How To Prepare For Digital Wallets – In Perspective Of Population Registration [Intermediate]

I have a legal background and not a tech background, I would like to say that from the first. I have a long experience from the public sector, fighting fraud and organized crimes against the welfare system, and I was also the program manager for the modernization of the population registry in Norway.

So, from that angle, I would like to also tell you how to prepare, how we do prepare for digital wallets and EIDAS 2.0, this regulation in the Norwegian system. We in Norway, as a part of the European economic area, not as a part of the EU, we will adopt the EIDAS 2.0 regulation, but we are a little later than the rest of Europe. But we are preparing, and we look into different roles that we have. For example, the tax administration, we have two different roles in this.

We are the owner of the national population registry, and we are users of the digital infrastructure as the tax administration in Norway. And we see that the secure identity is a fundamental building block in the ongoing digital transformation. And it's very important that we prepare to meet the expectations and the demands from the society, to make sure we maintain the trust in the public.

So, when I have taken this picture from the EU Commission's website, and I think it's quite interesting, because it also tells about the ambitions. Digital identity for all Europeans, for personal digital identity, wallet for EU citizens, for businesses and for residents. And who is resident in this context? And we will have to look into what are the ambitions. With this yellow, you should have easier access to public and private services for citizens. You should prevent fraud, and also everyone can access this.

We will have to look into how we are doing this today, because Norway is a very digital society. We have had bank ID for a very long time in Norway, and bank ID is our digital identity that is used by more than 90% of the population, for both public and private services. And we will have to learn from how do we see this today, and how will this be when we introduce digital wallets. The population registry issues national identity numbers, for both residents and non-residents. And this is the identification part from the bank ID, that is an authentication solution.

But this collaboration between both public and private sector has been a success for many years. But the regulation that we have on digital identities are done by the financial sector. So it is the financial sector saying who is allowed to have a digital identity, even though it is used to access public services, as the tax administration. So how can we make this inclusive, and to include everyone in a secure way? And then we will have to look at the role of the population registry. Who do we identify? And it is all about people.

We have had a central database as population registry from 1964, when we have issued national identity numbers. And last year, we issued about 200,000 identity numbers for non-residents. We have 66,000 people immigrated to Norway. They are getting these F numbers. And about... I'm very sorry, I do not have my glasses. It's about 60,000 also who are born in Norway. All of them are getting a national identity number because they are entitled to access services in the public or private sector. And you are able to use this identity number across different sectors.

And when we build the digital identity on this identification, we see that the quality of the information in the population registry becomes relevant in the digital identity as well. So when we see the challenges that we also have, we are not seeing this alone in the Nordic countries. We have a very similar system as Sweden, and the other Nordic countries, and also the Baltic countries. But from the Nordic perspective, we have had a long collaboration for a very long time. This slide is from both Norway and Sweden.

It's made by the Sweden Tax Agency, telling about the systematic welfare crimes that we see today as a challenge, both in Norway and in Sweden. So we see, because you can use these identity numbers across different services in both the public sector, if you break this chain, you open up possibilities for criminals. So we see that when you digitalize, you don't stop the criminals, you also make opportunities for them. So how can we do this?

How can we make sure that we take care of the values that we would like to have, and what kind of services and what kind of trust do we need to have for different things? And this is also about the democracy in the country, because the population registry has been used as a reliable source since 1964 for the electoral roll, the tax census, the cadastre, the welfare system, and also statistics for both the residents and non-residents. And how can we keep the trust, the national trust, in this to know who you are talking to, and that one person has one identity in Norway?

So we will have this legal framework, but there are different stakeholders. So it's quite hard to see these different sectors coming together, but we have started, and in 2018, we came together with the police, the immigration authorities, the welfare administration, and the digitalization directorate, and we made this vision together. And we would like to have a common holistic approach to identity, and we would like that one person should have one identity in Norway, and everyone should be given a chance to prove their Norwegian identity, both physically and digitally.

Because we see that there's a challenge, not only in Norway. We see that one billion people in the world, according to the World Bank, are without a legal identity in the country they come from. So if they do not have identity documents coming to Norway, and what can we do when we need to have control of the welfare system as well? So we would like to do this, and we have started.

We would like to identify one person as one identity by using the biometrics captured by the police when they issue passport and identity cards to lock one person to one identity in Norway, both the residents and the non-residents. So you create a fundamental identity in Norway, so you can build a digital identity based on that. So we think the whole chain is important.

So what we do now is, and what we have done for the last year, we have come together, these different stakeholders, and it's led by the Digitalization Agency, but together with the police, the Directorate of Immigration, and the Population Registry, and we have done an investigation for the government, looking how to prepare for national sovereignty and what should be under national sovereignty, and what about international interoperability, according to EIDAS 2.0. How can we explore the national regulation within this legal framework to keep the trust in the public.

So the three things that we have investigated is the prevalence, who should get this, should all who have the right to services get this digital wallet from Norway. Most Europeans will probably have a digital wallet by themselves, but there are a lot of people living in Norway, that work in Norway and maybe need digital communication with the welfare system or the tax administration, we would like them to pay tax. And how can we do the identity control before we issue this digital wallet? And how should cooperation with the market be? What should be the role of the public sector?

And what should be left to the market? So we have done this investigation that we have given to the government, and it was just before Easter, and they have not still decided, so I am not able to tell you what it said yet. They will make a decision probably this summer or in August. But it is quite interesting to have this strategy, this advice that is given, based on the national strategy for EIDs and the experience that we have together. But we have agreed on these suggestions to the government, so it is quite interesting to see how this will be followed up.

We see that when digital wallets and EIDs, when we see the trust and the challenges of identity fraud that we see with our digital identity today, we see that these challenges will not disappear by themselves when we cross-border identify a person. So we see different challenges that we have not solved. We see that when most of Europe do not have this national population registry type, but it is probably the same thing, because we see you have sector-based identification. You need to identify a person in one sector for one purpose.

National identification number identifies a person in one country. Customer identification identifies a person in one customer registry. There is now identification of third-country citizens. That is only third-country citizens. It is not mixed with the residents and citizens who are living in the country. So this is different databases in Europe. We see that Facebook app and big tech actors can identify a person across the world, but not for the person to access public service. Not yet either in Norway.

I think we have the discussion of what should we use for identification for different purposes. For example, the electoral roll. Should we use another actor to do that, or should we do that nationally? What kind of service do we need? National control? How can we do this? When we see how to access digital services for residents and non-residents with the digital wallet, we look at the issuance from Norway. What kind of questions do we need to look at? In the green spot, it says identification. How can we identify a person before issuing a wallet?

We will use the population registry national numbers for that. But also the authentication. How can we make sure this is the right person? How should authorization be done? And how should we do the identity control before issuing? To access Norwegian services with a foreign ID when a European comes to Norway, is this the correct user we will have to trust? This has been issued in a trustful way, according to the trusted framework, of course. But when you will have to access services in Norway, you will also have to identify yourself before this kind of service that you would like to access.

What we are thinking about is that you might have a verifiable credential saying what kind of national number do you have in Norway in your Swedish wallet as a customer credential from Norway. And if you have these different things, you might carry them with you across borders. That could be one solution. But we are looking at different ways to do this, and we have not all the solutions.

The investigation that we have done is how can we make this chain and how can we issue this in a secure, inclusive way that we can also include people without identity documents where they come from, but they are entitled to be in Norway, they are entitled to services, and we would like to control if this is the right user. To be able to do that, we will have to create something that we are able to control.

So, some key messages from us. The national infrastructure is a key also for cross-border possibilities. Duties and demands possibilities, the right to legal identity and ownership is the key of trust. And we think the binding with trust is essential. And we will have to see also identity challenges and management in a holistic way, not by just one sector.

So, thank you for your attention. So, yes, we've got a question.

Sorry, just hang on a minute. Then the people online can hear you as well. Thank you.

Hello, I'm John Gligos. Nice to see you again. I have a quick question. Regardless of the official deadlines coming from the EU, etc., do you have something on the pipeline on when you're planning to release a wallet? And is Norway participating in the schema for the certification for the UDI wallet of the northern countries with the Baltics or not? Thank you. Your first question, the official timeline for introducing this in Norway from the minister is 2030. This is later, of course, than the rest of the EU. But there are some pushes being done, so we don't know if this is the date yet.

But I think there's a lot of preparation also according to that we have a digital identity that works very well in the society to transform this and to change this. So I think we will need some time to prepare, but we are using this time quite well now, I think. And also we have a collaboration together with the Nordic and Baltic countries on this, especially on this cross-border identity matching thing that we are looking into different solutions. I mentioned one possible solution here, but there are different types of solutions that they are looking into.

So we are absolutely involved in that as well. Thank you. So are there any more questions?

Well, I'll ask one. Thank you. Can you give an example of how you dealt with the problems of privacy versus preventing fraud? Yeah. Thank you for that question. Privacy part is very regulated. The population registry is based on a strict regulation and an act saying who has access to what kind of information. And also mentioned what kind of information are we able to store in the registry. So it depends on the law, who can access what kind of information on both sides, both as a user and the other side.

And I think also about the fraud thing, I think we have a discussion and I think it's quite interesting because Norway and Sweden, we have this discussion. Should you be able to prove yourself in your country? That's also personal protection. So I think to give who should have these identity cards, this is also personal protection. But we have not come so far in this argument in Norway.

We have a challenge that you're not able to prove your Norwegian identity number in a good way yet for some people, especially for foreigners, because their passport does not have the Norwegian identity number in them. So that's why when you live in Norway, you can be a victim of identity theft or something. And also this part, since you are not asking for documentation well enough, then it's opening doors to misuse others' identities. It's not hard enough to... It's not a high enough control level, but that also is according to... There are no documents to control. That's not good enough.

So that's why we would like to issue identity cards, both for residents and non-residents from Norway. Thank you. So thank you very much for your insights. And so this closes the morning session. Thank you all for your attendance, and thank you very much to all of the speakers who have shared their insights this morning. Thank you.