Source: EDRi — https://edri.org/our-work/whats-behind-the-eus-digitalisation-push-surveillance-control-and-exclusion/
What changed: EDRi is challenging the story behind EU digitalisation#
EDRi’s argument is not that digital public services are automatically harmful. The sharper claim is that the EU’s digitalisation push is being sold as efficiency, modernisation, and citizen empowerment while building systems that can normalise surveillance, control, and exclusion.
That distinction matters. A faster welfare portal is one thing. A welfare system that makes identity, eligibility, movement, and access dependent on interoperable digital credentials is another. The first improves an interface. The second changes the relationship between the person and the state.
EDRi places the EU’s direction inside a wider global pattern often called the “Digital Welfare State.” In that model, governments use digital tools to automate, predict, verify, and optimise access to social protection. The promise is speed and administrative clarity. The risk is a shift from care to suspicion: the claimant becomes a data subject to be scored, checked, authenticated, and sometimes filtered out.
The source points to earlier global examples, including Aadhaar-linked welfare digitalisation, as a warning. The concern is that digitalisation can act as a Trojan horse for austerity. Once the state inserts a digital layer between the person and the service provider, denial, delay, and surveillance can become easier to hide inside process design.
This is what behind the EU debate is really about: not whether public services should use technology, but whether digital identity, data exchange, and automated verification become conditions for exercising rights.
Competence creep is the legal seam to watch#
EDRi’s strongest institutional point is about power. Under the EU Treaties, essential public services such as healthcare, social security, and education remain mainly Member State responsibilities. The EU does not have a direct mandate to decide how a resident in rural Romania reaches a doctor or how a worker in Lisbon claims unemployment benefits.
According to EDRi, the Commission has advanced digitalisation through softer routes: internal market logic, cross-border interoperability, administrative coordination, and funding conditions. This is where “competence creep” enters the story. A policy that would be hard to justify as direct control over national welfare systems can be framed as technical alignment between systems.
That framing is not neutral. Interoperability standards shape databases, identity flows, authentication rules, and institutional defaults. Once national systems are rebuilt around those standards, the policy choice becomes embedded in infrastructure.
Funding also matters. EDRi points to mechanisms such as the Recovery and Resilience Facility, where “digital transformation” can become attached to financial support. That does not mean every funded digital project is abusive. It does mean the political debate can move downstream, after the architecture has already been chosen.
For security operations and privacy risk, this is familiar terrain. Architecture is governance. A database schema, identity provider, API mandate, or opt-out mechanism can decide practical rights more forcefully than a policy slogan.
Emergency systems have a way of becoming permanent#
EDRi also ties the current push to the COVID-19 period. The EU Digital COVID Certificate was presented as a coordination success. It did solve a real cross-border administrative problem during a crisis. But it also built continent-scale infrastructure for health-status verification and movement control under emergency conditions.
The issue is not only what the certificate did at the time. The issue is what it made politically and technically thinkable afterward.
EDRi argues that the certificate created a blueprint for later identity infrastructure, including the EU Digital Identity Wallet. A tool justified for vaccination status in an emergency becomes part of a broader architecture that may connect to driving licences, prescriptions, bank accounts, and other credentials.
That is the pattern readers should examine before accepting any “temporary” system at face value. Emergency-mode governance compresses oversight. It rewards speed. It treats resistance as obstruction. After the emergency fades, the infrastructure remains, and the burden shifts to the public to explain why it should not expand.
This does not prove that every later wallet use is illegitimate. It does show why the origin story matters. Systems built under crisis conditions often lack the consent, scrutiny, and limitation that would be demanded in ordinary legislative time.
Why it matters for privacy risk and public rights#
The operational impact is concentrated in a few areas: identity, health data, welfare eligibility, labour mobility, and border-adjacent control.
EDRi highlights several sectoral projects rather than one single digitalisation law. That is important. The risk does not arrive as one obvious central database with a warning label. It arrives as overlapping systems that each look practical on their own.
The European Health Data Space aims to support cross-border sharing of medical records. The benefit case is clear: better access to care when people move across borders. The risk sits in “secondary use” provisions, where pseudonymised health data may be made available for research and industry. Pseudonymisation reduces exposure, but it is not the same as full anonymity. Health data remains among the most sensitive categories of personal information.
ESSPASS, the European Social Security Pass, is presented as a way to verify social security rights for mobile workers. The convenience case is also real. But a portable digital social identity can become a monitoring tool if labour inspectors, border authorities, or other actors gain routine access to social-rights signals.
The EU Digital Identity Wallet sits at the centre of the concern because it could consolidate credentials into one mobile environment. The more services depend on the wallet, the more refusal, exclusion, device loss, authentication failure, or design bias can affect real access to rights.
This is not abstract. If the digital credential becomes the normal proof of entitlement, the person without the right phone, stable connectivity, documents, literacy, legal status, or appeal support carries the cost.
What to check before acting on a digitalisation claim#
Readers should not treat every EU digital project as surveillance by default. That would be too crude. The better approach is to test each system against operational checks that expose where power moves.
🔎 Check these points first:
- What right or service becomes easier to access, and for whom?
- Is a digital credential optional in practice, or only optional on paper?
- What non-digital route remains available when authentication fails?
- Which authorities can access the data, under what legal basis, and with what logging?
- Is data minimised, or does the system collect extra fields because future reuse is expected?
- Can people see, correct, challenge, and appeal decisions made through the system?
- Are opt-outs simple, visible, and consequence-free?
- Does cross-border interoperability create new access for actors who previously could not query the data?
- Are private vendors involved in identity, hosting, analytics, or verification layers?
- What happens to undocumented people, disabled people, older people, rural users, and people without reliable devices?
These checks are basic security operations for public infrastructure. They are also civil-rights checks. If a system cannot answer them clearly, the efficiency claim is not enough.
For readers following open source security and public digital infrastructure, the same lesson appears elsewhere: artifacts, tests, and code matter, but governance decides how trust is used. See also GigaTap’s notes on operational security artifacts and open source security: OpenSSF’s April signal: make security artifacts operational, 100% package test coverage is the point, not the slogan, and Open Source Security Needs More Than Code.
What not to overclaim#
EDRi is making a rights-based critique, not presenting evidence that every EU digitalisation project has already produced the same harm. That boundary matters.
The source supports a clear warning: the EU’s digitalisation agenda can shift public services toward interoperable identity, broader data exchange, and more conditional access. It also supports skepticism toward emergency-built infrastructure becoming permanent. It does not, from the provided material alone, establish specific abuse numbers, individual legal outcomes, or proof that all Member States will implement these systems in the most coercive way.
The correct posture is neither panic nor trust. It is scrutiny before lock-in.
Once identity and welfare systems are redesigned, the rollback cost rises. Once agencies and vendors build workflows around interoperable credentials, paper alternatives and human review become “exceptions.” Once data reuse is normalised, refusal starts to look like friction rather than a right.
That is the real operational risk behind digitalisation: not one dramatic failure, but a steady redesign of public access around systems that are harder to question after they become infrastructure.