The Connector Podcast - Mastering Digital Identity in the EU: A Deep Dive into eIDAS 2.0 with itsme®

Welcome to the Connector Podcast, an ongoing conversation connecting fintechs, banks, and regulators worldwide. Join CEO and founder Coen van der Huydonk as you learn more about the latest available trends and solutions in the markets.

Welcome to another Connector Podcast from Belgian Fintech, and today we have. Tom van It's Me. Tom, welkom in de podcast.

Hi Koen.

Hello. Today we're going to talk about AIDAS version 2. What is this about?

Well, indeed, let me maybe start with already what is AIDAS as an abbreviation, because we will be talking a lot about AIDAS. Probably the name and the word will be dropped a lot.

Would be very useful.

So first of all, AIDAS stands for Electronic Identification, Authentication and Trust Services. It is actually a European Union legislation and regulation implemented initially in 2014 with the objective to ensure scalable and reliable electronic identification and trust services across the European Union. EIDAS facilitates electronic interactions between citizens, businesses, and public authorities. The update of the EIDAS law, and you've already referred to it, EIDAS V2 or EIDAS 2.0 as often referred to, actually builds upon the original ADAS legislation and the ADAS law. Detailing an exhaustive set of differences and nuances between ADAS V1 and ADAS V2 would probably lead us too far for today. We would still be here in the evening, even when it gets dark.

That's for another podcast.

Yes, even if these are already extending for quite a bit. Though I would really like to emphasize on 2 main differences, 2 key evolutions I consider most important from the It's Me perspective. First of all, ADAS V2 aims to enhance security and reliability of the electronic identification and trust services. Secondly, eIDAS V2 is actually about tackling one of the main challenges which is encountered within eIDAS V1, namely consistency. The original eIDAS implementation has too much varied across the different member states, which has led to inconsistencies and difficulties in using the services. The main shift therefore embedded in eIDAS V2 Is the creation of a unified European digital identity with the digital identity wallet, a concept we'll most probably be touching on very soon as a key component.

Now, it's super interesting because in my mind, I always knew that AIDAS was one of the first regulations that was truly European, and even that now is saying there is a reason for update for that reason.

Exactly. It's actually building up on maturity, let's say, and it's taking the next step in that first wave of structuring that from a European Union perspective.

Excellent, Tom. We didn't go. there in the first place, in the very beginning of our podcast. But what is Itsme? Because there's maybe listeners that have not even heard about Itsme.

Yeah, true. Well, Itsme is a digital identity solution. It's about a mobile application that facilitates data sharing, authentication, up to qualified electronic signatures. We'll come back to that concept later on in the podcast as well, most probably, which is actually today available in 14 countries. And which is serving about 7 million users in their day-to-day interactions. We see on average that itsme is being used more than once a week in different interactions across public and private sector use cases.

And where does itsme bring you then in relation to eIDAS version 2?

Well, eIDAS version 2, or let's say itsme today has 2 key accreditations and roles under the current eIDAS legislation. First of all, itsme is accredited as what they call an e-identification means at the highest level. To make that a bit more tangible, the e-identification means is actually the driver behind the fact that it's me is today available on the FAS, the Federal Authentication Hub of the Belgian government. That is making sure that it's allowing 7 million users, 7 million Belgians, to use the it's me to authenticate and access about 800 e-governmental applications going from student at work up to my pension and my minfin. Secondly, It's me is also being accredited as a qualified trust service provider, a second concept under EIDAS, which makes it possible to sign with It's me a document in a qualified way. So that's actually with It's me, by entering your 5-digit code, you can sign a document with the same legal value as the wet, as the paper signature. And given the nature of It's me, often referred to as a regtech because every beast needs a name, I would say, we are obviously closely following up on the different drafts of the EIDAS legislation. And in that context, today is actually a very special day because just at noon they officially announced that the final version of EDAS V2 has been released. Given that only today they released the final version, it is not possible yet to formally accredit already for EDAS V2, which will most probably very soon be possible. Though I'm convinced based on our analysis and the different checks we've been performing while the different drafts have been published and exchanged, that our current EDAS accreditations will be reconfirmed also under the EDAS V2 framework.

Well, earlier, Tom, you talked about an identity wallet, a European identity wallet. Could you elaborate a little bit more on that concept?

Sure. Well, next to the impact on our current offering, we've been talking about e-identification means, about qualified signatures. eIDAS V2 is actually introducing a new concept, the digital identity wallet. And each member state will have, or has since it's published officially today, the obligation to provide their citizens with a European identity wallet in the course of the next 2 years. From itsme perspective, with itsme being a good example of a successful collaboration between the public and the private sector, which we also want to continue—

Agreed.

Under the eIDAS V2 framework, I actually see 3 key roles or 3 opportunities. First of all, your identity wallet will include digital references of your personal and privacy-sensitive information. Think about your identity card. a driver's license, and potentially health attestations. Itsme therefore can be used as a secure key to make sure that only you, only the genuine person, can access, manage, and eventually exchange this information. Secondly, as different private players, like banks, telcos, will need to adopt the digital wallet also within their ecosystem, Itsme is very well placed given its current network and technical integrations with about 1,000 partners, To streamline and facilitate the technical integration of the European Identity Wallet within the B2B network. And last but not least, because I said I was going to talk about three, there is also a key role for its me in the facilitation and the exchange of data attributes with, and that's for me a key concept, the explicit consent of the user. Let me emphasize on that with a concrete example. Think about renting a car. Typically, that car rental company will ask for. identity information, checking if the person is above 18 years of age. We'll also probably ask for a payment means to process afterwards the invoice. And last but not least, they will be willing to check if you, one, have a driver's license, and two, if that is still valid. You not being stopped over the weekend for speeding or maybe drunk driving. In that context and for these kind of use cases, also itsme can be positioned as a trust anchor. Allowing the user to provide his explicit consent for the data exchange through the It's Me app, and in the meantime, very well known what you see is what you sign screen, and leverage its existing technical integration with the partners to provide the requested dataset. Important to state for me is that in this setup, or this is a setup whereby It's Me, apart from the identity data, is not managing, not storing these other data attributes, but will focus on exchanging capturing the consent of the user only.

So we're talking about self-sovereign identity coming into reality.

Absolutely. And we could even say for us, self-sovereignty is maybe one extreme whereby you push everything to the user. From itsme perspective, we believe very much in a hybrid model whereby you have that core identity dataset managed at itsme side, which will also allow us to facilitate in a convenient way lifecycle management for the user. Think about changing a device happening every 2 to 3 years. And secondly, also making sure that, for example, in the context of security and privacy, we can help and we can steer to make sure that we remain up to par with market trends and protect and make it a transparent experience for the user.

Because that was my reflection when hearing your very nice story about the Holy Trinity. It's about the user and about the concern about security. So can you elaborate maybe a little bit more how you guys are particularly addressing these security requirements?

Well, security is next to convenience and privacy, one of the 3 key focus areas for itsme. And to make sure that our itsme ecosystem, because I would call it an ecosystem, and the collaboration with the partners remains ahead of market from a security perspective, we have set up our own security operations center, which we often refer to as our SOC. And actually, our SOC is constantly following up on new threats. new market evolutions. We see numerous attempts and numerous creative attempts every day. It's about scanning any abnormal patterns or behaviors and is closely following up with the CCP, the Cybercrime Security Unit from the Belgian government, to drive resilience of the whole ecosystem.

Well, there is a strong Belgium story here, but I hear people or birds whispering that also It's Me is looking at broadening out of Belgium. How would that look like?

So actually, that's a very actual theme. Since December of last year, we have been extending the countries through which and the documents through which a user can enroll and activate its me from 3 up to 14 countries.

Wow, impressive.

Thank you. And key element there is it's not only about extending the countries. We have envisaged its me as from day one from an international, from a European perspective. That's also why for us it was key to, for example, be accredited in the context of ADAS, because that, for example, to just name one example, or one concrete element that allows us to support qualified electronic signatures. So the equivalent of a legal wet paper signature, not only for the Belgian citizens, but for the whole European Union.

Well, I hear a lot of nice stories. How does technology play a role on your end?

Technology often, of course, is a key element. We're based on a smartphone, we are an application on a smartphone. So obviously we're following up a lot on technology and also technological evolutions. The fact that is what we try to do is to combine technology, user convenience with security and also compliance. I refer to itsme as being a regtech. That also means that we are constantly at the outlook. How can we make sure that we make the most convenient experience for our end user possible, still respecting the different regulations and compliancy frameworks, which are also constantly evolving, of which ADAS V2 is a nice example.

Do you have perhaps any other examples where itsme can be used? Out of the context of me using it for my governmental information? Sure.

I think the same thing as I said earlier on would go here. We could probably talk for about a day, and that's probably the passion that speaks. But if I need to take out 2, then I would emphasize on, for example, Bolero, an affiliate of the KBC Group, where we actually combine our ability to share data and the qualified sign service to facilitate a customer onboarding process. Because actually the fact that we can offer these 2 services allows us to make sure that the user can on a Sunday afternoon become a user and a customer of Bolero with the same level of compliance as he would have been passing in a bank branch on a Monday morning. And there, itsme is not only driving a fully digital and a KYC/AML compliant process, though it has also allowed to shorten the process from about 3 weeks in a physical world to up to 3 minutes with itsme today. Second example, and I'll stop at 2 as I promised. You also have—

Not 3 this time.

Not 3 this time, indeed. You also have Henkel, for example, in the HR sector, is another good example of the USPs of the qualified electronic signature service of its me. For example, in the context of signing an employment contract, the qualified sign service offers the same value of a wet, of a paper signature, which is legally required for these kind of interactions. At the same time, the itsme offering goes beyond signing of employment contracts and can facilitate the signing of various documents and help to streamline even the entire HR process.

Wow, impressive. Tom, we're almost at the end of our conversation here. I think the last question I'm left with is, who should contact you and how do they contact you?

Well, I would say everybody with a genuine interest in itsme or maybe a potential opportunity who has been triggered maybe by the different elements brought forward. More than welcome, and very happy if they reach out. For me, 2 ways to do that: they can contact us through our website, where they can contact our sales teams or even the support teams should you encounter any issue directly. Of course, don't hesitate to also reach out to me directly via tom.vandenbosch@itsme-id.com.

Tom, it was a pleasure having you here in the podcast. Thank you very much. Thank you also to the audience for staying tuned. And stay tuned for more fintech and financial news. Thank you very much.

Thank you. The pleasure was mine. Bye-bye.

Thanks for listening to another episode of The Connector Podcast. To connect and keep up to date with all the latest, head over to www.jointheconnector.com or hit subscribe via your podcast streaming platform.