Spain’s data protection authority has warned that the EU Digital Identity Wallet, depending on how member states and companies build it, could shut vulnerable groups out of essential services instead of widening their access.
In the latest post in a series on eIDAS 2, the EUDI Wallet, and the GDPR, the innovation and technology division of the AEPD analyzes what it calls exclusion threats: ways the wallet ecosystem could fail to serve a person and hinder their participation in physical or digital life. Despite the regulation’s citizen-centric framing, the authority argues, gaps in the rules leave the protections for people who cannot or will not use the wallet underdeveloped.
One of its central concerns is biometric authentication. If a member state requires facial recognition or fingerprint verification to use the wallet without offering alternatives, the AEPD says, some groups face systematic exclusion. It notes that facial recognition can perform less well on women, people with darker skin tones, and older people whose features have changed, and that some users may struggle with liveness checks or with positioning themselves for a camera. The uneven performance of face biometrics across demographic groups has been a recurring subject of independent testing, including the UK National Physical Laboratory’s examination of racial bias in live facial recognition.
Hardware requirements pose a second barrier. Because the wallet needs a secure element or hardware-backed keystore to protect credentials, providers may support only recent devices, which the AEPD warns could exclude people with older or low-cost smartphones and turn economic status into a gatekeeper for digital identity. Those security requirements are still being defined, with ENISA consulting on the wallet’s cybersecurity certification. The authority also flags documentation barriers, since some states may require a physical ID card or passport to register, excluding undocumented migrants, homeless people, and those who have lost their papers.
Relying parties can exclude people too, the AEPD says, through design rather than outright refusal. It describes deceptive opt-in flows that quietly share extra data, and service tiers in which wallet-based verification takes minutes while non-wallet users wait days. From December 2027, banks will have to accept the wallet for strong customer authentication, and the authority warns that a biometric-only implementation could lock out customers who cannot use it. It calls for amendments requiring alternative authentication methods, support for older devices, anti-discrimination provisions for non-wallet users, and assistance for people with low digital literacy, cautioning that without them the wallet “risks becoming a source of digital division rather than harmonisation.”
Sources: AEPD
–
By Cass Kennedy
