Germany is getting its version of the EU Digital Identity (EUDI) Wallet, as the country's parliament (Bundestag) has passed the Digital Identities Act on October 15.
The law serves as the national legal framework for the introduction of the digital ID wallet, that the EU's official digital ID scheme will be implemented with, and that Germany will launch on January 2, 2027, under the name d-you.
What the bill does is make it easier to exchange biometric data between the authorities in charge of passports and ID cards; it lowers the age at which people can use online ID from 16 to 13; and it gives citizens the option to refuse the biometric photo.
One of the issues was the age at which children can start using the digital ID, with the Left rejecting the lowering of the age to 13, "because it ultimately amounts to preparation for introducing a social media ban for young people, which it also rejects."
EU rules say that very large online platforms are under obligation to accept the wallet, while the committee report said that the German law "extends the acceptance obligations" to situations with no cross-border element.
Reclaim The Net has previously reported about the plan of the Social Democrats (SPD) to make verification with the EUDI Wallet mandatory for social media users aged 16 and above. SPD Secretary General Tim Klüssendorf has been quoted as saying that "We are currently not meeting the state's obligation to protect" and that workarounds "such as via a VPN tunnel" should not be possible.
The EU, however, says that the wallet will be voluntary.
The federal citizen account will remain voluntary, but the pseudonym function, that is required by EU law, will not be ready by the time the wallet is launched.
According to the legislative process, the bill still has to clear the Bundesrat (the states' chamber), and then be signed by the Chancellor and the relevant minister, as well as the President.
The amended bill was adopted with the votes of CDU/CSU and SPD, while AfD, Greens, and the Left voted against it.
The motion put forth by AfD to stop the national wallet and seek a repeal of the wallet provisions in the EU's eIDAS 2.0 regulation (that requires member states to offer an EUDI Wallet) was rejected by a broad majority.
The government's argument is that using the wallet will be voluntary, that existing ID methods will not be replaced, and that this will be the first mobile electronic ID at the "high" level of assurance.
In addition, the report notes that the automated transfer of biometric photos between passport and ID card authorities was previously banned, but this ban on data exchange "costs time and makes it harder for passport authorities to check the identity of applicants."
However, the Greens saw this as a major problem, saying there are "no adequate protection mechanisms against abusive data requests and no binding requirements for secure and genuinely voluntary use." The party is also unhappy about the deletion of the existing ban on the automated transmission of biometric photos between passport authorities, describing it as "particularly problematic."
The Left party said that "it must be ensured that companies only receive the data from a wallet that they have a legal basis to request. This check must not be placed on the shoulders of individual users."
The AfD is worried that the wallet will be used "far beyond administrative services" and that "there must be no compulsion to use it."
The coalition's resolution was that the pseudonym function should be introduced "if not at launch, then promptly," but the Left wanted it to be part of the wallet from day one, saying that pseudonymization "must be in the wallet from the start."
A public hearing was held on October 6, where Thomas Lohninger of epicenter.works said the draft was "tending toward negative" and lacked "essential safeguards." In his view, the wallet could "either become a complete flop or a gift to Big Tech."
Andreas Hartl of the federal data protection commissioner's office said it was unfortunate that the wallet could not be used pseudonymously from the start, while Torsten Lodderstedt of SPRIND, who is in charge of building the wallet, said that "Even the first version will be better than anything that existed before." He also described it as "the start of scaling, not the end of our development."
The idea of a "voluntary" digital ID that online platforms will be forced to accept, that 13-year-olds will be able to use, that will not have the promised privacy feature at launch, and that will make it easier for the authorities to share biometric data, is a concerning one.
So is the fact that the parts of the scheme that are meant to expand its use are ready to go, while the part that is supposed to protect users' privacy will come later.
