A paper document shows everything on it to whoever holds it. With a wallet, each organisation asks for named details, the wallet shows the request, and the hunter answers. That protects the hunter only if the request is no wider than the check needs.
A checker may only ask for what it has registered, and the wallet warns you if it asks for more.
An organisation registers what it will ask for, and may not ask for more. The wallet compares each request with that, and must warn you if it asks for more. What happens after the warning is up to each wallet, and nobody tests beforehand whether the organisation needs what it registered. Registration applies from 24 December 2026, and the wallet’s check from 11 August 2028.
What the checker registered
Name
Hunting card
What it asks for
Name
Hunting card
Date of birth
An example. The wallet compares the two and warns you. What happens next is up to each wallet.More on this: A checker may only ask for what it has registered, and the wallet warns you if it asks for more.
The game asks: “Who decides what an organisation may ask for, and can your wallet tell when it asks for too much?”
What we know
An organisation that will rely on the wallet registers in the country where it is established.1
It registers what it will use the wallet for, and the data it will ask for.2
It must not ask for anything it has not registered.3
The registrar collects what an organisation will use the wallet for, and the data it will ask for, for transparency only, and applies no approval beforehand to them. Law on specific services still applies.4
The registers are public, for people and machines to read.5
The wallet compares each request with what the organisation registered.7
If the organisation asks for more than it registered, the wallet must warn the user before anything is shared.8
What happens after the warning is for each wallet provider to decide, from its own risk analysis, its security policy and the law that applies: let the user go on, share only the registered part, or reject the request.9
A registrar may suspend or cancel the registration of an organisation that asks for more than it registered.10
The rules on registration apply from 24 December 2026.11
The wallet’s duty to validate what an organisation registered applies from 11 August 2028.12,13
A recital says that whatever an organisation asks a wallet user for should be necessary for, and in proportion to, what it is used for.14
Not settled
In the rules we read, nobody tests beforehand whether an organisation needs what it registers, and a wallet need not refuse a request that asks for more.
On the trip: On Svenska Jägareförbundet’s website before the trip, and in the police check at the Swedish border.
Reg (EU) 2024/1183, Art. 5b(2)(c)the intended use of European Digital Identity Wallets, including an indication of the data to be requested by the relying party from users.
Reg (EU) 2024/1183, Art. 5b(3)Relying parties shall not request users to provide any data other than that indicated pursuant to paragraph 2, point (c).
CIR 2025/848 Art. 6(3a) (as amended 2026)only for the purpose of transparency and, without prejudice to paragraph 4 of Article 5b of Regulation (EU) No 910/2014, shall not apply any preauthorisation process on this information.
CIR 2025/848 Art. 3(4)publicly available online, both in human-readable form and in a form suitable for automated processing.
CIR 2024/2982 Annex II, WRP-OVERASKING-01 (as amended 2026)The EUDI Wallet shall compare the attestations and attributes requested by the wallet-relying party with the registered attestations and attributes in the wallet-relying party registration certificate.
CIR 2024/2982 Annex II, WRP-OVERASKING-02 (as amended 2026)Where the wallet-relying party requests PID or electronic attestations of attributes or claims that are not covered by the wallet-relying party registration certificate, the EUDI Wallet shall clearly warn the wallet user before any disclosure.
CIR 2024/2982 Annex II, WRP-OVERASKING-03 (as amended 2026)The wallet provider shall determine, based on its risk analysis, security policy and applicable law, whether the wallet user may continue despite such warning, whether only the subset of requested data covered by the registration certificate may be disclosed, or whether the request shall be rejected.
CIR 2025/848 Art. 9(2)(c)the wallet-relying party is requesting more attributes than they have registered in accordance with Article 5 and Article 6;
Reg (EU) 2024/1183, recital 56Any request by the relying party for information from the user of a European Digital Identity Wallet should be necessary for, and proportionate to, the intended use in a given case
You can always say no, and nothing we found tells the checker why.
In the EU’s technical framework you can always say no, and the wallet then behaves as if the document wasn’t there. We found no rule that the organisation is told that you refused, or why. What it must do next is not said.
More on this: You can always say no, and nothing we found tells the checker why.
The game asks: “Should your wallet tell an organisation that you said no, and should it ever say why?”
In the ARF, when the user refuses, the wallet behaves towards the organisation as if the credential did not exist.2
In the protocol used online, one error code covers the user saying no, the wallet not having the credential, and a failed unlock: the code alone doesn’t tell the organisation which it was.3
The wallet’s own log records why something was not completed.4
Using the wallet is voluntary, and nobody may be put at a disadvantage for not using it.5
Other ways of identifying oneself must stay possible.5
Not settled
In the Regulation and its implementing regulations, we found no rule that the organisation is told that the user said no, or why.
What an organisation must do after a no is not said. Whether the rules on other ways of identifying oneself, and on no disadvantage for not using a wallet, protect someone who has a wallet and says no to one request is not said either.
On the trip: When the hunting team asks for Kari’s shooting test, and she can turn the request down.
Sources
ARF Annex 2, RPA_07A Wallet Unit SHALL always allow the User to refuse presenting an attribute requested by the Relying Party or Verifier Wallet Unit.
ARF Annex 2, RPA_11When the presentation of an attestation or a PID is denied by the User, the Wallet Unit SHALL behave towards the Relying Party as if the attestation or PID did not exist.
OpenID4VP 1.0, section 8.5 (access_denied)The End-User did not give consent to share the requested Credentials with the Verifier.The Wallet did not have the requested Credentials to satisfy the Authorization Request.The Wallet failed to authenticate the End-User.
CIR 2024/2979 Art. 9(2)(d)in the case of non-completed transactions, the reason for such non-completion.
Reg (EU) 2024/1183, Art. 5a(15)Access to public and private services, access to the labour market and freedom to conduct business shall not in any way be restricted or made disadvantageous to natural or legal persons that do not use European Digital Identity Wallets.It shall remain possible to access public and private services by other existing identification and authentication means.
A wallet can show each checker only the part it needs.
A wallet can share some details of a document and leave the rest out, so Swedish and Norwegian customs could each see only their part. But we found no specification for a digital pet passport, so nothing says which parts those are.
The dog’s documents
Swedish customs
Norwegian customs
Microchip number
sees it
sees it
Owner
sees it
sees it
Tapeworm treatment
doesn’t
sees it
An example of how it could be, across the pet passport and the tapeworm treatment. No specification says which parts each one gets.
More on this: A wallet can show each checker only the part it needs.
The game asks: “Each authority that checks a dog’s papers needs different things from them. What should each see?”
What we know
The wallet must let the user share only some of the details in a credential.1
A recital ties sharing only some details to data minimisation.2
An issuer can attach a policy to a credential on who may see it, and the wallet must tell the user whether the one asking is allowed.3
Nothing is shared until the user has approved it, in part or in full.4
The ARF recommends that the user approves everything an organisation asks for, or nothing.5
What organisations told us
The authorities that check a pet passport need different information from it than the owner does.6
Reg (EU) 2024/1183, recital 59thereby reinforcing convenience and the protection of personal data, including data minimisation.
Reg (EU) 2024/1183, Art. 5a(5)(e)implement the appropriate mechanism to inform the user that the relying party or the user of the European Digital Identity Wallet requesting that electronic attestation of attributes has the permission to access such attestation;
ARF Annex 2, RPA_10aThe Wallet Unit SHOULD ensure that the User gives approval either to present all attributes requested in a presentation request, or none of them.
Workshop on travelling with dogs, October 2026 (not published)
Tullverket, information to the project, October 2026 (not published)
Your wallet logs what you shared. The rules mostly don’t say how long others may keep it.
Your wallet keeps a log of what you shared with whom, and from it you can ask an organisation to erase what it has. On how long an organisation may keep what it was shown, we found two rules only: one for the facial image, and one for intermediaries, which must not store what is shared. We read the rest as left to data protection law and each sector’s own rules.
More on this: Your wallet logs what you shared. The rules mostly don’t say how long others may keep it.
The game asks: “What may an organisation keep of what you showed it, and for how long?”
What we know
The wallet keeps a log of everything the user has done with it, shown in a dashboard.1
The log records which kinds of data were asked for and shared.2
In the ARF, the log does not hold the values that were shared.3
From the dashboard the user can ask an organisation to erase personal data, under the GDPR.4
In the ARF, the wallet can only log that a request for erasure was started.5
From the dashboard the user can report an organisation to the data protection authority.6
The organisation must give a link to its privacy policy for what it uses the wallet for.7
A rule limits what an organisation may keep of the facial image: it must not be kept unless it is needed to identify the user or the law provides for keeping it.8
An intermediary that acts for an organisation must not store what is shared.9
A Norwegian gun shop must see the buyer’s ID and proof of the right to acquire before handing over ammunition, and logs every sale.10,11
Not settled
Apart from the facial image and the rule for intermediaries, we found no rule for the wallet on how long an organisation may keep what it was shown.
We read that as left to data protection law and to each sector’s own rules.
On the trip: In the police check at the Swedish border, and in every check after it: the wallet lists what each one was given.
Sources
Reg (EU) 2024/1183, Art. 5a(4)(d)access a log of all transactions carried out through the European Digital Identity Wallet via a common dashboard enabling the user to:
ARF Annex 2, DASH_03athe log SHALL NOT contain the value of any attributes presented to the Relying Party or the Verifier Wallet Unit.
Reg (EU) 2024/1183, Art. 5a(4)(d)(ii)easily request the erasure by a relying party of personal data pursuant to Article 17 of the Regulation (EU) 2016/679;
Reg (EU) 2024/1183, Art. 5a(4)(d)(iii)easily report a relying party to the competent national data protection authority, where an allegedly unlawful or suspicious request for data is received;
CIR 2024/2977 Art. 3a(3) (as amended 2026)The portrait shall not be retained by wallet-relying parties unless its processing is necessary for the purposes of identification and authentication in compliance with Union data protection law or where this is provided for by Union or national law, in compliance with Union data protection law.
Reg (EU) 2024/1183, Art. 5b(10)Intermediaries acting on behalf of relying parties shall be deemed to be relying parties and shall not store data about the content of the transaction.
Våpenforskrifta § 9-5Ved utlevering av løyvepliktige skytevåpen, våpendelar eller ammunisjon skal løyvehavar krevje førelagt dokumentasjon for mottakaren sin identitet saman med dokumentasjon for ervervsløyve.
Våpenforskrifta § 9-8Løyvehavar skal føre ein laupande oppgåve over alt kjøp eller sal av ammunisjon (ammunisjonsprotokoll).
As we read it, Swedish law doesn’t say what a gun shop must see.
Swedish law says a shop may sell ammunition only to someone entitled to hold it. As we read it, it doesn’t say what the shop must see, and no source says whether the shop may accept the identity in a wallet. Norwegian law does say: the buyer’s ID and proof of the right to acquire.
More on this: As we read it, Swedish law doesn’t say what a gun shop must see.
The game asks: “What does the gun shop need: your date of birth, or only proof that the licence is yours?”
What we know
A Swedish gun shop may sell ammunition only to someone who has a permit or is otherwise entitled to hold it.1
In the ARF, a scheme for binding credentials together must let an issuer ask for proof that a new credential’s key is kept by the same secure component as the identity’s, or another credential’s.2
A recital says that whatever an organisation asks a wallet user for should be necessary for, and in proportion to, what it is used for.3
The words “minimum data necessary” are in the duty on very large online platforms.4
The wallet’s technical framework must not let issuers or anyone else get data that allows a user’s transactions to be tracked or linked, unless the user explicitly allows it.5
Where a credential doesn’t require the user to be identified, the framework must make it possible to show it without the showings being linked.6
In the ARF, the software of an organisation that checks must discard the values that are unique to a credential, and any timestamps, as soon as they are no longer needed, and must not pass them on.7
Not settled
The shop asks to see the Norwegian licence or European firearms pass, and ID. The law does not say what the shop must see.
No source says whether a Swedish gun shop may accept the identity in the wallet as ID.
The promise of unlinkability covers only credentials that need no identification, and Kari is identified in every check. In the Regulation and its implementing regulations, we found no rule on linking addressed to the organisations that check.
On the trip: At the gun shop in Sweden, where Kari buys ammunition.
Sources
Vapenlagen 6 kap. 4 §Ammunition, ljuddämpare och vapenmagasin får överlåtas eller yrkesmässigt förmedlas endast till den som har tillstånd eller annars har rätt att inneha föremålen.
ARF Annex 2, ACP_05is managed by the same WSCA/WSCD or keystore as the private key of a PID or another attestation already existing on the Wallet Unit.
Reg (EU) 2024/1183, recital 56Any request by the relying party for information from the user of a European Digital Identity Wallet should be necessary for, and proportionate to, the intended use in a given case
Reg (EU) 2024/1183, Art. 5f(3)in respect of the minimum data necessary for the specific online service for which authentication is requested.
Reg (EU) 2024/1183, Art. 5a(16)(a)not allow providers of electronic attestations of attributes or any other party, after the issuance of the attestation of attributes, to obtain data that allows transactions or user behaviour to be tracked, linked or correlated, or knowledge of transactions or user behaviour to be otherwise obtained, unless explicitly authorised by the user;
ARF Annex 2, OIA_16a Relying Party Instance SHALL discard the values of all unique elements, including at least the ones mentioned in requirement ISSU_35 in [Topic 10][topic-10], as well as any timestamps, as soon as they are no longer needed.The Relying Party Instance SHALL NOT communicate these values to the Relying Party or to any other party inside or outside the EUDI Wallet ecosystem.
What could be started on now
For each check on the trip, write down the fewest details the checker needs, and register no more than that.
Decide what each organisation keeps of what it is shown, and for how long, and say so in the privacy policy that its registration links to.
Agree across wallets what happens when an organisation asks for more than it registered, so that the same request gets the same answer from a Norwegian and a Swedish wallet.
