The Paradox of Modern Digital Verification
Consider a common scenario: how often in the past month have we been asked to present a full physical or digital document—a driver’s licence, an identity card, or a bank statement—simply to prove a single attribute? Whether demonstrating that we are of legal age, verifying a minimum income threshold, or confirming the absence of a criminal record for volunteer work, the current paradigm forces an “all-or-nothing” trade-off.
To confirm a simple “yes” to being over 18, citizens routinely hand over their full name, home address, exact date of birth, photo, and national identifier. Once a document leaves the holder’s hands, control is lost: it is archived, photocopied, or forwarded, potentially remaining in third-party databases indefinitely.
The GDPR principle: Data Minimisation as a foundation
The General Data Protection Regulation (GDPR) enshrines data minimisation as a core pillar (Article 5(1)(c)). Personal data must be adequate, relevant, and strictly limited to what is necessary for the specified purpose. This is not merely an administrative or technical detail; it is essential to safeguarding personal dignity and autonomy in digital environments. Without granular control over who accesses our personal data and why, individuals risk being reduced from active citizens to passive subjects of profiling and surveillance.
Because digital identity serves as the gateway to virtually all other personal data, it represents the primary battleground for data minimisation. For instance, purchasing age-restricted products online or entering venues requires confirming a single binary claim (e.g., age >= 18), rather than revealing full identity details.
The European Regulatory Context: eIDAS to eIDAS2
The shift for ensuring true digital sovereignty on personal data is backed by a defined European regulatory roadmap. While the original eIDAS Regulation (2014) established a framework for electronic signatures and trust services across Member States, its adoption remained fragmented.
The revised eIDAS2 Regulation (2024) introduces the European Digital Identity (EUDI) Wallet, mandating that all EU Member States provide at least one qualified wallet to citizens by late 2026. Key architectural principles governing eIDAS2 include:
- Explicit & Granular Consent: Citizens authorize each specific disclosure rather than granting generic, sweeping access.
- Revocation Capabilities: Enabling users to withdraw consent for future data processing.
- Transaction Logging: Transparent audit trails tracking which attributes were shared, with whom, and when.
- Cross-Border Interoperability: Ensuring credentials issued in one Member State are recognized seamlessly across the Union.
- Qualified Trust Service Providers: Trusted entities certifying specific attributes within the wallet so verifiers can rely on authenticity without contacting the source directly.
TRUSTED’s contribution
Two privacy-enhancing paradigms help responds to the above described regulatory shift, transforming digital credential verification from full exposure to strict necessity. They are both implemented in TRUSTED:
- Selective Disclosure: Selective disclosure enables credential holders to choose explicitly, attribute by attribute, which data points to share: a permissions management system, implemented by CyberSocial Lab., which allows users to define which attributes they share, for what purpose, under which conditions, and for how long. Within TRUSTED, this system creates a traceable, immutable, verifiable, and non-repudiable cryptographic proof of the relationship established between the party defining a privacy policy and the user accepting it.
- Zero-Knowledge Proofs (ZKPs): Zero-Knowledge Proofs advance privacy protection further. ZKPs allow a prover to mathematically demonstrate the truth of a statement to a verifier without revealing any underlying data. For more insights on this topic, refer to the TRUSTED Project article on Protecting Sensitive Personal Data Through Federated Data Processing.
In conclusion, within the TRUSTED project, achieving compliance with GDPR data minimisation is no longer just a legal obligation—it is a technical capability. Through the integration of Selective Disclosure and Zero-Knowledge Proofs, digital services will be designed in a way to protect personal privacy without sacrificing security.
