Data spaces need more than just technology to function: they need trust. Who is on the other side? Do they have the authority to act on behalf of their company? Is the data received reliable, and does it mean the same thing to both parties?

In this ‘Datos en Acción’ session, Raquel Garay, from Izenpe, begins by posing three questions that should be answered before using any data: who is on the other side, whether they are authorised to act on behalf of their company, and how much we can trust that data. She illustrates this with an example: carbon footprint data in a Digital Product Passport (DPP), to show that simply connecting systems is not enough to trust the information received.

To answer these questions, she explains how European wallets and verifiable credentials enable the verification of identity, representation and attributes. She focuses on the differences between the EUDI Wallet, for individuals, and the European Business Wallet, for organisations. An individual authenticates using their fingerprint or mobile phone; but how does a company do so? It has no fingers, and requires authorisations, automated processes and verifiable evidence. And simply connecting systems is not enough: the fact that two systems refer to a piece of data as a ‘VAT ID’ does not guarantee that they are referring to the same thing, so shared rules are needed. Furthermore, the wallet does not replace the data space: it demonstrates who is acting and under what authorisation, but it is the data space that stores and governs the information.

The session concludes with a real-life case study from the European WE BUILD project: BU3, ‘Foreign Tax Declaration’, which Izenpe is developing in collaboration with GFA and Izfe. It demonstrates how a person acting on behalf of a company can obtain a verifiable VAT ID credential using data from the Gipuzkoa Provincial Tax Authority.

Note: This activity is carried out in collaboration with CIDIHUB