Privacy regulator: digital driver’s license should not be linked to wallet
The European privacy supervisor wants the digital driving license that the European Commission is working on not to be linked to the European identity document. That is not the intention for the time being, but the EDPS already warns against it.
The European Data Protection Supervisor writes that in a press release. The EDPS is the supervisor of projects on European soil where data from citizens is processed. The EDPS’ wish regarding the digital driving license has no legal status, but it is nevertheless an important indication of how the supervisor thinks about it. The regulator responds with this way of thinking to plans by the European Commission to develop a digital driving licence. This should become a framework in which European citizens can not only obtain their driving license physically, but also as digital proof that can be shown via mobile phones, for example, and that must be valid in all EU Member States. The EC has drawn up a guideline for this and is still working on the technical specifications. These revolve around security and interoperability, for example.
The European privacy regulator has now given its first opinion on that plan. The most striking thing about this opinion is that, according to the EDPS, there should not be a mandatory link with the European digital identity wallet. This is also a plan of the Commission, which wants all identity documents of Europeans to be stored digitally in the future. The EDPS says that ‘using the EU Digital ID Wallet for mobile driving licenses should be optional, not mandatory’. There was no question that the driver’s license would be linked to the wallet, but that was obvious.
The EDPS proposes further measures concerning the driving licence. The regulator believes that member states may only exchange driving license data to investigate traffic violations and not for other matters. There should also be a maximum retention period for data.
Although these are only recommendations and not official policies, the statements of the EDPS can be important in the debate. It is now clear to policymakers which standards the regulator would like to apply. In the final determination of those standards, it is unwise for policymakers to deviate from them, because there is a good chance that the EDPS will ultimately pass a negative judgment on them. Just like national regulators, the European privacy regulator also has the right to impose fines or require policy changes if it appears that the GDPR has been violated.