keyboard_tab EIDAS 2014/0910 EN

whereas later:

definitions:

• electronic identification
• electronic identification means
• person identification data
• electronic identification scheme
• authentication
• relying party
• public sector body
• body governed by public law
• signatory
• electronic signature
• advanced electronic signature
• qualified electronic signature
• electronic signature creation data
• certificate for electronic signature
• qualified certificate for electronic signature
• trust service
• qualified trust service
• conformity assessment body
• trust service provider
• qualified trust service provider
• product
• electronic signature creation device
• qualified electronic signature creation device
• creator of a seal
• electronic seal
• advanced electronic seal
• qualified electronic seal
• electronic seal creation data
• certificate for electronic seal
• qualified certificate for electronic seal
• electronic seal creation device
• qualified electronic seal creation device
• electronic time stamp
• qualified electronic time stamp
• electronic document
• electronic registered delivery service
• qualified electronic registered delivery service
• certificate for website authentication
• qualified certificate for website authentication
• validation data
• validation

Article 6

Mutual recognition

1.   When an electronic_identification using an electronic_identification means and authentication is required under national law or by administrative practice to access a service provided by a public_sector_body online in one Member State, the electronic_identification means issued in another Member State shall be recognised in the first Member State for the purposes of cross-border authentication for that service online, provided that the following conditions are met:

(a)	the electronic_identification means is issued under an electronic_identification scheme that is included in the list published by the Commission pursuant to Article 9;

(b)

the assurance level of the electronic_identification means corresponds to an assurance level equal to or higher than the assurance level required by the relevant public_sector_body to access that service online in the first Member State, provided that the assurance level of that electronic_identification means corresponds to the assurance level substantial or high;

(c)	the relevant public_sector_body uses the assurance level substantial or high in relation to accessing that service online.

Such recognition shall take place no later than 12 months after the Commission publishes the list referred to in point (a) of the first subparagraph.

2.   An electronic_identification means which is issued under an electronic_identification scheme included in the list published by the Commission pursuant to Article 9 and which corresponds to the assurance level low may be recognised by public sector bodies for the purposes of cross-border authentication for the service provided online by those bodies.

Article 21

Initiation of a qualified trust_service

1.   Where trust_service providers, without qualified status, intend to start providing qualified trust_services, they shall submit to the supervisory body a notification of their intention together with a conformity assessment report issued by a conformity_assessment_body.

2.   The supervisory body shall verify whether the trust_service provider and the trust_services provided by it comply with the requirements laid down in this Regulation, and in particular, with the requirements for qualified trust_service providers and for the qualified trust_services they provide.

If the supervisory body concludes that the trust_service provider and the trust_services provided by it comply with the requirements referred to in the first subparagraph, the supervisory body shall grant qualified status to the trust_service provider and the trust_services it provides and inform the body referred to in Article 22(3) for the purposes of updating the trusted lists referred to in Article 22(1), not later than three months after notification in accordance with paragraph 1 of this Article.

If the verification is not concluded within three months of notification, the supervisory body shall inform the trust_service provider specifying the reasons for the delay and the period within which the verification is to be concluded.

3.   Qualified trust_service providers may begin to provide the qualified trust_service after the qualified status has been indicated in the trusted lists referred to in Article 22(1).

4.   The Commission may, by means of implementing acts, define the formats and procedures for the purpose of paragraphs 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 31

Publication of a list of certified qualified electronic_signature creation devices

1.   Member States shall notify to the Commission without undue delay and no later than one month after the certification is concluded, information on qualified electronic_signature creation devices that have been certified by the bodies referred to in Article 30(1). They shall also notify to the Commission, without undue delay and no later than one month after the certification is cancelled, information on electronic_signature creation devices that are no longer certified.

2.   On the basis of the information received, the Commission shall establish, publish and maintain a list of certified qualified electronic_signature creation devices.

3.   The Commission may, by means of implementing acts, define formats and procedures applicable for the purpose of paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 47

Exercise of the delegation

1.   The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2.   The power to adopt delegated acts referred to in Article 30(4) shall be conferred on the Commission for an indeterminate period of time from 17 September 2014.

3.   The delegation of power referred to in Article 30(4) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4.   As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

5.   A delegated act adopted pursuant to Article 30(4) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

Article 49

Review

The Commission shall review the application of this Regulation and shall report to the European Parliament and to the Council no later than 1 July 2020. The Commission shall evaluate in particular whether it is appropriate to modify the scope of this Regulation or its specific provisions, including Article 6, point (f) of Article 7 and Articles 34, 43, 44 and 45, taking into account the experience gained in the application of this Regulation, as well as technological, market and legal developments.

The report referred to in the first paragraph shall be accompanied, where appropriate, by legislative proposals.

In addition, the Commission shall submit a report to the European Parliament and the Council every four years after the report referred to in the first paragraph on the progress towards achieving the objectives of this Regulation.

Article 51

Transitional measures

1.   Secure signature creation devices of which the conformity has been determined in accordance with Article 3(4) of Directive 1999/93/EC shall be considered as qualified electronic_signature creation devices under this Regulation.

2.   Qualified certificates issued to natural persons under Directive 1999/93/EC shall be considered as qualified certificates for electronic_signatures under this Regulation until they expire.

3.   A certification-service-provider issuing qualified certificates under Directive 1999/93/EC shall submit a conformity assessment report to the supervisory body as soon as possible but not later than 1 July 2017. Until the submission of such a conformity assessment report and the completion of its assessment by the supervisory body, that certification-service-provider shall be considered as qualified trust_service provider under this Regulation.

4.   If a certification-service-provider issuing qualified certificates under Directive 1999/93/EC does not submit a conformity assessment report to the supervisory body within the time limit referred to in paragraph 3, that certification-service-provider shall not be considered as qualified trust_service provider under this Regulation from 2 July 2017.

Article 52

Entry into force

1.   This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

2.   This Regulation shall apply from 1 July 2016, except for the following:

(a)	Articles 8(3), 9(5), 12(2) to (9), 17(8), 19(4), 20(4), 21(4), 22(5), 23(3), 24(5), 27(4) and (5), 28(6), 29(2), 30(3) and (4), 31(3), 32(3), 33(2), 34(2), 37(4) and (5), 38(6), 42(2), 44(2), 45(2), and Articles 47 and 48 shall apply from 17 September 2014;

(b)	Article 7, Article 8(1) and (2), Articles 9, 10, 11 and Article 12(1) shall apply from the date of application of the implementing acts referred to in Articles 8(3) and 12(8);

(c)	Article 6 shall apply from three years as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8).

3.   Where the notified electronic_identification scheme is included in the list published by the Commission pursuant to Article 9 before the date referred to in point (c) of paragraph 2 of this Article, the recognition of the electronic_identification means under that scheme pursuant to Article 6 shall take place no later than 12 months after the publication of that scheme but not before the date referred to in point (c) of paragraph 2 of this Article.

4.   Notwithstanding point (c) of paragraph 2 of this Article, a Member State may decide that electronic_identification means under electronic_identification scheme notified pursuant to Article 9(1) by another Member State are recognised in the first Member State as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8). Member States concerned shall inform the Commission. The Commission shall make this information public.

---

(1)  OJ C 351, 15.11.2012, p. 73.

(2)  Position of the European Parliament of 3 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.

(3)  Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic_signatures (OJ L 13, 19.1.2000, p. 12).

(4)  OJ C 50 E, 21.2.2012, p. 1.

(5)  Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (OJ L 376, 27.12.2006, p. 36).

(6)  Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

(7)  Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(8)  Council Decision 2010/48/EC of 26 November 2009 concerning the conclusion, by the European Community, of the United Nations Convention on the Rights of Persons with Disabilities (OJ L 23, 27.1.2010, p. 35).

(9)  Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, p. 30).

(10)  Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of procedures by electronic means through the ‘points of single contact’ under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 274, 20.10.2009, p. 36).

(11)  Commission Decision 2011/130/EU of 25 February 2011 establishing minimum requirements for the cross-border processing of documents signed electronically by competent authorities under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 53, 26.2.2011, p. 66).

(12)  Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

(13)  Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(14)  OJ C 28, 30.1.2013, p. 6.

(15)  Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC (OJ L 94, 28.3.2014, p. 65).

---

---

---

---