How digital identity actually helps privacy: selective disclosure and the EUDI wallet
by Claudiu Hulea · IT Management Consultant
Digital identity can increase privacy rather than erode it, but only if it uses the right cryptography. The idea is not to have more identities. It is to prove one thing without revealing the rest. And this model becomes mandatory across the whole European Union, including Romania, by the end of 2026.
The problem: you prove everything to prove one thing
To demonstrate a single attribute today, you reveal your whole identity. You want to buy something age-restricted and you show your ID card, with everything on it: name, address, national ID number, photo. You proved you are over 18, and you also handed over everything that identifies you.
Every such over-sharing feeds exactly what everyone complains about: data brokers, profile correlation, breaches that expose complete records. The problem is not that people want privacy and do not have it. It is that the mechanism for proving who you are implicitly demands that you say far more than needed.
The real solution: verifiable credentials and selective disclosure
This is where digital identity helps, in the standards-based sense, not that of an app selling you multiple “personas”.
A verifiable credential is an attestation cryptographically signed by a trusted authority: the state, the bank, the university. Selective disclosure means you reveal only the attribute the transaction requires. For “are you over 18”, the verifier receives a signed “yes”, validated cryptographically, without your date of birth and without the whole document.
It is the difference between showing the document and presenting a proof. The verifier no longer has to trust you, nor to store data about you. It has a mathematical proof of a single fact. It is the same principle as “cryptographic proof, not presumption”.
The concrete instance: the EUDI wallet
This is not theory. eIDAS 2.0 (Regulation (EU) 2024/1183, in force since 20 May 2024) requires every member state to offer citizens a certified European Digital Identity Wallet (EUDI Wallet) by the end of 2026. The publicly cited deadline is 24 December 2026, conditional on completing security tests.
Romania is included. A first version of the RO Wallet is planned for 2026, with identification data and digital age verification. The documents targeted initially are the electronic identity card, the driver’s license and the health insurance card. On 17 and 18 March 2026, Bucharest hosted an interoperability exercise on the EUDI Wallet.
Where it is not magic: selective disclosure is not unlinkability
This is the nuance the pitches skip. Selective disclosure reduces what you reveal, but it does not guarantee that your presentations cannot be linked to one another.
The method chosen in the EUDI Wallet reference framework, SD-JWT, does not provide unlinkability and is not zero-knowledge. Researchers who evaluated the architecture showed that cryptographic metadata remains that links presentations, so the same credential used twice can be correlated. To get verifier unlinkability with SD-JWT or mDL, credentials must be issued in single-use batches, which adds cost.
Real unlinkability comes from more advanced zero-knowledge schemes, such as BBS+ or zk-SNARK, which prove a statement without leaving a correlatable trace. eIDAS 2.0 allows them, but only optionally, at each state’s discretion. So the privacy guarantee depends on the cryptography each implementation chooses, not on the “privacy by design” label.
And a governance question
A single state wallet holding your ID, license and health card is convenient and is, at the same time, a single point of correlation and a control question. Who sees what you present, what gets recorded, who can request what. In a country where trust in the state is low, the question is not paranoia, it is responsible design. Privacy is earned from architecture and from written limits, not from the app being officially issued.
What it means for an organisation
If you are a party that relies on identity, that is a bank, a retailer or a service provider, EUDI is coming toward you, not just toward the citizen. Age verification, KYC and onboarding will be able to run on wallet credentials, and the right model is “ask for the attribute, not the identity”.
Three practical reflexes:
- Do not over-ask. If you only need “over 18”, do not collect the date of birth. Minimisation is a GDPR obligation, not just good practice.
- Verify provenance cryptographically. A verifiable credential replaces “we take their word for it” with a signature that validates. Use exactly that.
- Ask what privacy guarantee the implementation offers. Selective disclosure without unlinkability is a step, not the destination.
Want to prepare your identity flows for EUDI without collecting more than you are allowed to? Get in touch and we start from a review of the data you actually ask for.
Sources
Frequently asked questions
How can digital identity increase privacy?
Through a verifiable credential (an attestation cryptographically signed by a trusted authority) and selective disclosure: you reveal only the attribute the transaction requires, not your whole identity. For "are you over 18", the verifier receives a signed "yes", validated cryptographically, without your date of birth and without the whole document.
What is the EUDI wallet and when does it arrive?
The European Digital Identity Wallet, a secure app mandated by eIDAS 2.0 (Regulation (EU) 2024/1183). Every member state, including Romania, must offer citizens a certified wallet by the end of 2026 (the publicly cited deadline is 24 December 2026, conditional on tests). The RO Wallet is planned for 2026, with the electronic identity card, driver's license, health insurance card and digital age verification.
Does selective disclosure mean anonymity?
No. Selective disclosure reduces what you reveal, but does not guarantee unlinkability. The method in the EUDI reference framework, SD-JWT, leaves cryptographic metadata that can link your presentations, so the same credential used twice can be correlated. Real unlinkability comes from zero-knowledge schemes like BBS+ or zk-SNARK, which eIDAS 2.0 allows only optionally.
What does it mean for an organisation?
If you rely on identity (a bank, retailer or service provider), age verification, KYC and onboarding will be able to run on wallet credentials. The right model: ask for the attribute, not the identity. Do not over-collect (minimisation is a GDPR obligation), verify provenance cryptographically, and ask what privacy guarantee the implementation offers.
