Across EU institutions, a sweeping digitalisation initiative is underway, yet beneath promises of efficiency and citizen empowerment sits a more concerning reality. Rather than a straightforward modernisation of government services, this represents a deliberate political strategy—developed over years—to subordinate individual protections in favour of normalising surveillance, control, and the marginalisation of vulnerable populations. This examination considers the multiple dimensions of the EU's digital welfare state agenda and its implications for state-citizen relations.
Situating the EU within the Global Digital Welfare State
The EU's current direction must be understood as part of a worldwide shift toward what experts call the 'Digital Welfare State.' In 2019, Philip Alston, then UN Special Rapporteur on extreme poverty and human rights, cautioned that nations are increasingly deploying digital systems to mechanise, forecast, and refine how social protections reach beneficiaries.
From India's Aadhaar-based welfare infrastructure to the UK's Universal Credit and the Toeslagenaffäre, welfare digitalisation frequently operates as a gateway for spending cuts. By inserting a digital layer between those seeking help and those providing it, governments distance themselves from accountability, converting what should be a protective mechanism into what amounts to mass data harvesting and surveillance. This occurs through administrative systems that reframe identity verification and confidence-building as mechanisms imposed from above, designed to treat recipients as inherently suspect. The EU is not exempt from these patterns; it actively seeks to establish itself as a global leader in this domain.
Competence Creep and Soft Law Architecture
A striking feature of the EU's digitalisation agenda is its fragile legal underpinning. Treaty provisions assign core public functions—medical care, social insurance, schooling—to individual Member States. Brussels lacks explicit authority to determine how a person in rural Romania obtains medical attention or how someone in Lisbon accesses jobless support.
To overcome this constraint, the European Commission has deftly deployed soft law and what amounts to incremental power expansion. By reframing digitalisation as an 'Internal Market' matter under Article 114 of the Treaty on the Functioning of the European Union or as a 'Cross-Border Interoperability' challenge, the Commission has launched a sequence of EU-wide projects and rules spanning judicial administration and public management. These initiatives target streamlined data movement and communication between national administrative systems through standardised digital frameworks. This manoeuvre has allowed Brussels to penetrate the core of how Member States structure their welfare policies.
Programmes such as the 'Once-Only Principle' or the 'Single Digital Gateway' are marketed as practical tools for mobile EU residents. In practice, they function as binding requirements that compel national agencies to restructure their systems according to Brussels-set specifications. Through financing channels like the Recovery and Resilience Facility, the EU has essentially made 'digital transformation' a prerequisite for receiving funds, circumventing the public deliberation typically required for major changes to welfare systems. This mirrors patterns seen across the developing world over the past decade, where international institutions have financed development initiatives conditional on nations adopting digitalised systems, particularly those incorporating biometric identification in government programmes.
The Normalisation of "Emergency-Mode" Governance
This expansion accelerated during the COVID-19 crisis. The swift rollout of the EU Digital COVID Certificate was lauded as a European coordination triumph. From a rights standpoint, however, it established a troubling precedent. It created a continent-spanning apparatus for surveillance tied to health status and movement, constructed under exceptional circumstances with minimal democratic scrutiny.
Following the pandemic, this crisis-driven mode of decision-making has solidified into standard practice. The COVID certificate infrastructure persisted and transformed. It furnished both the technical framework and political momentum for the EU Digital Identity Wallet. What began as a temporary measure to document vaccination has become a permanent mechanism that the EU intends to integrate with driving credentials, medical prescriptions, and financial accounts. The emergency provided the opening to deploy identity systems that would have faced prolonged legislative resistance during normal times.
Sectoral Initiatives: Building Structures of Oversight
The EU's digitalisation strategy operates not as a unified programme but as interconnected sectoral undertakings.
- The European Health Data Space (EHDS): Designed to establish a broad, transnational system for medical record distribution. Though marketed as enhancing care for travelling patients, 'secondary use' clauses permit sharing anonymised health information with commercial entities and academic institutions. This could transform intimate personal information into raw material for the Data Economy, increasingly viewed as vital to European industrial strength, frequently with unclear withdrawal options that favour commercial innovation over individual bodily and informational autonomy.
- ESSPASS (European Social Security Pass): By automating social security verification for workers crossing borders, the EU advances toward a portable digital welfare identity. For expatriate professionals, this appears convenient, yet it establishes a centralised registry of entitlements subject to inspection by employment authorities and immigration officials, converting welfare into an instrument for managing migration.
- eIDAS 2.0 and the Wallet: The EUDI Wallet anchors this digital framework. It consolidates all digital credentials into a single application. By mandating that commercial intermediaries (including Google and Apple) and public agencies recognise this wallet, the EU enforces a digital-first approach to accessing services.
The Surveillance Trap: From Privacy to Profiling
These programmes carry severe privacy implications. Society is transitioning from 'local and analogue' engagement—where your physician understands your medical situation and your municipal authority grasps your housing circumstances—to 'centralised and digital' exposure.
When core services operate on a digital-first basis, each transaction produces a data record. Combining these records constructs a comprehensive portrait of someone's existence. The dangers transcend data theft; they encompass detailed behavioural analysis. A digital credential used at a chemist can be matched with a transit pass, enabling authorities to reconstruct someone's travels and social connections with extraordinary detail.
Additionally, these mechanisms frequently invoke 'privacy-by-design' as rhetorical cover. We hear assurances that cryptographic methods permitting authentication without revealing personal details will safeguard us. Yet privacy extends beyond data secrecy; it concerns how infrastructure concentrates authority. Even with encrypted data, mandating use of a government-approved digital instrument to exercise a basic entitlement constitutes surveillance in itself. It establishes a 'control point' where authorities can instantaneously deny access to vital services.
Exclusion by Design: The Digital Divide as Policy
The most damaging consequence of the EU's digitalisation drive is its built-in capacity to exclude. The 'Digital Decade' roadmap targets complete online availability of government services by 2030. Yet what becomes of millions facing technological obstacles?
Digitalisation regularly functions as a barrier for society's most vulnerable: older adults, unhoused persons, foreign nationals, and those in poverty. When a physical office shuts and is supplanted by a website or a QR code, the service is not necessarily enhanced but effectively removed for entire populations. A 'digital underclass' is emerging—individuals dependent on helpers (relatives, nonprofits) to exercise their entitlements, sacrificing dignity and confidentiality in the process.
The 'once-only' and 'interoperability' framework presupposes that all government records are dependable and uniform. For someone in a marginalised position, a single 'once-only' mistake—an immigration file error or a wrongly triggered fraud flag—spreads instantaneously through the entire European administrative apparatus, with no transparent mechanism for correction.
Conclusion: Defending the Right to Analogue Access
The EU's agenda to digitalise core services is frequently presented as inevitable technological progress. It is not; it constitutes a deliberate decision—one favouring commercial expansion and administrative power over constitutional protections and broad participation.
As 2030 approaches, the 'digital-only' orthodoxy must be contested. There must be recognition of a 'right to analogue'—a binding legal safeguard guaranteeing that every essential government service remains obtainable through non-digital, human-centred pathways without disadvantage. For this guarantee to hold substance, analogue channels must perform comparably to digital ones and represent a genuine alternative for all, particularly groups at risk of systematic exclusion through digitalisation. Interoperability cannot become a euphemism for universal tracking.
The European social contract rests on principles of mutual support and fundamental freedoms. Should this contract be rewritten in algorithms, without public transparency or legitimate authority, Europe risks becoming a place where government functions not as a service provider but as a custodian of digital credentials, and where individuals are no longer rights-holders but subscribers whose access can be terminated.
EDRi's Response
EDRi is constructing a European network encompassing civil society groups, grassroots initiatives, and individuals with direct experience, working to document, oppose, and advance alternatives to the harms stemming from the extensive digitalisation of public and essential services. This network aims to jointly design advocacy and campaign strategies benefiting impacted communities and to displace current digitalisation narratives with a competing vision grounded in rights protection and human-centred design.
