Privacy by Design & the EU Data Wallet
- Nick Vermeulen
- Privacy , X400 , Sd JWT
- August 23, 2025
Table of Contents
From X.400 to SD-JWT: A Privacy Evolution in the EU Digital Identity Wallet
The landscape of digital identity is constantly evolving, and with the advent of the EU Digital Identity (EUDI) Wallet, we’re seeing a significant leap towards user-centric and privacy-respecting systems. For those of us with a longer history in digital communication, the term “X.400” might ring a bell. While seemingly disparate, comparing the foundational concepts behind X.400 and the modern SD-JWT (Selective Disclosure for JSON Web Tokens) within the context of the EUDI Wallet highlights a remarkable evolution, particularly in how we handle and control personal data.
The Channel Islands will have its own nuances in adopting digital identity solutions, the EU’s direction with the EUDI Wallet and its reliance on SD-JWT offers valuable insights for us all.
A Look Back: X.400 - The Address is the Key
For those unfamiliar, X.400 was a set of ITU-T standards for message handling systems (MHS) widely adopted in the late 20th century for email and other forms of electronic messaging. A core concept of X.400 was its addressing scheme. An X.400 address was a hierarchical structure containing various attributes like country name, administrative management domain, private management domain, organization name, and ultimately, the personal name.
In essence, to interact with someone via X.400, you needed a relatively detailed address containing potentially sensitive organizational and personal information. While this provided a structured way to route messages, it inherently meant sharing a significant amount of identifying data just to establish communication.
The Modern Approach: SD-JWT - Selective Disclosure is King
Fast forward to today and the EU Digital Identity Wallet’s reliance on SD-JWT. The fundamental shift is towards user control and data minimization. SD-JWTs, as the name suggests, allow for the selective disclosure of information contained within a digital credential.
Imagine a digital driver’s license in your EUDI Wallet, represented as an SD-JWT. If a shop needs to verify you’re over 18 to purchase alcohol, with a traditional digital certificate (akin to the information-rich X.400 address), you might have to present your entire license, revealing your full name, address, date of birth, and even your driving endorsements.
However, with SD-JWT, the underlying technology allows you to prove only that you are over 18. The credential itself contains all the information, but through cryptographic techniques, only the “age verification” claim is presented to the verifier. The rest of your personal details remain private within your wallet.
Comparing and Contrasting: Key Differences
| Feature | X.400 | SD-JWT in EUDI Wallet |
|---|---|---|
| Primary Use | Message routing and addressing | Representing and selectively disclosing digital credentials |
| Data Disclosure | Full address typically required for interaction | Selective disclosure of specific claims |
| Privacy Focus | Limited built-in privacy considerations | Strong emphasis on privacy by design |
| Control | Primarily system-driven address management | User-centric control over data sharing |
| Technology | Hierarchical addressing scheme | Cryptographic hashing and digital signatures |
| Use Case | Email and electronic messaging | Digital identity, credentials, and attributes |
The Privacy Evolution
The contrast is stark. X.400, while revolutionary for its time in standardizing electronic communication, operated on a principle of sharing identifying information as a prerequisite for interaction. The EUDI Wallet, powered by SD-JWT, flips this model on its head. It empowers individuals to hold digital credentials and selectively reveal only the necessary information for a specific context.
This shift is crucial in today’s data-sensitive world. The EUDI Wallet, leveraging SD-JWT, aims to provide a secure, interoperable, and privacy-respecting way for citizens across the EU (and potentially beyond, impacting places like Jersey in the future) to interact with online services and verify their identity without unnecessary data sharing.
While the technical underpinnings are vastly different, the comparison between the information-rich address of X.400 and the selective disclosure capabilities of SD-JWT highlights a fundamental evolution in how we approach digital identity and personal data. The EUDI Wallet’s embrace of SD-JWT signifies a commitment to building a digital future where privacy is not just an afterthought but a core design principle. As we move forward, understanding this evolution is key to appreciating the potential and the importance of user-centric digital identity solutions.
