Would you trust one app with all your digital identity?

The European Union is set to launch the EU Digital Identity Wallet (EUDI Wallet) by the end of the year. This app will allow citizens, residents, and businesses within the EU to store and share personal documents, access various services, and digitally sign documents. The Wallet is designed to be a private digital space, reducing reliance on major tech companies and national systems while providing users with more control over their personal data.

Each EU member state will develop its own app, which will share the same technical standards. These standards are based on the eIDAS 2.0 Regulation, which aims to create a single digital market for electronic identification. The Wallet will simplify document storage, streamline digital identification, and enhance security and reliability.

Users can include official credentials like national IDs, birth certificates, medical prescriptions, university diplomas, driving licences, gym memberships, and boarding passes in the Wallet. They can also share these documents with both private and public authorities across the EU. For instance, a Spanish university certificate can be presented to a German employer, and rental history from Milan can be shown to a landlord in Stockholm directly from the Wallet.

While users must identify themselves when applying for services, they remain in control of their digital identity throughout the process. They have the right to say no to sharing information or to share it selectively. For example, if someone asks for a student ID, a user could provide their university name and study subject instead of the ID itself.

The EUDI Wallet incorporates features such as "selective disclosure" and "zero-knowledge proof" to ensure users share only the necessary information while keeping other identifying details private. This means service providers will only collect the minimum data required to provide a service. Users can monitor who has access to their data through a privacy dashboard, and digital document issuers must not track or profile users.

Signing documents directly from the Wallet using a free e-signature, which carries the same legal validity as a handwritten one across member states, is also possible. However, the centralization of sensitive information within the Wallet creates a single point of failure. If compromised, the theft of a user’s phone could grant unauthorized access to all their legal, medical, and professional information.

Technical risks also exist, as the Wallet needs to communicate with government servers to verify credentials. This could allow governments or collaborating private corporations to track citizens' authentication activities, potentially infringing on privacy. Furthermore, there are concerns about "over identification," where easy and cheap verified identification could lead to organizations requesting it even when unnecessary.