EU Digital Identity Wallet Regulations: 2024/2979 Mandates Surveillance

From ChatGPT: The uncomfortable truth Article 9 is well-intentioned. It is also naïve about power. It assumes: • providers will resist overreach, • consent will remain meaningful, • retention laws will remain proportionate, • and exceptional access will remain exceptional. None of those assumptions have held reliably in the past. ⸻ Final judgment Article 9 is not a surveillance clause. But it is a pre-surveillance clause: a meticulously engineered register that can be transformed into an enforcement instrument without amending a single word of its text — only the laws around it, the contracts beneath it, and the architectures that implement it. The danger is not that Article 9 does too much. The danger is that it does exactly enough to make future overreach cheap, fast, and legally deniable. If history is any guide, that is the most dangerous kind of infrastructure of all

My mistake - it is Article 9 that is the real zinger Transaction logs 1. Irrespective of whether or not a transaction is successfully completed, wallet instances shall log all transactions with wallet-relying parties and other wallet units, including electronic signing and sealing. 2. The logged information shall at least contain: (a) the time and date of the transaction; (b) the name, contact details, and the unique identifier of the corresponding wallet-relying party and the Member State in which that wallet-relying party is established, or in case of other wallet units, relevant information from the wallet unit attestation; (c) the type or types of data requested and presented in the transaction; (d) in the case of non-completed transactions, the reason for such non-completion. 3. Wallet providers shall ensure integrity, authenticity and confidentiality of the logged information. 4. Wallet instances shall log reports sent by the wallet user to the data protection authorities via their wallet unit. 5. The logs referred to in paragraphs 1 and 2 shall be accessible to the wallet provider, where it is necessary for the provision of wallet services, on the basis of explicit prior consent by the wallet user. …

Happy reading, Been there and done that but both drafting the legal act and the committee work on the IA was paid work. I agree the logs that do not stay on the device are a problem and was forced into the legal act by parliament but where they may not have understood the rabbit hole opened by this privacy dashboard.

Tim Bouma Certainly concerning, but this model fails under realistic multi-hop conditions. When possession is the only security anchor, the system compensates with pervasive control and logging. That centralized log becomes the primary attack surface. In the event of a breach — a persistent risk for centralized systems at scale — the result is not just data exposure, but a cryptographically verifiable record of citizens’ activity in the wrong hands. With Proof of Continuity, entire classes of attacks disappear. Authority becomes anonymous or accountable by design, governed by the protocol rather than external policy. The wallet becomes a commodity. The real security value lies in authority continuity. Concentrating trust and risk this way violates fundamental distributed-systems principles. That is not a sustainable security architecture.

Perfect business opportunity for a privacy wallet provider. Do the regs say that the log have to be easy to find by the authorities? Shard that transaction log thoroughly enough and mix it with noise and I bet you could create a compliant system that is impossible to use for surveillance! Joking/not joking. As soon as I learned a few years ago that all RP had to be registered it became clear (without doing the heavy reading) that in the context “trustworthy” meant “controlled”. Which is of course not the universal understanding of trust.