Digital Brain
digital brain
digital brain

Canada Partners with the European Commission to Examine Use of Digital Credentials

December 7, 2021 Privacy and Cyber-Security Bulletin 4 minute read

With an increasing number of human interactions taking place in the digital world, there is a growing need for efficient and secure digital services.

To that end, Innovation, Science and Economic Development Canada recently announced a partnership between the Government of Canada and the European Commission to examine the use of digital credentials.[1] Standards for digital credentials are intended to improve privacy and global functionality, allowing governments and businesses (and their customers) to feel more secure in using such credentials.

Notably, Ontario has already begun developing its Digital Identity Program, which will provide a digital option for government issued identification in the province.[2]

What are digital credentials?

As the name suggests, digital credentials are the digital equivalents of ordinary physical credentials, such as passports, licenses, diplomas, educational certificates or tickets. They may appear as a badge in an email signature, an identification card in a digital wallet, or a certificate on a company’s website.

Digital credentials are generally used for the same purposes as their physical counterparts, including to confirm a person’s identity or qualifications. In order to perform this authentication function reliably and efficiently, digital credentials often have confirmatory information built right into the digital credential, in a manner that is difficult to fake. For example, a digital driver’s license may have meta-data or a digital watermark that includes the subject’s name, birthdate or photograph. The digital credential may also provide a method to automatically confirm the credential online with its source, such as through a verifiable data registry.[3]

In the private sector, businesses might use digital credentials externally (e.g., for membership and loyalty or rewards programs with customers) or internally (e.g., to verify education credentials and certifications in the hiring process). Businesses may also use digital credentials to verify an individual’s identity or to serve as proof of purchase (e.g., an airline ticket or conference admission pass).

The aim of digital credentials is to increase security, accessibility and efficiency when operating and interacting online. By allowing individuals to prove certain credentials about themselves, digital credentials are intended to provide a more privacy-friendly alternative to centralized digital user records or traditional paper records.

What came from this partnership?

Canada and the European Commission explored the use of digital credentials through workshops examining (i) the current technology and policy landscapes, (ii) areas of commonality, and (iii) gaps that need to be addressed to enable mutual support for the use of digital credentials.

There are several key gaps and challenges highlighted in the report from these workshops (the “Report”)[4], which center on the need for consistent standards.

The Report found that a variety of digital credential technologies already exist across different economic sectors and jurisdictions, which has led to the development of different standards in isolation. The Report noted that having disparate systems could lead to challenges for mutual recognition and scalability of digital credential systems. To address this, the Report recommends that both jurisdictions adhere to internationally recognized best practices and comply with endorsed principles of online interface design.

The Report also identified a lack of standards for digital wallets, which, like physical wallets, allow individuals to store and maintain digital credentials and other assets. The Report concluded that such standards are necessary to ensure the privacy and security of digital wallets.

Finally, the Report noted a risk that, as digital credential standards are developed, businesses and consumers may become dependent on larger players in the space, leading to reduced competition. The Report recommends open standards and a feature-agnostic system to address this problem.

To address these gaps and further advance the development of standards for digital credentials across Canada and the European Union, the Report provides a number of recommendations, including:

  • hosting digital credential showcases to build adoption, awareness, support and continuing engagement through both formal and informal channels;
  • implementing cross-border certification of academic diplomas to increase interoperability between Canada and the European Union; and
  • establishing mutual recognition for digital credentials through formal agreements between Canada and the European Union.

What should businesses know?

The increased collaboration between Canada and the European Union signals that both jurisdictions wish to clarify and bolster international standards and policies relating to digital credentials.

Now is a good time for businesses that have not made use of digital credentials to consider how using such systems could improve the privacy, efficiency, and security of their online interactions. Businesses looking to start using digital credentials should consider industry best practices, as these will likely inform any forthcoming policies and standards.

Businesses that already use digital credentials should consider whether their own practices with respect to digital credentials are reliable and whether they have sufficient privacy protections in place for digital credentials they manage.

Likewise, businesses that develop and offer products or services related to digital credentials should be alert to potential forthcoming guidelines, policies and/or legislative changes in Canada as a result of this ongoing collaboration.

Overall, the Report should be well received by international companies that make use of digital credentials in both the European Union and Canada, as unified standards of digital credentials may help create more business efficiencies and opportunities for collaboration across these jurisdictions.

With ongoing communication and engagement, policies and standards in this area will continue to change. We recommend reaching out to our Privacy and Data Protection team for any questions or concerns about the use of digital credentials.

[1] Canada, Innovation, Science and Economic Development Canada, News Release, Government of Canada announces partnership with the European Commission to examine the use of digital credentials (Ottawa: Innovation, Science and Economic Development Canada, 2021).
[2] Government of Ontario, Digital ID in Ontario  (November 2021).
[3] This is the manner in which the Ontario government has proposed to authenticate its digital identification cards: see Government of Ontario, Ontario’s Digital ID: Technology and Standards  (September 2021).
[4] Canada, Innovation, Science and Economic Development Canada, Canada and the European Union Joint Workshop Series for Enabling Interoperability and Mutual Support for Digital Credentials: Report on the Technical and Policy Workshops Held from Spring to Summer 2021 (Ottawa: Innovation, Science and Economic Development Canada, 2021).

by Robbie Grant, Kristen Pennington and Kristen Shaw (Articled Student)

 

Insights (5 Posts)

Featured Insight

The 2022 Construction Labour “Open Period” – What Employers Need to Know

March 1 – April 30, 2022 is the “Open Period” for ICI collective agreements, and many non-ICI agreements, in Ontario. During this period members of construction unions can apply to the Ontario Labour Relations Board to terminate a union’s bargaining rights with their employer, or – more commonly – a rival union can apply to the Board to displace an existing union, in what is commonly known as a “raid”. During the Open Period employers will likely see increased union activity on sites as incumbent unions will seek to maintain member support, and as rival unions may try to gather support for a raid.

Join us on Wednesday, February 2nd for a discussion about what employers should expect and need to know if a decertification application or a displacement application involving their employees is filed at the Board.

Details
Wednesday, February 2, 2022
Featured Insight

PropTech: Property Technology, the New Frontier in Real Property, Part 3: Challenges

In this bulletin, we discuss the risks and challenges of using PropTech by businesses in the real estate space and for consumers of such products.

Read More
Jan 18, 2022
Featured Insight

Plan for the Ban: Our New Year’s Update of Single-Use Plastics Bans Across Canada

This bulletin provides an updated summary of the current state of single-use plastics legislation across Canada.

Read More
Jan 18, 2022
Featured Insight

Cash is King – Taking Control over Cash Collateral

In secured lending transactions, a debtor's cash may form part of the lender's general security or may be deposited with a financial institution to support certain contingent obligations (such as outstanding letter of credits)

Read More
Jan 18, 2022
Featured Insight

Alberta Securities Commission Provides Guidance On Shareholder Rights Plans, Break Fees and Use of Equity Swaps in Take-over Bid Context

An Alberta decision has held that the use of swaps in a hostile take-over bid can be abusive, and added guidance on shareholder rights plans and break fees.

Read More
Jan 12, 2022