IT Wallet or EUDI Wallet? What’s happening with digital identities in Italy
We clarify the latest news with Giuseppe Mariani and Matteo Panfilo
How is the digital identity ecosystem changing in Italy? We talked about it with Giuseppe Mariani and Matteo Panfilo
In questo articolo scoprirai:
Let us recapitulate some key steps. In mid-2021, the EU starts work to create the European Digital Identity (EUDI) Wallet. In October 2022, a decree introduces a new way of using CIE, with Security Level 2, which simplifies usability by bringing it closer to that of SPID. In the meantime, news spreads, later denied, that the Italian government wants to deactivate SPID. In May 2023, the Department for Digital Transformation announced the IT Wallet.
That the digital identity ecosystem in Italy is in ferment is clear, but to what end? We discussed this in this interview with Matteo Panfilo, Chief Solution Officer, and Giuseppe Mariani, General Manager of Intesa.
Are IT Wallet and EUDI Wallet the same thing? What differences are there?
“Although the concept on which these two digital identity systems are based is practically identical, IT Wallet and EUDI Wallet are two separate projects,” Panfilo clarifies. “The EUDI Wallet is a project that the EU announced in 2021 and is part of a major revision of the eIDAS Regulation, the so-called eIDAS 2.0. The aim of the European wallet is to increase interoperability between member states by digitising not only identity documents but also other ‘attributes’, such as degrees, driving licences, professional certifications, signature certificates. The IT Wallet, on the other hand, is an entirely Italian project that anticipates, probably already by 2023, the EUDI Wallet and envisages the possibility of having one’s identity and attributes (starting with driving licence and disability certifications) within, presumably, the PagoPA IO app. What is still unclear, however, is how IT and EUDI Wallet will relate once they are both operational or whether IT Wallet will automatically become one of the EUDI Wallets that can be used by citizens in 2026.
What is the status of the European wallet project (EUDI Wallet)?
Panfilo adds: “The EUDI Wallet project is certainly a broader, far-reaching project that involves the European Commission and has a well-defined roadmap involving legislative and formal steps in Europe, so inevitably the timeframe for its realisation is getting longer. Right now we are in the so-called ‘trialogue phase’ of the eIDAS regulation, that is, a moment of negotiation between the representatives of the Parliament, the Council and the Commission, which we believe can be concluded in the next few weeks. In the meantime, international Consortiums have been selected – such as the Consortium POTENTIAL, of which Intesa is a member – that will work on the ‘Large Scale Pilot’, the pilot projects on various use cases of the EUDI Wallet. Involving so many governments and actors (public and private), for the realisation and diffusion of the EUDI Wallet there are significant technical and regulatory obstacles to be overcome, as well as the need to create a sustainable business model for all and with incentives for participants”.
SPID and CIE are destined to disappear?
“Let’s start by making a premise, SPID and CIE are two digital identity schemes notified according to the eIDAS regulation. They have different characteristics and in the perspective of the new European Wallet they could be PID (Person Identification Data) Providers, i.e. federated schemes to share a set of personal identity data. The PID providers will serve as a one-off service to initialise the wallets, which for subsequent use will have their own strong authentication mechanisms that will add other attributes to the mere personal data and other functionalities. Wallet therefore does not just mean proving one’s identity by replacing SPID and CIE, which we know well, but having a series of attributes and services on the side, a bit like our physical wallet is filled not only with the identity card but with various other cards or documents that can be digitised. Returning to the current scenario, however, SPID is still by far the most widely used digital identity system,’ explains Matteo Panfilo, ‘but its diffusion suffers from some original sins, including the absence of a sustainable business model for private providers and some other basic features that are no longer surmountable. This does not mean that SPID is destined to disappear or be replaced by the CIE in the very short term: even if the number of CIEs in circulation has exceeded that of SPID, in fact, today it is still SPID that counts the greatest number of accesses and is used.
Certainly, the national governmental indication, reinforced by Europe’s positioning, is clearly oriented towards CIE as the identity manager and the only future Italian PID provider, which is why Intesa too has chosen to be among the first Italian private Service Providers: in April 2023, ‘Level of Assurance – LoA’ 2 or ‘Substantial’ was introduced for CIE, which previously only had LoA 3 or ‘High’. To be clear, LoA 2 is the one assigned to most SPID users in circulation. Being able to use the CIE with a LoA 2 has certainly simplified its use (i.e. it is no longer essential to have the physical card with you to approach the NFC sensor for each use). According to the new eIDAS regulation, in fact, in order to initialise the wallet, a digital identity with LoA 3 will still be required, which is possible for CIE but not for SPID, and it is precisely SPID that is most widely used in Italy.
In other words, the scenario on the horizon both in Italy and in Europe seems to be very favourable and oriented towards the CIE, which, however, still has few users who know how to use it. Our estimate, because there are no official and public numbers, is that there are about 1 million active users (i.e. who use CIEs to access digital services) compared to more than 30 for SPID. This means that in terms of user adoption there is still a long way to go, despite the incentives or processes that will be imposed on users to encourage its use in order to start with the EUDI Wallet from 2026 with a good user base.”
We mentioned ‘attributes’. What are they and how could they change the way we use online services?
“For us Italians, already familiar with using our digital identities through SPID and CIE, the real news of the new wallets will be European interoperability, greater control over privacy, but above all the possibility of also using the so-called ‘attributes’ linked to identity. In other words, thanks to the wallet, we will always be able to prove that we have professional titles such as university degree or membership of professional associations, representation of legal entities, ISEE, driving licence, disability certification or other attributes and certifications produced by public or private entities. Moreover, our data, such as residence, will always be up-to-date thanks to the integration of various public data sources. This could have significant advantages for end-users and private companies, which could both improve their onboarding flows with certain and verified data acquired in an efficient way, and become attribute providers themselves’.
What is the role of private service providers such as Intesa in this context?
Giuseppe Mariani answers: “Service providers are those who integrate recognition and access with SPID and CIE within their services, so they are closely affected by these changes. Our goal is to give our customers services that are simple for users and up-to-date with respect to current regulations, and this is why we hope that the IT Wallet project will take into account the investments already made, both by us as ‘active participants’ in the ecosystem, and by our customers to get closer to the reality of end users. I believe it is our duty to point out and highlight the interest of those who believed in SPID and CIE to the point of wanting them as an identification and authentication system’.
What is Intesa’s strategy?
“In the short term we will continue to offer our services based on SPID, which, still, continues to be the digital identity most used by citizens. This is why we have also become aggregators,” Mariani says. “However, we see that CIE’s numbers are growing, especially now that the user experience has become simpler thanks to the introduction of the LoA Substantial that Matteo also mentioned. We were among the first private companies to give the possibility to use this ‘simpler version’ of CIE in our solutions, and as soon as we can, we will also become an aggregator for the ID card. The introduction and diffusion of the EUDI Wallet will be a delicate and important step for the whole EU. We hope that the introduction of the EUDI Wallet will not affect the business model of the current players in the sector and will make it possible to capitalise on the investments and experiences made by many private companies, facilitating a simple transition.
What strategies should companies that want to use digital identities in their services adopt?
“As mentioned, the creation of the EUDI Wallet is a long, but organic and defined process,” Mariani concludes. “Thanks to the attribute system, the opportunities for private companies will be many and will help citizens to have increasingly easy digital experiences. There is still much to be defined, but we know that SPID and CIE will drive any evolution and with a scenario evolving so fast, having a trusted partner to accompany these transformation processes can be a significant competitive advantage.”
