The status of Digital Identity in the EU - where is my EU Digital Wallet?
Welcome to Penneo’s newsletter, where you'll find actionable advice to tackle the challenges faced by your business when it comes to data security & regulatory compliance.?
Today's read is ~7 minutes
Almost two years ago, in June 2021, the EU Commission unveiled the project of establishing a European Digital Identity - the so-called EU Digital Wallet.?
The EU Digital Wallet will be a pan-European app that all EU citizens will be able to apply for and install on their smartphones to store in a single digital place all their ID documents and electronic identification data (including driving license, academic records, bank account details).?
According to EU Commissioner Margrethe Vestager , giving these wallets the form of a smartphone application is intended to help citizens navigate the bureaucracy abroad and cut through cross-border red tape.
The app will allow EU citizens to identify themselves online and offline, perform payments, and create digital signatures.?
Moreover, it will be used to access cross-border public and private services and apply for all sorts of requests - from reporting a change of address to renting a car, enrolling in a university program abroad, opening a bank account, or requesting a medical prescription.
The EU Digital Wallet initiative was created to compensate for the slowness and inefficiency of European countries in implementing national digital IDs.
However, the proposal aroused concerns from privacy activists who fear that storing all essential data of a person in one repository accessible through their phone could pose such information at risk of identity theft as devices can be lost, stolen, or hacked.
Still, the EU Commission clarified that appropriate safeguards would be implemented to ensure adequate protection of sensitive data.
Why was eIDAS 2.0 needed?
It’s been almost ten years since the publication of eIDAS – the EU Regulation which laid down rules for digital IDs in the EU Member States. However, the full potential of the eIDAS regulation has not yet been reached.
Not all EU countries have notified eID schemes, and the cross-border use of digital IDs is still minimal.
The new Digital Identity framework was proposed to make up for the ineffectiveness of the eIDAS regulation and the lack of official eIDs in many EU countries.
Why do many EU countries still lack digital IDs?
eIDAS did not have the desired impact and success. Several factors contributed to the ineffectiveness of this regulation. The following are perhaps the main pitfalls:
1. eIDAS enables the development and use of digital IDs but does not mandate them.
Member States can develop and notify their national eID schemes voluntarily. Even though encouraged by the EU, eID schemes are not mandatory for the Member States.
As a result, only some countries use digital IDs, limiting their coverage to about 60% of European citizens in 14 Member States – just over half of the EU population.
2. eIDAS enables Member States to notify the EU commission of eID means developed nationally but does not require them to do so.
The notification process is necessary for national eIDs to be mutually recognized in all Member States. However, the choice to notify the EU Commission of all, some, or none of the electronic identification schemes used at a national level is up to the Member States.
As a result, only 14 out of 27 Member States have notified their eID schemes.
3. eIDAS enables the mutual recognition of national eIDs but does not harmonize technical standards and audit procedures.
After an EU country notifies the EU Commission of a national eID scheme, this needs to go through a peer-review process. Only afterward is it officially added to the eIDAS Network and recognized in all Member States.
The regulation prohibits the Member States from refusing the eIDs of other Member States. It does not establish technical standards for developing digital IDs nor specific rules for auditing trust service providers.
4. eIDAS enables the notification of eID schemes by the Member States but does not allow private entities to access the notification process.
Limiting the competence to propose eIDs in the hands of state governments appears reductive, considering that the private sector is able and willing to play a decisive role in building eID schemes. In fact, in many cases, these eID means are provided both by public and private entities.
In some countries, national eID schemes are actually being led by the private sector (e.g., itsme? in Belgium, SPID in Italy, etc.).
领英推荐
Currently , 16 EU States have a hybrid approach – meaning that some eID schemes are provided by the State and others by private service providers, with the State acting as an identity broker.?
In 9 countries, however, the government is the primary identity provider responsible for creating, implementing, and maintaining the eID means.
Finland is the only country where private service providers operate the eID means while the State acts as a regulator and intermediary that connects Identity Providers with Service Providers in the public sector.?
5. Member States show a poor digitalization strategy, low level of alignment, and very slow implementation.
A substantial number of countries still need to develop a specific eID strategy.
Some States have briefly mentioned eID within their national digitalization documents or dedicated a small section to the topic in their strategic papers.?
So, what is the EU doing about it?
In light of those gaps, the EU Commission launched a public consultation on the eIDAS Regulation in October 2020 to collect feedback from a broad range of stakeholders and citizens.
The objective was to identify eIDAS weaknesses and the adjustments required to reflect current market trends and prepare for future needs.
The changes suggested to improve eIDs popularity and eIDAS efficacy ranged from shifting from voluntary to mandatory notification of national eID schemes to adopting guidelines to improve legal coherence and consistency.?
Better alignment and some level of similarity among national solutions are also considered a priority, particularly regarding security requirements, level of assurance, and interoperability of eID schemes.?
Besides, it’s been suggested to extend the eIDAS scope to the private sector to allow private trust service providers to develop and notify privately issued eIDs and have them recognized officially across the public and private sectors in the EU.?
Finally, the introduction of a super-national European Digital Identity scheme (EUid) was one of the measures proposed through public consultation.
The current situation
All EU member states agree that digital IDs are a crucial enabler of user-centric digital public services and a necessary step in the European Digital Strategy.
The EU Commission has further developed the concept in the "Proposal for a Regulation amending eIDAS as regards establishing a framework for a European Digital Identity " - where the EU Digital Wallet project was announced.?
Here are the most recent developments:
Concluding remarks
Despite the differences in digital maturity level and the degree of use of eIDs among the Member States, EU countries show a common recognition: eID is a crucial enabler of user-centric digital public services and a necessary step in the European Digital Strategy.?
eIDAS needs to become more valuable for those using, accepting, and providing eIDs and other trust services. The priority is tackling fragmentation in the single digital market, thereby enabling European consumers to access cross-border services and helping European companies grow and scale up their digital operations.?
And the EU Digital Identity Wallet seems an excellent solution to achieve these goals.
What can you do in the meantime?
We’ll keep you posted on new developments - so stay tuned!?
Meanwhile, do you want to learn more about the benefits of a European Digital Identity and the services you’ll be able to access via the EU Digital Wallet? Check out our article !?
And have a look at our latest infographic on how electronic identities are affecting the digital development of European businesses.?
Thanks for reading!
If you're interested in reading more about how to ensure compliance in your business, check out Penneo’s website, and follow us by subscribing to our email newsletter !
Subscribe and browse our previous newsletters and articles here .