Providing a digital wallet to every citizen who wants it is a legal obligation on Ireland under the EU eIDAS 2 regulation. Every EU member state has to provide a digital wallet by the end of 2026.

According to the organisations, a digital wallet created on a sound legal basis, with strong security protections and privacy safeguards, could potentially provide genuine benefits for citizens.

However, a central concern is that Ireland’s Government Digital Wallet will rely on MyGovID as its anchor credential - the primary way for someone to verify themselves in order to get a wallet.

The ICCL and DRI said it is impossible to get a verified MyGovID account without getting a Public Services Card (PSC), which necessitates a person enrolling in the PSC facial biometric database, which has been found to be unlawful by the Data Protection Commission (DPC). This matter is currently before the High Court as the Department of Social Protection is appealing that DPC decision.

Other issues, which the organisations say “put the use of MyGovID on very shaky legal and technical grounds”, are that MyGovID has no legal basis in Irish legislation, the security protections on MyGovID are “weak by modern standards”, and the administration and governance of MyGovID is “opaque”.

The discussion around Ireland’s digital wallet has also become conflated with a separate initiative: the State’s proposal to use the wallet to enforce a social media ban for under-16s (to get a MyGovID, a person has to be 16).

While the two issues are connected, the ICCL and DRI argue that they must be assessed separately because they raise distinct questions and risks.

After attending a workshop organised by the Department of Public Expenditure, Infrastructure, Public Service Reform and Digitalisation, the ICCL and DRI subsequently wrote a letter to the Department focusing on six concerns:

   1. Lack of a legal basis;
   2. MyGovID as the anchor credential for the wallet is inappropriate;
   3. Wallet access for people without an Android phone or an iPhone;
   4. Governance;
   5. Transparency and public trust; and
   6. Reported use of the wallet for a social media ban for under-16s/age-verification.

Before any pilot launch, the organisations are calling on the Department to publish the wallet’s Data Protection Impact Assessment (DPIA); any review of the DPIA by the DPC; the wallet’s source code; and a Human Rights Impact Assessment.

The ICCL and DRI are also concerned about reporting by the Irish Daily Mail that the Department of Culture, Communications and Sport has been “trialling age verification using the digital wallet with Meta”.