EU Parliament criticizes lifelong identification number

The EU is planning to introduce a digital proof of identity that can be used online as well as offline throughout the EU. The EU Parliament has now criticized these plans and drafted a compromise proposal.

Digital proof of identity

The planned digital proof of identity is intended to lead to the unique identification of all people living in the EU. At the heart of the project is a lifelong identification number that authorities and companies will be able to access. A link to other documents containing biometric data is also planned. It is expressly not intended that the digital ID can be used as a pseudonym.

The digital identity is not identical to the digital ID card, which has already been available for use in Germany for some time.

Massive privacy issues

After the plans were unveiled in 2021, criticism arose from data protection associations. These pointed out, for example, that with a unique personal identification number used not only across authorities but also across countries, it would be possible to create detailed personality profiles. However, those affected could not protect themselves from this or from the further consequences if the state obliged them to create and/or use the digital ID. Patrick Breyer, MEP of the Pirate Party, therefore called for decentralized data storage, the possibility of pseudonymous use and, for the sake of transparency, the openness of the source of the software used.

The project from 2021 is altogether in a row with many other law changes on EU as well as on national level, which legalize state surveillance and thus restrict the privacy of private individuals. The tax identification number as a personal identification number, which is far less comprehensive than the digital ID, for example, had earned its inventor Peer Steinbrück the BigBrother Award in 2007 for violating privacy and promoting surveillance.

Modification by EU Parliament

The EU Parliament has now taken a position on the proposed law and proposed numerous amendments. These are primarily aimed at preserving the autonomy of the individuals concerned vis-à-vis the state. The personal identification number, for example, is rejected in the EU Parliament’s proposal. Furthermore, the Parliament demands that the use of the eID must remain voluntary. Government agencies should be required to continue offering other means of identification and authentication.

Other key demands include a pseudonymous usage option and a revocation option. Those affected should have the right to have their eID deleted at any time. Another key proposal is to introduce so-called zero-knowledge areas. Authorities and companies should only be able to access information that is absolutely necessary for the use of a particular service. For example, if the age of majority is required for an online service, the responsible body should only be able to retrieve the age, but not other personal information.

The EU Parliament’s draft also provides for the implementation of a dashboard in which it is possible to see which data has been shared with whom. This function is also intended to ensure transparency and thus ultimately more authority over one’s own data.

Further developments open

Due to the apparent disagreement between the EU Commission, member states and the EU Parliament, further developments in the matter are open. A trilogue is to be held to develop a proposal to which all three parties agree. It is not yet possible to predict whether this will succeed.

It is also unclear whether the Pirate Party will succeed in getting the decentralized storage of data on users’ devices written into law via the Civil Liberties Committee.