Guest Contribution | Regulatory Construction Needed for Digital Credential Wallets: Can Convenience and Privacy Truly Coexist?

Hsiao-Chen ran out of skincare products at home. He ordered a restock online, and because receiving packages at his residence is inconvenient, he had it shipped to a nearby convenience store. At the counter, he skillfully recited the last three digits of his mobile number, and the store clerk walked over to the shelf and retrieved the corresponding package.

"Please present your identification to verify your name!"

Before the clerk even finished speaking, Hsiao-Chen began rummaging through his wallet, quickly handing over his ID. The clerk verified the name and handed it back along with the package.

Walking out of the convenience store, Hsiao-Chen felt that everything was very convenient and enjoyed that ease, yet he still felt something was a bit off: when handing his ID to the clerk, the card displayed his birthplace, his household registration in his hometown, his ID number, his date of birth, and even the names of his parents and spouse. If the clerk possessed an astonishing memory, or if he picked up packages often enough, the clerk might know more about him than most of his colleagues.

This was a large chain convenience store, and he was familiar with the clerks; they probably wouldn't do anything strange. Nor did he want to give up the convenience of store pickups because of this. Yet this unnecessary exposure always left him with a slight sense of unease.

"Next time, I'll pick that convenience store across the street instead," Hsiao-Chen thought to himself. But wouldn't that just expose his information to even more strangers? Could it really reduce the risk?

The Overlooked Cost: "Streaking-Style" Personal Data Exposure in a Convenient Life

Taiwan boasts the highest density of convenience stores in the world, and in-store pickup has become an inseparable part of daily life. However, behind this convenience lies a neglected privacy risk.

The moment citizens present their ID cards at a convenience store counter, they expose complete and sensitive personal information—including their birthplace, household registration address, ID number, and even the names of their parents and spouses—entirely to a potentially complete stranger.

If people wish to avoid disclosing so much information, can they shield it themselves? For instance, by crafting a card holder that reveals only their photo and name to the convenience store clerk?

Yet this approach has two flaws: First, it can only be used in scenarios requiring name verification; outside of store pickups, scenarios such as age verification for purchasing tobacco and alcohol would require cutting an extra hole in a multi-card holder. Second, because ID cards feature numerous anti-counterfeiting mechanisms, clerks seeing an ID encased in such a bizarre holder might pull it out for a closer inspection.

This time, Hsiao-Chen custom-made a "privacy card holder" that revealed only his name and photo. However, the clerk took the document—wrapped in layers of cardboard—with a deeply furrowed brow. "Sir, I'm sorry, but this covers the anti-counterfeiting label, and I cannot verify its authenticity. Could you please unwrap it?"

Under the gaze of the queue behind him, Hsiao-Chen awkwardly dismantled it. In the end, to confirm it wasn't a fake ID, the clerk inspected it even longer than usual. Instead of protecting his privacy, it drew even more attention.

This is a classic case of "Privacy-Enhancing Technologies" failing in the absence of standardized verification workflows. We need cards to verify identities, and this tool must carry sufficient information while allowing users to choose what portions to disclose during use.

From Physical Cards to Digital Identity Verification

So, suppose there is a digital ID in a smartphone, and upon presentation, one can choose which fields to disclose. This sounds good—what if I simply take a picture of my ID card on my phone and black out the unwanted information before using it?

Thus, Hsiao-Chen instead used his phone to photograph his ID and edited the image, blacking out the address and ID number while leaving only his name and photo. "This should do it," he thought.

Yet the clerk took one look and refused: "Sorry, we do not accept mobile phone photos." To bystanders, this "digital photo" lacking anti-counterfeiting holograms was even less trustworthy than a ruined card holder.

This highlights the rigidity of the current verification system. Under a digitally verified framework lacking official endorsement, any privacy-protection measure initiated by individuals struggles to find acceptance within existing trust frameworks. How is a clerk supposed to trust that the ID in that photo was issued to you by the government?

To solve the issues of identity verification integrity and selective disclosure, the Ministry of Digital Affairs (MODA) introduced the "Digital Credential Wallet," utilizing cryptographic principles to ensure credentials are signed by the government (integrity) and allowing users to disclose only the necessary information required for verification. Internationally, this concept is known as Self-Sovereign Identity (SSI), promising to return control over identity to the user and realizing the vision of "my identity, my choice."

This time, Hsiao-Chen used the government's newly launched "Digital Credential Wallet." When the clerk requested verification, the terminal displayed a QR code, which Hsiao-Chen scanned with his phone, selecting "disclose name only."

"Beep!" Verification successful. Hsiao-Chen successfully picked up his package without ever having to worry about his parents' names on his ID card being fully exposed. This seemed to be the perfect answer.

Yet, does such new technology truly carry no privacy risks whatsoever?

The Risks of Digitization: Surveillance

Hsiao-Chen thought he had found the savior of his privacy. Until the following month, when he received his insurance bill and discovered his premiums had surged by 30%. The notes column read: "System detects your frequent nighttime purchases of alcoholic beverages, classifying you as a high health-risk group."

Hsiao-Chen felt a chill down his spine. As it turned out, every time he executed a slick "minimal disclosure," his data was completely recorded and sent back through that single underlying identifier. He guarded against the clerk's eyes, but could not guard against the all-knowing digital eyes behind the scenes. He thought he was invisible, but before the cloud behemoths, he was more naked than if he had no clothes on at all.

This exposes a severe privacy vulnerability: while the frontend interface implements "minimal disclosure," the backend's "Linkable ID" and "Phone Home" mechanisms completely record every single one of his behaviors. This proves that without legal limits on the boundaries of data usage, technological convenience becomes a breeding ground for surveillance.

A linkable identifier is like the "ID number" of the digital world. If the same ID underlies your alcohol purchases at convenience stores, hospital registrations, and library book loans, then these previously unrelated databases—consumption records, medical histories, reading preferences—can be easily linked together. Your life is no longer fragmented privacy, but a transparent canvas pieced together in its entirety.

The phone-home mechanism functions as the "real-time reporting" of digital footprints. When you verify your identity, your device may transmit the time, location, and purpose of your use back to the issuer (such as the government). This means the issuer possesses a god's-eye view, keeping track of your whereabouts and actions at all times.

Hsiao-Chen's nightmare is precisely the consequence of combining these two: insurance companies link convenience store consumption records through the former, verify behavioral authenticity through the latter, and ultimately transform private data into the basis for determining lifestyle, directly impacting insurance premiums, credit, or job applications. Although these two technical issues can be resolved, this remains insufficient to counter practices where verifiers and issuers customize mechanisms in daily operations to worsen privacy risks. Vulnerabilities that transcend technical standards can ultimately only be constrained and resolved through law.

The Grand Pilot Launch of the Digital Credential Wallet: A Glamorous Adventure?

The current legal basis for the Digital Credential Wallet stems primarily from the "electronic-paper equivalence" provision in the Electronic Signatures Act: "Electronic documents and electronic signatures that comply with the provisions of this Act are functionally equivalent to physical documents and signatures, and their legal validity shall not be denied solely on the grounds of their electronic form."

While the regulations confer legal validity upon digital credentials, they fail to regulate "how they are used." Regarding privacy protection, currently only the Personal Data Protection Act acts as a safeguard; however, the competent authority for the Personal Data Protection Act is the Personal Data Protection Commission, rather than the MODA, which promotes the wallet. Meanwhile, the Cyber Security Management Act overseen by MODA can only regulate public agencies and critical infrastructure providers. In the absence of dedicated legislation, massive gray areas persist regarding how governments and enterprises utilize these credentials.

At a 2025 press conference, five major entities—including the Taipei City Government (Taipei Pass), the Ministry of Economic Affairs (MOE Certificate), the Ministry of the Interior (Citizen Digital Certificate), the Ministry of Labor (Technician Certificate), and the Ministry of Health and Welfare (NHI Card)—all expressed their intent to integrate credentials into the digital wallet. By the end of that same year, the Digital Credential Wallet officially entered its pilot operation phase, demonstrating cross-ministerial integration ambitions.

According to plans released by the Ministry of Digital Affairs, the initiative is progressively rolling out pilots across six major scenarios: convenience store package pickups, access control, job hunting, car rentals, visitor management, and mobile application processing. Among them, the convenience store package pickup function has already taken the lead in launching across FamilyMart and Uni-President convenience stores through electronic cards tied to the three major telecom subscriptions, officially bringing digital verification into everyday consumer scenarios. With National Yang Ming Chiao Tung University, the Ministry of Education, the Directorate General of Highways under the Ministry of Transportation and Communications, and major private human-resources agencies slated to join the pilot in phases by 2026, this digital identity ecosystem spanning both public and private sectors is accelerating its formation, attempting to deeply integrate digital identity verification into citizens' daily lives through diverse application scenarios.

This demonstrates the government's grand vision for the application scenarios of the Digital Credential Wallet. Yet, under the promotion of such large-scale digital infrastructure, without corresponding legal foundations to regulate usage boundaries and privacy protections, this will prove to be a massive adventure.

Although current digital wallet policies champion "user voluntariness," they lack legal mandates compelling public and private sectors to ensure equal access to public services. If agencies or businesses force the use of specific apps to obtain services in the future, citizens who are unwilling to use them or whose mobile hardware cannot support them will have their basic right to access directly stripped away.

Furthermore, we must legislate to prevent identity verification applications from expanding to services that do not require sensitive information in the first place.

How can issuing units (the government or telecom operators) control the digital footprints they are capable of acquiring? This cannot rely solely on technological optimization; it requires drawing clear red lines through legal institutionalization.

Unlike Taiwan's institutional vacuum, the European Union has established basic norms for the issuance and application of digital wallets under the eIDAS Regulation, establishing mandatory technical framework guidance documents. Although EU civil society organizations continue to advocate for patching loopholes, at least an initial blueprint for safeguards exists.

Taiwan's current policy lacks a legal foundation, mirroring the failed eID policy of the past by once again shifting the risks of inadequate planning and regulation onto users. If developed soundly, the digital wallet will be a vital element of the digital identity verification ecosystem; however, current policies still lack institutional planning regarding how to implement personal data minimization and how to prevent third parties from utilizing digital footprints for secondary purposes without explicit consent.

Lessons from Abroad: Regulations and Guidelines Are the Cornerstone of Trust

In promoting digital identity, technology has never been the hardest part; the difficult part is "trust." Let us look at how neighboring countries establish this trust through regulations and guidelines:

South Korea: Regulate First, Demonstrate via Government Action

When promoting Mobile IDs, South Korea demonstrated its determination to build digital infrastructure by prioritizing "regulations first." Rather than opting for administrative trial mandates, South Korea solidly amended its laws in advance to ensure digital credentials possessed legal validity equivalent to physical documents. For instance, as early as August 2019—prior to the official pilot of mobile driver's licenses—the government amended the Enforcement Rule of the Road Traffic Act to establish a clear legal basis for the application and validity of mobile driver's licenses. Furthermore, it simultaneously amended related regulations such as the Electronic Government Act, the Resident Registration Act, and the Enforcement Decree of the Act on Honorable Treatment of Persons of National Merit, laying a solid foundation for the legitimacy of digital identities.

In its implementation strategy, South Korea adopted a steady "inside-out" pace. Following the formulation of the "Digital Government Innovation Promotion Plan" in 2019, it did not rush to face the general public directly, instead issuing "Mobile Official IDs" to central government civil servants first in 2021. This government-led demonstration approach ("Dogfooding") allowed government agencies to practically verify safety and convenience in internal settings before full rollout to the public, conducting necessary tests and enhancements to ensure system stability prior to expanding applications.

After a year of internal verification and optimization, South Korea officially introduced the Mobile ID to the public. Piloted in January 2022 and officially issued in July 2022, the mobile driver's license became the first mobile ID geared toward the general citizenry. Subsequently, the government progressively expanded application scopes according to plan, moving from the "Mobile National Merit Registration Card" in 2023 to piloting the "Mobile Overseas Korean Identity Confirmation Document" and the "Mobile Resident Registration Card" (i.e., digital ID) in 2024, with plans to issue the "Mobile Foreigner Registration Card" in 2025, ultimately achieving a complete digital identity system covering all residents.

Japan: Digital Agency Guidelines, Unified Verification Standards

Japan's Digital Agency formulated DS-511 (Guidelines for Digitalization of Identity Verification), categorizing verification requirements based on risk. More importantly, it strictly regulates privacy principles, demanding adherence to "data minimization" to ensure administrative organs do not over-collect personal data through the verification process.

Ukraine: Trust in Times of Peace, Resilience in Wartime

The success of Ukraine's Diia app stems from trust accumulated during peacetime. Through sound privacy-by-design principles during normal times, the government made citizens believe that digital identities serve rather than surveil. It is precisely this capital of trust that allowed Diia to rapidly transform into a key component of national resilience amid the flames of war, enabling people to dare to use it to defend their country.

The experiences of these countries tell us: without robust regulations and guidelines, digital identity is merely an app that can leak privacy at any moment; with regulatory governance, it can become a digital shield protecting the people.

From Financial Regulation to Digital Human Rights, We Already Have a Ready-Made Trust Mechanism

After comparing various national regulations, we find that Taiwan actually possesses a mature standard for digital identity governance: the Financial Supervisory Commission's long-standing Guidelines for Financial Service Enterprises Handling Digital Identity Authentication.

These guidelines did not emerge from a vacuum; instead, they aligned with international high standards such as NIST SP 800-63B and ISO 29115-1. They clearly define standardized Levels of Assurance (LoA), formulating varying verification strengths based on risk levels to prevent over-sharing—such as requiring full ID disclosure simply to buy beer. Simultaneously, they strictly regulate data exchange protocols among institutions. Federated Identity allows financial institutions to complete trusted verifications on the premise of "not exchanging raw personal data." This is precisely the critical technical architecture required to resolve the privacy risks of digital identification.

Many Taiwanese rely on mobile phones for daily financial services. On payday, we use our phones to check our accounts rather than updating passbooks; during daily commutes, we use securities apps to check stock prices; when traveling abroad, we buy travel insurance via apps—all operated via the internet. Furthermore, all these identity verification processes are conducted using the FSC's digital identity verification guidelines. If the digital credential wallet could adopt this set of standards, Hsiao-Chen's convenience store consumption records would never be accessible to insurance companies via a single ID link without authorization. This is the digital governance we need.

However, we must also face current limitations: this high-standard trust mechanism currently appears to be the monopoly of large financial institutions. Taking the Financial Fast Identity Online (FastID)—a standardized financial mobile identity recognition mechanism allowing one financial institution to verify identities via another—as an example, currently only seven banks possess the capability to interface, while resource-strapped agricultural and fishery association credit departments are locked out. This creates a severe "digital divide": only large corporations can afford high-specification privacy protection, while smaller institutions are forced to remain in the old era. This is precisely why we need national-level regulations and infrastructure intervention to transform this standard into a public good, allowing institutions of all scales to operate under a unified trust framework rather than letting cybersecurity become a moat for major corporations.

Trust in Digital Infrastructure

The Digital Credential Wallet is a technology with considerable potential; yet ironically, while our financial system has already aligned with international high standards, the credential wallet launched by the MODA remains in a wild west stage of "having a legal basis without regulations." This "one country, two systems" approach to digital governance not only restricts advanced applications like FastID to financial circles but further exposes ordinary citizens' digital footprints to unknown risks.

Experiences from other nations tell us that the cornerstone of digital infrastructure lies in trust. Although Taiwan did not start late, if it ignores the importance of regulatory governance, the resistance to promoting the digital wallet will grow increasingly severe, even repeating the dilemmas of past policy drives. Taiwan's financial sector guidelines and legal practices abroad have pointed the way forward for Taiwan's digital credential wallet; the government should seize the opportunity to establish sound regulations to truly win public confidence in digital transformation.

Let us return to Hsiao-Chen's story, imagining a future empowered by sound regulatory governance:

Years later, Hsiao-Chen walks into that familiar convenience store once more to pick up a package. This time, what he takes out is no longer a paper card holder taped over with strips, nor is it an app that secretly phones home, but a "digital wallet" compliant with national digital identity guideline specifications.

The clerk requests identity verification. Hsiao-Chen taps his phone, and a prompt pops up on the screen: "The convenience store requests to verify your 'name.' Do you consent?" Hsiao-Chen taps agree.

"Beep!" Verification passed.

In that instant, the underlying operational mechanism is entirely different. Per regulatory requirements, this digital wallet utilizes de-identification technology; the convenience store receives only a "verification passed" signal, remaining entirely unable to obtain Hsiao-Chen's ID number or address. More importantly, regulations strictly prohibit cross-institutional data linking, ensuring insurance companies can never peer into his consumption records through a backdoor.

Hsiao-Chen walks out of the convenience store holding his package with a light step. He knows that this time, he does not need to choose between "convenience" and "privacy." Technology and law have blocked all prying eyes for him, and he can finally enjoy the freedom brought by technology with peace of mind.

This is the digital life we look forward to, and the ultimate purpose of the government formulating digital identity guidelines and regulations.

*The full text was published on March 11, 2026, in CommonWealth Independent Review