Digital identity in the EU is changing: from a document to control over one’s own data

The European Union is entering an important phase in the development of digital identity. A citizen’s identity is increasingly understood not simply as an identity document or a username used to access an online service.

A model is emerging in which individuals use their digital identity across public and private services while retaining control over which data they disclose in each specific situation.

An important part of this change is the European Digital Identity Wallet (EUDI Wallet).

The European Digital Identity Regulation requires Member States to make at least one European Digital Identity Wallet available to citizens and residents by the end of 2026. Its use will be voluntary.

This represents a significant shift in the way digital identity is understood.

One identity – different uses

The European Digital Identity Wallet is designed to allow users to prove their identity securely and to use different digital credentials.

Among the possibilities currently being developed or tested are:

• access to public services,
• opening a bank account,
• a mobile driving licence,
• electronic signing of contracts,
• healthcare services and prescriptions,
• proof of educational qualifications,
• travel,
• payments,
• access to social security data.

Large European pilot projects have tested these use cases with the participation of hundreds of public and private organisations.

However, an even more important question than what it will be possible to store in the digital wallet may be another one:

How much data do we actually need to disclose in order to prove something?

Do we always need to say who we are?

Let us imagine a simple example.

An online service wants to verify whether a user is over 18 years old.

Today, such verification may involve providing a date of birth or even presenting a document that also contains the person’s first name, surname, photograph and other personal data.

In reality, however, the service may need only one answer:

YES – the person is above the required minimum age.

It is not necessarily necessary to know the person’s name, address or exact date of birth as well.

This is precisely the direction in which the European approach is developing. In 2026, the European Commission called on Member States to accelerate the introduction of the European age-verification solution, which makes it possible to prove that a certain age threshold has been met without revealing the exact age, identity or other personal data. The solution is designed so that it can be used independently or integrated into the European Digital Identity Wallet.

This represents an important principle for the future of digital identity:

prove what is necessary, without revealing everything.

Selective disclosure of data

The European framework therefore includes the concept of selective disclosure of data.

In a specific situation, the user can disclose only the data or attribute that the other party actually needs.

European rules for digital wallets explicitly require support for the selective disclosure of attributes. They must also allow users to retain control over the use of personal identification data and electronic attestations.

This marks an important shift away from the traditional model:

“Show me your identity.”

towards the model:

“Prove to me only what I need to know.”

“The future of digital identity is not about revealing more data, but about being able to prove more securely while using less data.”
— Institute 1. april

A special issue: biometrics

An even more sensitive issue concerns biometric data.

In July 2026, the European Commission further amended the technical requirements for European Digital Identity Wallets. Where use of the wallet requires the transmission of the user’s portrait, disclosure must remain under the user’s control. Warning mechanisms, transaction logging and explicit user confirmation before disclosure of biometric data are foreseen.

This shows that the question of digital identity is no longer only:

“Can the system determine who I am?”

But also:

“Who can request my data, which data can they request, and do I really have control over it?”

From passwords to identity verification

For many years, digital identity was based primarily on a combination of a username and password.

However, a password by itself does not represent a person’s identity.

It can be forgotten, disclosed, lost or obtained by another person.

For this reason, development is moving towards combining different authentication methods, cryptographic proofs, digital credentials and other security mechanisms.

The European framework is therefore not simply building a new electronic identity card, but a broader ecosystem of trust between citizens, the state and service providers.

Where does QEI fit into this debate?

The QEI – Quantized Encrypted Identity initiative, developed by Institute 1. april, begins from a similar fundamental question:

How can we prove a person’s identity or a particular characteristic without unnecessarily exposing their personal data?

QEI is currently a concept and a development initiative, not an already implemented European system. For this reason, we do not equate it with the European Digital Identity Wallet.

However, we see important areas in which it is worthwhile exploring possible connections and complementary approaches:

• minimisation of personal data,
• multi-factor verification,
• local processing of sensitive data,
• cryptographic protection of identity,
• individual control over the use of identity,
• traceability of access,
• the principle of Privacy by Design.

The development of the EU therefore confirms above all a principle that is also important for the debate on QEI: the future of digital identity will depend not only on how efficiently we can identify a person, but also on how little data we need to disclose and how effectively we can protect it.

Digital identity is becoming infrastructure

Digital identity will gradually become an infrastructure, much like payment systems, telecommunications or the internet are today.

We will use it in our interactions with the state, banks, healthcare, education and private companies.

For this reason, the debate about the future of digital identity must go beyond technology alone.

It also concerns questions such as:

Who controls the identity?

Where is the data stored?

Who can request it?

Can the user see who has used it?

Can a person prove their age, entitlement or another characteristic without revealing their full identity?

And above all:

Is technology serving the human being, or must the human being adapt their privacy to technology?

With the European Digital Identity Wallet, the European Union has taken an important step towards a new model.

The role of research initiatives such as QEI may be to explore how the next generations of these systems could become even more secure, more privacy-preserving and more focused on protecting the individual.