# Digital Identity in the EU: Promoting eIDAS Solutions Based on Biometrics
## 2 From Personal Identity to Digital Identity
An enrollment phase which must precede the identification process in order to release personal credentials. During this phase, a person appears before a civil registry office that verifies the personal identity and acquires the additional personal information necessary to fully define the digital identity. Commonly, all of this information (personal data) is stored within an electronic medium (e.g., a microchip ID card) and/or in a protected database. The tangible and/or intangible element containing the personal information used for online service authentication is also known as \"electronic identification mean\". Because some personal information may change over time, the literature often views enrollment as an ongoing process, with regular updates that must be applied five to ten years apart. 2. Once the digital identity of a person has been defined through the enrollment phase, such a person can undergo electronic identification (eID) and gain access to IT resources and services. Note that a recent trend in Europe, led by the evolution of smartphones and more convenient for users, is the adoption of mobile-based solutions for performing electronic verification. More precisely, the system involves the following main entities and components:  
* The user who wants to access an online service through his mobile device;
* The browser or other application used by the user to access online services;
* The IdP that manages the authentication procedure;
* The SP which, after requesting user authentication from the IdP, manages the authorization and delivers the requested service;
* The ID App, a mobile application provided by the IdP, needed to challenge the credentials of the user;
* The ID card, which is one of the possible authentication means (containing personal data) involved in the scheme;
* To enhance security, the ID App often employs \"secure\" multi-factor authentication, combining elements such as something the user knows (e.g., a password or PIN) and something the user owns (e.g., a token generator or a card); a further evolution of these systems is the use of embedded biometric authenticators that mostly include biometric sensors for fingerprint or face recognition. This solution is often used in place of the PIN code since it is considerably more user-friendly but brings a lot of security concerns, as better described in Section 3.3. In summary, the definition of digital identity schemes poses a complex challenge to the legal discipline and requires adequate integration of information technology, as it involves the management and protection of sensitive personal data. Existing schemes already provide a fair level of security, but they intentionally avoid biometric recognition precisely because of the sensitivity of biometric data. Moreover, there is a problem of interoperability and data management of a supranational nature that necessarily needs to be addressed to pave the way for a broader field of application. The following section illustrates how this could be done, at least in the European sphere, without excessive disruption.