Germany's eIDAS Plan Raises Questions About Digital Identity

Germany's eIDAS Plan Raises Questions About Digital Identity

Approximately 40% of Germans already use their Personalausweis (ID card) to access government services online. However, the country's implementation of the EU's eIDAS regulation is set to introduce a new era of digital identity verification, with a twist: users will need to have an Apple or Google account to access and manage their digital identity. This requirement has sparked controversy and raised concerns about data privacy and security.

The key takeaway here is that Germany's eIDAS implementation will rely heavily on US-based tech giants, potentially compromising data sovereignty and creating a single point of failure. This might sound like a drastic claim, but it's essential to understand the context and the implications of this approach.

How eIDAS Works

The eIDAS regulation is built on the concept of 'notification' and 'recognition' of electronic identification schemes, allowing member states to notify their schemes to the EU and have them recognized by other member states. This is a crucial aspect of eIDAS: it ensures that electronic identification means from one country are accepted and trusted by other countries. Germany, like other EU member states, will need to implement an electronic identification scheme that meets the eIDAS standards.

Germany's Implementation and the Role of Apple and Google

Germany's implementation of eIDAS will utilize a 'Personalausweis' app, which will require users to have an Apple or Google account to access and manage their digital identity. This decision has sparked controversy, with experts arguing that relying on US-based tech giants for digital identity verification may compromise data sovereignty and create a single point of failure. The concerns are valid: Apple and Google are subject to US laws and regulations, such as the Cloud Act, which allows US authorities to access user data stored in the cloud.

The Contrarian View: Increased Security and Usability

Some experts argue that the requirement for an Apple or Google account may actually increase security and usability. These companies have invested heavily in security and authentication infrastructure, making them more secure than many individual governments. Additionally, many users already have accounts with Apple and Google, making it a more convenient option for digital identity verification.

What Most People Get Wrong

Most people focus on the fact that Germany's eIDAS implementation requires an Apple or Google account, but the real problem is more nuanced. The issue is not just about dependence on US-based tech giants; it's also about the data sovereignty implications. When users rely on these companies for digital identity verification, they are effectively outsourcing their data to entities that are subject to US laws and regulations.

Data Sovereignty and the Cloud Act

The Cloud Act is a US law that allows US authorities to access user data stored in the cloud, even if the data is stored in another country. This raises significant concerns about data sovereignty, as it means that German citizens' data may be accessed by US authorities without their knowledge or consent. The use of US-based tech giants for digital identity verification may create a single point of failure, where a single entity has control over a significant amount of sensitive data.

Digital Identity Standards and the EU's Vision

The EU has a clear vision for digital identity: a secure, standardized, and interoperable framework that allows citizens to access government services online. The eIDAS regulation is a key component of this vision, but Germany's implementation has sparked controversy and raised concerns about data sovereignty. The EU may need to revisit its approach to digital identity, ensuring that member states prioritize data sovereignty and security.

Conclusion and Recommendations

The German implementation of eIDAS is a critical test case for the EU's digital identity vision. While the use of Apple and Google accounts may increase security and usability in the short term, the long-term implications are far more concerning. To mitigate these risks, I recommend that the EU:

• Revisit its approach to digital identity and prioritize data sovereignty and security
• Develop standards that promote interoperability and security, rather than reliance on specific companies
• Ensure that member states implement eIDAS in a way that respects data sovereignty and security

By taking these steps, the EU can ensure that digital identity verification is secure, standardized, and interoperable, while also protecting citizens' data and sovereignty.