Coming to a website near you this summer: the European Commission is close to a ‘solution’ that could force people to use their government-issued ID to get online. EDRi and EFF’s concerns about threats to everyone’s privacy and data protection, a chilling effect on access to information, and digital exclusion – harming the already most marginalised in society - remain unsolved.
How could this possibly be GDPR compliant?
So I’ve actually looked into the EU wallet stuff quite a bit. The article talks about age verification. The way the EU wallet works is that you can share individual attributes, you don’t need to share your identity at all. When you load your government ID into the wallet, one of the fields is
over_18which has a boolean value (true or false). Any service that requires you to be 18+ would only need to request this single attribute, nothing more. No names, no other personal information, just the fact that you’re over 18.fun fact, governments don’t have to care about gdpr.
Actually they do. They can’t just process your data without your consent. The exceptions where they can process your data without consent are (at least to my knowledge) legal obligation (for example processing your income to calculate your taxes) and public interest (for example doing statistics on households), both requiring some legal work before actually being allowed to be used without your consent.
Technically they can do so that they don’t have to care about GDPR but then it also has to become public knowledge that they don’t want to care about GDPR and it becomes the responsibility of the citizens to oppose such moves.
EDIT: Forgot to add that in this case it most likely would become part of the law so yeah, they wouldn’t have to care about GDPR in this circumstance.