eu-digital-identity-wallet / eudi-doc-architecture-and-reference-framework

The European Digital Identity Wallet
https://eu-digital-identity-wallet.github.io/eudi-doc-architecture-and-reference-framework/
Other
431 stars 60 forks source link

PID set: Potential issue with uniqueness in mandatory attribute set #159

Closed jantdm closed 7 months ago

jantdm commented 8 months ago

Description

In section 5.1.1.1 one of the principles states "No two persons SHALL have the same PID set of values for mandatory attributes." Based on the mandatory set of attributes as specified in 5.1.1.2 the combination of family and given name with birth date will lead to a very small but still non-zero number of cases with persons having the same PID set of values in a population of 450m.

(Using given_names (plural) instead or adding this in the mandatory set could reduce the chances, but not to zero.) Edit: Just realized that the PID rulebook already specifies given_name as plural "name(s)".

Are these edge cases accepted or is this something where the spec would need to be adapted/extended?

I'm just getting into the process so apologies if this is not relevant here.

ivanek666 commented 8 months ago

There are several cases of tuples Name, Surname and Date of birth just in Czech Republic according to state data https://archi.gov.cz/en:nap:iseo

This principle cannot be achieved.

jantdm commented 8 months ago

There are several cases of tuples Name, Surname and Date of birth just in Czech Republic according to state data https://archi.gov.cz/en:nap:iseo

This principle cannot be achieved.

Very interesting, thank you for posting. I was quickly looking for something like this but mostly found news articles of examples and theoretical statistics. This is a perfect empirical example.

So the issue is much more significant, 25 000 people that could not uniquely be identified for the Czech Republic alone.

jantdm commented 7 months ago

Following up on this, a unique identifier was part of the mandatory data set in the ARF up until the changes introduced with issue #67. Is there a reasoning available for the removal of the respective line?

2015/1501 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32015R1501) which was referenced before as a source for the requirement also still references the need for a unique identifier.