Wg-pemc

Download

wg-pemc@kantarainitiative.org

June 2026

3 participants
2 discussions

Draft Scope of Work for Stream 2
by John Wunderlich 04 Jun '26

04 Jun '26

Hi Folks; I have created a draft scope of work for PEMC Stream 2. You should be able to view and comment with this link: https://docs.google.com/document/d/1MBcsmjc9N4H0rwpKEVzrSvOJnOkazfmaC5vG7Xi… Looking forward to your comments and to talking tomorrow on the call. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

an example of the trust approval process for (in this case) the user's digital wallet
by Tom Jones 03 Jun '26

03 Jun '26

The EU ensures that a wallet used to hold *person identification data (PID)* and other identity information is “approved” (i.e., trustworthy and legally valid) through a *combination of law, certification, and technical standards* under the *eIDAS 2.0 framework*. Here’s a clear breakdown of how that assurance works: ------------------------------ 1) Only government‑issued or officially recognized wallets are allowed - Under the updated *eIDAS Regulation (EU) 2024/1183*, every EU Member State must provide at least one *official digital identity wallet* to citizens. [signzy.com] <https://www.signzy.com/regulation-glossary/eIDAS-2-digital-identity-EU> - These wallets are: - Issued *directly by the state*, or - Issued by *private providers that are formally recognized by the state*. [digital-st....europa.eu] <https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation> ✅ This ensures that the wallet itself comes from a *trusted authority*, not just any app. ------------------------------ 2) Mandatory certification before a wallet can be used - The EU requires wallets to undergo *formal certification* before they are accepted. - Certification is based on: - *Cybersecurity requirements* - *Functional requirements* - *Data protection rules* [eur-lex.europa.eu] <https://eur-lex.europa.eu/eli/reg_impl/2024/2981/oj/eng> ✅ In practice, this means a wallet must pass defined tests and audits to prove it is secure and reliable. ------------------------------ 3) Detailed technical rules (Implementing Acts) - The high-level law (eIDAS) is backed by *Implementing Regulations* that define: - How identity data (PID) and attributes must be stored and shared - Security and integrity controls - Interoperability protocols - Certification and compliance procedures [entrust.com] <https://www.entrust.com/resources/learn/eidas-implementing-acts> ✅ These rules ensure *all wallets behave consistently across the EU*, not differently in each country. ------------------------------ 4) Identity data must come from trusted issuers - The information inside the wallet (like PID or other attributes) is not self-declared. - It must be issued by: - *Public authorities* (e.g., national ID registries), or - *Qualified or recognized providers* (e.g., certified trust service providers) [identt.pl] <https://www.identt.pl/en/blog/attributes-in-the-european-digital-identity-w…> ✅ This guarantees that the identity data presented is *verifiable and authoritative*. ------------------------------ 5) Trust through “qualified trust service providers” (QTSPs) - The framework regulates *trust service providers* who issue or verify identity credentials. - These providers must meet strict EU requirements and may need *qualified status* (QTSP). [yousign.com] <https://yousign.com/blog/eidas-2-0-digital-identity-wallet-compliance-requi…> ✅ This creates a *regulated ecosystem of approved actors*, not open or unverified participants. ------------------------------ 6) Common architecture and standards across Europe - The EU defines a shared *Architecture and Reference Framework (ARF)* and common standards. [eudi-wallet.eu] <https://www.eudi-wallet.eu/> - All national wallets must follow: - Same technical protocols - Same data formats - Same security model ✅ This enables *mutual recognition*—a wallet approved in one country is trusted in all EU countries. ------------------------------ 7) Continuous compliance with privacy laws (GDPR) - All wallet processing of personal data must comply with: - *GDPR* and other EU privacy laws [eur-lex.europa.eu] <https://eur-lex.europa.eu/eli/reg_impl/2024/2981/oj/eng> ✅ This ensures strong protection of personal identity information throughout its lifecycle. ------------------------------ Putting it together (simple explanation) The EU assures that a wallet is “approved” by ensuring: 1. ✅ It is *issued or recognized by a Member State* 2. ✅ It has passed *mandatory certification* 3. ✅ It follows *common EU technical rules and standards* 4. ✅ The identity data inside comes from *trusted, regulated issuers* 5. ✅ The whole system is governed by *strict security and privacy laws* ------------------------------ Key idea 👉 The wallet is not trusted because of the app itself — 👉 It is trusted because it is part of a *regulated, certified, government-backed ecosystem*. Peace ..tom jones

1 0