AEPD makes case for alternatives to EUDI Wallet, biometric authentication

Alternatives to using EU Digital Identity (EUDI) Wallets or their biometric authentication measures must be established lest the project become a source of “digital division” instead of harmonization, according to Spanish data protection regulator AEPD.

The AEPD reviews the ways people can be excluded physically, digitally, economically and socially, and raises the possibility of “privacy-based self-exclusion” in a Monday blog post on “eIDAS2, the EUDI Wallet and the GDPR.”

Spain’s data protection authority has emerged as a leading voice critical of the use of biometrics in general, and the EUDI Wallet onboarding process specifically. The AEPD levied a 950,000 euro fine against Yoti in March for three alleged violations of GDPR, taking an interpretive position on valid legal basis and biometrics that the AVPA warns could undermine the entire EUDI Wallet system.

eIDAS 2.0 at this point does not provide adequate protection for those “unable or unwilling to use the wallet,” the AEPD says. As currently written, the statute allows for implementation choices by EU Member States that can lead to exclusion, in the regulator’s view.

Requiring the use of facial recognition or fingerprint biometrics without an alternative authentication method can cause “systematic authentication” for different demographic groups, the AEPD argues, citing the possibility of algorithms performing “poorly” for women, people with darker skin and with facial asymmetry. The AEPD also suggests “elderly individuals whose facial features have changed over time may struggle with liveness detection systems,” and that physical disabilities make it difficult for some people to position themselves correctly for camera-based authentication.

Documentation barriers could arise if Member States require specific physical identity documents for EUDI Wallet onboarding. Wallet providers could introduce exclusion through device requirements and design choices, including technical requirements that run into planned obsolescence. Relying parties could make design choices that implicitly discriminate against non-wallet users. Opt-out processes could be designed in a deceptive way, which the AEPD says could push privacy-conscious individuals to “slower, more cumbersome alternatives.”

Here the crux of the problem is laid bare. If EUDI Wallets are to deliver the degree of assurance that makes them useful, then the binding of the individual to their wallet must be sufficiently robust. But no method of binding that provides equal assurance to biometrics, according to NIST (among others). For those without modern devices and government-issued ID documents, in-person verification comes the closest, but is generally slower and more cumbersome than remote processes. In other words, the AEPD is calling for an equivalent alternative that does not exist.

“Addressing these exclusion threats requires regulatory and technical amendments mandating alternative authentication methods, technical requirements ensuring support for older devices, explicit anti-discrimination provisions for non-wallet users and opt-out choosers, and mandated support infrastructure for low digital competence populations,” argues the AEPD.

The digital identity community awaits its suggestion on what those alternative authentication methods might be.

Article Topics

AEPD  |  biometric binding  |  biometrics  |  data protection  |  digital wallets  |  EU Digital Identity Wallet