In this photo illustration, a government website shows instructions for setting up Germany's AusweisApp in Berlin, Germany. Sean Gallup/Getty Images

Premium Economy EU bubble

EU digital identity wallet stalls in 24 member states as Brussels reopens its privacy rulebook

4 minutes read

Only Italy reached any scale before the December date, privacy groups challenged safeguards the European Commission had redrafted in committee, and the gap between the law and the rollout left the specification still open to change.

Senior Editor

Some 24 of the European Union’s 27 member states have yet to make a digital identity wallet available to their citizens and are expected to miss the bloc’s legal deadline of December 24, 2026, according to Euronews.

The obligation stems from Regulation (EU) 2024/1183, the revised eIDAS framework, which requires every capital to offer citizens at least one certified wallet.

The deadline falls on governments rather than on citizens. It measures whether 27 administrations can build something, not whether anybody wanted it built.

On the first count the answer is now clear. On the second there is very little evidence either way, and the little there is does not point in the direction the timetable assumed.

Italy is the exception, with almost eight million people using its wallet each month. Germany has set January 2, 2027 as its launch date, nine days after the deadline expires.

The Netherlands has pushed its rollout back to late 2027 after a pilot scheme attracted 57 users. Bulgaria is still drafting the national legislation it needs to issue a wallet at all.

This is a familiar sequence in EU technology policy. A regulation sets a date, the date arrives, and the infrastructure it assumed turns out to exist in three member states.

What makes this particular slippage worth examining is that the rules the wallet is meant to follow are themselves still being written.

The regulation writes in three safeguards intended to stop the wallet becoming a tracking tool, namely selective disclosure, unlinkability and issuer blindness.

Together they are meant to ensure that a shop checking a customer’s age learns nothing else, and that the issuing State cannot see where the wallet is used.

Those provisions are the difference between an identity document and a record of where its holder has been.

European Digital Rights (EDRi) and the Austrian group epicenter.works have argued that the European Commission is diluting them through implementing acts, which are drafted outside the ordinary legislative procedure and attract none of its scrutiny.

They say the text now asks only that revocation mechanisms hinder linkability rather than prevent it, and that a facial image has been added to the minimum data set every wallet must carry.

Member states settled that dispute at a meeting of the eIDAS committee on June 18, agreeing that national authorities may make the portrait optional. Campaigners counter that nothing obliges them to do so.

So the question of what a European identity wallet must contain is being resolved in a technical committee, two years after the European Parliament thought it had resolved it.

That is the case for the delay. A specification can be argued over while it exists on paper. Once it has been implemented across 27 national systems and the databases behind them, changing it stops being a drafting question and becomes a procurement one.

The 24 capitals that have not built a wallet have not yet locked anything in. That is worth something while the eIDAS committee is still sitting.

The window narrows from next year. Businesses will have to accept the wallet from December 24, 2027, and banks face an earlier date of July 2027 because of anti-money-laundering rules.

Using the wallet is voluntary and paper documents remain valid, though a credential that every bank and business is obliged to accept tends to become the path of least resistance regardless of what the law says about choice.

The scope has already moved once. The European Commission, which in April urged capitals to adopt its age-verification app, has built that tool so it can be folded into the national wallets rather than run separately.

Each addition is reasonable on its own terms and cheap to make once the plumbing is laid, which is the usual way these systems grow.

EU-funded pilot projects involving 350 organisations issued more than 1,500 digital credentials and completed over 8,000 cross-border transactions before the deadline, Euronews reported.

The European Commission has set a target of 80 per cent of citizens using a digital identity solution by 2030, a figure that assumes both that a wallet exists and that people reach for it.

Italy suggests the second assumption can hold. The Dutch pilot is the only other published attempt to test it, and it found 57 people.

The deadline will pass in December with most of the bloc having built nothing. The rules the wallet will eventually run on are better for it.

Key Topics

More like this

Democracy

New EU digital driving licence ‘will erode personal freedoms’

By Paddy Belton

Europe's sovereignty stack is missing the tech
Opinion

Europe’s sovereignty stack is missing the tech

By Thibault Schrepel

EU bubble

St John of Patmos saw it coming: EU digital identity will know everything

By Konstantinos Bogdanos

The European Commission is turning up the pressure on EU capitals to deploy the age-verification app.(Photo by Thierry Monasse/Getty Images)
Bureaucracy

EC urges member states to adopt age-verification app

By Anne-Laure Dufeal