How will digital wallet pilots in Europe affect the world?

The fourth ID4Africa livecast in the ‘Mobile for Identity Management & Inclusive ID4D’ series turns to mobile ID in advanced economies to close the quartet. Panelists explain the importance of EU pilots, developments in mobile driving licenses and digital travel credentials and how digital ID can power regional identity schemes.

ID4Africa dedicates much of its efforts and livecast airtime to issues affecting developing countries. In this livecast the emphasis shifted to the situation facing digital identity in advanced economies to explore differences and whether any achievements in developed areas may assist schemes elsewhere.

A final panel looks at Africa and why the advantages enjoyed in Europe for new schemes do not necessarily translate to the continent.

All eyes on EU pilots for eIDAS 2.0 implementation clues

The European Union is attempting something that few others are ready to take on: to harmonize the digital identity schemes of multiple nations – 27 at the current head count – and enforce full interoperability for digital wallets and travel documents.

The bloc is not quite ready itself and recently announced funding opportunities for pilot projects to test various use cases for digital identity and digital wallets. The results should inform the full eIDAS 2.0 act to instruct member states as to exactly what is required.

Dr. Detlef Houdeau of Infineon Technologies, speaking in conversation with ID4Africa Executive Chairman Dr. Joseph Atick, shared lists of the digital and mobile ID schemes in place (with notable large omissions such as Germany and France), revealing the fragmented approach to digital identity across the bloc.

“Are we touching greenfield with mobile ID? The answer is ‘no’,” said Dr. Houdeau, which is why the pilots and what they could mean for interoperability are so eagerly anticipated.

There are three key areas of development underway to reach an EU-wide interoperability, according to Dr. Houdeau. The outcome of the adhoc group of identity experts working on a toolbox whose tools are not yet apparent. Then there are the pilots which should be selected in December 2022 and begin in Q1 2023 and last two years. Then there will be the implementation act materials themselves which he expects to appear by 2024 or 2025.

The nature of the pilots, when announced, could be revealing in terms of the scope of interoperable digital ID. Mobile devices could be used for building access, social security, pensions wherever in Europe a European citizen lives.

“This seems to be one of the biggest developments in the domain of identity since I’ve been in it for the last 30 years,” remarked Dr. Atick. “This seems to be basically infrastructure in a most extensive way.”

Dr. Houdeau warned that the outcomes of the pilots into daily life use cases are essential as there are still unknowns such as how the system will handle minors, and what happens when a smartphone is lost or stolen.

What’s different about digital identity in an advanced economy?

“In most advanced economies, mobile ID goes beyond a single tool to authenticate a citizen or user,” said Marie-Sophie Bellot, Marketing and Strategic Manager for Digital Identity Markets at Idemia.

“We are looking for real citizen experiences with the ability to derive multiple identity documents, from your national identity card, passport, driving licence, health documents alongside other related identity attributes such as residence, diploma.”

For Einārs Leps, regional sales executive of Latvia’s X-Infotech, this transition period from physical to digital credentials is the “belle époque of digital identity” and Hannes Krause of Estonia’s Cybernetica believes that the online world gets people used to a certain standard of online experience, no matter where they are, which will impact digital identity products in the developing world.

Bellot believes that the requirement to involve the private sector in eIDAS developments is key to the project’s successes, something Dr. Atick believes is “going to create a revolution.”

Digital identity technologies may become more essential in countries where younger generations are particularly used to living their lives online, thought the panelists.

Leps compared 2021 municipal elections in neighboring Estonia and Latvia. The latter achieved 34 percent turnout, the former 54 percent. “You can guess which of these two has e-voting in place,” said Leps, adding that 46 percent of all voters who voted in the Estonian elections had voted online.

“If you want to engage your younger generation, if you want them to be part of the governmental process, of state processes, you have to talk about full-scale e-government,” said Leps.

Digital identity on the move: mDLs and border crossings

New generations of digital travel credentials are on their way, signed by ICAO, said Michael Edwards of Veridos. Three types are coming into use, with Type 1, the least sophisticated, already available.

While a traveler can use NFC to scan an e-passport with the Type 1 smartphone software, it is not sufficiently robust to act as a virtual passport and he or she must also carry the physical credential.

By the end of the year, Types 2 and 3 should be available. These require physical safety features in higher end smartphones and Type 3 requires a user to register in person. Type 2 users are advised to carry their passports, whereas Type 3 should be able to cross borders with their smartphones.

Mark Sullivan of Canadian Bank Note said that upcoming digital trust services will allow cached versions of mobile driver’s licences (mDLs) to be read offline and be easily checked outside the issuing jurisdiction. Sullivan also said new ISOs for mDLs would improve testing and extended use of the digital credentials.

Can digital identity be a shortcut to regional identity?

Countries focus on their own national identity apparatus whether physical or digital. But as more nations club together in regional blocs, there can be duplication where citizens are required to register for another credential for the region. What if that part were purely digital?

“The beauty of the digital identity wallets is that it’s going to bridge not all the gaps but some of the gaps and it will ease interoperability, especially with the latest standards,” said Kristel Teyras of the Secure Identity Alliance.

By adopting digital identity for regional schemes, it can be made interoperable. All countries to buy in to the system and decide on standards and security, but using a digital wallet will give a group flexibility, according to Teyras.

Countries can leverage their existing achievements such as a biometric register and upcoming ISOs will make interoperability even easier to handle.

Meanwhile in Africa, stakeholders are not practicing what they preach

A lack of data protection legislation or poor enforcement means identity systems in Africa leave citizens vulnerable to surveillance, according to a panel of African digital rights experts. The fact the global mobile network operators (MNOs) do not operate in Africa to the standards they adhere to in, say, Europe, is not helping.

As African nations pursue public-private partnerships with MNOs, such as for registering people for national ID in Nigeria, can the public trust them?

“There’s a thin line where data may be misused potentially by the MNOs. If you find yourself using an MOU (memorandum of understanding) in the partnership, that basically means nothing because MOUs are not legally enforceable,” said Nolwazi Hlophe of the Digital Frontiers Institute, speaking about gaps between legislation being approved and implemented.

“So you might need to take it a step further and think about contractual agreements, service agreements, NDAs.”

This would be to attempt to make sure data goes straight to the identity authority, not held by the MNO.

Citizens need assurance that there are protections for their personal data, said Teki Falconer of the Africa Digital Rights’ Hub. This requires legislation to be implemented and this implementation plays a more significant role than the law.

Solomon Okedara, a Nigerian digital rights lawyer, pointed out that Nigeria’s new NDPR is still just regulation, not legislation. In what he describes as a “failed attempt at regulating personal data in Nigeria,” the NDPR focuses on electronic data meaning little protection for data on paper documents and its agency NITDA is not an independent authority.

Falconer points out that MNOs in Africa may follow legislation to the letter in Europe, but less so in Africa. They also do not publish transparency reports on whether they interact with citizens on issues such as data deletion or provide records of data access requests by government agencies.

Okedara says MTN Nigeria has published only one such report, in 2020. Falconer says that African governments are also not releasing their own reports on transparency.

MNOs may claim they operate to higher international standards, but beware, said Falconer, as if something goes wrong, for example in Ghana, a person cannot flag GDPR as it does not apply there.

The knock-on effects on surveillance in Africa are already apparent. “We are even passing legislation that enables this to happen, we are passing legislation that forces mobile operators to necessarily give access, information to government entities without going through proper protocols or legal structures,” said Falconer, who pointed out agencies are acquiring user data from MNOs without even going through courts.

When it comes to digital and mobile identity, Nolwazi Hlophe has a warning: “No matter how convenient it is, don’t give up your privacy.”

Find our coverage of the first, second and third episodes in the series for more background to the discussion.

Registration for ID4Africa 2022 is currently slated to end by 20 May, subject to availability, and workshop applications close on 6 May 2022.

Article Topics

Africa  |  biometrics  |  data protection  |  digital ID  |  digital travel credentials  |  digital wallets  |  eIDAS  |  EU Digital Identity Wallet  |  Europe  |  ID4Africa  |  identity management  |  Infineon  |  interoperability  |  mDL (mobile driver's license)  |  standards