Eurosmart’s Answer to Public Consultation on Travel – Dizitalizing ID Cards to make travelling easier

20 Jan 2025 Eurosmart’s Answer to Public Consultation on Travel – Dizitalizing ID Cards to make travelling easier

Eurosmart welcomes the proposal to digitalize national identity cards, enhancing free movement within the EU/SAC Area and leveraging the EUDI Wallet introduced by the amendment to the eIDAS Regulation. However, Eurosmart identifies the following comments:

1. Security Aspects: The proposal lacks clarity on Digital Travel Credentials (DTCs) security aspects. Eurosmart recommends explicitly addressing in Article 5 security of issuance and disclosure process, authentication and validation, and revocation. Eurosmart also suggests requiring end-to-end encryption for DTC issuance in Article 2.
2. Definitions of “Creation” and “Issuance”: These terms are not clearly defined. Eurosmart recommends adding precise definitions to distinguish between these two actions, as each have distinct technical implications.
3. Technical Feasibility of Creation: Article 2.3(2) requires Member States to ensure actions before DTC creation. However, since creation seems to be under the holder’s control (e.g., copying chip content to a mobile), this is odd as it places responsibility on Member States. The distinction between DTC creation and issuance should be clarified.
4. Verification of the storage medium of the identity card: Article 2.3(2) requires verification of the identity card’s storage medium integrity and authenticity but lacks provisions to verify identity card’s validity (e.g., revoked, suspended, or not revoked cards). Eurosmart recommends the proposal to distinguish storage medium (chip), and the data stored in it, and specify how to verify authenticity, integrity, and validity of both.
5. Stakeholder Involvement: Eurosmart advocates for the creation of an expert group to support the technical specifications and procedures outlined in Article 5. This group should include stakeholders such as industry experts and carriers relevant to DTCs.
6. Implementation Timeline: The proposed 12-month timeline for the implementation of Articles 2(1) and 2(2) seems too short. Eurosmart suggests extending the implementation period to 24 months to allow sufficient time for procurement, deployment, testing, and going live.
7. Content of DTCs: Eurosmart recommends clarifying in a dedicated recital that DTCs should allow for up-to-date data (e.g., a recent portrait or current address), to enhance trust in the quality of data provided through DTCs.
8. Definition of DTCs: Eurosmart recommends a clearer definition of DTCs than the one provided in Article 13 of the proposal on EU Travel Application, covering its characteristics such assurance level and validity. Article 5 should focus on technical specifications, while legal aspects should be in the core regulation. The link to the EU Travel application should be clearer, particularly with Article 13, and EUDI Wallet provisions should emphasize trust, security, and binding quality.
9. Integration with the EUDI Wallet: The proposal lacks clarity on DTCs forms under the EUDI Wallet ecosystem (e.g., EAA, QEAA PID) or which entity would play the role of (Q)EAA or PID provider, especially when using the EU Digital Travel Application to create DTCs.
10. Viable Business Model: Eurosmart highlights recommends viable business model for the private sector willing to provide products, systems and services to support the uptake and deployment and DTC, but also to develop and propose use cases based on these DTCs.
11. Technical Integration in EUDI Wallet: Eurosmart calls for clarifications for the technical integration of DTCs within the EUDI Wallet, including:
12. Protocols for DTC provisioning and presentation (e.g., ICAO specifications for border-crossing in the context of the EU Digital Travel Application; ISO/IEC 23220-4 for broader use cases within the EUDI Wallet).
13. Clear security, trust level, and binding quality standards of DTCs within the EUDIW.
14. Privacy measures, as selective data disclosure or lower-resolution portraits in certain use cases to protect sensitive information when presenting DTCs with an EUDI Wallet.