Kelly Burke looks at progress on setting up EU digital wallets.
What's the issue?
A digital identity is an online representation of self. It contains attributes which allows services, systems or applications to determine with confidence that the person they are interacting or transacting with is who they say they are. Attributes are unique identifiers, like a fingerprint accessible online.
The Regulation on Electronic Identification and Trust Services for Electronic Transactions (eIDAS) has been in place since 2014 and provides for national electronic identification schemes as well as cross-country trust services which give digital identity solutions the same legal status as paper based equivalents. Various shortcomings with eIDAS have been identified. It contains inherent limitations, excessive complexity and a lack of flexibility, and this has led to limited adoption of its key goal to create national electronic identity solutions. Only 14 Member States have implemented such schemes. The shortcomings were noted in a European Commission review held during 2020-2021.
Digital identities have become increasingly common with demand soaring during the Covid-19 pandemic demonstrating that a consistent, user-centric and standardised approach was needed. As a result, the European Commission undertook to update eIDAS to provide for an EU-wide framework for attribute-based electronic identity solutions, including a government-issued digital identity wallet which would avoid the need to use commercial authentication providers.
What's the development?
The European Digital Identity Framework Regulation (also known as eIDAS 2.0) was adopted by the European Parliament at the end of February and by the Council in March, and will now be published in the Official Journal. It is expected to come into force by the end of the end of summer 2024, and some implementing legislation is likely to have to be adopted as early as six months from entry into force.
eIDAS 2.0 seeks to recognise the efficiency gains which can be achieved through a high level of assurance, and to address the issues with the current arrangements. One of the key goals of eIDAS 2.0 is empower citizens to use trusted, secure digital identity solutions and provide an efficient and secure digital life for EU citizens.
eIDAS 2.0 has an expanded scope. The existing trust services covered under eIDAS, which focus on digital signatures, will be supplemented by the provision of electronic archiving services, electronic ledgers and the management of remote electronic signatures.
A focus on security and a harmonised approach to technical architecture will further allow the expanded trust services to be used across national boundaries, avoiding fragmentation in national solutions. The revised Regulation includes more stringent technical and operational requirements for trust service providers.
National digital ID wallet
To overcome the low adoption rates of digital identity services under eIDAS, a national digital identity wallet will be created. The wallet will be issued by each Member State and enable secure, trusted and seamless access to services in both the public and private sphere on a voluntary basis.
A digital identity wallet should permit individuals to store the attributes necessary to authenticate themselves online and offline without the need for external authentication solutions. Users will be able to store, share, manage and grant access to their electronic identification and trust services, in a single, convenient application. The digital identity wallet will be provided by mobile phone apps and build on familiarity with using mobile devices for a range of daily tasks such as checking in at an airport or authenticating an online purchase.
For security and trust purposes, attributes held within a digital wallet must be verified and wallet providers will be subject to certification programmes which comply with EU cybersecurity requirements.
Control is a key component of the wallets and individuals will be protected under specific provisions in eIDAS 2.0 as well as other relevant EU frameworks such as GDPR. Users will have control over what data is communicated and how it is used via a privacy dashboard. They will also be able to get free qualified electronic signatures with the same legal standing as written ones.
What does this mean for you?
Practical use cases of digital identity wallets under eIDAS 2.0 include opening a bank account, obtaining a medical prescription or demonstrating a university qualification. Wallets will offer conformity across EU Member States, with a common mechanism applying across all parties which may rely on the attributes presented within them. Citizens will benefit from digital identity wallets to verify their right to live, work or study in a Member State. A pilot programme is already underway to test some of these use cases.
With the move towards a digital future embracing empowerment and trust, the EU hopes to reduce fraud and promote secure cross-border transit. Take up is voluntary so individuals will need to be willing to take the next step in moving past antiquated identity solutions and put down the paper to pick up the mobile phone. Businesses have opportunities, to provide a positive experience for users but also face challenges in achieving the stringent level of assurance required for both legal compliance and to justify the trust placed in them by allowing access to the very characteristics that define who we are.
