QEI takes the next step: a proposal for a research pilot project for the Republic of Slovenia has been prepared
The Institute 1 April has completed the preparation of a proposal for a QEI – Quantized Encrypted Identity research pilot project for the Republic of Slovenia. The document represents the next step in the development of the QEI initiative.
The QEI – Quantized Encrypted Identity initiative is based on a question that is becoming increasingly important as digital identity continues to evolve:
Is it possible to reliably prove a person’s identity or a specific attribute without having to disclose more personal data than is actually necessary?
The prepared research pilot project proposal is intended precisely to examine this question.
It does not represent the implementation of QEI in Slovenia, nor does it mean that the pilot project has already been approved. It is a research pilot proposal intended to enable an expert assessment of the concept and determine whether individual elements of QEI can provide measurable added value in the areas of security, privacy and personal data protection.
From a concept to a testable research question
When developing new digital identity systems, an idea alone is not enough.
A concept must be capable of being tested, measured, compared with existing solutions and independently evaluated.
For this reason, the QEI pilot project proposal is designed as a limited research environment in which the key hypotheses of the concept could be tested without directly implementing it in production government systems.
The proposed approach includes, among other things:
- the use of synthetic or test identities,
- work without direct intervention in production government records,
- testing the security and privacy properties of the concept,
- analysis of personal data minimisation,
- evaluation of the conceptual technical architecture,
- legal and data protection assessment,
- comparison with the European digital identity framework,
- independent expert evaluation of the results.
The key principle is simple:
The pilot must not be designed to prove that QEI works – the pilot must determine whether QEI works and under what conditions.
QEI and European digital identity
The European Union is currently establishing a new digital identity framework, whose central element is the European Digital Identity Wallet, or EUDI Wallet.
QEI is not an alternative to the European Digital Identity Wallet, nor do we equate the two.
The research question is different.
We want to examine whether certain conceptual elements of QEI could provide an additional layer of security or privacy and whether, in the future, they could potentially be connected with the European digital identity ecosystem without compromising its interoperability.
Particular attention is therefore given to areas such as Privacy by Design, data minimisation, cryptographic protection, local processing of sensitive data, user control and reducing unnecessary disclosure of identifying information.
Prove what is necessary – without revealing everything
One of the reference use cases envisaged for research testing is proof of an age threshold.
If a digital service needs to verify whether a user is over the age of 18, an important question arises:
Does the service need to know the person’s first name, surname, date of birth and other personal information – or does it only need a reliable confirmation that the required age threshold has been met?
Such examples lie at the heart of the broader question concerning the future of digital identity.
The digital systems of the future will not be assessed solely on how reliably they can identify a person, but also on how much data they need to process, to whom that data must be disclosed and how effectively it can be protected.
The pilot must also allow for a negative result
An important feature of the proposed research approach is that the outcome is not predetermined.
The research may show that QEI provides significant additional security or privacy value.
It may show that only certain elements of the concept are useful.
It may show that certain parts of the architecture need to be modified.
It may also show that existing or emerging European mechanisms already provide certain functionality sufficiently effectively and that an additional solution is not necessary.
Any of these outcomes would constitute a legitimate result of a research pilot.
The possibility of independent verification, including the rejection of individual hypotheses, is precisely what distinguishes a research project from the promotion of a predetermined solution.
People must remain at the centre
Digital identity is gradually becoming a fundamental infrastructure of modern society.
We will use it in our interactions with government, banks, healthcare services, educational institutions, businesses and numerous digital services.
For this reason, the question of the future of digital identity is not merely a technical one.
It is also a question of who controls identity, who may request data, how much data an individual must disclose and what possibilities individuals have to control how their data is used.
This is also the foundation on which further QEI research is based.
“A good digital identity is not one that reveals the most about a person. A good digital identity is one that can reliably prove what is necessary while revealing as little as possible.”
— Institute 1 April
The next step: expert evaluation
The preparation of the research pilot project proposal represents an important development milestone, but it does not mark the end of QEI’s development.
The next phase must be based on the involvement of relevant experts and institutions in the fields of digital identity, cybersecurity, cryptography, personal data protection, law and European digital infrastructure.
The objective is not to validate QEI in advance.
The objective is to create the conditions under which it can be tested.
If the research pilot demonstrates that the concept provides added value, the results could form a basis for further research and development.
If it does not, that too will be an important result.
For Institute 1 April, the prepared pilot project proposal therefore represents above all a transition from the question:
“How could QEI work?”
to the considerably more important question:
“Can its added value be independently measured and demonstrated?”
This is the next step in the development of the QEI initiative.
