themes
Assessment of technology impact on privacy
Digital identity is becoming critical infrastructure. From finance to healthcare, more and more interactions hinge on proving who we are. Assigning identity is never neutral: it is an act of power, because the boundaries of one’s identity define what one can and cannot do, what one may access, and ultimately which rights one may enjoy. Ethics, in other words, is not adjacent to architecture; it is encoded by it.
Self-sovereign identity (SSI) emerged to rebalance power toward individuals. Christopher Allen’s principles - control, consent, minimization, transparency, portability, interoperability, and others - sketch a humane baseline in which people disclose less, on their terms, across contexts [1]. Yet Allen himself cautions that “labels” can be co-opted: systems described as “decentralized” may, in practice, centralize control in operating systems, platform APIs, or mandatory intermediaries. The lesson is stark: semantics do not guarantee sovereignty; defaults do [2] [3].
Turning principles into protection requires translation into the lives of real stakeholders. Value Sensitive Design (VSD) offers that bridge by mapping abstract values - autonomy, dignity, fairness, transparency, trust - onto concrete requirements for specific actors, and by acknowledging value branching: autonomy does not mean the same thing to a patient, a hospital, and a regulator. Without this mapping, cryptographic elegance can coexist with unjust outcomes - especially when identity doubles as access control [4]. Consider “forced identification”: service providers frequently demand full identification where a simple, privacy-preserving proof of eligibility would suffice. Age-gating (“over 18”) or professional status (“licensed clinician”) rarely needs a name, birth date, or a stable identifier. When systems normalize full identification for low-risk use cases, they entrench power asymmetries: providers accrue data and leverage while users bear exposure and friction. VSD reframes this not as a usability oversight but as a designable correction: proportional proofs, by default, so stakeholders with less power are not forced to over-disclose merely to participate [4].
The European Digital Identity Wallet (EUDIW) is a proving ground for these choices. On paper, it embraces minimization and user control. In practice, two implementation patterns will determine whether it empowers or exposes citizens. The first concerns identifiers. If a wallet reuses a single identifier across services, it enables correlation and long-term traceability - fuel for profiling, function creep, and quiet recentering of power around actors who can aggregate logs. Supervisory and civil-society critiques have warned that any unique persistent identifier (UPI) is difficult to reconcile with data minimization, purpose limitation, and privacy-by-design obligations. The remedy is well understood: pairwise (per-relying-party) identifiers, frequent key rotation, and unlinkable proofs as protocol defaults, with any exceptional traceability strictly scoped, audited, and clearly visible to the user [7][8]
The second pattern concerns verification flows. Many architectures perform transaction-linked status checks, contacting an issuer or status service each time a credential is presented. Even if attributes remain hidden, the verification layer emits usage metadata - who verified, and when - which can reveal patterns of life. Privacy-preserving alternatives exist and operate at scale: cacheable status lists or accumulator-based proofs can support revocation without per-transaction callbacks; where online checks remain necessary, they should be aggregated and de-identified so that issuers and intermediaries cannot reconstruct interaction histories [2]. Europe has already demonstrated the feasibility of offline or semi-offline verification at continental scale with the EU Digital COVID Certificate: cryptographic integrity was preserved without requiring issuers to witness each presentation [9].
Ethical risk is not limited to correlation and metadata. Onboarding is a critical fault line. Mandating facial recognition to enroll predictably excludes some users. Accuracy still varies across skin tones, gender expression, age, and disability; some people cannot provide biometrics; others reasonably refuse to do so. A “biometrics-only” gate turns security into a barrier to rights. An ethical baseline is plurality: biometrics as an option, alongside assisted and document-based routes with human review. Crucially, exclusion must be measured and reduced as a first-class objective, not treated as a regrettable by-product of higher assurance [5].
Inclusion also intersects with hardware and assurance levels. High assurance often translates into secure elements and recent devices - reasonable from a security perspective, but potentially exclusionary when unaccompanied by assisted channels or analog fallbacks. If a wallet becomes the de facto route to essential services, the absence of alternative paths risks hardening the digital divide. Here again, VSD’s insistence on stakeholder analysis is pragmatic: design for those with the least capacity first, or the system will reproduce existing inequities in a more efficient form [4].
A further layer that is often overlooked sits in the stack itself, the entire system as a whole. It is tempting to treat identity as a purely cryptographic question - signatures, tokens, zero-knowledge proofs - and to declare success once those primitives check out. But identity never lives in a single layer. Every component that touches the identity flow can introduce new vulnerabilities or power dynamics. A protocol can be sound while a browser API reveals which wallets are present or what credential types are available. A wallet’s proof may be unlinkable, yet the operating system might log when and where presentations occur, correlating them with app telemetry. Even benign platform “conveniences” can act as side channels. Thinking ethically about identity therefore means widening the threat model beyond attackers and exploits to include privacy and human-rights risks across the stack. The W3C’s Identity & the Web report argues that threat modeling should be treated as a first-class design method, not a compliance checkbox: security, privacy, and human-rights impacts must be examined from protocol surfaces to browser and OS hooks, precisely because identity is assembled from many layers that can each shift power toward or away from the individual [9].
This stack-aware perspective also clarifies why standards and governance matter. Open standards for verifiable credentials and privacy-preserving presentations are not merely interoperability aids; they are levers to encode proportionality and minimization into conformance profiles. When certification suites test for unlinkability, when default APIs avoid leaking credential metadata, and when wallet UX foregrounds selective disclosure rather than full data dumps, incentives change. Conversely, if platform integrations make issuer call-backs or persistent identifiers the easiest route to “it just works,” then market convenience will overpower ethical intent.
Examples of safer patterns are not hypothetical. Austria’s sector-specific personal identifier derives a different identifier per domain, preventing cross-context correlation by construction; it shows how public services can reconcile reliable matching with principled separation. Selective disclosure and zero-knowledge techniques - already standardized in the verifiable credentials stack - allow one-bit statements like “over 18” or “licensed clinician” without unveiling full identity [1][8] And the COVID certificate ecosystem proved that robust, large-scale verification can avoid transaction-linked status checks. Each of these choices is a small political act: they make it more costly to surveil and easier to participate [10].
Finally, there is drift. Identity systems tend to expand. New relying parties arrive; new purposes are justified; previously separate datasets become joinable. This mission creep is not a rhetorical flourish but a structural pressure. The only durable countermeasure is to move ethical aspirations into binding design constraints: minimal proofs as defaults; pairwise identifiers mandated; transaction-linked status checks disfavored; biometrics optional; assisted and analog channels required for essential services; and transparency that faces the user, not just the auditor. When such constraints are encoded in standards, certification, and interfaces, incentives re-align. When they are left to policy memos, drift wins.
SSI’s promise was never only better cryptography; it was dignity expressed in protocols. That promise will not survive poor defaults. A wallet that reuses persistent identifiers, relies on transaction-linked checks for every verification, mandates biometrics at the gate, or demands identity where a simple proof would do will recentre power in providers and platforms. A wallet that treats minimal disclosure, unlinkability, and inclusion as baseline properties can expand autonomy and trust. The task for standards bodies, implementers, and regulators is shared: convert principles into enforceable design choices, visible to users and testable in code. That is where technology meets ethics.
