eIDAS 2: the countdown to a single European Digital ID Wallet has begun

By September 2023, all EU member states must make a Digital Identity Wallet available to every citizen who wants one.

This article outlines the aims and ambitions of this new cross-border EU Digital Identity Wallet (EDIW) and the benefits it will offer citizens, governments, and enterprises. We’ll also explain where responsibility for developing the new wallet lies and the roadmap ahead.
 

eIDAS 2 – realising the vision of a single Digital ID Wallet for Europe 

Many of us are already familiar with using our mobile phones as a convenient means of digital identification. What’s more, the ubiquitous smartphone is an increasingly popular tool for proving that we are who we claim to be (the process known as authentication) in everyday tasks such as digital banking. On top of that, we also see more entitlements migrate to our handsets. These can include anything from an airline ticket to proof of our Covid vaccination status. 

It's a dramatic shift away from clumsy, time-consuming and insecure paper-based techniques.

But across the EU, the development and adoption of an e-ID (electronic ID) accepted in all member states still has a long way to go.

Think about this.

Today, just 14% of key public services across all EU states allow cross-border authentication with e-ID. 

Clearly, that’s not what a single market and equal rights for citizens should look like.

And it’s precisely where the eIDAS 2 Regulation comes into play. With eIDAS 2, the EU Commission intends to make cross-border e-ID a reality. In a nutshell, by 2023, every EU member state must make a Digital Identity Wallet available to every citizen who wants one. 

For citizens, governments, and a myriad of different public and private sector service providers, the advent of eIDAS 2 and the EDIW will bring a mix of challenges and opportunities.

Let’s dig deeper.

Catching up with a digital world

We need to start with a quick history lesson. In 2014, the original eIDAS Regulation was introduced.

In an increasingly digital world, the EU Commission wanted to ensure that citizens could access electronic services smoothly, securely and efficiently, regardless of the European country they were in.

With the advent of eIDAS, the EU became the first global region with a legal framework for trusted digital transactions. In the years since, consistent standards of authentication have been established and much infrastructure built. 
 

So what is significant about eIDAS 2?

With eIDAS 2, the Commission intends to fully realise its vision of a universal, cross-border e-ID. 

In the words of Ursula von der Leyen, President of the European Commission, the goal is a : 

Building on the progress made by the original eIDAS, with eIDAS 2 the Commission is targeting improvement in four key areas:

• The coverage of e-ID schemes
• The acceptance of these schemes by member states
• The use of cross-border authentication
• The user experience of e-ID schemes and services 
   

Introducing the benefits of a Digital ID wallet

Before we explore the benefits of the new EDIW, let’s define what it is - and what it isn’t. 

Many of us already use an OEM wallet, such as those operated by Apple, Samsung and Google, to store digital payment cards on our mobile phone. As the name suggests, the EDIW will perform a similar role for a variety of different schemes including not only ID, but credentials such as driving licences, health records and digital travel documents. 

Significantly, the EDIW is not likely to replace the ID documents (digital and physical) that EU citizens currently use but rather provide a convenient digital version of them. 

At the same time, it is far more than a convenient location on the handset for digital ID, attestations and entitlements. 

Why’s that? 

The EDIW will be highly secure.

It will allow us to share only the personal attributes and data that we need and want to share with third parties.

It will allow us to identify, authenticate and prove our entitlements. In the years ahead, it will facilitate an ever-growing range of services and use cases.

Different member countries will have the freedom to pursue their own designs and functionality.

But every wallet will share some common features and be interoperable right across the EU. 

Specifically, the EDIW will:

• Be fully compliant with existing EU legal frameworks such as the GDPR (General Data Protection Regulation) and Cyber Security Act. 
• Feature strong cryptography, offer the highest level of assurance, and meet specific requirements for preventing and managing security breaches.
• Enable selective disclosure of attributes (such as age). The user only needs to share the necessary information for a particular transaction. For example, if you use the wallet to prove your age, you do not need to share other personal details such as date of birth, name or address. 
• Support a vast range of functions and use cases. The details are still being defined at the time of writing, but these are almost certain to include online identification and signatures. 

But there’s more.

It is not just citizens who stand to benefit from the EDIW. The pandemic has demonstrated the need for governments to digitalise their services even more clearly. In doing so, they can simultaneously improve convenience, security and efficiency. 

The same applies to private enterprises. A secure trusted, and EU-wide means of digital identification and authentication opens the door to a new era in seamless access to services. Enterprises will be able to enhance the user experience while reducing bureaucracy and overheads.

The current situation

To fully grasp the new wallet's difference, briefly consider the current situation. 

According to a 2020 Eurobarometer survey, about 60% of the EU population can access a digital ID. But that figure masks some wide variations between individual countries.

Even the most sophisticated national ID schemes have limited functionality compared to the forthcoming EDIW. And these national schemes do not generally support seamless cross-border functionality right across the EU.
 

Implementing the EDIW

All the evidence suggests strong demand from citizens for the new wallet proposed by eIDAS 2. So how does the EU Commission expect member states to implement it?

The final regulation and the comprehensive ‘toolbox’ of resources and measures needed to create the new wallet are expected in September 2022. At that point, member states will have a year to roll out the wallet. 

But while we are currently missing some detail, the broad principles are clear:

• Every EU member state must ‘notify’ at least one form of electronic Digital ID Wallet.
•  The wallet can be issued directly by a government department or a private-sector provider commissioned by the government. 
• Banks, telecoms and utilities are the most likely such private sector providers. There are potential benefits in areas such as customer relationship management, but they will not be able to monetise the wallet directly. It must be available free to all citizens who want it.
• The wallet must enable verification of a range of attributes, including personal details, qualifications, permits and licenses, and financial and employment data.
• Public services will accept the wallet from launch. Private-sector services will follow. 

Opening the toolbox

The toolbox, when it arrives, will detail everything that member states need to build an architecture to launch and support their wallet. A sizeable proportion of that is likely to be familiar, as it will re-use appropriate European and international standards.

Equally, important new work will be undertaken to provide a common framework and governance for the new scheme. 
 

How can Thales help?

The EDIW is on its way, and the impact on the Digital ID landscape will be transformational. 
Here at Thales, we are ideally positioned to support the key stakeholders responsible for making the EDIW a reality. As a global leader in trusted digital identity schemes, our teams have been working with governments, public services and enterprises on eIDAS since its first iteration in 2014.

As a result, we have a range of proven, eIDAS-certified solutions. Now, we partner with dozens of clients across Europe, helping them prepare for eIDAS 2.

Our technology and expertise support the EU and its member states, accelerate the deployment and adoption of the wallet, and help to put greater convenience and security in the hands of millions of EU citizens.