OC#6 2026

In terms of broader European interests, my fellowship contributes to EU goals of digital sovereignty, user empowerment, and privacy leadership on the global stage. As the EUDI wallet is adopted across Europe, this framework will provide a scalable model for data protection and user-centric identity management that can be extended beyond digital wallets to other data-sharing contexts, enhancing Europe’s role as a privacy leader. With data privacy becoming a key competitive factor, this initiative not only strengthens the protection of EU citizens’ rights but also sets a high standard for digital identity solutions globally.

My work supports fundamental societal values by helping define how citizens can safely and transparently share their personal data through the European Digital Identity (EUDI) Wallet. At the heart of this is the development of access control standards that ensure individuals are not just passive data subjects, but active participants who can decide what data is shared, with whom, under what conditions, and for what declared purpose.
By enabling these controls through enforceable, machine-readable policies, the standard empowers users to exercise real agency over their digital identity—moving beyond consent screens toward meaningful privacy protections embedded in the architecture of the wallet itself. This aligns with the EU’s commitment to privacy, data minimisation, and purpose limitation under the GDPR.
The work also supports societal inclusion by ensuring that access control mechanisms are transparent and usable, helping citizens understand their rights and obligations, while also simplifying compliance for service providers. The inclusion of ISO/IEC 27560 in this framework ensures that all lawful bases for processing—not just consent—are clearly documented and traceable, which is especially important for use cases like healthcare, education, or public services.
Importantly, the open availability of ISO/IEC 27560 as a free standard lowers the barrier for adoption, supporting uptake by public administrations, SMEs, and civil society. This ensures that privacy-enhancing technologies are not limited to large commercial actors, but can benefit all layers of European society.
Overall, this work contributes to a more trustworthy, transparent, and citizen-centric digital identity ecosystem—one that upholds European values while supporting innovation, cross-border interoperability, and regulatory alignment.

This activity impacts the societal challenges in three key areas:
Secure societies - protecting freedom and security of Europe and its citizens: Supporting standards on e-identity and e-privacy information management ensures identity information lifecycle, identification, bound proofed identity information and authentication of citizen and societies are in place before authorized accesses to services is provided without compromising their privacy;
Cybersecurity, network and identity information security: Standards on reference architectures around e-identity and e-privacy management ensure information infrastructure has the required controls in place to protect citizen and societies while accessing and using provided services;
ePrivacy protection: Data protection good practice ensures any risk on identity information is mitigate during the processing of the information.

This work has societal impact at least on three axes, including:
Secure societies - protecting freedom and security of Europe and its citizens: Supporting standards on e-identity and e-privacy information management ensures identity information lifecycle, identification, bound proofed identity information and authentication of citizens and societies are in place before authorized accesses to services is provided without compromising their privacy;
Cybersecurity, network and identity information security: Standards on reference architectures around e-identity and e-privacy management ensure information infrastructure has the required controls in place to protect citizens and societies while accessing and using provided services;
ePrivacy protection: Data protection good practice ensures any risk on identity information is mitigated during the processing of the information.