An electronic identity credential is a record kept in electronic form that—

• (a) contains authenticated core identity information about an individual; and

• (b) is assigned a unique code by the Service.

(1) An electronic identity credential may contain as much of the following core identity information about an individual as it is possible to authenticate:

• (a) the individual's full name:

• (b) the individual's sex:

• (c) the individual's date of birth:

• (d) the individual's place of birth.

(2) The following table sets out details that may be included in an electronic identity credential under each of the paragraphs in subsection (1):

(1) An electronic identity credential is effective for the period prescribed in regulations made under section 70(1).

(2) Subsection (1) applies unless the electronic identity credential—

• (a) is cancelled by the chief executive under section 31 or 33; or

• (b) is revoked by the chief executive under section 35; or

• (c) is revoked by order of a court under section 64(1)(b).

(3) An electronic identity credential may be renewed, in accordance with section 29, for a further period or periods prescribed in regulations.

(1) There must be no more than 1 electronic identity credential for each individual at any given time.

(2) This section is subject to section 12.

(1) Section 11 does not apply to an individual who is specified in subsection (2) for whom new identity information has been created under section 65 of the Births, Deaths, Marriages, and Relationships Registration Act 1995 (which relates to the protection of certain witnesses, undercover police officers, and other protected persons).

(2) An individual referred to in subsection (1) (a specified individual) is a person who is, has been, or will be—

• (a) an undercover police officer; or

• (b) an officer or employee of the New Zealand Security Intelligence Service; or

• (c) approved by the Director of Security to undertake activities for the New Zealand Security Intelligence Service.

(3) Accordingly, a specified individual who already has a current electronic identity credential at the time the new identity information is created may, on application under section 28, be issued another electronic identity credential in respect of his or her new identity.

(4) If subsection (3) applies and the other electronic identity credential is issued, the specified individual may choose to use either or both of the electronic identity credentials in question.

(5) However, a specified individual who does not have a current electronic identity credential at the time the new identity information is created may, on application under section 28, be issued an electronic identity credential in respect of—

• (a) his or her original identity; or

• (b) his or her new identity; or

• (c) both identities.

(6) If subsection (5)(c) applies and 2 electronic identity credentials are issued, the specified individual may choose to use either or both of the electronic identity credentials in question.

(7) A specified individual who uses either or both of the specified individual's electronic identity credentials as contemplated by subsections (4) and (6) is not excused from any criminal liability in respect of any act or omission involving the use of those credentials that would otherwise constitute an offence against any other enactment.

(8) However, subsection (7) does not limit or affect the provision of any other enactment or rule of law that confers protection on a specified individual against criminal liability and, if there is any inconsistency between that subsection and that provision, the latter prevails.

(9) In this section,—

• (a) Director of Security has the meaning given to it by section 2 of the Births, Deaths, Marriages, and Relationships Registration Act 1995; and

• (b) employee, officer, and undercover Police officer have the meanings given to them by section 65(5) of that Act.

(1) The following individuals for whom new identity information has been created under section 65 of the Births, Deaths, Marriages, and Relationships Registration Act 1995 do not come within the exception set out in section 12:

• (a) an individual who is, has been, or will be a witness in any proceeding and who is not a specified individual:

• (b) an individual who needs protection because of his or her relationship to an individual who is, has been, or will be a witness in any proceeding.

(2) For an individual referred to in subsection (1), the chief executive—

• (a) may, on application under section 28, issue an electronic identity credential in respect of the individual's new identity; and

• (b) if applicable, must cancel, in accordance with section 33, an electronic identity credential that has been issued in respect of the individual's original identity.

An electronic identity credential is personal to the individual to whom it has been issued and may not be transferred or vest by operation of law in any person other than that individual.

An individual does not have any legal or beneficial interest in an electronic identity credential that has been issued to him or her.

An individual may use an electronic identity credential only if—

• (a) it has been issued to him or her; and

• (b) it is current.

(1) An individual may use an electronic identity credential for the purpose of verifying his or her identity by electronic means in order to meet the identification requirements of a participating agency in relation to any applicable transaction or service.

(2) An individual may give consent for the Service to supply to a participating agency some or all of the core identity information contained in the individual's electronic identity credential for the purpose of verifying the individual's identity.

(1) The Service may supply any of the information described in subsection (2) to a participating agency if the participating agency has paid or has made arrangements to pay any fees or charges prescribed by regulations made under this Act or set by an agreement referred to in section 71(4)(a)(ii) or (b)(ii).

(2) The information is as follows and must, if supplied, be accompanied by the technical code for the individual's electronic identity credential:

• (a) core identity information contained in the individual's current electronic identity credential:

• (b) information derived from, or based on, core identity information referred to in paragraph (a) (for example, the individual's age as derived from his or her date of birth):

• (c) information about the status of the individual's electronic identity credential.

(3) A participating agency that is supplied by the Service with any of the information referred to in subsection (2) may use the information to verify the identity of the individual concerned by electronic means.

(4) For the purposes of subsections (1) to (3), a participating agency may—

• (a) choose the types of transactions or services offered by the agency that are to be applicable transactions or services (as long as the choice of those transactions or services is consistent with achieving the purpose of this Act); and

• (b) choose the types of core identity information that the agency will accept or require for the purpose of verifying an individual's identity; and

• (c) for a continuing service, determine the frequency at which an individual will be required to verify his or her identity in order to continue to receive the service from the agency.

(5) This section is subject to this Act and any other enactment.

(1) Subsections (2) and (3) apply to—

• (a) a legal requirement for an individual to supply information about the individual's identity to a participating agency:

• (b) a legal requirement for a participating agency to obtain or verify information about an individual's identity.

(2) A legal requirement to supply information or to obtain or verify information about an individual's identity includes, for example, a legal requirement arising in the course of—

• (a) making an application:

• (b) making or lodging a claim:

• (c) lodging a return:

• (d) making a request:

• (e) lodging an objection:

• (f) making a complaint:

• (g) providing access to information:

• (h) providing access to a benefit, service, or transaction:

• (i) establishing a relationship with an individual:

• (j) monitoring or maintaining a relationship with an individual or an individual's transactions.

(3) The legal requirement is met—

• (a) if the individual gives consent for the Service to supply all or some of the core identity information contained in the individual's current electronic identity credential to the participating agency; and

• (b) if the Service supplies the information to the participating agency; and

• (c) even if the requirement does not specify that information contained in an individual's electronic identity credential may be used; and

• (d) only to the extent to which the information that is required to be supplied is the same as the information that the individual consents to the Service supplying.

(4) Subsections (5) and (6) apply to a legal requirement for an individual to supply a signature to a participating agency.

(5) The legal requirement is met—

• (a) if the individual gives consent for the Service to supply the individual's current electronic identity credential to the participating agency; and

• (b) if the Service supplies the individual's current electronic identity credential to the participating agency; and

• (c) even if the requirement does not specify that an individual's electronic identity credential may be used; and

• (d) for matters that are additional to those addressed by the individual's current electronic identity credential and are the subject of information supplied to the participating agency by the individual,––

  • (i) the individual adequately indicates to the participating agency the individual's approval of the information that the individual supplies; and

  • (ii) alterations subsequently made in the information are detectable.

(6) In interpreting subsection (5)(d)(i), reference may be made to sections 6 and 22(1)(a) of the Electronic Transactions Act 2002.

(1) A change in status of an electronic identity credential does not, of itself, affect the validity of any applicable transaction or service that was completed or provided before the change even if the identity of the individual to whom the transaction or service relates was verified using the credential.

(2) Nevertheless, the chief executive—

• (a) must give written or electronic notice of the revocation of an electronic identity credential to each participating agency with which an individual has used the credential; and

• (b) may provide information about any other change in the status of an electronic identity credential to a participating agency with which an individual has used the credential if, in the chief executive's opinion, it is in the participating agency's interest to receive that information.

(3) Subsection (1) is subject to any direction that a court may give under section 64(1)(c).

An individual may access—

• (a) the core identity information contained in the individual's electronic identity credential:

• (b) information about the status of the individual's electronic identity credential.

(1) Only the following persons may access a photograph of any individual stored in the Service database:

• (a) the individual who is the subject of the photograph:

• (b) the chief executive or an employee of the Service or department who is authorised by the chief executive for the purpose:

• (c) an officer of a law enforcement agency for the purpose of any proceedings relating to a specified offence.

(2) A person who has access to a photograph under subsection (1)(b) or (c) may use the photograph only in the course, and for the purposes, of the person's official duties.

(1) Only the following persons may access an individual's record of usage history:

• (a) the individual to whom the electronic identity credential that is the subject of the record has been issued:

• (b) a person who satisfies the chief executive that access to the record is required for the conduct of proceedings before a court or tribunal relating to electronic identity credentials or the Service:

• (c) a person who satisfies the chief executive that information obtained from accessing the record is to be used only for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the subject of the information:

• (d) a person authorised by the chief executive who is carrying out administrative, technical, or other functions relating to the management, maintenance, and use of the Service.

(2) A person described in subsection (1) may be refused access to the record if the chief executive considers that access—

• (a) may prejudice an investigation or prosecution against an individual for a specified offence; or

• (b) may prejudice the security or integrity of the Service; or

• (c) cannot be given for technical or practical reasons.

(3) The person described in subsection (1)(c) may be granted access to the record only if the chief executive makes the record available in a form that protects the privacy of the individual concerned.

The chief executive may disclose an individual's record of usage history to a law enforcement agency if the chief executive believes on reasonable grounds that—

• (a) a specified offence has been or may be committed; and

• (b) the law enforcement agency cannot investigate the offence without the record of usage history.

An issuing officer may issue a search warrant under the Search and Surveillance Act 2012 to access an individual's record of usage history.

An application to the chief executive may be made for an electronic identity credential—

• (a) to be issued under section 28; or

• (b) to be renewed under section 29; or

• (c) to be amended under section 30; or

• (d) to be voluntarily cancelled under section 31.

(1) An individual may make an application on his or her own behalf.

(2) If the individual is under 14 years of age,—

• (a) the individual—

  • (i) may make the application on his or her own behalf; and

  • (ii) must include in it the written or electronic consent of at least 1 of his or her parents or guardians; or

• (b) 1 of the individual's parents or guardians may make the application on the individual's behalf.

(3) Subsection (2)(b) describes the only situation in which an individual may make an application for someone else.

(1) An application for an electronic identity credential to be issued must—

• (a) be made in a manner approved by the chief executive under section 45; and

• (b) include any information specified by the chief executive under section 46; and

• (c) include any other prescribed information or documentation; and

• (d) be accompanied by any prescribed fee.

(2) The chief executive may grant the application only if—

• (a) the application complies with subsection (1); and

• (b) the chief executive is satisfied by 1 or more of the following sources that the identity of the applicant has been authenticated:

  • (i) the information included with the application:

  • (ii) a comparison of the information undertaken in accordance with section 39(4):

  • (iii) proper inquiries; and

• (c) the chief executive is satisfied, if an item of core identity information is absent, that the absence does not derogate from the authentication of the identity of the applicant; and

• (d) subsection (3) does not apply.

(3) The chief executive must refuse the application if—

• (a) it is made by, or on behalf of, an individual under 14 years of age and it does not include the written or electronic consent of at least 1 of the individual's parents or guardians; or

• (b) the applicant has already been issued with an electronic identity credential and it is suspended under section 34; or

• (c) an order made by a court under section 64(1)(a) in respect of the applicant has not expired; or

• (d) the chief executive has not completed any action necessary to give effect to an order made by a court under section 64(1)(b); or

• (e) the chief executive—

  • (i) knows that the applicant is under investigation, liable to prosecution, or the subject of a charge for a specified offence; and

  • (ii) is satisfied that refusing the application will not prejudice the investigation into or proceedings about the offence.

(4) If the chief executive refuses the application, he or she must, as soon as practicable, give the applicant written or electronic notice of the decision and the reason for it.

(1) An application to renew an electronic identity credential may be made either before or after the expiry of the electronic identity credential (as provided in section 10).

(2) Section 28 applies, with any necessary modifications, to the application as if it were an application for an electronic identity credential to be issued.

(1) An application to amend an electronic identity credential may be made if—

• (a) an individual has changed his or her name; or

• (b) an individual's core identity information has changed as a result of the individual's adoption under any of the following:

  • (i) an adoption order under the Adoption Act 1955:

  • (ii) an adoption order that has the same operation and effect as an adoption order under that Act:

  • (iii) an adoption to which section 17 of that Act or section 11 of the Adoption (Intercountry) Act 1997 applies; or

• (c) an individual has assumed and intends to maintain the gender identity of a person of a different sex from the sex that is included in the individual's electronic identity credential; or

• (d) an individual considers, on reasonable grounds, that there is an error or omission in the core identity information contained in his or her electronic identity credential.

(2) The application must—

• (a) be made in a manner approved by the chief executive under section 45; and

• (b) include any information specified by the chief executive under section 46; and

• (c) include the written or electronic consent of at least 1 parent or guardian of an individual under 14 years of age; and

• (d) include any other prescribed information or documentation; and

• (e) be accompanied by any prescribed fee.

(3) The chief executive may grant the application only if—

• (a) the chief executive is satisfied that the application complies with subsection (2); and

• (b) the chief executive is satisfied by 1 or more of the following sources that good reason for the amendment exists:

  • (i) the information included with the application:

  • (ii) a comparison of the information undertaken in accordance with section 39(4):

  • (iii) proper inquiries.

(4) If the chief executive refuses an application because he or she is not satisfied as required by subsection (3)(a), he or she must, as soon as practicable, give the individual written or electronic notice of—

• (a) the refusal; and

• (b) the reason for the refusal.

(5) If the chief executive refuses an application because he or she is not satisfied as required by subsection (3)(b), he or she must, as soon as practicable, give the individual written or electronic notice of—

• (a) the refusal; and

• (b) the reason for the refusal; and

• (c) the individual's right in subsection (6).

(6) The right is to request the chief executive to take steps to indicate that the information is contested when the Service supplies the information to a participating agency.

(7) If an individual exercises the right, the chief executive must take the steps that the chief executive considers reasonable.

(8) Subsection (9) applies if the chief executive is satisfied about an application as required by subsection (3) but knows that the individual is under investigation, liable to prosecution, or the subject of a charge for a specified offence.

(9) The chief executive—

• (a) may grant the application; or

• (b) may refuse the application and, if he or she does so, may comply with subsection (4) or (5) or neither.

(1) An application for an electronic identity credential to be voluntarily cancelled must—

• (a) be made in a manner approved by the chief executive under section 45; and

• (b) be accompanied by any prescribed fee.

(2) If an application complies with subsection (1), the chief executive must—

• (a) grant the application; and

• (b) give to the applicant, as soon as practicable, written or electronic notice of the cancellation of the applicant's electronic identity credential.

(1) The chief executive must amend an electronic identity credential if the chief executive is satisfied, after proper inquiries, that—

• (a) the core identity information of the individual to whom it has been issued has changed as a result of the individual's adoption under any of the following:

  • (i) an adoption order under the Adoption Act 1955:

  • (ii) an adoption order that has the same operation and effect as an adoption order under that Act:

  • (iii) an adoption to which section 17 of that Act or section 11 of the Adoption (Intercountry) Act 1997 applies; or

• (b) there is an error or omission in the core identity information contained in the electronic identity credential; or

• (c) the core identity information contained in the electronic identity credential needs to be updated.

(2) Subsection (1)—

• (a) applies whether or not an application to amend the electronic identity credential is made to the chief executive under section 30; and

• (b) does not limit the grounds for making an application to amend an electronic identity credential under section 30.

(3) If subsection (1)(b) applies, the chief executive must remove any incorrect information and replace it with new information, but only if he or she is satisfied that the new information in his or her possession is correct.

(1) The chief executive must cancel an electronic identity credential if the chief executive is satisfied, after proper inquiries, that the individual to whom it has been issued—

• (a) has died; or

• (b) is a specified individual who is exempted under section 12(1) from the requirements of section 11, but is no longer using the credential because it relates to 1 of his or her identities that is no longer required; or

• (c) is an individual referred to in section 13(1) and the credential is in respect of his or her original identity.

(2) Subsection (1)—

• (a) applies whether or not an application to voluntarily cancel the electronic identity credential is made to the chief executive under section 31; and

• (b) does not limit the grounds for making an application to voluntarily cancel an electronic identity credential under that section.

(1) This section applies if—

• (a) an individual is under investigation for a specified offence; or

• (b) the chief executive has reasonable grounds to believe that an individual is liable to prosecution, or is the subject of a charge, in respect of a specified offence.

(2) The chief executive may suspend—

• (a) the processing of an application relating to the individual; or

• (b) the individual's electronic identity credential.

(3) The chief executive may withdraw the suspension at any time by written or electronic notice to the individual concerned if he or she is satisfied that the reason for the suspension no longer applies.

(4) An individual whose electronic identity credential is suspended may not apply for the credential to be renewed or for a further credential to be issued during the period of the suspension.

(5) The suspension of an electronic identity credential does not affect its expiry.

(1) The chief executive may revoke an individual's electronic identity credential if the chief executive is satisfied, after proper inquiries, that the credential—

• (a) was issued, renewed, or amended on the basis of any false or fraudulent representation or declaration, made either orally or in writing; or

• (b) was issued or renewed in error.

(2) An individual whose electronic identity credential is revoked may apply for another electronic identity credential to be issued to him or her.

(1) Before exercising the power of suspension conferred by section 34 or the power of revocation conferred by section 35, the chief executive must give the individual—

• (a) written or electronic notice of the proposed suspension or revocation and the reason for it; and

• (b) a reasonable opportunity to make written or electronic submissions.

(2) However, subsection (1) does not apply if the chief executive considers that giving written or electronic notice to the individual—

• (a) may prejudice the investigation referred to in section 34(1)(a) or the inquiries referred to in section 35(1); or

• (b) is not practicable because the individual cannot be located and his or her contact details cannot readily be established; or

• (c) may compromise the security or integrity of the electronic identity credential in question or of the Service and immediate suspension or revocation is necessary to avoid or lessen that risk.

(3) If the chief executive decides to exercise the power of suspension or revocation after considering any written or electronic submissions made by the individual, the chief executive must, as soon as practicable, give written or electronic notice of the suspension or revocation to the individual.

(4) The written or electronic notice must specify—

• (a) the reason for the suspension or revocation; and

• (b) the date on which and the time at which the suspension or revocation commences; and

• (c) for a suspension, the period of the suspension.

In sections 38 and 39,—

The purpose of section 39 is to facilitate the disclosure of identity-related information to the chief executive and the Service for the purpose of helping the chief executive to—

• (a) authenticate an individual's identity; and

• (b) keep the core identity information contained in an individual's electronic identity credential accurate and up to date.

(1) The chief executive and a responsible authority may enter into an agreement for the disclosure by the responsible authority to the chief executive of identity-related information in respect of an individual who has applied for or been issued with an electronic identity credential.

(2) Subsection (1) applies even though the chief executive is the same person as the responsible authority.

(3) A responsible authority may disclose identity-related information only in accordance with an agreement entered into under subsection (1).

(4) The chief executive or the Service may cause a comparison to be made of any identity-related information disclosed under an agreement entered into under subsection (1) with information held in the Service database.

(1) The chief executive may keep and maintain information produced by a comparison undertaken in accordance with section 39(4) for use in auditing the access and use of that information by the Service or employees of the department for the purposes of this Act.

(2) This section applies despite rule 6 of the information matching rules set out in Schedule 4 of the Privacy Act 1993.

The functions of the chief executive under this Act are the following:

• (a) to establish and maintain the Service database:

• (b) to provide advice and information to participating agencies on matters relating to the use of electronic identity credentials:

• (c) to enter into and carry out any agreement with a third party under section 51(1)(b) for the performance of any function or duty, or the exercise of any power, imposed or conferred on the chief executive by this Act:

• (d) to prepare reports required by the Privacy Commissioner under section 57:

• (e) to perform any other functions and duties and exercise any other powers specified in this Act or in regulations made under this Act:

• (f) to administer this Act:

• (g) to perform any functions that are incidental and related to, or consequential upon, the functions set out in paragraphs (a) to (f).

(1) The chief executive must take all reasonable steps to ensure that the identity of an individual has been authenticated before an electronic identity credential is issued to the individual.

(2) Without limiting subsection (1), examples of reasonable steps that the chief executive could take to authenticate an individual's identity include the following:

• (a) to cause a comparison to be made of any identity-related information disclosed under an agreement entered into under section 39(1) with information held in the Service database:

• (b) to ask for an identity information check to be carried out in accordance with Schedule 1.

(1) The chief executive must publish the material described in subsection (2)—

• (a) on an Internet site maintained by or on behalf of the chief executive; and

• (b) by any other means he or she considers appropriate.

(2) The material is—

• (a) approvals given by the chief executive under section 45:

• (b) requirements for information specified by the chief executive under section 46:

• (c) standards or specifications set by the chief executive under section 47:

• (d) reports required by the chief executive under section 48.

(3) The chief executive may publish the material described in subsection (2)(c) or (d)—

• (a) in its entirety; or

• (b) with information withheld—

  • (i) for reasons in the Official Information Act 1982; or

  • (ii) to protect the security or integrity of the Service.

(1) The chief executive must keep a record of usage history for each electronic identity credential (whether the credential is current or otherwise).

(2) The record of usage history—

• (a) must include, subject to subsection (3), information about which participating agency has used an individual's electronic identity credential to verify the identity of the individual; and

• (b) must include information about each occasion that any of the persons referred to in section 23(1) accesses the record; and

• (c) must be available for access at all times by the individual whose electronic identity credential it is (subject to section 23(2)); and

• (d) may be kept in electronic form so long as it is readily retrievable.

(3) The record of usage history must not include details about any transaction between an individual and a participating agency.

(4) The chief executive must delete the record of usage history at the end of the period for which the Service may retain the record of usage history, if a period has been prescribed in regulations made under section 70(3).

(1) The chief executive may approve the manner in which applications must be made.

(2) Without limiting subsection (1), the chief executive may—

• (a) allow applications to be lodged electronically or by any other means; and

• (b) specify the electronic format for applications that may be lodged electronically.

(1) The chief executive may specify what information must be provided with an application.

(2) Without limiting subsection (1), the chief executive may—

• (a) issue standard forms (including electronic forms) requiring information or setting out information that must be provided with an application; and

• (b) specify requirements in connection with the use of standard forms, including requirements relating to electronic signatures on electronic forms; and

• (c) specify what evidence of identity is required to be provided with an application.

(3) Any evidence of identity requirements under subsection (2)(c) may apply—

• (a) generally or in respect of a specified class or classes of applicants:

• (b) differently to different applicants in different circumstances.

(4) Those evidence of identity requirements may also include a requirement that every applicant must submit, or allow the Service to take, a photograph of the applicant.

(5) The chief executive may compare the photograph with information held in the Service database or with information disclosed under an agreement entered into under section 39(1) to ensure that the applicant is not—

• (a) applying for more than 1 electronic identity credential to be issued to him or her at any given time (subject to section 12); or

• (b) applying for an electronic identity credential to be issued or renewed on the basis of any false or fraudulent representation or declaration; or

• (c) an individual to whom an electronic identity credential must not be issued because of a court order under section 64(1)(a).

(6) A comparison under subsection (5) may be carried out manually or electronically (for example, using facial recognition software).

(1) The chief executive may set standards or specifications that participating agencies must comply with in respect of the use of electronic identity credentials by those agencies.

(2) Without limiting subsection (1), the standards and specifications may relate to 1 or more of the following:

• (a) measures to protect the privacy of individuals:

• (b) measures to protect and enhance the security of information supplied to participating agencies:

• (c) minimum requirements for the storage of information supplied by the Service.

(1) The chief executive may require a participating agency to provide to the chief executive, by a given date and time or at specified intervals, a written or an electronic report on the use of electronic identity credentials by the agency.

(2) Without limiting subsection (1), the chief executive may require the report to include information about 1 or more of the following:

• (a) the numbers and types of applicable transactions or services offered by the participating agency:

• (b) the types of core identity information that the participating agency is accepting or requiring for the purpose of verifying an individual's identity:

• (c) how the participating agency proposes to comply, or is complying, with the standards or specifications set by the chief executive under section 47.

(3) The chief executive may also require a participating agency to include an auditor's report on the information contained in the written report.

(4) A participating agency must comply with a requirement made under this section.

(1) The chief executive may suspend the use of electronic identity credentials by a participating agency if satisfied that—

• (a) the participating agency has failed to comply with—

  • (i) the standards and specifications set by the chief executive under section 47:

  • (ii) a reporting requirement under section 48; or

• (b) the suspension is necessary to protect the security or integrity of the Service in respect of an investigation that it is undertaking into the possible misuse of electronic identity credentials by that participating agency or any other participating agency.

(2) Before exercising the power of suspension conferred by subsection (1), the chief executive must give the participating agency—

• (a) written or electronic notice of the proposed suspension and the reason for it; and

• (b) a reasonable opportunity to make written or electronic submissions.

(3) However, subsection (2) does not apply if subsection (1)(b) applies and the chief executive considers that giving written or electronic notice to the participating agency may prejudice the investigation in question.

(4) If the chief executive decides to exercise the power of suspension conferred by subsection (1) after considering any written or electronic submissions made by the participating agency, the chief executive must, as soon as practicable, give written or electronic notice of the suspension to the agency.

(5) The written or electronic notice must specify—

• (a) the reason for the suspension; and

• (b) the period of the suspension; and

• (c) the date on which and the time at which the suspension commences.

(6) Despite the suspension, the participating agency continues to be subject to the provisions of this Act and, among other things, remains liable to pay any outstanding fees or charges prescribed by regulations made under this Act or set by an agreement referred to in section 71(4)(a)(ii) or (b)(ii).

(1) The chief executive may delegate to any person (whether an employee of the State services or not), either generally or particularly, any of the chief executive's functions, duties, and powers under this Act.

(2) However, the chief executive must not delegate any function, duty, or power to a person or class of persons who are employed outside the State services without the written consent of the Minister.

(3) A delegation may be made to—

• (a) a specified person; or

• (b) a person belonging to a specified class of persons; or

• (c) the holder of a specified office or appointment; or

• (d) the holder of an office or appointment of a specified class.

(4) A delegation—

• (a) must be written; and

• (b) may not include a power to further delegate any function, duty, or power; and

• (c) may be made subject to any restrictions and conditions that the chief executive thinks fit; and

• (d) is revocable at any time, in writing; and

• (e) does not prevent the performance of a function or duty, or the exercise of a power, by the chief executive.

(5) A person to whom any functions, duties, or powers are delegated may perform and exercise them in the same manner and with the same effect as if they had been conferred directly by this Act and not by delegation.

(6) A person who appears to act under a delegation is presumed to be acting in accordance with its terms in the absence of evidence to the contrary.

(7) This section does not limit or affect the chief executive's power of delegation under section 41 of the State Sector Act 1988.

(1) The chief executive may perform his or her functions and duties, or exercise his or her powers, under this Act—

• (a) through the employees of the department:

• (b) by entering into an agreement with a third party (whether corporate or unincorporate).

(2) The chief executive must not enter into an agreement under subsection (1)(b) or agree to an extension of the term of an agreement without the written consent of the Minister.

(3) Nothing in this section or in any agreement entered into under subsection (1)(b) relieves the chief executive of the obligation to perform any function or duty, or to exercise any power, imposed or conferred on the chief executive by this Act.

(1) This section applies to the following:

• (a) a person to whom the chief executive has delegated, under section 50(1), the chief executive's functions, duties, or powers under this Act and who is not an employee of the State services:

• (b) a third party with whom the chief executive has entered into an agreement under section 51(1)(b) for the performance of the chief executive's functions and duties, or the exercise of the chief executive's powers, under this Act.

(2) For the purposes of the Ombudsmen Act 1975 and the Official Information Act 1982, a person or third party to whom this section applies is to be treated as part of the department when performing the chief executive's functions and duties, or exercising the chief executive's powers, under this Act.

Section 54 applies to the following decisions that are made by the chief executive:

• (a) a decision to refuse to issue an electronic identity credential under section 28; or

• (b) a decision to refuse to renew an electronic identity credential under section 29; or

• (c) a decision to refuse to amend an electronic identity credential under section 30; or

• (d) a decision to refuse to cancel an electronic identity credential under section 31; or

• (e) a decision to amend an electronic identity credential under section 32; or

• (f) a decision to cancel an electronic identity credential under section 33; or

• (g) a decision to suspend the processing of an application under section 34(2)(a); or

• (h) a decision to suspend an electronic identity credential under section 34(2)(b); or

• (i) a decision to revoke an electronic identity credential under section 35; or

• (j) a decision to suspend the use of electronic identity credentials by a participating agency under section 49.

(1) A person dissatisfied with a decision to which this section applies may apply to the chief executive for a reconsideration of the decision.

(2) An application under subsection (1) must be made in a manner approved by the chief executive and, for the purposes of this subsection, section 45 applies with any necessary modifications.

(3) If the original decision was made by the chief executive personally, it must be reconsidered by the chief executive personally.

(4) If the original decision was made by a person acting under the delegated authority of the chief executive under section 50 or by a third party under an agreement made under section 51, it must be reconsidered by—

• (a) a person not involved in making the original decision; or

• (b) the chief executive.

(5) The person undertaking the reconsideration—

• (a) may take into account any new or additional information supplied by the applicant for reconsideration; and

• (b) must complete the reconsideration within 20 working days after the date on which the chief executive receives the application for reconsideration under subsection (1); and

• (c) must, as soon as practicable, give the applicant written or electronic notice of—

  • (i) the decision on the reconsideration; and

  • (ii) the reasons for the decision on the reconsideration.

(6) The decision on the reconsideration is final and no further application for reconsideration of that decision can be made.

(7) This section does not affect the right of any person to apply, in accordance with law, for judicial review.

The Electronic Identity Verification Service is the same service as the Identity Verification Service that—

• (a) was operating immediately before the commencement of this Act; and

• (b) issued pre-commencement electronic identity credentials.

(1) The function of the Service is to support the chief executive in performing his or her functions or duties, and in exercising his or her powers, under this Act.

(2) The Service and, in particular, the employees of the department, perform functions or duties, and exercise powers, that the chief executive may from time to time delegate to those employees under section 50.

(1) The Privacy Commissioner may, at intervals not shorter than 12 months, require the chief executive to provide the Privacy Commissioner with a report on—

• (a) the operation of the Service or any aspect of the Service:

• (b) the operation of a confirmation agreement entered into in accordance with Schedule 1.

(2) Without limiting subsection (1)(a), the Privacy Commissioner may require the chief executive to include information about the following matters in a report under that subsection:

• (a) the number of participating agencies:

• (b) the number of electronic identity credentials that have been issued or cancelled:

• (c) the types of transactions or services for which electronic identity credentials are used:

• (d) the number of times electronic identity credentials have been used by all or any classes of individuals:

• (e) the number of times that persons have accessed individuals' records of usage history under section 23(1)(b) to (d):

• (f) any issues that have arisen, or that are likely to arise, in the use of the Service.

(3) A single report may address the matters in subsection (1)(a) and (b) if reports on both of those matters are required by the Privacy Commissioner to be the subject of a report.