Data Protection by Design for Cross-Border Electronic Identification: Does the eIDAS Interoperability Framework Need to Be Modernised?

Abstract

This paper contributes to the discussion on privacy preservation methods in the context of electronic identification (eID) across borders through interdisciplinary research. In particular, we evaluate how the GDPR principle of 'Data Protection by Design' applies to the processing of personal data undertaken for identification and authentication purposes, suggesting that, in some cases, unlinkable eIDs should be a key requirement in order to facilitate data minimisation and purpose limitation. We argue that in an attempt to welcome diverse types of architectures, the Interoperability Framework could have the effect of reducing the data protection level reached by some national eID schemes, when transacting with services that do not require unique identification. We consequently propose that data minimisation and purpose limitation principles should be facilitated through the implementation of two methods, pseudonymisation and selective disclosure, through an addition to eIDAS' technical specifications.

Toward Interoperable Self-Sovereign Identities

“…Zero-knowledge proofs (ZKPs) enable selective disclosure of those claims, meaning the identity subject can disclose only a subset of the claims in a VC instead of disclosing everything in the VC. Selective disclosure is also essential as regulatory frameworks such as eIDAS align with some of the GDPR philosophies like data minimization [81]. In the EU, the eIDAS 2.0 is in development to support new technologies such as VCs and ISO/IEC 18013-5:2021 mobile driver's license (mDL).…”

A Tutorial on the Interoperability of Self-sovereign Identities

“…6. SSI reference model, complete picture data minimisation [72]. In the EU, the eIDAS 2.0 is in development to support new technologies such as VCs and ISO/IEC 18013-5:2021 mobile driver's license (mDL) 21 .…”