Context: refugee crisis and Poland's reaction

Russia's invasion of Ukraine on February 24, 2022, triggered an unprecedented humanitarian crisis, forcing millions of Ukrainian citizens to leave their homes in search of safety. Poland, as a neighboring country, became the main destination for escape, receiving the largest number of displaced persons. The scale of this influx posed enormous logistical, administrative, and social challenges for the Polish authorities, requiring immediate and effective solutions to provide aid, registration, and legalization of stay for arrivals. In response to these needs, Poland undertook a series of measures, including legislative and technological ones, aimed at streamlining the process of receiving refugees and enabling them to function in a new reality.

Diia.pl as a pioneering digital solution

Diia.pl, launched in July 2022 by the Ministry of Digital Affairs, is a "revolutionary solution". Poland utilized its existing and well-developed digital infrastructure (mObywatel, Trusted Profile) to provide refugees with secure identity confirmation. Instead of creating an entirely new system from scratch, which would have been time-consuming, Poland used its existing, reliable digital tools. This indicates a certain level of readiness and flexibility in Polish digital administration, which allowed for such rapid action. The name "Diia.pl" refers to the Ukrainian digital services platform "Diia," which may suggest a desire for interoperability or a shared digital philosophy.

The statement by Ukrainian Minister of Digital Transformation Mykhailo Fedorov, who called Diia.pl "one of the first joint digital projects" and expressed hope for future digital cooperation with EU countries, underscores this aspect. This is not just a technical solution, but also a political gesture of support and integration during wartime, which can serve as a "soft power" tool, demonstrating EU solidarity and paving the way for Ukraine's adaptation to EU digital standards, key to its accession aspirations.

Dual role: electronic identity document and the EU's first digital residence permit

Diia.pl serves a dual function: it is an electronic identity document recognized in Poland and the first fully digital residence permit recognized in the European Union. This dual functionality defines its key utility, offering users both an easier daily life in Poland and the ability to travel legally within the EU. The recognition of Diia.pl as the first fully digital residence permit in the EU may also influence the development and implementation of the broader European Digital Identity Wallet initiative. As the EU actively works on pan-European digital identity frameworks, Diia.pl serves as a real, large-scale test case. The successes and challenges faced by Diia.pl, such as cross-border recognition, security, or user adoption, will provide valuable lessons for the EU-wide system, demonstrating the feasibility and benefits of digital residence permits.

National legal basis

The main legal act regulating the functioning of Diia.pl is the "Special Act" of March 12, 2022 on assistance to citizens of Ukraine. Article 10 of this act is the direct legal basis for the Diia.pl service and for the collection of personal data necessary for its functioning. This so-called "Special Act" played a key role in quickly establishing the legal parameters for Diia.pl, enabling the effective implementation of the solution in response to the crisis. The rapid adoption of the "Special Act" – the law was passed on March 12, 2022, shortly after the conflict began on February 24, 2022 – demonstrates the government's ability to create flexible legal frameworks in response to crises, bypassing standard, often lengthy legislative processes to meet immediate needs. Regulations regarding Diia.pl also refer to the Act of September 24, 2010, on population records regarding data acquisition. The minister responsible for informatization (Minister of Digital Affairs) is defined as the provider of the Diia.pl service.

Notification to the European Commission and its implications

On July 12, 2022, the Polish Ministry of Interior and Administration formally notified the European Commission of the Diia.pl document as a document confirming legal stay and qualifying as a residence permit. Information on this matter was simultaneously transmitted to EU member states and states associated within the Schengen Area. This notification was necessary for Diia.pl to be officially recognized for the purposes of crossing EU external borders and moving within the Schengen Area. The EU notification process and subsequent recognition of Diia.pl illustrate the functioning of EU solidarity mechanisms and the importance of established procedures for validating national documents at the EU level. Poland not only created the document but also went through the formal EU notification process, ensuring that other member states are aware of and recognize the document, which is key for travel in the Schengen Area.

Status as a formal residence document

After official notification, the Diia.pl document, held by an authorized person, serves as a residence document. It confirms the legality of the stay of war refugees from Ukraine on Polish territory. In conjunction with a valid travel document (e.g., passport), it entitles the holder to cross the EU's external border and travel within the Schengen Area for 90 days in any 180-day period. The fact that Diia.pl is a fully digital document, yet has gained EU-wide recognition as a residence permit, is a significant step. This suggests growing acceptance and trust by EU authorities in digital documentation, provided that security and verifiability are ensured. Traditionally, residence permits are physical documents with high-security features. EU acceptance indicates that digital security measures, authentication processes, and links to a reliable national register (PESEL) have been deemed sufficient. This may pave the way for other member states to adopt similar digital solutions and for further EU development of standards for exclusively digital official documents.

The Ministry of Interior and Administration also notified a certificate of temporary protection for non-Ukrainian citizens covered by temporary protection, indicating a multi-track approach to documenting the legal stay of various groups affected by the conflict.

mObywatel application as a platform (digital wallet)

Diia.pl is a service (document) available within the Polish government's mObywatel application. The mObywatel application functions as a digital wallet for various documents and services, such as mDowód (digital ID), driver's license, or access to ePrescriptions. The publisher of the application is the Chancellery of the Prime Minister (KPRM). The application is available for smartphones with Android (version 6.0 or newer) and iOS (version 13.0 or newer).

Data encryption and secure on-device storage

The personal data of a Diia.pl user is retrieved from the PESEL Register and stored in encrypted form directly on the user's mobile device. Strong encryption mechanisms are used to protect the document from unauthorized access, copying, and modification. Access to data in the mObywatel application is additionally secured by a password or PIN code set by the user for the application. This architecture positions the user's smartphone as a secure token storing encrypted data and a cryptographic certificate. While convenient, this also concentrates risk on the security and integrity of the device itself. Loss or compromise of the phone can lead to temporary loss of access or potential (though limited by encryption/app password) data disclosure.

Visual security elements (interactive preview)

To prevent forgery and enable visual verification of authenticity, the Diia.pl document includes several dynamic security elements. Hover over or click on the elements below to learn more:

Authentication based on cryptographic certificates

During the first activation of the Diia.pl service, a cryptographic certificate is created and downloaded, assigned to the user and their mobile device. This certificate is used to authenticate the user's data in the IT systems of other service providers, for example, when accessing ePrescriptions or the EU Digital COVID Certificate through the e-Health Center systems. The certificate has a limited validity period (maximum one year from the activation date) and can be managed (e.g., revoked) by the user. The user can activate Diia.pl and download data simultaneously on a maximum of three mobile devices. Despite the decentralized storage of data on users' devices, the ultimate trust and authority for Diia.pl data come from centralized government registers (PESEL) and certification authorities managed by the Minister, which ensures its legal status and reliability.

Data protection and GDPR compliance

The controller of personal data processed within the Diia.pl service is the Minister of Digital Affairs. A Data Protection Officer has been appointed, who can be contacted regarding matters of personal data processing. The legal basis for data processing is Article 6(1)(e) of the GDPR (task carried out in the public interest) in conjunction with national provisions (Article 19h of the Act on Informatization and Article 10 of the Act on Assistance to Citizens of Ukraine). Users have rights under the GDPR, such as the right to access data, rectify it, object to processing, restrict processing, and lodge a complaint with the President of the Personal Data Protection Office (UODO). Data is not processed for marketing purposes and is stored for 6 years from the last activity in the application. Personal data may be processed on behalf of the Minister by entities such as the Central Informatics Center and NASK National Research Institute.

Summary of Diia.pl's role as an innovative crisis response tool

Diia.pl has emerged as a key and innovative tool in response to the unprecedented refugee crisis caused by the war in Ukraine. Its rapid development and implementation, utilizing existing Polish digital infrastructure, demonstrated an ability to adapt and respond in emergency situations. Of particular importance is the fact that Diia.pl was recognized as the first fully digital residence permit in the European Union, setting a precedent at the European level. This project demonstrates how digital tools can increase social resilience in the face of serious disruptions, ensuring identity continuity and access to rights for displaced persons.

Contribution to refugee autonomy and digital integration

The Diia.pl document has significantly facilitated Ukrainian citizens in confirming the legality of their stay, accessing public services (such as healthcare via e-prescriptions), and mobility within the Schengen Area. Thus, it has contributed to increasing their autonomy and sense of security in a new country. At the same time, Diia.pl has played a role in the integration of refugees into the Polish digital ecosystem of public services, which is an important step towards their fuller participation in social life.

Ongoing need for adaptation, addressing challenges, and support

The success of Diia.pl does not mean an absence of challenges. Identified problems, such as the digital exclusion of people without smartphones or adequate skills, technical issues, and above all, problems with the accuracy of data regarding UKR status and its maintenance, require constant attention and corrective actions. Although Diia.pl is a technological success, its challenges highlight the constant tension in digital transformation: the pursuit of innovative, efficient solutions must be balanced with ensuring equal access and safeguards against systemic errors that can disproportionately affect vulnerable users. Further improvement of the system, provision of effective user support, and maintenance of legal clarity are necessary, especially in the context of extending temporary protection and introducing new systems, such as the EU EES.

Potential as a model for other digital public services

The experience with Diia.pl provides valuable lessons that can be used in designing and implementing other digital public services, both in Poland and in other countries. Especially in the context of crisis management, Diia.pl shows the potential of digital technologies to quickly and scalably address the needs of large population groups. As the first fully digital residence permit in the EU, Diia.pl is not just a temporary solution but a standard-setter. Its operational experience, legal recognition, and security model are likely to influence how other countries and the EU itself will approach digital identity documents for both citizens and third-country nationals.

The statement by Ukrainian Minister Mykhailo Fedorov, describing Diia.pl as one of the "first joint digital projects with EU countries," suggests the prospect of further digital cooperation and the potential use of this model in the future, possibly accelerating the transition to official digital documentation throughout the EU.

Thus, Diia.pl is not only a testament to Polish solidarity and innovation but also an important case study in the global discussion on the digital transformation of public administration and its role in building resilient and inclusive societies.