Digital identity systems compared: Estonia, India, Kenya, the EU and Switzerland

National digital identity systems are among the most consequential pieces of state infrastructure built in the twenty-first century. They decide who can prove who they are online, which services and markets they can reach, and how much the state (and its contractors) can see. This study compares five systems that represent different design choices and different routes to legitimacy: Estonia's mandatory chip-based ID card, India's biometric Aadhaar number, Kenya's Huduma Namba and its successor Maisha Namba, the European Union's Digital Identity Wallet under the revised eIDAS Regulation, and Switzerland's state-issued e-ID. The comparison is organised around four questions: who is included, who is excluded, how secure the system is, and who can hold it to account. The main finding is that technical architecture matters less than governance. Systems that were built first and legitimised later (Aadhaar, Huduma Namba) were reshaped by courts; systems that went through legislatures and voters first (eIDAS 2.0, the Swiss e-ID) were designed around voluntariness and data minimisation, at the cost of slower rollout; and Estonia's near-universal use rests on a small, high-trust state and a long record of legal equivalence for digital signatures, which is hard to export.

Key findings

• Architecture follows purpose. India and Kenya built centralised population registers with biometrics to target welfare and establish identity for people who lacked documents. Estonia, the EU and Switzerland built credentials that let people authenticate and sign, with data held in separate registers or on the user's own device.
• Courts have been the main check on centralised systems. India's Supreme Court upheld Aadhaar in September 2018 but struck down private-sector authentication under Section 57, limited retention of authentication records to six months and quashed mandatory linking of bank accounts and mobile numbers. Kenyan courts twice constrained Huduma Namba, in 2020 and in 2021, the second time for failing to carry out a data-protection impact assessment.
• Voters have been the main check in Switzerland. Swiss voters rejected a privately issued e-ID in March 2021 and approved a state-issued, voluntary one in September 2025 by 50.39% to 49.61%.
• Exclusion is a design and transition problem, not only a coverage problem. In a large experiment in India's subsidised-grain system, stricter biometric authentication reduced corruption but 1.5-2 million legitimate beneficiaries lost access at some point during the reforms.
• Security failures are often in the supply chain. A 2017 flaw in a widely used chip library made RSA keys on many identity cards factorisable; Estonia's ID card, the most mature system in this comparison, was among those affected.
• Voluntariness is now the European norm. The EU Wallet and the Swiss e-ID are free and optional, and offline channels remain. Whether voluntary systems reach universal use, and whether "voluntary" survives when services go digital-first, is untested.

Research question and scope

The study asks: how do national digital identity systems with different architectures and legal foundations compare on inclusion, exclusion, security and oversight, and what does that imply for the design of digital public infrastructure?

"Digital identity" here covers two layers that are often conflated: foundational identity (a register of who exists and a unique identifier, as with Aadhaar) and credentials (means of proving identity online and signing, as with the Estonian card or a wallet app). Systems differ in which layer they emphasise. The five cases were selected for contrast, not representativeness: they span a small European state, the world's largest biometric programme, an African state with a colonial registration history, a supranational framework, and a direct democracy. The study does not assess commercial identity providers, sector-specific identity (such as health records) or digital voting, except where they bear on the national system.

Background

Identity registration is an old instrument of state power. Kenya's history makes the point: under the Native Registration Ordinance of 1915 the colonial government required adult African men to register and carry the kipande, a fingerprinted registration certificate used to control labour. Universal registration was extended to women only in 1980. Any digital identity programme in such a context inherits a memory of identity as control.

The development rationale for modern identity systems is different. Without proof of identity, people struggle to open bank accounts, receive transfers, register property or claim benefits, and weak civil registration leaves states unable to count their population. An advisory paper by Amnesty International Kenya and Strathmore University's CIPIT, citing the Kenya Vital Statistics Report, records that 14% of births and 45% of deaths were unregistered in Kenya in 2021. Digital identity promises to close such gaps, cut fraud and make services cheaper.

These two histories meet in every design decision: what data are collected, whether enrolment is compulsory, whether one number links every database, who may query the system, and what happens to people the system cannot recognise.

Method and sources

The study is a structured comparison based on primary legal texts and court decisions (the Indian Supreme Court's 2017 privacy and 2018 Aadhaar judgments; Kenyan High Court rulings; Regulation (EU) 2024/1183; Swiss federal vote results), official system descriptions (UIDAI, e-Estonia, the European Commission's Wallet programme, the Swiss federal e-ID site), one large randomised evaluation (Muralidharan, Niehaus and Sukhtankar), one security study (Nemec and colleagues), and one civil-society policy analysis (Amnesty International Kenya and CIPIT). Where only secondary accounts were available, as for parts of the Kenyan litigation, the text says so. Usage figures are those published by the operators themselves and are not independently audited.

Findings

Five systems at a glance

Estonia: high take-up in a high-trust, small state

Estonia's card, issued since 2002, carries certificates for authentication and for digital signatures that are legally equivalent to handwritten ones. The card is mandatory; e-Estonia reports that 99% of residents hold one. It is complemented by mobile credentials (Mobile-ID and Smart-ID, offered through SK ID Solutions) and sits on top of X-Road, a data-exchange layer that lets separate state registers query one another rather than merging them into a single database. Estonia's e-Residency programme and internet voting, both documented elsewhere in this atlas, rely on the same credentials.

The system's strengths are near-universal coverage and a decentralised data architecture: registers stay with the agencies that own them, and citizens can see when their data are accessed. Its weaknesses are the conditions of its success. Estonia is small, had to build state infrastructure from scratch after 1991, and has unusually high trust in digital public services. None of these conditions transfer automatically.

Security. In 2017 researchers at Masaryk University reported an "algorithmic flaw in the construction of primes for RSA key generation" in a widely used library from a major chip manufacturer, allowing practical factorisation of keys used in identity cards, passports and other devices; they estimated the affected devices "in the order of at least tens of millions". Estonia's ID cards were among them: the Information System Authority (RIA) put the number of affected cards at about 800,000. From 3 November 2017 the Police and Border Guard Board suspended some 760,000 certificates; holders could renew them remotely through a software update, and by early December about 327,000 had done so, while the number of Mobile-ID users rose by 26,000 to 160,000. The episode shows that a mandatory, single-credential system concentrates supply-chain risk, and also that a remote fix can limit the disruption without replacing the cards.

India: Aadhaar, scale, and the Supreme Court

Aadhaar assigns a 12-digit number linked to demographic data and biometrics (fingerprints, iris scans and a photograph) held by the Unique Identification Authority of India. UIDAI's dashboard reported more than 145 crore (1.45 billion) enrolments and more than 2,600 crore e-KYC transactions in October 2026. Aadhaar-based authentication underpins benefit transfers, subsidised food distribution and, through e-KYC, a large part of financial and telecom onboarding.

The programme began administratively in 2009 and received a statute only in 2016. Its constitutional status was settled in two stages:

• Privacy (24 August 2017). A nine-judge bench in Justice K.S. Puttaswamy (Retd.) v. Union of India held that the right to privacy is protected under the Constitution, describing it as "an intrinsic part of the right to life and liberty", subject to the requirements of legality, legitimate aim and proportionality.
• Aadhaar (26 September 2018). A five-judge bench upheld the Aadhaar Act by majority, with Justice Chandrachud dissenting. The majority judgment, written by Justice Sikri for the Chief Justice, himself and Justice Khanwilkar, held unconstitutional "that portion of Section 57 of the Aadhaar Act which enables body corporate and individual to seek authentication"; held that authentication records may not be kept beyond six months; struck down Section 33(2), which allowed disclosure on national-security grounds; held the mandatory linking of bank accounts under the 2017 money-laundering rule amendments unconstitutional; and quashed the Department of Telecommunications' circular of 23 March 2017 on linking mobile numbers, as "not backed by any law". It upheld the mandatory use of Aadhaar for subsidies and benefits financed from the Consolidated Fund under Section 7, and the requirement to link Aadhaar with the tax identifier (PAN). It also urged the government to enact a "robust data protection regime".

The dissent held that passing the Act as a Money Bill, bypassing the upper house, "constitutes a fraud on the Constitution". The majority disagreed. Parliament later amended the law in 2019 to permit voluntary authentication by some private entities, and India enacted the Digital Personal Data Protection Act in 2023.

Exclusion. The strongest evidence on Aadhaar's distributional effects comes from Muralidharan, Niehaus and Sukhtankar, who used large-scale randomised and natural experiments to study the introduction of stricter biometric verification in India's largest social-protection programme, the subsidised-grain Public Distribution System, in the state of Jharkhand. They found that "corruption fell but with substantial costs to legitimate beneficiaries, 1.5-2 million of whom lost access to benefits at some point during the reforms", and that the harms were driven primarily by how the transition was managed. Field reports and the wider public debate point to fingerprint-recognition failures, connectivity problems at ration shops and the removal of eligible households from lists as mechanisms; the study itself attributes the harm mainly to how the transition was managed. The study's lesson is general: the same technology can reduce or increase exclusion depending on fallback procedures, the speed of rollout and who bears the cost of authentication failure.

Kenya: Huduma Namba, the courts and Maisha Namba

Kenya launched the National Integrated Identity Management System (NIIMS), popularly "Huduma Namba", in 2019, aiming to create a single population register linked to a unique number. According to the Amnesty International Kenya and CIPIT paper, the programme aimed to register 40 million Kenyans and eventually registered about 36 million. Enrolment was promoted as necessary for access to services, which made it compulsory in practice for many people.

The programme was challenged in court almost immediately. Petitioners included the Nubian Rights Forum, which represents a community that has historically faced discriminatory vetting before receiving identity cards, a reminder that identity systems can exclude groups as well as individuals. The litigation produced two rulings:

• In January 2020, in Nubian Rights Forum and others v. Attorney General and others, the High Court allowed NIIMS to continue only if an adequate legal framework for data protection was in place and held the proposed collection of DNA and GPS location data to be unjustified.
• In October 2021, in judicial-review proceedings brought by the Katiba Institute, the High Court quashed the decision to roll out Huduma Namba cards because no data-protection impact assessment had been carried out as required by section 31 of the Data Protection Act 2019.

Both judgments are published by Kenya Law, whose site blocked automated access when the atlas checked them; the summaries follow Kenya Law's case listing and, for 2020, the Columbia Global Freedom of Expression digest, which cites the judgment's paragraphs (NIIMS may be implemented only "on condition that an appropriate and comprehensive regulatory framework" is in place, para. 1047).

After the 2022 change of government, Kenya moved to a new system known as Maisha Namba, built around a Unique Personal Identifier assigned at birth ("maisha" means "life"), a digital ID and a new card. A launch planned for 2 October 2023 was postponed, and a pilot rollout for first-time applicants and people replacing lost or defaced cards began on 1 November 2023. The Amnesty and CIPIT paper, published in January 2024, called for a data-protection impact assessment before rollout, for specific data-protection rules, for post-implementation assessment and for measures to prevent the exclusion of minorities, migrants and people with low literacy. It also noted gaps in Kenyan state practice: lack of data-sharing codes between agencies, of impact assessments, and of mechanisms for people to exercise their data rights. The Kenyan sequence illustrates a pattern: when a system is launched before its legal framework, courts become the venue in which its design is finalised.

The European Union: a wallet, not a register

The original eIDAS Regulation (EU) 910/2014 required member states to recognise each other's notified national electronic identification schemes, but take-up was uneven and many citizens had no usable cross-border credential. Regulation (EU) 2024/1183, which entered into force on 20 May 2024, changed the model. Each member state must offer at least one European Digital Identity Wallet, built to common specifications, by the end of 2026. The wallet lets users hold personal identification data and electronic attestations of attributes (a diploma, a driving licence, proof of age) on their own device and disclose only what a service needs, for example proving that they are over 18 without revealing their date of birth. Use is voluntary and free for natural persons, and the Commission's programme emphasises a privacy dashboard showing users which parties have received their data.

The implementation has been unusually procedural. Rather than procuring one system, the Commission published an Architecture and Reference Framework (version 2.0 in May 2025) and adopted successive batches of implementing regulations during 2025 on certification, registration of relying parties, trust services and attestations. Large-scale pilots run by consortia of governments and companies tested use cases such as payments, travel and education.

The main controversies concern what the wallet might enable rather than what it does: whether a persistent unique identifier lets services link a person's activity, how strictly relying parties are limited in what they may request, and, during the legislative process, a provision on qualified website authentication certificates that security researchers and browser makers argued could weaken web security. The wallet's voluntariness is also untested: if services move to wallet-first access, opting out may become costly in practice even where it is protected in law.

Switzerland: two referendums

Switzerland's route was decided by voters. On 7 March 2021 they rejected a federal e-ID law by 64.4% to 35.6% (1,778,196 votes to 984,574); opponents objected above all that private companies would issue and operate the identity. Parliament then passed a new e-ID Act in which the Confederation issues the e-ID and runs the infrastructure. A referendum was again called, and on 28 September 2025 the law was accepted by 1,384,586 votes to 1,363,362 (50.39%), with turnout of 49.58%.

The federal e-ID programme describes the system as an optional complement to the physical identity card, free of charge, built on decentralised and open-source infrastructure, with the credential held in the swiyu wallet app. Public services remain available offline. In October 2026 the system was still being introduced, with a testing sandbox in place and a national communication campaign being tendered for implementation from 2027.

The Swiss case shows that direct democracy can force a redesign: the defeated 2021 model and the approved 2025 model differ above all in who issues the identity. It also shows the limits of that legitimacy: a margin of about 21,000 votes means almost half of voters did not want even the state-run version.

Comparative analysis

Inclusion

Coverage is highest where enrolment is mandatory (Estonia) or tied to benefits (India). Neither route is cost-free: mandatory systems remove choice, and benefit-linked systems turn identity failures into lost food or income. Voluntary systems (the EU, Switzerland) protect choice but depend on usefulness for uptake, and may reach the digitally confident first and the people who most need public services last.

Exclusion

Exclusion takes at least three forms: people who cannot enrol (lack of documents, discriminatory vetting, as Kenyan Nubians experienced); people who enrol but cannot authenticate (worn fingerprints, poor connectivity, as in Jharkhand); and people excluded by design choices (no offline channel, no assisted access). The evidence from India shows that the second form can affect millions even when the first is small, and that fallback procedures, such as manual overrides, alternative documents and grace periods, are the decisive safeguard.

Security

Centralised biometric registers create a single high-value target and an irreversible risk: a leaked fingerprint cannot be reissued. Credential-based systems spread risk but concentrate it in chips, apps and suppliers, as the 2017 key-generation flaw showed. Wallet systems shift part of the security burden to users' phones and to certification regimes that are still being built.

Oversight

What the evidence does not show

• That one architecture is best everywhere. The five systems serve different purposes in different states. A credential wallet does not solve the problem of people without foundational identity, and a biometric register is unnecessary where civil registration is already reliable.
• Net welfare effects of Aadhaar. The Jharkhand study measures one programme and one transition. It does not estimate Aadhaar's overall effect on corruption, inclusion or welfare across India.
• Uptake of voluntary systems. The EU Wallet and the Swiss e-ID are too new for evidence on who uses them, who does not, and whether opting out becomes costly.
• Independent security audits. Public information on penetration testing, breach history and supplier risk is limited for all five systems; operators' statements are not audits.
• Kenyan outcomes. The effect of Maisha Namba on registration gaps and exclusion has not yet been evaluated.

Implications for institution design

1. Legislate before you enrol. Every system here that was built before its legal framework was later rewritten by courts. A statute with purpose limits, data-protection rules and an impact assessment should precede mass enrolment.
2. Separate identity from data. Architectures that keep registers apart and let people disclose only the attributes a service needs (Estonia's X-Road, the EU's selective disclosure) limit the damage of breaches and the temptation of surveillance.
3. Make fallback a right. Where identity gates benefits, failure to authenticate must not mean failure to eat. Manual alternatives, assisted access and grace periods should be legal entitlements, monitored with published error rates.
4. Keep offline channels. Voluntariness is meaningful only if non-digital routes remain usable; Switzerland wrote this into its system.
5. Plan for supply-chain failure. Revocation, re-keying and communication plans should be tested before they are needed.
6. Give oversight bodies standing. Data-protection authorities, ombudsmen and courts need access to system documentation and the power to order changes, not only to award remedies afterwards.

Open questions

• Will voluntary wallets reach the people who need public services most, or will they widen the gap between digitally confident and excluded groups?
• Can selective disclosure resist pressure from relying parties, including states, to request more data than they need?
• How should states handle the irreversible risk of biometric data that have already been collected?
• Does a narrow referendum mandate, as in Switzerland, give a system enough legitimacy to survive its first serious failure?
• What does mutual recognition between wallet systems (the EU and Switzerland, the EU and third countries) mean for national control over identity?

Sources

1. e-Estonia. ID-card (official description of the Estonian ID card).
2. e-Estonia. X-Road (data-exchange layer).
3. Nemec, M., Sýs, M., Švenda, P., Klinec, D. and Matyáš, V. (2017). The Return of Coppersmith's Attack: Practical Factorization of Widely Used RSA Moduli. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 1631-1648.
4. Supreme Court of India (2017). Justice K.S. Puttaswamy (Retd.) and Anr. v. Union of India and Ors., judgment of 24 August 2017 (right to privacy).
5. Supreme Court of India (2018). Justice K.S. Puttaswamy (Retd.) and Anr. v. Union of India and Ors., Writ Petition (Civil) No. 494 of 2012, judgment of 26 September 2018 (Aadhaar).
6. Unique Identification Authority of India. UIDAI homepage and Aadhaar dashboard (figures as consulted in October 2026).
7. Muralidharan, K., Niehaus, P. and Sukhtankar, S. (2025). Identity Verification Standards in Welfare Programs: Experimental Evidence from India. The Review of Economics and Statistics 107(2), 372-392.
8. Amnesty International Kenya and CIPIT, Strathmore University (2024). Advisory Policy Paper on Implementing a Rights-Respecting Digital ID in Kenya, 31 January 2024.
9. High Court of Kenya (2020). Nubian Rights Forum and 2 others v. Attorney General and 6 others; Child Welfare Society and 8 others (Interested Parties), Petitions 56, 58 and 59 of 2019 (Consolidated), [2020] KEHC 8772 (KLR), judgment of 30 January 2020.
10. High Court of Kenya (2021). Republic v. Mucheru, Cabinet Secretary, Ministry of Information, Communication and Technology and 2 others; Katiba Institute and another (Ex parte), Judicial Review Application E1138 of 2020, [2021] KEHC 122 (KLR), judgment of 14 October 2021.
11. Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework. Official Journal of the European Union, 30 April 2024.
12. European Commission. EU Digital Identity Wallet (programme home page, updated January 2026).
13. Swiss Federal Chancellery. Popular vote of 7 March 2021 (Federal Act on Electronic Identification Services).
14. Swiss Federal Statistical Office / Federal Chancellery (2025). Popular vote of 28 September 2025: e-ID Act, final result.
15. Swiss Confederation. The e-ID (federal e-ID and swiyu programme site).
16. Information System Authority (2017). Estonia resolves its ID-card crisis, 8 December 2017.
17. Global Freedom of Expression, Columbia University. Nubian Rights Forum v. Attorney General (case analysis).
18. Citizen Digital (2023). Gov't postpones Maisha Namba launch due to 'unavoidable circumstances', 29 September 2023; Kenyans.co.ke (2023). Govt Begins Maisha Namba Rollout to 3 Categories of Kenyans, 1 November 2023.