Working on wallet notifications in CEN TC224 WG20, I keep hearing the same objection: ‘This is too complicated for the average user.’ But the complexity isn’t optional — it’s already mandated. The real question is whether we trust citizens with the information they need to protect themselves.
As Lead Editor of CEN/TS 18297, I reviewed the three draft Implementing Acts against the EUDI Wallet regulatory framework and submitted 17 comments to the European Commission consultation. The three critical findings share a common root: the regulations define what the wallet must do, but do not ensure the information needed to do it is available at the point of disclosure.
ISO/IEC 27560 defines how organisations should create, store, and manage consent records. As lead editor of this standard — now freely available — I explain what it covers, why it matters for GDPR compliance and EUDI wallet ecosystems, and how to get started with implementation.