Following the requirements of the Privacy Act won't be sufficient to meet user privacy expectations for digital cash, the Reserve Bank (RBNZ) acknowledges.
The RBNZ makes this point in a consultation note released with its new digital cash consultation paper, Designing privacy into digital cash.
The RBNZ on Wednesday issued the consultation paper seeking public feedback on a central bank digital currency (CBDC) to potentially be used by the general public. The RBNZ notes it has still not yet decided whether to issue a CBDC, which it's referring to as "digital cash." This would be a digital version of New Zealand's existing fiat money, the NZ dollar, backed by the Government and representing a direct liability on the RBNZ.
The objectives for digital cash, the RBNZ says, would be; to ensure that central bank money is available to New Zealanders and allow it to be used digitally, and to enable a money and payments system that is innovative, competitive and contributes to the development of NZ’s digital economy.
Ian Woolford, the RBNZ's Director of Money and Cash, told RNZ digital money would be "private not anonymous," unlike cash which is anonymous because "there is no real tracing of it digitally."
The RBNZ says it wouldn't collect transaction data, and there would be rules on how people's information was used by third parties. Any digital cash service provider will give users control and assurance over how their information is collected, stored, used, shared and deleted, with other government agencies such as Police and Inland Revenue required to use legal mechanisms to access any personal or transaction data held in an individual’s device or online wallet.
"The Reserve Bank will collect as little data as possible and won’t be able to see your personal information or how you spent your money. You will have a choice on how your information is used, stored, shared, and deleted," the RBNZ says.
"To the extent that data is collected, the Reserve Bank should apply the principles on collection, retention and use of information set out in the Privacy Act 2020."
"In particular, the Reserve Bank must also consider who holds the data of end users. The data on end users could be held by the Reserve Bank, a digital cash ecosystem service provider, or an independent entity. The Reserve Bank does not have commercial interests in consumer data, but service providers in the digital cash ecosystem may. Establishing information governance policies and monitoring third party adherence to these policies would likely be required," the RBNZ says.
The design of digital cash should establish how transactions will be authorised, whether the user will be identified and what role the RBNZ will play in collecting and accessing personal data. The RBNZ says digital cash design must consider how any Māori data collected would be consented, identified, classified, stored, and made available to iwi and hapū for their use as per the Māori data governance model. And digital cash design must also address concerns about cybersecurity.
"A key conclusion of this note is that adhering to the Privacy Act 2020 will not be sufficient to meet user privacy expectations. Providing for informational privacy will also not be sufficient. The design and governance of digital cash must also provide for a contextual view of privacy," the RBNZ says.
"Specifically, digital cash design should consider how to embed personal autonomy and freedoms into the use of the digital cash."
"In addition, the Reserve Bank should assure people of the privacy protections that it designs into digital cash. The Reserve Bank and third parties should also communicate well with end users, so they understand what information is being collected and how it is being governed and used. The Reserve Bank should also explore the role of third parties and technical solutions in digital cash and its ecosystem," the RBNZ says.
It notes digital cash may need to comply with the Anti-Money Laundering and Countering Financing of Terrorism Act.
The RBNZ's consultation note summarises privacy considerations in Table 1 below.
The RBNZ is seeking submissions by July 26.
*This article was first published in our email for paying subscribers. See here for more details and how to subscribe.
We welcome your comments below. If you are not already registered, please register to comment
Remember we welcome robust, respectful and insightful debate. We don't welcome abusive or defamatory comments and will de-register those repeatedly making such comments. Our current comment policy is here.