News & Insights

The EU Digital Identity Wallet is likely to fulfil the SSI principles of existence, access, interoperability, consent, minimalisation and protection. It will allow citizens to have an independent existence. It is likely that the wallet will give users access to all its claims and data and that users can retrieve the claims and other data within their wallet. Data will be stored decentrally in the user’s wallet. The intention of the European Commission is to allow – or even force – acceptance in a wide range of sectors in the public and private domain and thereby ensure that identities are as wisely usable as possible (interoperability). The principle of consent will also be met, as it is already fulfilled with current eID solutions notified under eIDAS and other EU regulations, such as GDPR and PSD2. One of the explicit requirements of the proposal is selective disclosure, in line with GDPR’s rules on data minimalisation. The rights of users will be protected, as the proposed regulation includes multiple explicit statements about privacy, security and protection of personal data.

The principle of transparency could be fulfilled, although this is still uncertain. The principle requires systems and algorithms to be free, open-source, well-known and as independent as possible of any architecture. The principle also requires management and updates to be transparent. The generic technical framework as described in the proposal will likely be transparent, but since it is intended to also allow for market parties to deliver their services, it remains to be seen whether systems, algorithms, management and updates of all individual wallets will be fully transparent.

The degree to which the principles of portability will be fulfilled by the EU Digital Identity Wallet also remains to be seen. The principle requires information and services about identity to be transportable and requires that identities must not be held by a singular third-party entity. The proposed regulation allows member states to develop and implement their own government-operated EU Digital Identity Wallet, or to select an external organisation to develop and implement the EU Digital Identity Wallet on behalf of the government, or a combination of both. This freedom in implementation could make it impossible to transfer information and services to other wallets, as alternatives might not exist in a single member state. Within a member state, the digital identity can still be locked down to one single solution.

The principle of control cannot be entirely fulfilled by the EU Digital Identity Wallet. The principle requires the user to have the ultimate authority over his/her identity, including the ability to hide his/her identity. In several public or compliance-heavy use cases, this is impossible. For example, in circumstances such as submitting a tax declaration, pressing charges, registering as a donor or opening a bank account, the verifier requires a certain level of assurance and the user will not have control over which attributes he/she provides. Many European countries have a central register of persons that is used for many such cases. There are also legal provisions in place for these use cases that do not allow the user to have the ultimate authority over his/her identity.

The principle of persistence will not be entirely fulfilled either. The principle requires a user to be able to dispose of an identity if he/she wishes claims to be modified or removed as appropriate over time. This requires a firm separation between an identity and its claims. In many use cases in a public setting, such as submitting a tax declaration, this is impossible. The tax authority needs to know who did the specific tax declaration. Disposing of an identity should be within legal constraints. A user cannot undo a criminal record because he/she wants to be forgotten. Such use cases do require a connection between an identity and its claims.

Balancing ‘user in control’ with ‘public administration realities’

By design, the EU Digital Identity Wallet cannot fulfil all SSI principles. In a public setting, users have an obligation to provide identity attributes to relying parties, and legal constraints make a firm separation between an identity and its claims impossible. Because of that, the EU Digital Identity Wallet requires the ambition to put the user in control to be balanced with public administration realities. It remains to be seen how exactly this will be balanced as it depends on choices that still need to be made in the eIDAS revision. However, the fact that the revision seems to be an attempt to move towards putting the user in control can be regarded as a positive change compared to the current situation.