EIDAS 2014/0910 EN

1. Qualified and non-qualified trust_service providers shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust_services they provide. Having regard to the latest technological developments, those measures shall ensure that the level of security is commensurate to the degree of risk. In particular, measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of the adverse effects of any such incidents.

2. Qualified and non-qualified trust_service providers shall, without undue delay but in any event within 24 hours after having become aware of it, notify the supervisory body and, where applicable, other relevant bodies, such as the competent national body for information security or the data protection authority, of any breach of security or loss of integrity that has a significant impact on the trust_service provided or on the personal data maintained therein.

Where the breach of security or loss of integrity is likely to adversely affect a natural or legal person to whom the trusted service has been provided, the trust_service provider shall also notify the natural or legal person of the breach of security or loss of integrity without undue delay.

Where appropriate, in particular if a breach of security or loss of integrity concerns two or more Member States, the notified supervisory body shall inform the supervisory bodies in other Member States concerned and ENISA.

The notified supervisory body shall inform the public or require the trust_service provider to do so, where it determines that disclosure of the breach of security or loss of integrity is in the public interest.

3. The supervisory body shall provide ENISA once a year with a summary of notifications of breach of security and loss of integrity received from trust_service providers.

4. The Commission may, by means of implementing acts,:

(a)	further specify the measures referred to in paragraph 1; and

(b)	define the formats and procedures, including deadlines, applicable for the purpose of paragraph 2.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 3

Qualified trust_services

Article 25

Legal effects of electronic_signatures

1. An electronic_signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic_signatures.

2. A qualified electronic_signature shall have the equivalent legal effect of a handwritten signature.

3. A qualified electronic_signature based on a qualified certificate issued in one Member State shall be recognised as a qualified electronic_signature in all other Member States.

Article 35

Legal effects of electronic_seals

1. An electronic_seal shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic_seals.

2. A qualified electronic_seal shall enjoy the presumption of integrity of the data and of correctness of the origin of that data to which the qualified electronic_seal is linked.

3. A qualified electronic_seal based on a qualified certificate issued in one Member State shall be recognised as a qualified electronic_seal in all other Member States.

Article 46

Legal effects of electronic_documents

An electronic_document shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form.

CHAPTER V

DELEGATIONS OF POWER AND IMPLEMENTING PROVISIONS

whereas

(21) This Regulation should also establish a general legal framework for the use of trust_services.
However, it should not create a general obligation to use them or to install an access point for all existing trust_services.
In particular, it should not cover the provision of services used exclusively within closed systems between a defined set of participants, which have no effect on third parties.
For example, systems set up in businesses or public administrations to manage internal procedures making use of trust_services should not be subject to the requirements of this Regulation.
Only trust_services provided to the public having effects on third parties should meet the requirements laid down in the Regulation.
Neither should this Regulation cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards form laid down by national or Union law.
In addition, it should not affect national form requirements pertaining to public registers, in particular commercial and land registers.

- = -

(27) This Regulation should be technology-neutral.
The legal effects it grants should be achievable by any technical means provided that the requirements of this Regulation are met.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN