Hi, this is Naohiro Fujie.
Today, I’m looking at a report that Italy’s data protection authority has approved the technical and architectural plans for IT-Wallet, the country’s implementation of the European Digital Identity Wallet.
Source: THINK Digital Partners, “Digital Identity: Global Roundup” (November 2, 2026)
According to THINK Digital Partners, Italy’s data protection authority, the Garante per la protezione dei dati personali, found that the proposed IT-Wallet framework aligned with existing data protection requirements and did not request changes to the draft. At the same time, it emphasized that the organizations involved need to clarify responsibility for handling individuals’ requests to exercise their data rights, as well as safeguards for sensitive information, including biometrics.[1]
What caught my attention was that approval of the design came alongside a statement about the responsibilities of the organizations operating it. A wallet functioning technically is not the same as users being able to ask questions about their data or exercise their rights. I think this news matters when viewed as a question of how to bridge that gap.
Key Points
- The reported approval concerns IT-Wallet’s technical and architectural plans.[1]
- The authority did not request changes to the draft, but it also highlighted the need to clarify the responsibilities and safeguards of organizations handling personal data.[1]
- It is important not to treat this article alone as confirmation of the compliance of specific implementation methods or products, or of the lawfulness of every aspect of operations.
What Stands Out
Here is the passage worth noting.
“However, the regulator emphasised that organisations involved in processing personal data must clearly define responsibility for handling individuals’ data rights requests and demonstrate appropriate safeguards for sensitive information, including biometrics.”[1]
In other words, organizations involved in processing personal data need to make clear who is responsible for handling individuals’ requests to exercise their rights and demonstrate appropriate safeguards for sensitive information, including biometrics.
What I want to highlight here is that the subject is not just the wallet application, but the “organizations” involved in data processing. Even if users see a single service, multiple roles may be involved behind the scenes, including issuing, storing, presenting, and verifying credentials. If inquiries are passed from one organization to another at those boundaries, the system cannot be considered sufficient as a means for users to exercise their rights.
It is worth noting that the source here is reporting by a specialist media outlet. This article does not let us examine the authority’s decision itself or the details of the design documents it reviewed. We should avoid extending the scope of the approval too far and distinguish between what the report explicitly states and the design questions we can draw from it.
Why Does This Matter?
Discussions about digital identity tend to focus on technical verification, such as whether a credential is genuine or whether the person presenting it is its legitimate holder. Those questions are, of course, important. But even if the right information reaches the right party, users may still have concerns if it is unclear how their data will subsequently be handled or whom they should contact.
For example, if information displayed in a wallet is incorrect, should the user contact the wallet provider or the issuer? What if they want to ask about information retained by the party to whom they presented it? These are not claims that such problems are actually occurring with IT-Wallet. Rather, they are examples of questions that should be addressed in advance when designing a system with separate roles.
The authority’s reported emphasis on clarifying responsibilities offers a reminder not to place this end-to-end user experience outside the scope of the architecture. Data protection does not end with an on-screen consent action; it also includes who will respond afterward.
Implications for Implementation and Standardization
On the implementation side, the question is how to incorporate contact points for rights requests, coordination with the organizations involved, and tracking of responses into the service’s operational design. The following are not newly established specifications, but points to check when translating the reported observations into implementation.
- Identify the responsible organization and contact point for each type of data and purpose of processing.
- Provide a path to the appropriate contact point without requiring users to understand the internal arrangements of the issuer, wallet provider, or party receiving the presentation.
- For biometric information, distinguish where it is processed, where it is stored, and who can access it, and be prepared to explain the safeguards.
In particular, the mention of biometric information should not be read as meaning that IT-Wallet is designed to centralize biometric data. Identity verification on a device and retention of information on a server involve different risks to examine. A concrete assessment requires checking the actual data flows.
As for standardization, the report does not indicate changes to any particular protocol or credential format. It would therefore be inappropriate to treat this as approval of a new technical standard. At the same time, being able to connect in accordance with technical specifications and being able to explain responsibilities across organizations are separate things to verify. The perspective that interoperability testing alone does not establish operational readiness is useful for implementers as well.
What to Watch Next
What I would like to examine next is how the approved plans spell out the division of responsibilities among the organizations involved and the procedures available to users. When reviewing published materials, I want to look not only at how users get started, but also at the paths available when information is incorrect or they have an inquiry.
Convenient presentation is not the only thing that supports wallet adoption. Knowing who will help when something goes wrong is also an important part of continuing to use a service with confidence. This news offers an opportunity to consider that unglamorous but essential aspect.
No comments:
Post a Comment