EIDAS 2014/0910 EN

With a view to ensuring the proper functioning of the internal market while aiming at an adequate level of security of electronic_identification means and trust_services this Regulation:

(a)	lays down the conditions under which Member States recognise electronic_identification means of natural and legal persons falling under a notified electronic_identification scheme of another Member State;

(b)	lays down rules for trust_services, in particular for electronic transactions; and

(c)	establishes a legal framework for electronic_signatures, electronic_seals, electronic_time_stamps, electronic_documents, electronic_registered_delivery_services and certificate services for website authentication.

Article 13

Liability and burden of proof

1. Without prejudice to paragraph 2, trust_service providers shall be liable for damage caused intentionally or negligently to any natural or legal person due to a failure to comply with the obligations under this Regulation.

The burden of proving intention or negligence of a non-qualified trust_service provider shall lie with the natural or legal person claiming the damage referred to in the first subparagraph.

The intention or negligence of a qualified trust_service provider shall be presumed unless that qualified trust_service provider proves that the damage referred to in the first subparagraph occurred without the intention or negligence of that qualified trust_service provider.

2. Where trust_service providers duly inform their customers in advance of the limitations on the use of the services they provide and where those limitations are recognisable to third parties, trust_service providers shall not be liable for damages arising from the use of services exceeding the indicated limitations.

3. Paragraphs 1 and 2 shall be applied in accordance with national rules on liability.

whereas

(16) Assurance levels should characterise the degree of confidence in electronic_identification means in establishing the identity of a person, thus providing assurance that the person claiming a particular identity is in fact the person to which that identity was assigned.
The assurance level depends on the degree of confidence that electronic_identification means provides in claimed or asserted identity of a person taking into account processes (for example, identity proofing and verification, and authentication), management activities (for example, the entity issuing electronic_identification means and the procedure to issue such means) and technical controls implemented.
Various technical definitions and descriptions of assurance levels exist as the result of Union-funded Large-Scale Pilots, standardisation and international activities.
In particular, the Large-Scale Pilot STORK and ISO 29115 refer, inter alia, to levels 2, 3 and 4, which should be taken into utmost account in establishing minimum technical requirements, standards and procedures for the assurances levels low, substantial and high within the meaning of this Regulation, while ensuring consistent application of this Regulation in particular with regard to assurance level high related to identity proofing for issuing qualified certificates.
The requirements established should be technology-neutral.
It should be possible to achieve the necessary security requirements through different technologies.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN