Pioneering Dutch IRMA app points the way for new European digital identity
Users keep full control of their personal data
Users keep full control of their personal data
Earlier this month, the European Commission set out a framework for a European digital identity. The plan envisages an e-wallet for every European citizen, resident and business, enabling them to validate their identity and share all kinds of digitally authenticated documents. So that, whenever you need to show something like a driving licence and educational qualification – or demonstrate your medical status in a situation like the current pandemic – you'll be able to do so using the new system. The European Commission will provide the legal framework (based on eIDAS) and the technical standards for interoperability. Individual member states and commercial players will then ensure that, for example, a Dutch ID app works in France and a French citizen can prove their identity in the Netherlands. Various ID apps are under development around the EU and beyond. But, in IRMA, the Netherlands already has a working app that's ready for large-scale rollout now. IRMA does exactly what the Commission is suggesting the European Digital Identity should do. You could even say the Commission has completely embraced the philosophy underpinning the Dutch IRMA app.
What makes the IRMA app special is that the user never has to share all their personal data. Instead, data is saved locally in the form of a collection of separate authenticated characteristics, called attributes. An individual attribute might consist of evidence that you are over eighteen, for example, or that you live in a particular postal district. That opens up all manner of possibilities. A local authority could enable anonymous voting by getting residents to log in using their validated postcode and evidence of meeting the age criterion. Or a car hire company could check that a customer is qualified to drive without the customer having to say whether they are a man or a woman. IRMA's privacy-friendly design – technically safeguarded by strong cryptographic security – dovetails perfectly with the Commission's requirements for the new European digital identity. The approach minimises the amount of personal data retained by organisations of all kinds, while also enhancing both security and privacy. Another big advantage with IRMA is that data isn't stored in the cloud by anyone like Google, Facebook or Logius (DigiD). Instead, each individual user keeps hold of their own digital proofs of ID, just as they do with a physical passport or driving licence. That design concept – where you, the user, decide what personal data to share when and with whom – is known as Self-Sovereign Identity (SSI). So it's not necessary to use your Google or Facebook account to log in to a third-party service, thus sharing information about yourself with a data hungry tech giant eager to know where and when you log in, and use that knowledge for profiling. IRMA's inventor Bart Jacobs, Professor of Security, Privacy and Identity at Nijmegen's Radboud Universiteit, sees numerous other uses for his brainchild, such as booking a hotel or placing an online order, taking part in an authenticated video call, opening a bank account or enrolling for a study programme.
IRMA is already used by various local authorities and care providers in the Netherlands. So your own city council will soon be able to give you a digital ID, which you can then use to prove who you are and get access to public services, both locally and further afield. Compared with a solution such as DigiD, the great thing about IRMA is that it's an open-source, not-for-profit system. So it's freely available for use by any online service provider that wants to enable secure, privacy-friendly login for its users. And the reliability of IRMA's technical infrastructure is assured by SIDN, the organisation behind the .nl domain. There's also scope for arranging service level agreements covering aspects such as support services. User organisations additionally have the option of contracting out IRMA management, which is then paid for on the basis of the transaction volume. What's more, IRMA transaction charges are lower than the corresponding DigiD and iDIN charges. IRMA already has more than forty thousand users, with hundreds more signing up daily. If, for example, IRMA is adopted by Marktplaats for buyer and seller identification, the rate of take-up could accelerate very rapidly. Thanks to the pioneering IRMA software, the Netherlands is already fully prepared to roll out the kind of modern, privacy-friendly digital identity now envisaged by the European Commission.