CIT-008, Documents and Personal Data
Not law. Regulates what the register already does. CIT-003 requires a citizen to hold a passport and says nothing about how long one lasts, what happens when it is lost, or what the Union may keep about you in order to issue it.
CIT-008: Documents and your personal details. The Union gives every citizen a passport, and every citizen and e-resident an ID card, when they are approved and at no charge. Both last five years.
You get a free replacement if a document runs out, is wrong, or is lost or stolen. The old one stops being valid the moment the new one is made.
The Union will not make a document with blank or made-up details, and will not make one at all if it does not know your name and date of birth. The Union publishes a way to check whether a document number is valid, and that check says nothing about who holds it.
About each applicant, citizen and e-resident, the Union keeps: name and date of birth as they appear on legal ID, nationality, country and city they live in, a way to contact them, and why they applied. It keeps nothing else, and it never records anybody's ethnicity or religion.
Those details are stored encrypted and only unlocked for a stated reason. Every time they are read it is written down, and you can see that list, including the times you read them yourself. Photo ID you send with an application is destroyed once the application has been decided.
You can get a copy of everything the Union holds about you at any time, have anything wrong corrected, and have your personal details deleted. Deleting them removes your details and your documents. It does not remove the record that the Union made a decision, which stays with nobody's name attached.
The Union does not publish how many citizens it has, or any list of them.
Notes
Five years is the number the code already uses and it is arbitrary. It is written into the law rather than left in a settings table so that changing it takes a vote rather than an edit.
"blank or substituted particulars" is a problem the register hit on its first day. Two citizens were recognized when it opened, before there was anywhere to record a name, so a passport was impossible for them. The tempting fix is to issue one with the fields empty or filled with a username, which produces a document with an invalid machine-readable zone - worse than no document, because it looks like identification and fails every check.
"It holds nothing else" is an exhaustive list, which is unusual and deliberate. An open-ended permission to hold what is necessary becomes a permission to hold whatever somebody later finds convenient. Adding a field should be a conversation.
The access log including your own readings is not housekeeping. It is how you would notice your file being opened at three in the morning from an address you do not recognize. A log that omits legitimate access to reduce noise cannot do that.
Erasure keeping the decision. A state that can be made to forget it decided something has no history. A state that keeps your name on that decision after you asked it not to is doing something else wrong. Detaching one from the other is the only answer that serves both.