EIDAS 2014/0910 EN

1. An electronic_identification scheme notified pursuant to Article 9(1) shall specify assurance levels low, substantial and/or high for electronic_identification means issued under that scheme.

2. The assurance levels low, substantial and high shall meet respectively the following criteria:

(a)

assurance level low shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a limited degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of misuse or alteration of the identity;

(b)

assurance level substantial shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a substantial degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of misuse or alteration of the identity;

(c)

assurance level high shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a higher degree of confidence in the claimed or asserted identity of a person than electronic_identification means with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent misuse or alteration of the identity.

3. By 18 September 2015, taking into account relevant international standards and subject to paragraph 2, the Commission shall, by means of implementing acts, set out minimum technical specifications, standards and procedures with reference to which assurance levels low, substantial and high are specified for electronic_identification means for the purposes of paragraph 1.

Those minimum technical specifications, standards and procedures shall be set out by reference to the reliability and quality of the following elements:

(a)	the procedure to prove and verify the identity of natural or legal persons applying for the issuance of electronic_identification means;

(b)	the procedure for the issuance of the requested electronic_identification means;

(c)	the authentication mechanism, through which the natural or legal person uses the electronic_identification means to confirm its identity to a relying_party;

(d)	the entity issuing the electronic_identification means;

(e)	any other body involved in the application for the issuance of the electronic_identification means; and

(f)	the technical and security specifications of the issued electronic_identification means.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 26

Requirements for advanced electronic_signatures

An advanced electronic_signature shall meet the following requirements:

(a)	it is uniquely linked to the signatory;

(b)	it is capable of identifying the signatory;

(c)	it is created using electronic_signature creation data that the signatory can, with a high level of confidence, use under his sole control; and

(d)	it is linked to the data signed therewith in such a way that any subsequent change in the data is detectable.

Article 36

Requirements for advanced electronic_seals

An advanced electronic_seal shall meet the following requirements:

(a)	it is uniquely linked to the creator of the seal;

(b)	it is capable of identifying the creator of the seal;

(c)	it is created using electronic_seal creation data that the creator of the seal can, with a high level of confidence under its control, use for electronic_seal creation; and

(d)	it is linked to the data to which it relates in such a way that any subsequent change in the data is detectable.

Article 44

Requirements for qualified electronic_registered_delivery_services

1. Qualified electronic_registered_delivery_services shall meet the following requirements:

(a)	they are provided by one or more qualified trust_service provider(s);

(b)	they ensure with a high level of confidence the identification of the sender;

(c)	they ensure the identification of the addressee before the delivery of the data;

(d)	the sending and receiving of data is secured by an advanced electronic_signature or an advanced electronic_seal of a qualified trust_service provider in such a manner as to preclude the possibility of the data being changed undetectably;

(e)	any change of the data needed for the purpose of sending or receiving the data is clearly indicated to the sender and addressee of the data;

(f)	the date and time of sending, receiving and any change of data are indicated by a qualified electronic_time_stamp.

In the event of the data being transferred between two or more qualified trust_service providers, the requirements in points (a) to (f) shall apply to all the qualified trust_service providers.

2. The Commission may, by means of implementing acts, establish reference numbers of standards for processes for sending and receiving data. Compliance with the requirements laid down in paragraph 1 shall be presumed where the process for sending and receiving data meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 8

Website authentication

whereas

(16) Assurance levels should characterise the degree of confidence in electronic_identification means in establishing the identity of a person, thus providing assurance that the person claiming a particular identity is in fact the person to which that identity was assigned.
The assurance level depends on the degree of confidence that electronic_identification means provides in claimed or asserted identity of a person taking into account processes (for example, identity proofing and verification, and authentication), management activities (for example, the entity issuing electronic_identification means and the procedure to issue such means) and technical controls implemented.
Various technical definitions and descriptions of assurance levels exist as the result of Union-funded Large-Scale Pilots, standardisation and international activities.
In particular, the Large-Scale Pilot STORK and ISO 29115 refer, inter alia, to levels 2, 3 and 4, which should be taken into utmost account in establishing minimum technical requirements, standards and procedures for the assurances levels low, substantial and high within the meaning of this Regulation, while ensuring consistent application of this Regulation in particular with regard to assurance level high related to identity proofing for issuing qualified certificates.
The requirements established should be technology-neutral.
It should be possible to achieve the necessary security requirements through different technologies.

- = -

(41) To ensure sustainability and durability of qualified trust_services and to boost users’ confidence in the continuity of qualified trust_services, supervisory bodies should verify the existence and the correct application of provisions on termination plans in cases where qualified trust_service providers cease their activities.

- = -

(47) confidence in and convenience of online services are essential for users to fully benefit and consciously rely on electronic services.
To this end, an EU trust mark should be created to identify the qualified trust_services provided by qualified trust_service providers.
Such an EU trust mark for qualified trust_services would clearly differentiate qualified trust_services from other trust_services thus contributing to transparency in the market.
The use of an EU trust mark by qualified trust_service providers should be voluntary and should not lead to any requirement other than those provided for in this Regulation.

- = -

(67) Website authentication services provide a means by which a visitor to a website can be assured that there is a genuine and legitimate entity standing behind the website.
Those services contribute to the building of trust and confidence in conducting business online, as users will have confidence in a website that has been authenticated.
The provision and the use of website authentication services are entirely voluntary.
However, in order for website authentication to become a means to boosting trust, providing a better experience for the user and furthering growth in the internal market, this Regulation should lay down minimal security and liability obligations for the providers and their services.
To that end, the results of existing industry-led initiatives, for example the Certification Authorities/Browsers Forum — CA/B Forum, have been taken into account.
In addition, this Regulation should not impede the use of other means or methods to authenticate a website not falling under this Regulation nor should it prevent third country providers of website authentication services from providing their services to customers in the Union.
However, a third country provider should only have its website authentication services recognised as qualified in accordance with this Regulation, if an international agreement between the Union and the country of establishment of the provider has been concluded.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN