Safer, higher-level login is becoming increasingly important as more online government services handle sensitive personal data. The Digital Government Act (Wet digitale overheid, Wdo) requires service providers to adjust their services: the greater the risk of the service, the higher the required level of trustworthiness. The citizen’s identity must be accurate. In an ever-more digital world, it is essential that all citizens, regardless of their skills, age, or physical and cognitive abilities, have access to government services.
Assurance levels
The Digital Government Act (Wdo) is based on the assurance levels defined in the European eIDAS regulation. Under European rules, DigiD Basic and Medium are considered low-level:
- DigiD Basic: username and password (eIDAS Low)
- DigiD Medium: 2-factor authentication via SMS or app (eIDAS Low)
- DigiD Substantial: one-time ID check in the app (eIDAS Substantial)
- DigiD High: ID check at every login via the app (eIDAS High)
Assurance levels in the Access Framework
The Wdo provides the legal framework for the new Access Framework (Stelsel Toegang). This framework enables public service providers to leverage substantial login volumes across both public and private login methods and to support voluntary representatives and legal guardians. The current public login method, DigiD, will, like future private login methods, have to meet the requirements set out in the Wdo’s Identification Means Regulation when joining the Access Framework.
Safer login for everyone
It is important that all citizens have access to government services. Currently, over 9.5 million citizens have activated a higher level of assurance. However, for various reasons, more than 7 million people have not yet done so:
- Around 750,000 people lack a Dutch identity document and cannot upgrade their DigiD to Substantial or High.
- Approximately 1.1 million people do not have a suitable smartphone for the ID check and therefore cannot upgrade their DigiD.
- More checks with ID verification increase security but require more user actions.
- There is currently no PIN reset option: the DigiD High PIN cannot yet be reliably recovered if, for example, the user forgets it.
- A group of users can activate DigiD at a higher trust level, but has not yet done so.
What does the Ministry of the Interior and Kingdom Relations do?
- Exploring the setup of a helpdesk solution for people without a (suitable) Dutch ID card.
- Investigating alternative options to make DigiD High more accessible.
- Developing a desktop option for those who do not have a smartphone.
- Raising awareness about the importance of secure login.
- Phasing out DigiD Basic completely, as logging in with only a username and password is no longer secure enough.
- Delivering services that meet people’s needs and everyday realities, for example, through government-wide service desks, by informing people early about their rights and available services, and by providing information related to life events.
- Offering support to citizens via the Digital Government Information Points, known in Dutch as Informatiepunten Digitale Overheid (Dutch).
What does the Dutch Government do?
- Improving the digital accessibility of websites and apps of government organisations.
- Enhancing the digital skills and knowledge of citizens, employers, and employees.
- The Electronic Administrative Communications Modernisation Act, or Wmebv (in Dutch, Wet modernisering elektronisch bestuurlijk verkeer), states that the government must still provide the option to access services in person, for example by letter, telephone, or at a service desk. This offers an additional option for people who are not digitally proficient.
Voluntary authorisation and legal representation
Anyone with a DigiD can handle government matters digitally. If you cannot, do not wish to, or are not permitted to do so yourself, you can authorise someone else to act on your behalf, either digitally or in another way. However, service providers must first offer services that support representation.
- With DigiD Machtigen, capable citizens can set up an authorisation with connected service providers, allowing someone to manage their government affairs digitally on their behalf.
- For legal representation of incapable citizens, sources will be made available that confirm who is legally authorised to act on another’s behalf. Once these functionalities are live, service providers can integrate them and offer services tailored for representatives.
