EU Digital Wallet: What you need to know now

What is this all about?

The European Union is continuing to drive digitalization forward and is introducing the digital wallet (EU Digital Identity Wallet, EUDI Wallet) announced back in 2022. It provides EU citizens with an electronic identity and is expected to be available from 2026. Initial pilot projects are already underway.

What is the EUDI Wallet?

The EU's digital wallet is designed to function like a digital wallet that many consumers are already familiar with from companies like Google, Samsung, or Apple. The difference: official identity documents such as ID cards or driver's licenses can be stored in the EUDI Wallet. In addition, EU citizens will be able to use the wallet to provide qualified electronic signatures. The EUDI Wallet is one of the requirements of the amended "Regulation on electronic identification and trust services for electronic transactions in the internal market," or eIDAS 2.0 ("electronic IDentification, Authentication and trust Services"). The revised regulation obliges EU member states to provide their citizens with access to a digital identity that is recognized across Europe.

What are the use cases for the EUDI Wallet?

There are various use cases for the EU's new digital wallet. Primarily, it simplifies the use of public and private online services throughout Europe. With the EUDI Wallet, EU citizens will be able to, among other things,

• open bank accounts
• manage travel tickets
• Store digital documents such as the electronic ID card

The wallet will also play an important role in authentication on the internet . Large platforms like Amazon and private services that are required to authenticate their users will have to accept the wallet in the future. Private service providers without a mandatory authentication requirement can also accept the EUDI Wallet, for example to develop new business models .

How can companies improve their offerings with the EUDI?

In one of four EU pilot projects, the potential of the EUDI Wallet is currently being tested in Germany across six use cases, including registering for a SIM card. The project involves German mobile network operators O2 Telefónica, Telekom, and Vodafone. In addition to concrete projects, there are already numerous other ideas for using the digital wallet for EU citizens – some of which emerged from the "Showcase Digital Identities" innovation competition :

• Logging in to email providers
• Identification for online shopping
• Verifying driver's licenses for car rentals and car sharing
• Registering with the tax office and communicating with tax advisors
• Hotel check-ins
• Digital spa and guest cards in tourism
• Digital identity for travel: all your documents in one place
• Digital employee ID: easy password resets or time tracking
• Managing your personal carbon footprint

Good to know: According to a PwC survey about half of the people in Germany – especially those under 45 – are open to using digital identity verification not only for government services but also for private online transactions.

How does identity verification work?

The EUDI Wallet and the digital identity credentials stored within it are designed to be conveniently managed via smartphone and used. The credentials are verified and electronically signed by qualified trust service providers or a government agency. EU citizens must consent to the sharing of their data with so-called Relying Parties – i.e., banks, car rental companies, government agencies, or other entities to whom they wish to prove their identity. Only then can these entities use an EU trusted list to verify that the credentials have been validated by the issuing authority. To protect the privacy of data owners, the authority is not informed about the queries.

What do data protection experts say?

To ensure data protection for EU citizens, wallet holders should be able to decide for themselves about the sharing of their data. The EU also provides for a data cockpit through which users can view all transactions in their wallet and report suspected data breaches . In addition, the EUDI Wallet is intended to operate with data minimization : For example, when verifying age, it should only confirm that a certain age has been reached, rather than disclosing the person's exact age. Despite these security measures, many data protection experts remain critical of the EU's digital wallet. They fear that an infrastructure is being created that could theoretically enable the surveillance of EU citizens by states and companies. This is considered problematic for two reasons:

• While it is possible to use the EUDI Wallet with a pseudonym (zero-knowledge proof), this protection mechanism is not mandatory and could be bypassed.
• The EU's planned website authentication certificates could allow government agencies in possession of a cryptographic "master key" to monitor internet traffic.

What's next for the digital wallet

There is still a need for discussion regarding data protection. The key here is to set up the IT architecture to be as secure as possible, for example by not using open source. Furthermore, EU citizens must be made more aware of the issue of data protection . The European Parliament is currently voting on the digital identity and eIDAS 2.0 in plenary session. It is expected to come into force in the spring of 2024, and member states will then have to provide a wallet during the course of 2026 . By then, technical specifications, among other things, must be clarified.

What do companies need to know now?

The introduction of the EU Digital Identity Wallet affects not only how EU citizens interact with authorities, but also companies that are legally required to authenticate their customers. While the use of the wallet is voluntary for citizens, certain institutions and companies must offer identification via the wallet. Various pilot and showcase projects demonstrate the possible use cases. Companies that are open to the EUDI wallet can use the time before its introduction to develop new business models. In doing so, it is important to comply with the requirements of eIDAS 2.0 and the GDPR to keep in mind. You are on the safe side when you rely on the expertise of an external data protection officer for your digital projects.