44 Bowen Street
Private Bag 6995
Wellington 6141
New Zealand
T 64 4 894 5400
F 64 4 894 6100
www.nzta.govt.nz
19 December 2025
Charlie Drummond
[FYI request #32965 email]
REF: OIA-20390
Dear Charlie
Request made under the Official Information Act 1982
Thank you for your email of 23 November 2025 requesting the information about the development of a
Digital Driver Licence (DDL) under the Official Information Act 1982 (the Act).
I wil address each part of your request in turn.
1. Privacy Impact Assessments (PIAs):
Please provide a copy of al Privacy Impact Assessments (PIAs), privacy-by-design documents, or
similar risk analyses that have been completed for the DDL project.
A Privacy Impact Assessment (PIA) has not yet been completed for the DDL project. This wil be
undertaken as part of the project’s assurance activities once the detailed design phase commences.
This also applies to the other documents sought by this question.
I am therefore refusing this part of your request under section 18(e) of the Act, as the document
alleged to contain the information requested does not exist.
2. International Standards and Interoperability:
Please provide any documents, briefing papers, or meeting minutes that discuss the adoption of
international standards for the DDL.
Specifical y, I am requesting information that addresses:
a) The adoption of ISO/IEC 18013-5 (the international standard for mobile driver’s licences).
b) Any discussions, consultations, or agreements with international bodies or other nations
(including, but not limited to, Australia, the United Kingdom, the United States, and Canada)
regarding cross-border recognition or technical interoperability of digital identity credentials. If
specifics cannot be given for any valid reason please confirm where such discussions have taken
place with a given nation.
The DDL is being designed to align with ISO/IEC 18013-5, the international standard for mobile driver
licences. This standard sets the framework for secure and interoperable mobile credentials. To
support this, NZ Transport Agency Waka Kotahi (NZTA) has worked with Austroads, the association of
Australian and New Zealand transport agencies, through co-design workshops to ensure a DDL aligns
with international standards and New Zealand requirements.
Following discussions with Australian jurisdictions early in our investigations for this initiative, in
particular with Queensland and New South Wales, part of their lessons learnt was that not building to
a standard wil / has resulted in additional reworking of their products. This drove our decision to
progress alignment with ISO/IEC 18013-5.
The Austroads forum has since published these findings as part of its roadmap for harmonisation
around standards for mobile driver licences, which is available at:
https://austroads.gov.au/publications/registration-and-licensing/ap-r702-23/media/AP-R702-
23_Mobile_Driver_Licences_Developing_a_Harmonisation_Roadmap.pdf
We also participated in a recent international interoperability event in Wel ington in November 2025,
focused on mobile driver licence standards. Attendees were from Australia, New Zealand,
Netherlands, USA, France, Japan, UK, Sweden. This event provided valuable insights into cross-
border recognition and technical interoperability, which are informing our approach.
As details of engagement with specific technology providers and international partners are subject to
obligations of confidence with those parties, I am withholding all remaining information which relates to
this part of your request under section 9(2)(ba)(i) of the Act, to protect information which is subject to
an obligation of confidence or which any person has been or could be compel ed to provide under the
authority of any enactment, where the making available of the information would be likely to prejudice
the supply of similar information, or information from the same source, and it is in the public interest
that such information should continue to be supplied.
3. Data Sharing and Architecture:
Please provide any documents that describe the proposed data architecture of the DDL system.
Specifically:
a) A high-level diagram or description of how the DDL app wil interact with the central Motor
Vehicle Register.
b) The policy or technical specifications outlining what information is shared during a typical
verification event (e.g., with Police, or a private entity like a bar or rental car agency).
c) Any documents detailing the potential for the DDL infrastructure to be linked with other
government identity systems (e.g., RealMe) or private sector digital wallets.
The DDL is stil under development, and detailed technical architecture has not been finalised.
However, the intended design is that the system wil interact securely with the NZTA systems via
encrypted channels, but it wil not interact with the Motor Vehicle Register. During verification, it is
intended that data is shared from the device and the customer wil be made aware of what data is
going to be shared.
We anticipate that the DDL wil seek accreditation under the Government’s Digital Identity Services
Trust Framework but work on this has not yet started. As the architecture is stil being designed, it has
not yet been determined if it will be linked to any other government identity systems.
I am withholding the information which relates to parts a), b), and c) of this question under the
following sections of the Act:
• S9(2)(f)(iv) in order to maintain the constitutional conventions for the time being which protect
the confidentiality of advice tendered by Ministers of the Crown and officials; and,
2
• S9(2)(g)(i) in order to maintain the effective conduct of public affairs through the free and frank
expression of opinions by or between or to Ministers of the Crown or members of an
organisation or officers and employees of any public service agency or organisation in the
course of their duty.
4. Third-Party and Law Enforcement Access:
Please provide the policy or procedural documents that outline:
a) How law enforcement officers wil access and verify the DDL.
b) The framework for allowing private sector businesses to verify age or identity using the DDL,
and what data they wil receive.
c) The circumstances under which law enforcement agencies can request access to the historical
log of a person's DDL authentications.
d) Whether any third parties (commercial or otherwise) wil be able to access any part of the
transactional metadata, either in real-time or historically.
In response to part a) of this question, law enforcement wil be able to verify credentials using an ISO
compliant verifier (Such as NZ Verify – from the Department of Internal Affairs). This provides secure
methods that protect privacy, and private sector entities wil only receive confirmation of relevant
attributes (for example, age check).
At this stage, no formal policy or procedural documents exist that outline these processes, this work is
stil under development. I am therefore refusing the remaining parts of this question under section
18(e) of the Act, as the documents alleged to contain the information requested do not exist.
5. Security and Biometrics:
Please provide any documents discussing the security measures for the DDL, including the use of
biometrics (e.g., facial recognition, fingerprint) for unlocking or authenticating the credential.
ISO standards can be purchased from Standards New Zealand, a
t: https://www.standards.govt.nz/. The security policies and procedures for the DDL are under development. However, the security
measures for the DDL product wil include encryption, secure credential signing, and optional biometric
authentication for unlocking the application. Releasing the documents held by NZTA, including for
cryptographic key management and vulnerability assessments would prejudice the security of the
DDL.
I am therefore withholding the information sought by this question under section 9(2)(k) of the Act, in
order to prevent the disclosure or use of official information for improper gain or improper advantage.
6. Privacy
a) Privacy Impact Assessments (PIAs):
Please provide a copy of al PIAs or similar risk analyses for the DDL project. I specifically request
any sections that discuss the risks associated with the creation, storage, and use of transactional
logs or metadata.
b) Wil a central log be created by Waka Kotahi (or another government agency) each time a
citizen uses their DDL to authenticate with a third party (e.g., a business or law enforcement)?
3
c) If so, what specific data fields wil be recorded in this central log? For example, wil it include the
citizen's identifier, the verifier's identifier, the date/time stamp, the location, and the type of
verification (e.g., "age check")?
d) What is the policy regarding the retention period for this transactional log data?
As confirmed to you in my response to question 1, the PIAs are yet to be undertaken as the DDL is still
under development, and detailed policies for it have not been finalised.
However, I can confirm in response to parts b), c), and d) of your question that tracking when a
credential is validated does not and wil not take place. Verifiers do not ‘check back’ with the issuing
authority.
7. Data Aggregation
Please provide any policy or technical documents that discuss plans for the anonymisation or
aggregation of DDL usage data. Specifically:
a) Are there plans to use the aggregated metadata for statistical analysis, policy research, or
pattern analysis?
b) What measures wil be in place to ensure that "anonymised" data cannot be re-identified?
There are currently no policy or technical documents that exist which discuss anonymisation or
aggregation of DDL usage data. I am therefore refusing this part of your request under section 18(e) of
the Act, as the documents alleged to contain the information requested do not exist.
With respect to the information that has been withheld, I do not consider there are any other factors
which would render it desirable, in the public interest, to make the information available.
Under section 28 of the Act, you have the right to ask the Ombudsman to review my decision to
withhold some information and to refuse other parts of your request. The contact details for the
Ombudsman can be located at www.ombudsman.parliament.nz.
In line with NZTA policy, this response wil soon be published on our website, with personal
information removed.
If you would like to discuss this reply with NZTA, please contact Ministerial Services by email to
[NZTA request email].
Yours sincerely
Liz Maguire
Chief Digital Officer
4
