EIDAS 2014/0910 EN

1. An electronic_identification scheme notified pursuant to Article 9(1) shall specify assurance levels low, substantial and/or high for electronic_identification means issued under that scheme.

2. The assurance levels low, substantial and high shall meet respectively the following criteria:

(a)

assurance level low shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a limited degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of misuse or alteration of the identity;

(b)

assurance level substantial shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a substantial degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of misuse or alteration of the identity;

(c)

assurance level high shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a higher degree of confidence in the claimed or asserted identity of a person than electronic_identification means with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent misuse or alteration of the identity.

3. By 18 September 2015, taking into account relevant international standards and subject to paragraph 2, the Commission shall, by means of implementing acts, set out minimum technical specifications, standards and procedures with reference to which assurance levels low, substantial and high are specified for electronic_identification means for the purposes of paragraph 1.

Those minimum technical specifications, standards and procedures shall be set out by reference to the reliability and quality of the following elements:

(a)	the procedure to prove and verify the identity of natural or legal persons applying for the issuance of electronic_identification means;

(b)	the procedure for the issuance of the requested electronic_identification means;

(c)	the authentication mechanism, through which the natural or legal person uses the electronic_identification means to confirm its identity to a relying_party;

(d)	the entity issuing the electronic_identification means;

(e)	any other body involved in the application for the issuance of the electronic_identification means; and

(f)	the technical and security specifications of the issued electronic_identification means.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 26

Requirements for advanced electronic_signatures

An advanced electronic_signature shall meet the following requirements:

(a)	it is uniquely linked to the signatory;

(b)	it is capable of identifying the signatory;

(c)	it is created using electronic_signature creation data that the signatory can, with a high level of confidence, use under his sole control; and

(d)	it is linked to the data signed therewith in such a way that any subsequent change in the data is detectable.

Article 36

Requirements for advanced electronic_seals

An advanced electronic_seal shall meet the following requirements:

(a)	it is uniquely linked to the creator of the seal;

(b)	it is capable of identifying the creator of the seal;

(c)	it is created using electronic_seal creation data that the creator of the seal can, with a high level of confidence under its control, use for electronic_seal creation; and

(d)	it is linked to the data to which it relates in such a way that any subsequent change in the data is detectable.

Article 52

Entry into force

1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

2. This Regulation shall apply from 1 July 2016, except for the following:

(a)	Articles 8(3), 9(5), 12(2) to (9), 17(8), 19(4), 20(4), 21(4), 22(5), 23(3), 24(5), 27(4) and (5), 28(6), 29(2), 30(3) and (4), 31(3), 32(3), 33(2), 34(2), 37(4) and (5), 38(6), 42(2), 44(2), 45(2), and Articles 47 and 48 shall apply from 17 September 2014;

(b)	Article 7, Article 8(1) and (2), Articles 9, 10, 11 and Article 12(1) shall apply from the date of application of the implementing acts referred to in Articles 8(3) and 12(8);

(c)	Article 6 shall apply from three years as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8).

3. Where the notified electronic_identification scheme is included in the list published by the Commission pursuant to Article 9 before the date referred to in point (c) of paragraph 2 of this Article, the recognition of the electronic_identification means under that scheme pursuant to Article 6 shall take place no later than 12 months after the publication of that scheme but not before the date referred to in point (c) of paragraph 2 of this Article.

4. Notwithstanding point (c) of paragraph 2 of this Article, a Member State may decide that electronic_identification means under electronic_identification scheme notified pursuant to Article 9(1) by another Member State are recognised in the first Member State as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8). Member States concerned shall inform the Commission. The Commission shall make this information public.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 23 July 2014.

For the Parliament

The President

M. SCHULZ

For the Council

The President

S. GOZI

(1) OJ C 351, 15.11.2012, p. 73.

(2) Position of the European Parliament of 3 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.

(3) Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic_signatures (OJ L 13, 19.1.2000, p. 12).

(4) OJ C 50 E, 21.2.2012, p. 1.

(5) Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (OJ L 376, 27.12.2006, p. 36).

(6) Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

(7) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(8) Council Decision 2010/48/EC of 26 November 2009 concerning the conclusion, by the European Community, of the United Nations Convention on the Rights of Persons with Disabilities (OJ L 23, 27.1.2010, p. 35).

(9) Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, p. 30).

(10) Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of procedures by electronic means through the ‘points of single contact’ under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 274, 20.10.2009, p. 36).

(11) Commission Decision 2011/130/EU of 25 February 2011 establishing minimum requirements for the cross-border processing of documents signed electronically by competent authorities under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 53, 26.2.2011, p. 66).

(12) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

(13) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(14) OJ C 28, 30.1.2013, p. 6.

(15) Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC (OJ L 94, 28.3.2014, p. 65).

ANNEX I

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SIGNATURES

Qualified certificates for electronic_signatures shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic_signature;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least, the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)	at least the name of the signatory, or a pseudonym; if a pseudonym is used, it shall be clearly indicated;

(d)	electronic_signature validation_data that corresponds to the electronic_signature creation data;

(e)	details of the beginning and end of the certificate’s period of validity;

(f)	the certificate identity code, which must be unique for the qualified trust_service provider;

(g)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(h)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (g) is available free of charge;

(i)	the location of the services that can be used to enquire about the validity status of the qualified certificate;

(j)	where the electronic_signature creation data related to the electronic_signature validation_data is located in a qualified electronic_signature creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX II

REQUIREMENTS FOR QUALIFIED ELECTRONIC SIGNATURE CREATION DEVICES

Qualified electronic_signature creation devices shall ensure, by appropriate technical and procedural means, that at least:

(a)	the confidentiality of the electronic_signature creation data used for electronic_signature creation is reasonably assured;

(b)	the electronic_signature creation data used for electronic_signature creation can practically occur only once;

(c)	the electronic_signature creation data used for electronic_signature creation cannot, with reasonable assurance, be derived and the electronic_signature is reliably protected against forgery using currently available technology;

(d)	the electronic_signature creation data used for electronic_signature creation can be reliably protected by the legitimate signatory against use by others.

Qualified electronic_signature creation devices shall not alter the data to be signed or prevent such data from being presented to the signatory prior to signing.

Generating or managing electronic_signature creation data on behalf of the signatory may only be done by a qualified trust_service provider.

Without prejudice to point (d) of point 1, qualified trust_service providers managing electronic_signature creation data on behalf of the signatory may duplicate the electronic_signature creation data only for back-up purposes provided the following requirements are met:

(a)	the security of the duplicated datasets must be at the same level as for the original datasets;

(b)	the number of duplicated datasets shall not exceed the minimum needed to ensure continuity of the service.

ANNEX III

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SEALS

Qualified certificates for electronic_seals shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic_seal;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)	at least the name of the creator of the seal and, where applicable, registration number as stated in the official records;

(d)	electronic_seal validation_data, which corresponds to the electronic_seal creation data;

(e)	details of the beginning and end of the certificate’s period of validity;

(f)	the certificate identity code, which must be unique for the qualified trust_service provider;

(g)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(h)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (g) is available free of charge;

(i)	the location of the services that can be used to enquire as to the validity status of the qualified certificate;

(j)	where the electronic_seal creation data related to the electronic_seal validation_data is located in a qualified electronic_seal creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX IV

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR WEBSITE AUTHENTICATION

Qualified certificates for website authentication shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for website authentication;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)

for natural persons: at least the name of the person to whom the certificate has been issued, or a pseudonym. If a pseudonym is used, it shall be clearly indicated;

for legal persons: at least the name of the legal person to whom the certificate is issued and, where applicable, registration number as stated in the official records;

(d)	elements of the address, including at least city and State, of the natural or legal person to whom the certificate is issued and, where applicable, as stated in the official records;

(e)	the domain name(s) operated by the natural or legal person to whom the certificate is issued;

(f)	details of the beginning and end of the certificate’s period of validity;

(g)	the certificate identity code, which must be unique for the qualified trust_service provider;

(h)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(i)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (h) is available free of charge;

(j)	the location of the certificate validity status services that can be used to enquire as to the validity status of the qualified certificate.

whereas

name='idcons16'>

(16) Assurance levels should characterise the degree of confidence in electronic_identification means in establishing the identity of a person, thus providing assurance that the person claiming a particular identity is in fact the person to which that identity was assigned.
The assurance level depends on the degree of confidence that electronic_identification means provides in claimed or asserted identity of a person taking into account processes (for example, identity proofing and verification, and authentication), management activities (for example, the entity issuing electronic_identification means and the procedure to issue such means) and technical controls implemented.
Various technical definitions and descriptions of assurance levels exist as the result of Union-funded Large-Scale Pilots, standardisation and international activities.
In particular, the Large-Scale Pilot STORK and ISO 29115 refer, inter alia, to levels 2, 3 and 4, which should be taken into utmost account in establishing minimum technical requirements, standards and procedures for the assurances levels low, substantial and high within the meaning of this Regulation, while ensuring consistent application of this Regulation in particular with regard to assurance level high related to identity proofing for issuing qualified certificates.
The requirements established should be technology-neutral.
It should be possible to achieve the necessary security requirements through different technologies.

- = -

name='idcons23'>

(23) To the extent that this Regulation creates an obligation to recognise a trust_service, such a trust_service may only be rejected if the addressee of the obligation is unable to read or verify it due to technical reasons lying outside the immediate control of the addressee.
However, that obligation should not in itself require a public body to obtain the hardware and software necessary for the technical readability of all existing trust_services.

- = -

name='idcons51'>

(51) It should be possible for the signatory to entrust qualified electronic_signature creation devices to the care of a third party, provided that appropriate mechanisms and procedures are implemented to ensure that the signatory has sole control over the use of his electronic_signature creation data, and the qualified electronic_signature requirements are met by the use of the device.

- = -

name='idcons52'>

(52) The creation of remote electronic_signatures, where the electronic_signature creation environment is managed by a trust_service provider on behalf of the signatory, is set to increase in the light of its multiple economic benefits.
However, in order to ensure that such electronic_signatures receive the same legal recognition as electronic_signatures created in an entirely user-managed environment, remote electronic_signature service providers should apply specific management and administrative security procedures and use trustworthy systems and products, including secure electronic communication channels, in order to guarantee that the electronic_signature creation environment is reliable and is used under the sole control of the signatory.
Where a qualified electronic_signature has been created using a remote electronic_signature creation device, the requirements applicable to qualified trust_service providers set out in this Regulation should apply.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN