Privacy commissioner John Edwards
The Privacy Commissioner is concerned using date of birth information to authenticate online voters could undermine trust in the electoral system.
In a submission to Parliament, Privacy Commissioner John Edwards said he supports the Government’s intention to modernise voting, however, insufficiently secure voting systems "risk undermining the confidence of voters and the uptake of the new voting system".
The submission was on the Local Electoral Matters Bill, which will pave the way for online voting in local elections.
As reported last month, Local Government New Zealand is currently seeking an online voting system for use in a trial of online voting in local body elections.
"I am concerned that an elector’s date of birth is insufficiently secure for use in authenticating an elector’s identity," Edwards said.
Edwards said people provide their date of birth widely to friends and family and on social media sites such as Facebook.
"Date of birth is also a poor choice for authentication because if compromised, a person cannot alter it," he added.
"As date of birth will provide little additional assurance of identity, I do not consider that there is sufficient justification for local authorities to collect it from the Electoral Commission.
"Further, given its inherent security issues I do not think it is appropriate for use in something as important as an election."
The Electoral Commission also expressed concerns about sharing date of birth information it collects with local councils. It submitted the Bill does not include any security, safe retention or destruction measures for the information.
Edwards said international online voting models generally require a higher standard of identity verification than date of birth and a higher standard is required here too.
"Government supported standards of authentication already exist, such as the RealMe system maintained by the Department of Internal Affairs," he said.
The Wellington City Youth Council wants to see a trial of online voting go ahead as an addition to postal voting rather than a complete switch. It also referenced RealMe authentication.
"We note that many critical and confidential functions already occur online within a secure framework: successive Governments have been at the forefront of this process, encouraging citizens to register for RealMe logins so that they can securely access various government services, while online IRD logins are a separate yet equally secure attempt at digitising confidential access," the Youth Council said in its submission.
