Digital ID and privacy: the safeguards that actually work

Guides · Published 2026-10-09

A small padlock securing a rusty iron hasp on a weathered red wooden door — A padlock on an old storehouse door in Oulu, Finland. Photo: Estormiz, CC0, via Wikimedia Commons.

A national digital identity can open doors: bank accounts, benefits, mobile connections, online services. It can also become a tracking key that links every part of a person's life. Whether it does one or the other is mostly decided by design choices and law. This guide sets out the safeguards that make the difference.

The core risk: linkability

The main privacy danger of a digital ID is not that it identifies people (that is its job) but that a single identifier, used everywhere, makes it trivial to link records across health, banking, telecoms, travel and welfare. Linkability enables profiling by the state or by companies, magnifies the damage of any data breach, and makes "function creep" (using data collected for one purpose for another) easy.

Most safeguards below aim to reduce linkability while keeping the identity useful.

Design safeguards

1. Collect less

Every attribute in the central register is a liability. Good systems collect only what is needed to establish uniqueness and deliver the core services, and avoid recording data such as religion, ethnicity or caste unless a specific law requires it. Biometric collection, especially from children, should be justified rather than assumed.

2. Sector-specific identifiers

Instead of using one number everywhere, a system can derive a different identifier for each sector (tax, health, social security) from a protected source number. Austria's identity system has long used such sector-specific personal identifiers, computed cryptographically so that records in two sectors cannot be matched without authorisation. Each sector can identify the person reliably, but casual cross-sector linkage is blocked.

3. Tokenisation and virtual IDs

India introduced the Aadhaar Virtual ID in 2018, a revocable 16-digit number that a person can give instead of their Aadhaar number for authentication, and authentication agencies receive tokens rather than the number itself in many contexts. Tokenisation reduces how widely the master identifier is stored.

4. Yes/no answers and selective disclosure

Many transactions do not need the full identity record. A service may only need to know that the person is over 18, resident in a district or the holder of a valid licence. Authentication systems that answer "yes" or "no", or return only the attributes needed, limit exposure. Digital wallets based on verifiable credentials can go further, letting the holder disclose a single attribute from a credential, a feature required for the EU Digital Identity Wallet.

5. No "phone home"

If every time a credential is checked the issuer is contacted, the issuer learns where the person goes. Offline verification (checking a digital signature without contacting the issuer) and careful design of revocation checks prevent identity providers from becoming surveillance hubs.

6. Transparency to the individual

People should be able to see who has authenticated them or accessed their data, when and for what declared purpose. Estonia's data tracker and the authentication history offered in some MOSIP-based systems are examples. The EU wallet rules require a dashboard showing the transactions a user has made.

7. Protect biometrics specifically

Biometric data cannot be changed after a breach. Safeguards include storing templates rather than raw images where possible, encrypting them, restricting matching to defined purposes, allowing people to lock biometric authentication, and always providing a non-biometric fallback for those whose fingerprints or irises cannot be read reliably.

Legal safeguards

Design choices can be reversed by the next administration. Law makes them durable. The essentials:

a specific statute for the identity system, defining its purposes, the data collected, who may use it and the penalties for misuse;
a general data protection law with an independent, adequately resourced authority;
a requirement for data protection impact assessments before launch and major changes;
limits on mandatory use, especially for essential services;
accessible grievance and appeal routes.

What courts have said

Several court decisions have shaped how identity systems are designed:

India. In Justice K.S. Puttaswamy v. Union of India (August 2017), a nine-judge bench of the Supreme Court held that privacy is a fundamental right. In September 2018, a five-judge bench upheld the Aadhaar Act but struck down the provision that allowed private companies to require Aadhaar authentication, and limited mandatory use.
Jamaica. In April 2019, the Supreme Court of Jamaica struck down the National Identification and Registration Act, finding that mandatory biometric enrolment without adequate safeguards was unconstitutional. The country later adopted new legislation.
Kenya. On 14 October 2021, the High Court ruled that the government had rolled out the Huduma Namba identity cards without first carrying out the data protection impact assessment required by the Data Protection Act 2019. It quashed the rollout decision and ordered an assessment before any further processing of data.

The common thread: courts have not rejected digital identity as such, but have insisted on legal basis, proportionality and prior assessment of risks.

The EU Digital Identity Wallet

The revised eIDAS Regulation, Regulation (EU) 2024/1183, entered into force on 20 May 2024. It requires each member state to provide at least one European Digital Identity Wallet to citizens and residents, with the deadline falling at the end of 2026 under the implementing timetable. The wallet must be voluntary and free for individuals, support selective disclosure, let users see a log of transactions and report suspicious requests, and relying parties must register and declare what data they intend to request. It is a notable attempt to write privacy-preserving design into law rather than leave it to implementation.

A short checklist

Question	Safeguard
Does every service see the same number?	Sector-specific identifiers or tokens.
Does the service receive more data than it needs?	Yes/no answers, selective disclosure.
Does the issuer learn every use?	Offline verification, privacy-preserving revocation.
Can the person see who accessed their data?	Access logs and dashboards.
What if biometrics fail?	Non-biometric fallback, written into the rules.
What stops function creep?	Specific statute, independent authority, impact assessments.

For broader governance questions, see DPI governance and safeguards.

Sources

World Bank ID4D, Principles on Identification for Sustainable Development.
Regulation (EU) 2024/1183 (European Digital Identity Framework), EUR-Lex.
Supreme Court of India, Justice K.S. Puttaswamy (Retd.) v. Union of India, judgments of 24 August 2017 and 26 September 2018, available via the Supreme Court of India.
Unique Identification Authority of India, uidai.gov.in (Virtual ID and authentication).
Austrian Federal Ministry, oesterreich.gv.at (ID Austria).