done is groundwork," it told RNZ.
Beyond NZTA's work, "legislative changes in some instances [will be] required", the Cabinet committee paper said.
Internal Affairs "has worked with a range of agencies to identify potential legislative implications of agencies improving services using digital identity solutions and/or making the information they hold available for consent-based reuse."
The department has also created a "confirmation agreement" for organisations that want to use Identity Check.
The Cabinet paper said there had "already been proof of concept testing for some of these capabilities".
The NZTA portal work was spurred on by the Health Ministry's interest in using the system for identity verification around Covid-19 services, a document and statements show.
Internal Affairs said a privacy impact assessment was updated to identify the risks around driver licence photos.
NZTA did not do its own privacy impact assessment.
Despite Internal Affairs telling RNZ that assessments "should be readily publicly available once they have been completed," the driver licence assessment is not, because it is still being worked on.
The most recent assessment available on Internal Affairs web page listing them dates to 2018.
An NZTA tender notice shows it wanted driver licence processing to be interoperable with Australia.
Interoperability across digital identity systems is a core goal of an eight-nation group that includes New Zealand, set up in 2020 to boost trade.
The Cabinet committee paper also stresses that Māori must be consulted about digital identity changes. RNZ has approached iwi data experts for comment.
