The expansion of digital ID will drive further growth in Europe’s cyber-security industry – estimated to be worth US$57bn in 2024 – which will be increasingly essential to securing and sustaining these systems. National digital ID programmes have repeatedly suffered from security breaches in recent years, exposing personal data and highlighting the need for strong cyber security. In some cases, personal data was sold illegally, either as a stand-alone product or as services that grant criminals paid access. Even countries with robust cyber-security frameworks, such as Singapore, have not been immune to a sharp rise in illicit activity involving Singaporean identity data in the first half of 2024. To address these challenges, European governments are starting to rely more on decentralisation and blockchain technology. This method allows citizens’ data to be stored in a distributed manner rather than in centralised databases that have become major targets for cyber attacks. For example, the EU is developing a Digital Identity Wallet that focuses on data sovereignty and privacy, with the aim of creating opportunities for European businesses and increasing transparency and trust among the public. While decentralised ID systems offer a degree of protection, they are not without shortcomings. These systems are typically more complex and expensive to implement, which can hinder their adoption in developing countries, which are home to the majority of the 3.3bn people worldwide who currently lack access to any form of government-issued digital ID. Another challenge is the dispersal of citizens’ data across various public and private entities, which increases the number of potential access points. This widespread sharing creates fragmented and difficult-to-manage ecosystems, in which identity data is routinely exchanged between government bodies and private organisations for use in a range of services. As a result, sensitive identity information is increasingly held by third parties whose security standards may not always be sufficiently robust to protect the data. |