ID wallets: The future of identification and data exchange

This article is based on an episode of the Data Sharing Podcast.

Digital ID wallets are an emerging concept in the world of innovation and digital data sharing. In this article, Hidde Koning (Director of Business Development at Ockto) and Robert Harreman (Founder of Ockto) delve into this topic.

Using five statements, Hidde and Robert provide a comprehensive overview of the current state of ID wallets and offer insights into the future.

They discuss topics such as the feasibility of the wallets, their function as (non-)storage of personal data, the mandatory acceptance by companies and institutions, the potential applications, and the expected offerings in the Netherlands.

Statement 1: Will digital identity wallets really come into existence?

Firstly, the question arises whether ID wallets will indeed materialize. Robert is firm on this matter: “Yes. The European Parliament has adopted the eIDAS 2.0 regulation. This regulation enables the introduction of ID wallets in the European Union. Furthermore, the regulation obliges member states to offer their citizens a digital identity that they can use via an ID wallet.”

Each member state will have its own digital identity

There is sometimes an impression that there will be one central identity coming from Europe for all Europeans, but that is not the case. Europe ensures that individual member states will provide a digital identity. With this, you can identify yourself throughout Europe with your mobile phone, both online and offline.

The precise manner in which the wallets should be introduced will be defined in the so-called ‘Architecture Reference Framework’ (ARF) and in further developing implementing acts. It is expected that this process will be completed by early 2025, after which it will be up to the individual member states to introduce the wallets.

Dutch ID wallet

For the Netherlands, this means that the introduction of ID wallets will be regulated through the ‘second tranche of the Digital Government Act’. Although there are still some uncertainties, such as the exact timeline and political decision-making, it is expected that the wallets will be available to Dutch citizens by the end of 2026 or early 2027.

It is important to note that the use of the wallets will be voluntary. Citizens who do not wish to use them can continue to use traditional identity documents such as passports. Additionally, there will be a choice between wallets offered by the government and wallets from private providers.

Statement 2: Wallets should not be a repository for all your data

With an ID wallet, you can identify yourself, log in to governments and companies, and sign contracts. But with a wallet, you can also share personal data. For example, when applying for a mortgage or other loan, or when renting a house.

Your identity is one of the things you need to provide, but with the wallet, you can also share bank and income data, or data held by the Tax Authority. The second statement is about the function of ID wallets and whether they should contain this entire collection of personal data.

Digital postmen

Robert believes that this should not be the primary role of the wallets. He sees the wallets more as ‘digital postmen’ who transport data securely from the source to the recipient. Upon request and under the user’s control. The data itself is then retrieved from the official source, such as government agencies or banks, only when needed.

This approach has several advantages:

• The data is always up to date since it comes directly from the authentic source (a lender cannot and may not assess based on outdated data);
• the user does not have to keep various data in different wallets;
• from a privacy perspective, it is better if sensitive information is not stored in more places than strictly necessary.

Robert: “However, the wallet will likely contain some basic data, such as the user’s identity and an overview of which data has been shared with whom and when. But the substantive data, such as financial or medical data, remains at the source and is only retrieved and shared with the user’s explicit consent.”

This principle, where the user retains control over their own data and where data is only shared when necessary, closely aligns with the philosophy of ‘data minimization’, which is an important principle in current privacy legislation. It demonstrates how ID wallets can contribute to careful and privacy-friendly handling of personal data in the digital age.

The wallet thus enables easy and secure sharing of your current data with service providers and institutions when requested.

Statement 3: Governments and companies should be obliged to accept all wallets

An important point of discussion is the mandatory acceptance of ID wallets by governments and companies. At least, for a large part of the market.

Each EU member state is required to offer at least one wallet to its citizens. This means that there will already be 27 different wallets in the EU.

Additionally, Robert expects that, especially in the initial phase, there will be a large number of private parties offering wallets. He draws a parallel with the introduction of PSD2 and Open Banking, where many parties jumped in. “In the long run, it is expected that there will be a consolidation to a smaller number of dominant players per country, but the initial variety of wallets will be considerable.”

Governments and large companies, such as banks, insurers, and telecom companies, will be required to accept all these wallets. Major tech platforms such as Facebook and Apple will also be obligated to do so. For smaller companies, such as digital financial advisors, this is not yet entirely clear. The precise scope of the acceptance obligation will be detailed in the aforementioned ‘implementing acts’.

Enabling parties

The obligation to accept wallets will be a considerable challenge for the organizations involved. They will need to adapt their systems and processes to handle dozens of different wallets. However, the wallets will operate according to certain standards, which should simplify implementation. There will also be enabling parties, such as Ockto, that will support organizations in accepting the various wallets.

Despite these considerations, Robert is clear: “For a large group of organizations, the acceptance of ID wallets will become mandatory. This will have a significant impact on their operations and how they manage identity and data.”

Statement 4: In three years, you’ll be able to rent a home using only the data from your wallet.

Moving on to a concrete use case for ID wallets: renting a home. Can you get a rental property in three years purely based on the data you distribute via your digital wallet? Robert’s answer is resolute: “Yes. And furthermore, in a somewhat different form, you can do that now.”

Ockto already offers solutions allowing tenants to securely share their personal data with landlords. This includes identity information, income statements, and insights from bank transactions - precisely the information needed to screen tenants.

eIDAS 2.0 regulation ensures standardization

The difference with the future situation is that this process currently occurs through specific technical solutions provided by companies like Ockto. With the introduction of the eIDAS 2.0 regulation and ID wallets, this process, which is already widely used in the Netherlands, will be standardized and formalized at the European level. However, the underlying need and functionality, namely, securely and easily sharing data between tenant and landlord, is already a reality.

Digital data submission has significant benefits for all parties involved. For tenants, it means a faster and easier process without the need to physically submit various documents. For landlords, it means a reduction in administrative burdens and a decrease in the risk of fraud, as the origin of the data is guaranteed.

Critical questions

Robert emphasizes that we must also be cautious that identification is not requested everywhere indiscriminately in the future. “Precisely because it’s so easy. It’s important to examine that closely. And politicians should rightly ask critical questions about it.”

“Fortunately, there is already legislation for that, the GDPR, which ensures that only the strictly necessary data is requested. For example, when you need to prove you’re 18+, a delivery person doesn’t need to know your date of birth. But often, they still do. With ID wallets in the future, this will be much easier.”

Another point the politics rightly questions, according to Robert, is whether this will exclude non-digital citizens. “Governments and organizations are required to accept digital wallets, but the paper flow must still be possible. And that is also an interesting discussion that will be talked about much more in the coming years. I am sure of that.”

In short, although the statement specifically addresses renting a home, this example illustrates a broader trend. ID wallets will play a key role in numerous transactions and interactions in the near future where securely sharing personal data is crucial.

Statement 5: Initially, the Netherlands will have dozens of wallets

The final statement of the podcast addresses the expected number of ID wallets in the Netherlands. Robert expects that initially, there will be dozens of parties offering wallets in the Dutch market.

An important player in this will undoubtedly be the Dutch government. Robert refers to the ‘NL Wallet’, a pilot project the government is currently working on. “I expect that this wallet will ultimately be integrated into the existing DigiD app, which is already used by a large part of the Dutch population to log in to government services. This government wallet will likely focus on basic identification services and will be broadly applicable within the public sector.”

In addition, Robert foresees the emergence of several private wallets. He expects that initially, there will be many parties looking to enter this new market. In the long term, there will likely be a consolidation into a smaller number of dominant players, possibly two or three major wallets that capture a substantial market share.

These private wallets are expected to offer a broader functionality than the government wallet. They will play a role in a wide range of sectors and use cases, from taking out insurance to booking a trip.

Data in the hands of ‘Big Tech’?

A big question mark in this development is the role of the large tech companies, the so-called ‘Big Tech’. Robert expresses concern that companies like Apple and Google, with their massive user bases and technological capabilities, could dominate the European market for ID wallets.

“We are also discussing with the government and the Dutch business community that they should closely monitor what’s happening here. Make sure you don’t miss the boat and that our entire identification and data sharing piece ends up in foreign hands.”

He emphasizes that this is not the desire of the European Commission either and that measures must be taken to protect European sovereignty in this area.

In summary, Robert paints a picture of a future in which Dutch consumers will have the choice of a wide range of ID wallets offered by both public and private parties. The exact market dynamics are uncertain, but for Robert, it’s clear that digital identity will become a core component of our daily lives.