epicenter.works @epicenter_works have published their statement regarding several issues with the #EU's digital #EUDI-Wallet. Three particularly serious issues mentioned:
Pseudonymous use of services only exists on paper
In theory and by law, you have a right to pseudonymous usage of most services, because they have absolutely no legitimate need to know your legal identity. But companies wouldn't be obliged to provide such pseudonymous access. They can just bluntly ask for your legal identity – and if you choose to not provide it, you can't get in.
Your passport photo given away, for free
»The draft Implementing Acts now propose to include a mandatory facial image in the Wallet’s minimum person identification data set«. Whoever you have to provide with your digital legal identity gets a copy of your photo: A premium biometric data item, needlessly surrendered, for free.
Any member state can enable companies to rummage through your digital wallet
#EU Member states can decide to not issue "registration certificates" for businesses, at all. Those certificates work a bit like official IDs, e.g. for ticket inspectors, or police officers. If you look at, and verify such an ID, you know whether those people are making acceptable requests, or not. You wouldn't hand over your driving license, or your bus ticket to arbitrary strangers requesting them, would you?
A country deciding to not issue registration certificates is effectively saying things like "our ticket inspectors and police officers don't need an ID, to back up their requests".
Companies can simply set up a local business there, and treat your digital wallet like a self-service store – because requests originating from that country don't come with any registration certificates that would enable your digital wallet to ring an alarm, in case of an overreach.
https://epicenter.works/content/open-letter-concerning-the-fourth-batch-of-eidas-implementing-acts
#privacy #DigitalWallet