- Wg-pemc - mailman.kantarainitiative.org

an example of the trust approval process for (in this case) the user's digital wallet
by Tom Jones 03 Jun '26

03 Jun '26

The EU ensures that a wallet used to hold *person identification data (PID)* and other identity information is “approved” (i.e., trustworthy and legally valid) through a *combination of law, certification, and technical standards* under the *eIDAS 2.0 framework*. Here’s a clear breakdown of how that assurance works: ------------------------------ 1) Only government‑issued or officially recognized wallets are allowed - Under the updated *eIDAS Regulation (EU) 2024/1183*, every EU Member State must provide at least one *official digital identity wallet* to citizens. [signzy.com] <https://www.signzy.com/regulation-glossary/eIDAS-2-digital-identity-EU> - These wallets are: - Issued *directly by the state*, or - Issued by *private providers that are formally recognized by the state*. [digital-st....europa.eu] <https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation> ✅ This ensures that the wallet itself comes from a *trusted authority*, not just any app. ------------------------------ 2) Mandatory certification before a wallet can be used - The EU requires wallets to undergo *formal certification* before they are accepted. - Certification is based on: - *Cybersecurity requirements* - *Functional requirements* - *Data protection rules* [eur-lex.europa.eu] <https://eur-lex.europa.eu/eli/reg_impl/2024/2981/oj/eng> ✅ In practice, this means a wallet must pass defined tests and audits to prove it is secure and reliable. ------------------------------ 3) Detailed technical rules (Implementing Acts) - The high-level law (eIDAS) is backed by *Implementing Regulations* that define: - How identity data (PID) and attributes must be stored and shared - Security and integrity controls - Interoperability protocols - Certification and compliance procedures [entrust.com] <https://www.entrust.com/resources/learn/eidas-implementing-acts> ✅ These rules ensure *all wallets behave consistently across the EU*, not differently in each country. ------------------------------ 4) Identity data must come from trusted issuers - The information inside the wallet (like PID or other attributes) is not self-declared. - It must be issued by: - *Public authorities* (e.g., national ID registries), or - *Qualified or recognized providers* (e.g., certified trust service providers) [identt.pl] <https://www.identt.pl/en/blog/attributes-in-the-european-digital-identity-w…> ✅ This guarantees that the identity data presented is *verifiable and authoritative*. ------------------------------ 5) Trust through “qualified trust service providers” (QTSPs) - The framework regulates *trust service providers* who issue or verify identity credentials. - These providers must meet strict EU requirements and may need *qualified status* (QTSP). [yousign.com] <https://yousign.com/blog/eidas-2-0-digital-identity-wallet-compliance-requi…> ✅ This creates a *regulated ecosystem of approved actors*, not open or unverified participants. ------------------------------ 6) Common architecture and standards across Europe - The EU defines a shared *Architecture and Reference Framework (ARF)* and common standards. [eudi-wallet.eu] <https://www.eudi-wallet.eu/> - All national wallets must follow: - Same technical protocols - Same data formats - Same security model ✅ This enables *mutual recognition*—a wallet approved in one country is trusted in all EU countries. ------------------------------ 7) Continuous compliance with privacy laws (GDPR) - All wallet processing of personal data must comply with: - *GDPR* and other EU privacy laws [eur-lex.europa.eu] <https://eur-lex.europa.eu/eli/reg_impl/2024/2981/oj/eng> ✅ This ensures strong protection of personal identity information throughout its lifecycle. ------------------------------ Putting it together (simple explanation) The EU assures that a wallet is “approved” by ensuring: 1. ✅ It is *issued or recognized by a Member State* 2. ✅ It has passed *mandatory certification* 3. ✅ It follows *common EU technical rules and standards* 4. ✅ The identity data inside comes from *trusted, regulated issuers* 5. ✅ The whole system is governed by *strict security and privacy laws* ------------------------------ Key idea 👉 The wallet is not trusted because of the app itself — 👉 It is trusted because it is part of a *regulated, certified, government-backed ecosystem*. Peace ..tom jones

1 0

Kantara PEMC Shared Google Drive Folder — Access and Structure
by John Wunderlich 27 May '26

27 May '26

Hello everyone, I've reorganised the shared Google Drive folder I use for the PEMC work group and wanted to give you an overview of the current structure and how access works. Folder Access The folder is now accessible to anyone with the link at comment level. That means you can view all documents and add comments, but not edit. If you need edit access to a specific file or subfolder — for example, to contribute directly to a draft — please let me know and I'll grant it on request. The folder link is: https://drive.google.com/drive/folders/1uhQoi_5gWzh3BsdLZqHRkWWbUeyfo8zl?us… Folder Structure The folder is organised as follows: • Archive — Earlier working documents and drafts that have been superseded by published output. Retained for reference. • Presentations — Presentations made by the work group, including at conferences such as IIW and Identity Week. • Reports — Finalised Kantara output, including published recommendations and reports produced by the work group. • Templates — The Kantara document template for use in drafting new work group output. • WIP — Active work in progress. This folder contains two subfolders, one for each current workstream: • 1. PEMC Requirements v1.1 — The working draft for the v1.1 update to the published Recommendation. • 2. PEMC Requirements v2.0 — The emerging scope and charter work for the next major version. If you have any questions about the folder or want access to contribute to any of the WIP documents, please reply to this message. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 2

Apologies for the late cancellation of the PEMC
by John Wunderlich 22 Apr '26

22 Apr '26

Another work crisis Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Cancelling today Stream 2 call
by John Wunderlich 08 Apr '26

08 Apr '26

A work conflict has arisen. Apologies. Note: For next week's Stream 1 call, we may have a report from an implementor under the Chatham House Rule. More to follow. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

a proposed use case for the next phase of PEMC
by Tom Jones 01 Apr '26

01 Apr '26

https://docs.google.com/document/d/1aGSbo2QMpRlOZQ5IS0tVmjb0OJ1yifrB7ZO0fYN… please comment directly in the doc. Peace ..tom jones

1 0

Digital Governance Standards Institute Publishes Revised Technical Specification DGSI/TS 115 for Digital Credentials and Digital Trust Services - Digital Governance Council
by John Wunderlich 23 Mar '26

23 Mar '26

FYI: Available in French and English for no charge: https://dgc-cgn.org/digital-governance-standards-institute-publishes-revise… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

The eID Wallet still doesn’t deserve your full trust - European Digital Rights (EDRi)
by John Wunderlich 11 Mar '26

11 Mar '26

https://edri.org/our-work/the-eid-wallet-still-doesnt-deserve-your-full-tru… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

The eID Wallet still doesn’t deserve your full trust - European Digital Rights (EDRi)
by John Wunderlich 11 Mar '26

11 Mar '26

https://edri.org/our-work/the-eid-wallet-still-doesnt-deserve-your-full-tru… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Reminder: No PEMC call tomorrow
by John Wunderlich 03 Mar '26

03 Mar '26

Hi folks; I'm travelling this week so there's not going to be a call tomorrow. In the meantime, I'd like to ask a favour. As you know the new charter splits our work into two work streams. The first work stream is discussions leading to an update to version one of the requirements based on feedback from implementers and testers. The second work stream is discussions leading to a version two of requirements, including elements that we were not considering in version one. The plan is to meet on alternate weeks week one for Work stream one and week two for Work stream two. What I would like to know from you is whether you have a preference to participating in Work stream one, Work stream two, or both? Please reply to this email with an indication of your preference starting next week or the week after we will switch to an alternating cadence of meetings based on your preferences. Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

PEMC 2026 Charter
by John Wunderlich 13 Feb '26

13 Feb '26

Dear Work Group Members At the meeting earlier this week the members attending reached consensus on the 2026 Charter (see the minutes for a copy of the charter). This email is to ensure that all members of the work group are aware of the charter update. Please see the meeting notes here: https://kantara.atlassian.net/wiki/spaces/PEMC/pages/1555562497/2026-02-11+… Have a better than expected day, John Wunderlich “The law, in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.” ― Anatole France Calendly: https://calendly.com/privacycdn LinkedIn: https://www.linkedin.com/in/privacycdn/ Bluesky: https://bsky.app/profile/privacycdn.bsky.social Mastodon: https://mastodon.social/@PrivacyCDN Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0