Secure and Privacy-Preserving Authentication for Data Subject Rights Enforcement

The chapter delves into the challenges of securely authenticating data subjects for exercising their rights under the GDPR. It examines current practices, such as requesting ID documents or email verification, which are often insecure and non-compliant. The author proposes a new architecture leveraging eIDs and self-sovereign identity (SSI) to enhance security and privacy. The architecture is designed to be flexible, allowing data controllers to implement it with minimal effort. The proposed solution combines eIDs with attribute-based credentials to ensure minimal data disclosure while maintaining strong authentication. The chapter also discusses the role of identity providers and issuers, as well as the challenges and advantages of different authentication models. It concludes by highlighting the need for further research and implementation of this architecture in the context of the European data strategy.