9.1.4.2.6. Wallet Instance Dashboard and Transaction Logging

The Wallet Instance MUST maintain a secure, Wallet-local transaction log to ensure transparency, traceability, and User awareness of actions performed through the Wallet Instance as defined in EIDAS-ARF (Annex 2.02 HLRs, Topic 19). The log MUST cover all transactions (including non-completed) in these categories:

  • Credential issuance and re-issuance.

  • Credential presentation to Relying Parties.

  • data deletion requests sent to Relying Parties.

For each such transaction, the Wallet Instance MUST create a corresponding transaction record. The record contains the data elements specified in the applicable ARF requirements for that transaction category. Where applicable, the Wallet Instance MUST update the record with the final outcome as defined in EUDI-TS 10.

For presentation transactions, attribute values MUST NOT be logged. A presentation request may contain sensitive transactional data, such as a payment or a digital signature. The Wallet Instance MUST log the value of such transactional data only to the extent explicitly required by EUDI-TS 12. The logging stays associated with the requested attestation. The logging follows data minimization principles. Where no such requirement exists, transactional data values MUST NOT be logged.

To support User access to the transaction log, the Wallet Instance MUST provide a dashboard interface. The dashboard allows the User to view an overview of transaction records in the log. The dashboard allows the User to access individual record details. The dashboard allows the User to export and delete records. Where a transaction involves a Relying Party, the dashboard allows the User to initiate a data deletion request to that Relying Party, using logged contact information if available.

The Wallet Provider MUST protect the confidentiality, integrity, and authenticity of the transaction log and of any exported log objects in accordance with EUDI-TS 10. Access to the log MUST be restricted to the User and the Wallet Instance.

Records MUST be retained for at least the minimum legal period as defined in General Log Retention Policies. If storage limits require automatic deletion, the Wallet Instance MUST notify the User via the dashboard, warn of consequences, and offer export of affected records before deletion.

9.1.4.2.6.1. Export and Deletion of Transaction Records

Export: The dashboard MUST allow the User to export one or more transaction records to a file using the common format and security measures defined in EUDI-TS 10.

The exported file MUST be storable in an external or remote storage location of the User’s choice, from among the storage options supported by the Wallet Instance.

This export enables the download of selected transaction records. Restoration of the transaction log into a receiving Wallet Instance is specified in Migration to a Different Wallet Solution.

Deletion: The dashboard MUST allow the User to delete one or more transaction records from the Wallet Instance at any time.

Before deleting any transaction record, the Wallet Instance MUST display a clear warning to the User about the potential consequences for the User’s data protection rights.

Deletion of transaction records MUST:

  • apply only to Wallet-local copies of the records.

  • be irreversible for the Wallet Instance once completed.

The Wallet Instance MUST continue to protect any remaining transaction records in accordance with the confidentiality, integrity, and authenticity requirements defined for the transaction log in this section.

No entity other than the User MAY delete transaction records.