CEN/TC 224/WG 20 - Ad Hoc Group on European Digital Identity Wallets

This document defines and describes the concept of on-boarding of person identification data (PID) within a Wallet. The scope of this document includes cases where a natural person is the User in control of a Wallet. This includes a natural person who is in control of their own information, as well as natural persons who control information to represent another natural person or a legal person. This document considers a single set of PID attributes linked to a single Wallet Unit. This does not exclude the issuance of multiple PIDs representing the same set of PID attributes, e.g. batch issuance.
It also provides the general workflow, the roles and responsibilities at stake, and links the on-boarding with the Level of Assurance concept underpinning eIDAS [1];
The scope of this document includes cases where a natural person is the User in control of a wallet. This includes a natural person who is in control of their own data as well as natural persons who control data to represent another natural person or legal person.
EXAMPLE     If a natural person represents a legal person, the PID provider can issue a "representation PID" in an own Wallet Unit for representation purposes controlled by the natural person Wallet User. The "representation PID" is a kind of attestation which contains PID about the natural person (representative) and about the legal person (representee).
This document is limited to the on-boarding of an unique set of person identification data, complying with the legal provisions of eIDAS [1], in particular (1) issued in accordance with Union or National laws, and (2) conformant with the relevant implementing act [5].
The following aspects are out of scope of this document:
—   the on-boarding of person identification data within a Wallet where the User is a legal person;
—   other types of on-boarding, such as:
—   provisioning of person identification data after revocation, expiration or deletion;
—   addition of other Attributes (under the shape of attestations) in accordance with the requirement of Level of Assurance “High” which are not part of the set of person identification data but are part of the legal identity under National’s laws;
—   management of person identification data (deletion, update, etc.);
—   provisioning of person identification data which is not compliant with the relevant implementing act [5];
—   provisioning of a partial set of person identification data;
—   provisioning of supplemental set(s) of person identification data (multiple PIDs);

This document identifies relevant existing standards and standards work in progress around European Digital Identity Wallets. It also identifies missing work items and overlaps in standards and is supposed to work as a roadmap for future standardization projects in the area.

This document specifies the functionality of the Wallet Unit for Access Control to Wallet Held Assets (WHAs) i.e. personal data relating to the Wallet User and stored in the Wallet Unit. It defines the Wallet Access Control decision Engine (WACE) and the corresponding functional requirements, resulting in recommendations to the user on decision to be made.
This document aims at:
1)   describing and specifying an Access Control Model supporting access control to the various possible operations on WHA(s);
2)   providing the definitions and classification of the various types of data and metadata, and supporting access control to the various possible operations on WHA(s) ;
3)   describing and specifying a W ACE controlling the access to the various possible operations on WHA(s) and the notification returned by the Wallet Access Control Decision Engine to a Wallet Unit;
4)   identifying requirements applicable to the Wallet Access Control Decision Engine;
This document also:
-   identifies technical specifications and standards that can be used to support the concepts described herein;
-   specifies additional requirements for the use of the identified specifications to meet the above objectives;
-   provides the missing technical specifications needed to meet the above objectives where needed;
-   provides examples and use cases;
The Access Control Model and Wallet Access Control Decision Engine defined in this document aim to comply with the regulator requirements regarding access control.
The following areas are out of the scope of this document:
1)   content and encoding of the policies assigned for the disclosure of WHA(s),
2)   implementation choice and encoding of Wallet Held Access Control Metadata;
3)   encoding of electronic attestation(s) of attributes which are in the remit of ETSI/TC ESI.