Pursuant to section 168D of the Land Transport Act 1998, the Director of Land Transport, after being satisfied of the matters set out in section 168D(3) of that Act, gives the following notice.

1. Title

This notice is the Land Transport (Driver Licensing) Rule 1999: Latitude Data Breach – Easier Replacement of Compromised Driver Licence Class Exemption Notice 2023.

2. Commencement

This notice comes into force on 30 March 2023.

3. Expiry

This notice expires at the close of 30 March 2024.

4. Application

This notice applies to any holder of a current photo driver licence who has been advised by Latitude Financial Services (or a subsidiary) that an Image of that photo driver licence retained by Latitude (or a subsidiary) has been illegally taken by an unknown third party (the Latitude data breach) in March 2023.

5. Interpretation

(1) In this notice –

1. Act means the Land Transport Act 1998
2. Image means a copy of the physical card that includes information on the back and front of the card including the version number
3. Rule means the Land Transport (Driver Licensing) Rule 1999
4. Special Process means a one-off process devised by Waka Kotahi to facilitate the issue of a replacement card for this exemption

(2) Any term or expression that is defined in the Act, the Land Transport Management Act 2003, or the Rule and used, but not defined, in this notice has the same meaning as in the respective Act or the Rule.

6. Class exemption

(1) Any holder of a photo driver licence described in clause 4 of this notice is exempt from clause 74(3)(a) and (b) of the Rule, when seeking a replacement driver licence from Waka Kotahi.

(2) The exemption in subclause (1) is subject to the conditions specified in clause 7 of this notice.

7. Conditions applying to drivers relying on this class exemption

(1) A person who relies on this exemption to obtain a replacement driver licence must comply with the Special Process devised by Waka Kotahi, this includes:

1. providing the correct answer to an additional security question; and
2. confirm an address to which the replacement driver licence may be sent.

(2) Any person of a class described in clause 4 must either surrender their superseded licence card to the Director or destroy the superseded licence card as soon as practicable after receiving their replacement licence card.

Signed at Wellington on this 29th day of March 2023.

KANE PATENA, Director of Land Transport.

Explanatory Note

This note is not part of the notice. This note indicates the notice’s general effect and the reasons for it being made.

This notice comes into force on 30 March 2023. It expires at the close of 30 March 2024, and may be amended, replaced, or revoked in accordance with section 168E(2) of the Act.

Purpose

The purpose of this class exemption is to expedite the issue of a new PDL with a new version number and reduce inconvenience and cost to the affected PDL holders. This is intended as a temporary measure only to address the Latitude data breach.

General effect of the class exemption

The notice allows holders of a current photo driver licence (PDL), whose PDL image was taken by an unknown third party during the Latitude data breach, to apply for and obtain a replacement PDL without the need to conduct the transaction through a driver licensing agent. This will reduce the potential inconvenience for such holders who would not otherwise be expecting to replace their PDL other than due to illegal actions of an unknown party.

In deciding to grant this exemption the Director of Land Transport has considered the matters set out in section 168D(3) of the Act. The Director is satisfied that the exemption is appropriate considering the Agency’s objective, the need to maintain or improve land transport safety, and other relevant and appropriate matters. The Director is also satisfied that the exemption is no broader than is reasonably necessary to address the matters that gave rise to it.

Reasons for giving the class exemption

PDLs have been a requirement in New Zealand since 1999 and contributed to improved road safety outcomes. Since then, many holders have found a PDL to be a convenient means of proving their identity when dealing with banks and other financial institutions. A PDL may also be used to comply with mandatory identity requirements – for example when buying or selling a property.

Banks and financial institutions have mandated reporting requirements and therefore now retain copies of PDLs (and other documents presented for identification purposes such as Passports) on electronic databases.

Latitude Financial Services and its subsidiaries (Latitude) are significant providers of financial services in Australia and New Zealand. In March 2023 Latitude was subject to a substantial unauthorised data breach by an unknown third party. Amongst the data taken were potentially up to 15,000 PDL images or details. The taking of the images is higher risk in that it included full PDL information including the PDL version number. The version number is an important security feature. It comprises a non-sequential three-digit number which is added to each PDL card issued. A PDL’s version number can be checked against the version number listed on Waka Kotahi records. If the version numbers do not line-up, then that is strong evidence the PDL presented should not be depended upon.

A new PDL obtained by the affected party will have a new non-sequential version number. The old PDL is automatically cancelled on issuance of the new PDL, and the new version number acts as a point of differentiation between the old and new PDLs.