Specification of Common Interface for Data Deletion Requests to Relying Parties

Vérifié le 2026-10-29

Disponible uniquement en anglais. Le texte est affiché dans sa langue d'origine.


Specification of Common Interface for Data Deletion Requests to Relying Parties

Abstract

The present document specifies the common protocols and interfaces according to Article 5a (5) (a) (ix) of (EU) No 910/2014 used by a Wallet Unit for invoking a suitable external application, such as a browser, an email client or a phone application, for requesting the erasure of personal data pursuant to Article 17 of Regulation (EU) 2016/679 at a Wallet-Relying Party for personal data, which was previously provided by a Wallet Unit.

Licensing and Reuse

© European Union, 2025-2026.

This document is made available under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), unless otherwise stated.

You may reuse this document provided that appropriate credit is given and any changes are indicated.

The full licence text is available at https://creativecommons.org/licenses/by/4.0/ .

Versioning

VersionDateDescription
0.12025-05-27Initial version for first discussions.
0.22025-06-12Update after first discussions.
0.92025-06-22Update after second focus meeting.
0.102025-07-16Minor editorial update.
0.112026-01-30Editorial update (licensing and reuse clarification).
1.02026-07-12Final Version.

Notational Conventions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in "Key words for use in RFCs to Indicate Requirement Levels" RFC2119. The interpretation should only be applied when the terms appear in all capital letters.

1. Introduction

The present document specifies the common protocols and interfaces according to Article 5a (5) (a) (ix) of (EU) No 910/2014 used by a Wallet Unit for invoking a suitable external application, such as a browser, an email client or a phone application, for requesting the erasure of personal data according to Article 17 (EU) 2016/679 at a Wallet-Relying Party (WRP) for personal data, which was previously provided using a Wallet Unit.

The general approach with respect to the protocols and interfaces specified in the present document are based on the result of the related discussions documented in the corresponding L+M-Discussion-Paper.

2. Requirements

2.2 High-Level Requirements

The set of high-level requirements after the discussions documented in the L+M-Discussion-Paper and the two focus meeting on the present topic, which slightly changed DATA_DLT_02 and DATA_DLT_07 and added DATA_DLT_08 and DATA_DLT_09 are as follows:

IndexRequirement specification
DATA_DLT_01A Wallet Provider SHALL ensure that its Wallet Units support the technical specifications mentioned in DATA_DLT_02, allowing a User to request from a Relying Party the erasure of their attributes that were presented by that Wallet Unit to that Relying Party, in accordance with Article 17 of Regulation (EU) 2016/679.
DATA_DLT_02A Wallet Unit SHALL support at least one of the following possibilities to request data deletion from a Wallet-Relying Party: a) Open a URL in an external browser, which is assumed to be available on the platform, to ask for the deletion of data in a web form provided by the Wallet-Relying Party. b) Open an external mail client, if available on the platform, and start a draft email to the Wallet-Relying Party (see also DATA_DLT_08 below). c) Open a phone application, if available on the platform, in order to call the Wallet-Relying Party.
DATA_DLT_03A Wallet Instance SHALL provide a function where the User may select one Relying Party for which an attribute deletion request must be submitted.
DATA_DLT_05A Wallet Unit SHALL include attribute deletion requests in a log so they can be presented to the User via the dashboard (as specified in TS10 and Topic 19 respectively).
DATA_DLT_06The log SHALL also document the initiation of a data deletion request and include as a minimum: - Date and time of attribute deletion request, - Relying Party to which the request was made, - Attributes requested to be removed.
DATA_DLT_07Before executing a data deletion request, a Wallet-Relying Party SHALL authenticate the requesting User, or the request itself, using appropriate authentication mechanisms of its own choice. The Wallet-Relying Party SHOULD use the authentication and signature facilities offered by the User's Wallet Unit for this purpose.
DATA_DLT_08The text in the subject of the mail prepared by the Wallet Unit according to DATA_DLT_02 (b) SHALL clearly indicate that the purpose of the mail is to asks for the deletion of the personal data according to Article 17 of (EU) 2016/679, which has been previously provided by the user via its Wallet Unit.
DATA_DLT_09The text in the body of the mail prepared by the Wallet Unit according to DATA_DLT_02 (b) SHOULD contain the necessary information for the WRP to handle the request in an appropriate manner. This in particular includes the information which personal attributes are requested to be deleted, or that all previously exchanged personal data are requested to be deleted.

3. Specification of Protocols and Interfaces

3.1 System Architecture

As agreed upon within the discussions documented in the L+M-Discussion-Paper the general approach is to utilise the already existing interfaces and processes of the Wallet-Relying Parties as much as possible and abstain from the creation of additional technical interfaces.

The resulting system architecture is depicted in the following figure:

Overview

3.2 Interfaces

As shown in the figure above, there are the following interfaces:

  • (I1) - is a user-friendly user interface, which allows to access the functionality of the Wallet Unit, browse through the Transaction Log, search for transactions within a given period in time or with a given Wallet-Relying Party and in particular allows to request the deletion of the previously provided personal data according to Article 17 (EU) 2016/679 at a specific Wallet-Relying Party.

  • (I2) - is a platform-specific interface, which allows to invoke a browser on the platform to open a specific URL of the WRP, which may have been provided in the supportURI element within the registration information in TS5 and consequently may be available in the wallet-relying party access certificate, as required by ANNEX IV Nr. 3 (k) of (EU) 2025/848. The web application available at this URL is assumed to provide further information how to request the deletion of the personal data, which has previously been provided by a Wallet Unit.

  • (I3) - represents a logical interface provided by the web application hosted by the Wallet-Relying party at the given URL contained in the supportURI of the Wallet-Relying party according to TS5. Note, that it is assumed that there is always a browser on the platform, but a mail client is considered to be optional. Therefore, it is RECOMMENDED in TS5 that WRPs register a supportURI, which points to the website for helpdesk and support according to ANNEX I Nr. 7 (a) (EU) 2025/848.

  • (I4) - is a platform-specific interface, which allows to invoke a mail client on the platform, if available. The invocation can be realised using a mailto: link with the email address of the WRP, a suitable text for the subject of the mail and a proposal of a text for the body of the mail in which the data subject asks for the deletion of the personal data, which has previously been provided by a Wallet Unit.

  • (I5) - represents a logical interface given by the mail system of the WRP, which is assumed to exist, if the registration information with respect to the supportURI of the WRP according to TS5 contains an email address for support. Note, that the Wallet Unit can recognise the type of the endpoint, which is either an email address, the URL of a website or a phone number, by inspecting the content of the supportURI element.

  • (I6) - is a platform-specific interface, which allows to invoke the phone application of the platform.

  • (I7) - is the phone system of the WRP, which SHALL exist, if there is only a phone number registered within the supportURI element of TS5, as admissibly by ANNEX I Nr. 7 (b) (EU) 2025/848.

  • (I8) - is the interface of a Wallet Unit based on ETSI TS 119 472-2 (v1.2.1) as profiled in Annex II of (EU) 2024/2982, which allows to ask for the identification of the data subject, or the creation of a qualified electronic signature as described in ETSI TS 119 432 (v1.3.1) for example. Whether this interface of the Wallet Unit is invoked or not is determined by the Wallet-Relying Party.

3.3 Process

The process for requesting the deletion of personal data according to Article 17 (EU) 2016/679 and Article 5a (5) (a) (ix) of (EU) No 910/2014 contains the following simple steps:

  • (1) - The Wallet Unit determines the possible ways for contacting the WRP to request the deletion of data by inspecting the registered supportURI information, which is part of the WRPAC, as specified in ANNEX I Nr. 7 and ANNEX IV Nr. 3 (k) of (EU) 2025/848. According to ETSI TS 119 475 (v1.2.1) (Table 1 and Table 3) the registered supportURI is encoded as uniformResourceIdentifier within the Subject Alternative Name of the WRPAC as specified in clause 4.2.1.6 of RFC 5280.

  • (2) - The Wallet Unit shall display the available supportURI options to the User for selection, or use a previously configured preference of the User for this choice.

  • (3) - The Wallet Unit invokes the external application determined by the User in step (2) above, i.e. a browser, a mail client or the phone application on the platform of the user, and adds the initiated deletion request to the transaction log as specified in DATA_DLT_05 and DATA_DLT_06, such that it may later on be displayed to the User, as required by Article 6 Nr. of (EU) 2024/2982.

  • (4) - The data deletion request, which was initiated in step (2), will finally be handled by the WRP. Note, that this step is out of the scope of the present specification.