Pursuant to section 168D and sections 168E(2)(b) and (d) of the Land Transport Act 1998, the Director of Land Transport, after being satisfied of the matters set out in section 168D(3) of that Act, gives the following notice.

1. Title

This notice is the Land Transport (Driver Licensing) Rule 1999: Latitude Data Breach – Easier Replacement of Compromised Driver Licence Class Exemption Notice 2023 No 2.

2. Commencement

This notice comes into force on 4 May 2023.

3. Expiry

This notice expires at the close of 4 May 2024.

4. Purpose

This notice revokes and replaces the Land Transport (Driver Licensing) Rule 1999: Latitude Data Breach - Easier Replacement of Compromised Driver Licence Class Exemption Notice 2023, New Zealand Gazette, 30 March 2023, Notice No. 2023-sl1320.

5. Application

(1) This notice applies to any holder of a current photo Driver Licence who has been advised by Latitude that an Image of, or Details from, that photo Driver Licence retained by Latitude have been stolen by an unknown third party in the Latitude data breach which took place during and around March 2023.

(2) This notice does not apply to any person whose Driver Licence has been replaced or renewed since the Image or Details of the Driver Licence were last provided to Latitude.

6. Revocation and Replacement of Earlier Exemption

The Land Transport (Driver Licensing) Rule 1999: Latitude Data Breach - Easier Replacement of Compromised Driver Licence Class Exemption Notice 2023 which took effect on 30 March 2023 is revoked and replaced with the Land Transport (Driver Licensing) Rule 1999: Latitude Data Breach - Easier Replacement of Compromised Driver Licence Class Exemption Notice 2023 No 2.

7. Interpretation

(1) In this notice –

1. Act means the Land Transport Act 1998
2. Director means the Director of Land Transport.
3. Driver Licence means a licence to drive that is issued under the Land Transport Act 1998.
4. Details means the driver identity information recorded on the front side of the Driver Licence, including the licence number and version number
5. Image means a photographic copy of the physical Driver Licence that includes information on the back and front of the Driver Licence including the version number
6. Latitude means Latitude Financial Services Limited, Company Number 5624865, (or one of its subsidiaries).
7. Rule means the Land Transport (Driver Licensing) Rule 1999
8. Special Process means the process determined and then notified to persons whom this exemption applies by Waka Kotahi NZ Transport Agency to facilitate the issue of a replacement Driver Licence card for this exemption

(2) Any term or expression that is defined in the Act, the Land Transport Management Act 2003, or the Rule and used, but not defined, in this notice has the same meaning as in the respective Act or the Rule.

8. Class Exemption

(1) Any holder of a Driver Licence described in clause 5 of this notice is exempt from clause 74(3)(a) and (b) of the Rule, when seeking a replacement Driver Licence from Waka Kotahi NZ Transport Agency.

(2) The exemption in subclause (1) is subject to the conditions specified in clause 9 of this notice.

9. Conditions Applying to Drivers Relying on this Class Exemption

(1) A person to whom this exemption applies who relies on this exemption to obtain a replacement driver licence must:

1. comply with the Special Process;
2. provide the correct answer to an additional security question;
3. confirm an address that the replacement Driver Licence may be sent to; and
4. either surrender their superseded Driver Licence card to the Director or destroy the superseded Driver Licence card as soon as practicable after receiving their replacement Driver Licence card.

(2) A person to whom this exemption applies may only obtain one replacement Driver Licence under this notice, and following this, a further replacement must be applied for in accordance with the standard process.

Signed at Wellington on this 2nd day of May 2023.

KANE PATENA, Director of Land Transport.

Explanatory Note

This note is not part of the notice. This note indicates the notice’s general effect and the reasons for it being made.

This notice comes into force on 4 May 2023. It expires at the close of 4 May 2024, and may be amended, replaced, or revoked in accordance with section 168E(2) of the Act.

Purpose

The purpose of this class exemption is to expedite the issue of a new photo driver licence (PDL) with a new version number and reduce inconvenience and cost to the affected PDL holders. This is intended as a solution to address the Latitude data breach. Latitude has agreed to compensate Waka Kotahi for the fees associated with replacement licences for persons to whom this exemption applies.

This class exemption revokes and replaces the Land Transport (Driver Licensing) Rule 1999: Latitude Data Breach—Easier Replacement of Compromised Driver Licence Class Exemption Notice 2023, dated 30 March 2023. The initial exemption created a special process for those persons who had their driver licence image stolen. This amendment notice widens the specified class of persons who can benefit from this special process, to include those persons who had driver licence details taken as part of this data breach.

General effect of the class exemption

The notice allows holders of a current PDL, whose PDL image or details have been stolen by an unknown third party during the Latitude data breach, to apply for and obtain a replacement PDL without the need to conduct the transaction through a driver licensing agent. This will reduce the potential inconvenience for such holders who need to replace their PDL because of the illegal actions of an unknown party.

In deciding to grant this exemption the Director of Land Transport has considered and is satisfied of the matters set out in section 168D(3) of the Act. The Director is satisfied that the exemption is appropriate considering the Agency’s objective in section 94 of the Land Transport Management Act 2003, the need to maintain or improve land transport safety, the fact that this exemption supports the response to a large-scale data breach, and other relevant and appropriate matters. The Director is also satisfied that the exemption is no broader than is reasonably necessary to address the matters that gave rise to it.

Reasons for giving the class exemption

PDLs have been a requirement in New Zealand since 1999 and contributed to improved road safety outcomes. Since then, many holders have found a PDL to be a convenient means of proving their identity when dealing with banks and other financial institutions. A PDL may also be used to comply with mandatory identity requirements – for example when buying or selling a property.

Banks and financial institutions have mandated reporting requirements and therefore now retain copies of PDLs (and other documents presented for identification purposes such as Passports) on electronic databases.

Latitude Financial Services and its subsidiaries (Latitude) are significant providers of financial services in Australia and New Zealand. In March 2023 Latitude was subject to a substantial unauthorised data breach by an unknown third party. Amongst the data taken were potentially up to 111 000 PDL images or details. The taking of both the images and details is high risk in that in both scenarios it includes full PDL information including the PDL version number. The version number is an important security feature. It comprises a non-sequential three-digit number which is added to each PDL card issued. A PDL’s version number can be checked against the version number listed on Waka Kotahi records. If the version numbers do not line-up, then that is strong evidence the PDL presented should not be relied upon.

A new PDL obtained by the affected party will have a new non-sequential version number. The old PDL is automatically cancelled on issuance of the new PDL, and the new version number acts as a point of differentiation between the old and new PDLs.