EUDI Wallet biometric compromise draws privacy concerns

EU member states have reached a compromise on a contentious biometric requirement for the European Digital Identity (EUDI) Wallets. Under an agreement struck on June 18th, individual EU member states will be allowed, but not required, to let users opt out of including a biometric facial image in their digital ID wallet.

The agreement resolves a standoff between the European Commission, which had pushed for mandatory portrait images, and a bloc of member states that objected on privacy grounds. Digital rights advocates, however, say the compromise falls short of protecting citizens and could pressure people into sharing sensitive biometric data whether they want to or not – potentially creating a backlash against the digital ID scheme.

“If they are pressured and forced to use it, I think we’ll just create a pushback from society and people will simply not use this in situations where it might actually be useful for them,” Thomas Lohninger, executive director of digital rights group Epicenter.works, told Biometric Update.

The EUDI Wallet is set to offer residents and businesses in EU countries a means to safely identify themselves online and access public and private services across the bloc. Although they are not mandatory, European countries must offer a digital ID wallet to their citizens by the end of 2026.

The European Commission has been seeking to make facial images mandatory for the EUDI Wallet through Implementing Acts that set the technical rules for wallets’ core functionalities, including specifications for Person Identification Data (PID). The plan, however, has caused a rift among Member States participating in the eIDAS Committee, which is tasked with drafting and voting on the Implementing Acts.

The issue was finally settled at a Committee meeting on June 18th, where the two sides agreed on the amended version of the rule, which is now set to be formally adopted. According to the rule, EU member states can choose to make the portrait image optional, allowing users to decline adding a portrait image to their personal identification data.

Organizations such as European Digital Rights (EDRi) and Epicenter.works point out that countries are not obliged to provide this option to their citizens. Those member states that make the portrait image mandatory could end up leaving them with no option but to share their biometric data with a requesting company or authority whenever they need to prove their age, sign a contract, or order a book.

“It’s a vastly different thing to have your biometric portrait image in a government-issued digital identity system that’s mostly used for e-government,” notes Lohninger. “The [EUDI] wallet is a means to conduct business. It will be the basis for doctor visits, it’ll be the basis for public transport and aviation. So having your portrait in this piece of technology might carry vastly different consequences.”

According to people familiar with the matter, the Commission’s reasoning for including a facial photo of a user is to maintain the EUDI Wallet’s interoperability with Australia, Japan, and Canada, which have adopted the ISO mobile driving license standard (18013-5) that mandates a portrait image. Another reason for having a facial image is for easing identification in proximity scenarios, meaning it can be used in face-to-face interactions with service providers.

In its May response to concerns raised by digital rights advocates, the Commission explains that the portrait image is meant to “support the verification of the identity of the wallet user where genuinely needed.”

“The selective disclosure feature ensures that the portrait is presented only where it is requested by a relying party and the user has approved its disclosure. A portrait cannot, for example, be requested for simple age verification,” writes Christiane Kirketerp de Viron, acting director for Cybersecurity at the Commission’s Directorate General for Communications Networks, Content and Technology (DG CONNECT).

Epicenter.works, however, says that users may be pressured to share biometric data with employers or public authorities.

“The power dynamics in our society are such that there are many situations where consent is not really given,” notes Lohninger.

The inclusion of biometric data in EUDI wallets may also lead to future GDPR issues. Users may have little recourse against relying on a party established in different European countries with weak enforcement of privacy laws.

Epicenter.works also argues that the European Commission has been attempting to use the Implementing Acts to negate many of the safeguards introduced in previous negotiations with lawmakers on the EUDI Wallet.

The group, which is involved in the APTITUDE consortium testing EUDI Wallets, has raised other privacy concerns related to the project, including missing registration certificates, pseudonymity, Big Tech loopholes and weakened anti-tracking protections.

For now, whether the EUDI Wallet becomes a trusted tool or a contested one may depend less on the compromise reached in Brussels and more on the choices individual governments make when implementing it at home.

Article Topics

biometrics  |  digital wallets  |  Epicenter  |  EU Digital Identity Wallet  |  face biometrics  |  interoperability  |  ISO 18013-5