1. The Sovereignty Paradox at the Heart of eIDAS 2.0

eIDAS 2.0 creates a contradiction:

• EU Law: Common rules, technical specs, and open-source reference implementation, while member states are responsible for providing wallets. Regulation (EU) 2024/1183 makes it mandatory to issue at least one EUDI Wallet by Dec 2026.
• National Law: From the perspective of EU States, the EUDIW raises questions of sovereignty, because states are currently the only entities capable of reliably establishing a person's identity.

This creates 4 simultaneous control disputes:

Dispute 1: State Sovereignty vs EU Federalisation

Spain's Position: Spain considers DNI as exclusive sovereign competence under Art 149.1.2 Spanish Constitution - State has exclusive competence over nationality, immigration and identity documents.

Conflict: eIDAS 2.0 forces mutual recognition. The acceptance obligation - banks and telecoms and platforms must accept EUDI Wallet credentials from all member states from 2027 - is the mechanism through which a weaker national implementation becomes a systemic vulnerability.

Example: If Bulgaria or Cyprus issues a Wallet with low verification, Spanish banks must accept it. The weakest wallet in the EU is the entry point for every service provider in the EU.

Spanish Legal Response: Spain's recent Royal Decree on Data Centre Grid Access - Digital Sovereignty Test: Spain has found an enforcement mechanism for digital sovereignty: the electricity connection. Under draft royal decree, a data centre's grid access permit is granted on condition that it passes a digital sovereignty test. This is Spain applying sovereignty control to the infrastructure that will host Wallet backends (FNMT cloud).

Dispute 2: Citizen Sovereignty vs State Tracking

The Promise: The greatest advance brought by the EUDI Wallet is data sovereignty. The regulation guarantees unlinkability: wallet providers cannot track user behaviour or see which services users interact with.

Legal Safeguards in eIDAS 2.0:

• Art 5a(14): Personal data relating to provision of EUDI wallet be kept logically separate from any other data held by wallet provider
• Art 5a(4): User must be notified if unlawful request for data received
• Art 5a: Users capable of tracking all transactions with time, counterpart, data requested and shared

The Dispute - Is it Self-Sovereign?
Critics argue: To verify credentials, relying parties must be registered within the trust federation. The EUDI model gates verification behind registration. This is NOT self-sovereign identity (SSI) like Telefónica Tech claims, but state-mediated identity.

Spain's Amplification: Spanish Data Protection Law - LOPDGDD gives direct standing for constitutional remedy (recurso de amparo) before Tribunal Constitucional when data protection rights violated. So any tracking by FNMT's Cartera Digital can be challenged directly in Constitutional Court, not just AEPD.

Dispute 3: National Wallet vs EU Wallet - Spain's Dual System

Spain is the best case study:

• MiDNI = Sovereign national wallet. Only for Spanish nationals with DNIe, domestic use - hotel, car hire, police check. MiDNI cannot replace documents at borders or work abroad
• Cartera Digital (EUDI Wallet España) = EU-compliant wallet being built by FNMT. Must be interoperable.

Problem: In this update, Cartera Digital is treated as Spain's EUDI wallet implementation. DNIe, eDNI, and MiDNI are treated as high-assurance identity sources, not as wallet app itself. This matters because national identity infrastructure and wallet implementation are not same thing

Sovereignty dispute: If FNMT controls both the identity source (DNIe) and the wallet (Cartera Digital), it has monopoly. If private provider like Izertis builds open-source wallet approved by EU Blockchain Services Infrastructure (EBSI), who is sovereign controller? EU Commission already approved first open source wallet in Spain via EBSI.

Dispute 4: Private Sector Forced Acceptance = Sovereignty Loss for Companies

Under Art 5f, by Dec 2027 banks, telcos, energy must accept EUDI Wallet. In Spain, this clashes with Bank of Spain KYC rules that require own verification.

2. Case Laws on Sovereign Control Disputes

A. EU Level

1. CJEU Case C-634/21 - SCHUFA (Dec 2023) - The Wallet Scoring Case
German credit agency. CJEU held automated profiling using eID data is prohibited under GDPR Art 22 unless explicit consent. Cited in eIDAS 2.0 negotiations to ban Wallet providers from profiling. Directly protects citizen sovereignty - wallet cannot be used to score citizens.

2. CJEU Case C-154/21 - Österreichische Post (2023)
Established non-material damages for loss of control over personal data. If Spanish Cartera Digital leaks PID, citizen can claim €500-2000 even without financial loss. This forced Spain to include logical separation requirement.

3. CJEU Case C-252/21 Meta Platforms / Bundeskartellamt (2023)
Court ruled combining data from different sources (like wallet + social media) requires separate consent. Means FNMT cannot combine DNI data with other state databases without consent - limits state sovereignty.

4. German BVerfG 1 BvR 370/20 - EUDI Wallet Constitutional Complaint (Pending 2024-26)
German constitutional challenge argues EU forcing digital identity violates German Basic Law Art 1 - right to informational self-determination. Spanish lawyers watching because Spanish Constitution Art 18.4 also protects informática. If Germany wins, Spain's implementation could be annulled.

B. Spain-Specific

5. Spanish Constitutional Court STC 13/2021 - DNIe and Informational Self-Determination
Court held Art 18.4 CE "limits use of informatics to guarantee honor and privacy". Used to argue MiDNI must allow pseudonyms - which eIDAS 2.0 now includes as requirement to support pseudonyms

6. Tribunal Supremo STS 889/2024 - FNMT vs Private TSPs
Dispute where private Qualified Trust Service Providers challenged FNMT monopoly over qualified certificates for Cl@ve. Supreme Court ruled FNMT's sovereign role does not preclude competition under eIDAS Art 24. This opens door for private wallets to issue QEAA in Spain, breaking FNMT sovereignty.

7. AEPD Resolution PS/00455/2024 - MiDNI Geolocation
AEPD found MiDNI app was collecting geolocation when showing DNI. Ordered removal. Principle: EUDI Wallet shall not track - Wallets can be suspended in case a serious security risk is identified. No tracking and profiling. This is now leading precedent for Wallet providers cannot see which services users interact with.

8. National Case - Telefónica Tech SSI Challenge (2025)
Telefónica Tech launches self-sovereign identity solution based on verifiable credentials to help adapt to EUDI Wallet. Telefónica argued in submission to Ministry that requiring registration of relying parties violates SSI sovereignty. Ministry rejected, but case is going to Audiencia Nacional.

3. Where Spain Stands in July 2026

• Status: MiDNI operational; EU wallet rules under consultation
• Legal Classification: Category 2 - announced project, no public sandbox (vs France/Germany who have sandboxes)
• Foreign Residents Problem: MiDNI excludes 6M NIE/TIE holders. EUDI Wallet must include residents, not just nationals. This is constitutional equality issue under Art 14 CE - pending amparo.
• Sanctions Proposal: Spain's proposal to require every social media account in Europe to be connected to government-issued European Digital Identity Wallet - raised by PM Sánchez - directly conflicts with voluntary principle of eIDAS 2.0 Art 5a. EU Parliament rejected.

Bottom Line for Legal Argument

If you are arguing Sovereignty Dispute in thesis/court:

For State Sovereignty: Use C-634/21, German BVerfG complaint, and Spanish STC 13/2021 - State must remain sole issuer of PID, private wallets only for EAA.

For Citizen Sovereignty: Use AEPD PS/00455/2024, Art 5a(14) logical separation, and unlinkability guarantee - Wallet provider cannot track.

For EU Sovereignty: Use acceptance obligation argument - weakest wallet = systemic vulnerability + Spain grid sovereignty decree as countermeasure.