EIDAS 2014/0910 EN

1. When issuing a qualified certificate for a trust_service, a qualified trust_service provider shall verify, by appropriate means and in accordance with national law, the identity and, if applicable, any specific attributes of the natural or legal person to whom the qualified certificate is issued.

The information referred to in the first subparagraph shall be verified by the qualified trust_service provider either directly or by relying on a third party in accordance with national law:

(a)	by the physical presence of the natural person or of an authorised representative of the legal person; or

(b)

remotely, using electronic_identification means, for which prior to the issuance of the qualified certificate, a physical presence of the natural person or of an authorised representative of the legal person was ensured and which meets the requirements set out in Article 8 with regard to the assurance levels ‘substantial’ or ‘high’; or

(c)	by means of a certificate of a qualified electronic_signature or of a qualified electronic_seal issued in compliance with point (a) or (b); or

(d)	by using other identification methods recognised at national level which provide equivalent assurance in terms of reliability to physical presence. The equivalent assurance shall be confirmed by a conformity_assessment_body.

2. A qualified trust_service provider providing qualified trust_services shall:

(a)	inform the supervisory body of any change in the provision of its qualified trust_services and an intention to cease those activities;

(b)

employ staff and, if applicable, subcontractors who possess the necessary expertise, reliability, experience, and qualifications and who have received appropriate training regarding security and personal data protection rules and shall apply administrative and management procedures which correspond to European or international standards;

(c)	with regard to the risk of liability for damages in accordance with Article 13, maintain sufficient financial resources and/or obtain appropriate liability insurance, in accordance with national law;

(d)	before entering into a contractual relationship, inform, in a clear and comprehensive manner, any person seeking to use a qualified trust_service of the precise terms and conditions regarding the use of that service, including any limitations on its use;

(e)	use trustworthy systems and products that are protected against modification and ensure the technical security and reliability of the processes supported by them;

(f)

use trustworthy systems to store data provided to it, in a verifiable form so that:

(i)	they are publicly available for retrieval only where the consent of the person to whom the data relates has been obtained,

(ii)	only authorised persons can make entries and changes to the stored data,

(iii)

the data can be checked for authenticity;

(g)	take appropriate measures against forgery and theft of data;

(h)

record and keep accessible for an appropriate period of time, including after the activities of the qualified trust_service provider have ceased, all relevant information concerning data issued and received by the qualified trust_service provider, in particular, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service. Such recording may be done electronically;

(i)	have an up-to-date termination plan to ensure continuity of service in accordance with provisions verified by the supervisory body under point (i) of Article 17(4);

(j)	ensure lawful processing of personal data in accordance with Directive 95/46/EC;

(k)	in case of qualified trust_service providers issuing qualified certificates, establish and keep updated a certificate database.

3. If a qualified trust_service provider issuing qualified certificates decides to revoke a certificate, it shall register such revocation in its certificate database and publish the revocation status of the certificate in a timely manner, and in any event within 24 hours after the receipt of the request. The revocation shall become effective immediately upon its publication.

4. With regard to paragraph 3, qualified trust_service providers issuing qualified certificates shall provide to any relying_party information on the validity or revocation status of qualified certificates issued by them. This information shall be made available at least on a per certificate basis at any time and beyond the validity period of the certificate in an automated manner that is reliable, free of charge and efficient.

5. The Commission may, by means of implementing acts, establish reference numbers of standards for trustworthy systems and products, which comply with the requirements under points (e) and (f) of paragraph 2 of this Article. Compliance with the requirements laid down in this Article shall be presumed where trustworthy systems and products meet those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 4

Electronic signatures

Article 30

Certification of qualified electronic_signature creation devices

1. Conformity of qualified electronic_signature creation devices with the requirements laid down in Annex II shall be certified by appropriate public or private bodies designated by Member States.

2. Member States shall notify to the Commission the names and addresses of the public or private body referred to in paragraph 1. The Commission shall make that information available to Member States.

3. The certification referred to in paragraph 1 shall be based on one of the following:

(a)	a security evaluation process carried out in accordance with one of the standards for the security assessment of information technology products included in the list established in accordance with the second subparagraph; or

(b)

a process other than the process referred to in point (a), provided that it uses comparable security levels and provided that the public or private body referred to in paragraph 1 notifies that process to the Commission. That process may be used only in the absence of standards referred to in point (a) or when a security evaluation process referred to in point (a) is ongoing.

The Commission shall, by means of implementing acts, establish a list of standards for the security assessment of information technology products referred to in point (a). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

4. The Commission shall be empowered to adopt delegated acts in accordance with Article 47 concerning the establishment of specific criteria to be met by the designated bodies referred to in paragraph 1 of this Article.

Article 33

Qualified validation service for qualified electronic_signatures

1. A qualified validation service for qualified electronic_signatures may only be provided by a qualified trust_service provider who:

(a)	provides validation in compliance with Article 32(1); and

(b)	allows relying parties to receive the result of the validation process in an automated manner, which is reliable, efficient and bears the advanced electronic_signature or advanced electronic_seal of the provider of the qualified validation service.

2. The Commission may, by means of implementing acts, establish reference numbers of standards for qualified validation service referred to in paragraph 1. Compliance with the requirements laid down in paragraph 1 shall be presumed where the validation service for a qualified electronic_signature meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 34

Qualified preservation service for qualified electronic_signatures

1. A qualified preservation service for qualified electronic_signatures may only be provided by a qualified trust_service provider that uses procedures and technologies capable of extending the trustworthiness of the qualified electronic_signature beyond the technological validity period.

2. The Commission may, by means of implementing acts, establish reference numbers of standards for the qualified preservation service for qualified electronic_signatures. Compliance with the requirements laid down in paragraph 1 shall be presumed where the arrangements for the qualified preservation service for qualified electronic_signatures meet those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 5

Electronic seals

Article 47

Exercise of the delegation

1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2. The power to adopt delegated acts referred to in Article 30(4) shall be conferred on the Commission for an indeterminate period of time from 17 September 2014.

3. The delegation of power referred to in Article 30(4) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

5. A delegated act adopted pursuant to Article 30(4) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

Article 52

Entry into force

1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

2. This Regulation shall apply from 1 July 2016, except for the following:

(a)	Articles 8(3), 9(5), 12(2) to (9), 17(8), 19(4), 20(4), 21(4), 22(5), 23(3), 24(5), 27(4) and (5), 28(6), 29(2), 30(3) and (4), 31(3), 32(3), 33(2), 34(2), 37(4) and (5), 38(6), 42(2), 44(2), 45(2), and Articles 47 and 48 shall apply from 17 September 2014;

(b)	Article 7, Article 8(1) and (2), Articles 9, 10, 11 and Article 12(1) shall apply from the date of application of the implementing acts referred to in Articles 8(3) and 12(8);

(c)	Article 6 shall apply from three years as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8).

3. Where the notified electronic_identification scheme is included in the list published by the Commission pursuant to Article 9 before the date referred to in point (c) of paragraph 2 of this Article, the recognition of the electronic_identification means under that scheme pursuant to Article 6 shall take place no later than 12 months after the publication of that scheme but not before the date referred to in point (c) of paragraph 2 of this Article.

4. Notwithstanding point (c) of paragraph 2 of this Article, a Member State may decide that electronic_identification means under electronic_identification scheme notified pursuant to Article 9(1) by another Member State are recognised in the first Member State as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8). Member States concerned shall inform the Commission. The Commission shall make this information public.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 23 July 2014.

For the Parliament

The President

M. SCHULZ

For the Council

The President

S. GOZI

(1) OJ C 351, 15.11.2012, p. 73.

(2) Position of the European Parliament of 3 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.

(3) Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic_signatures (OJ L 13, 19.1.2000, p. 12).

(4) OJ C 50 E, 21.2.2012, p. 1.

(5) Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (OJ L 376, 27.12.2006, p. 36).

(6) Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

(7) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(8) Council Decision 2010/48/EC of 26 November 2009 concerning the conclusion, by the European Community, of the United Nations Convention on the Rights of Persons with Disabilities (OJ L 23, 27.1.2010, p. 35).

(9) Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, p. 30).

(10) Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of procedures by electronic means through the ‘points of single contact’ under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 274, 20.10.2009, p. 36).

(11) Commission Decision 2011/130/EU of 25 February 2011 establishing minimum requirements for the cross-border processing of documents signed electronically by competent authorities under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 53, 26.2.2011, p. 66).

(12) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

(13) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(14) OJ C 28, 30.1.2013, p. 6.

(15) Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC (OJ L 94, 28.3.2014, p. 65).

ANNEX I

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SIGNATURES

Qualified certificates for electronic_signatures shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic_signature;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least, the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)	at least the name of the signatory, or a pseudonym; if a pseudonym is used, it shall be clearly indicated;

(d)	electronic_signature validation_data that corresponds to the electronic_signature creation data;

(e)	details of the beginning and end of the certificate’s period of validity;

(f)	the certificate identity code, which must be unique for the qualified trust_service provider;

(g)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(h)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (g) is available free of charge;

(i)	the location of the services that can be used to enquire about the validity status of the qualified certificate;

(j)	where the electronic_signature creation data related to the electronic_signature validation_data is located in a qualified electronic_signature creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX II

REQUIREMENTS FOR QUALIFIED ELECTRONIC SIGNATURE CREATION DEVICES

Qualified electronic_signature creation devices shall ensure, by appropriate technical and procedural means, that at least:

(a)	the confidentiality of the electronic_signature creation data used for electronic_signature creation is reasonably assured;

(b)	the electronic_signature creation data used for electronic_signature creation can practically occur only once;

(c)	the electronic_signature creation data used for electronic_signature creation cannot, with reasonable assurance, be derived and the electronic_signature is reliably protected against forgery using currently available technology;

(d)	the electronic_signature creation data used for electronic_signature creation can be reliably protected by the legitimate signatory against use by others.

Qualified electronic_signature creation devices shall not alter the data to be signed or prevent such data from being presented to the signatory prior to signing.

Generating or managing electronic_signature creation data on behalf of the signatory may only be done by a qualified trust_service provider.

Without prejudice to point (d) of point 1, qualified trust_service providers managing electronic_signature creation data on behalf of the signatory may duplicate the electronic_signature creation data only for back-up purposes provided the following requirements are met:

(a)	the security of the duplicated datasets must be at the same level as for the original datasets;

(b)	the number of duplicated datasets shall not exceed the minimum needed to ensure continuity of the service.

ANNEX III

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SEALS

Qualified certificates for electronic_seals shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic_seal;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)	at least the name of the creator of the seal and, where applicable, registration number as stated in the official records;

(d)	electronic_seal validation_data, which corresponds to the electronic_seal creation data;

(e)	details of the beginning and end of the certificate’s period of validity;

(f)	the certificate identity code, which must be unique for the qualified trust_service provider;

(g)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(h)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (g) is available free of charge;

(i)	the location of the services that can be used to enquire as to the validity status of the qualified certificate;

(j)	where the electronic_seal creation data related to the electronic_seal validation_data is located in a qualified electronic_seal creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX IV

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR WEBSITE AUTHENTICATION

Qualified certificates for website authentication shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for website authentication;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)

for natural persons: at least the name of the person to whom the certificate has been issued, or a pseudonym. If a pseudonym is used, it shall be clearly indicated;

for legal persons: at least the name of the legal person to whom the certificate is issued and, where applicable, registration number as stated in the official records;

(d)	elements of the address, including at least city and State, of the natural or legal person to whom the certificate is issued and, where applicable, as stated in the official records;

(e)	the domain name(s) operated by the natural or legal person to whom the certificate is issued;

(f)	details of the beginning and end of the certificate’s period of validity;

(g)	the certificate identity code, which must be unique for the qualified trust_service provider;

(h)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(i)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (h) is available free of charge;

(j)	the location of the certificate validity status services that can be used to enquire as to the validity status of the qualified certificate.

whereas

name='idcons11'>

(11) This Regulation should be applied in full compliance with the principles relating to the protection of personal data provided for in Directive 95/46/EC of the European Parliament and of the Council (7).
In this respect, having regard to the principle of mutual recognition established by this Regulation, authentication for an online service should concern processing of only those identification data that are adequate, relevant and not excessive to grant access to that service online.
Furthermore, requirements under Directive 95/46/EC concerning confidentiality and security of processing should be respected by trust_service providers and supervisory bodies.

- = -

name='idcons14'>

(14) Some conditions need to be set out in this Regulation with regard to which electronic_identification means have to be recognised and how the electronic_identification schemes should be notified.
Those conditions should help Member States to build the necessary trust in each other’s electronic_identification schemes and to mutually recognise electronic_identification means falling under their notified schemes.
The principle of mutual recognition should apply if the notifying Member State’s electronic_identification scheme meets the conditions of notification and the notification was published in the Official Journal of the European Union.
However, the principle of mutual recognition should only relate to authentication for an online service.
The access to those online services and their final delivery to the applicant should be closely linked to the right to receive such services under the conditions set out in national legislation.

- = -

name='idcons15'>

(15) The obligation to recognise electronic_identification means should relate only to those means the identity assurance level of which corresponds to the level equal to or higher than the level required for the online service in question.
In addition, that obligation should only apply when the public_sector_body in question uses the assurance level ‘substantial’ or ‘high’ in relation to accessing that service online.
Member States should remain free, in accordance with Union law, to recognise electronic_identification means having lower identity assurance levels.

- = -

name='idcons21'>

(21) This Regulation should also establish a general legal framework for the use of trust_services.
However, it should not create a general obligation to use them or to install an access point for all existing trust_services.
In particular, it should not cover the provision of services used exclusively within closed systems between a defined set of participants, which have no effect on third parties.
For example, systems set up in businesses or public administrations to manage internal procedures making use of trust_services should not be subject to the requirements of this Regulation.
only trust_services provided to the public having effects on third parties should meet the requirements laid down in the Regulation.
Neither should this Regulation cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards form laid down by national or Union law.
In addition, it should not affect national form requirements pertaining to public registers, in particular commercial and land registers.

- = -

name='idcons23'>

(23) To the extent that this Regulation creates an obligation to recognise a trust_service, such a trust_service may only be rejected if the addressee of the obligation is unable to read or verify it due to technical reasons lying outside the immediate control of the addressee.
However, that obligation should not in itself require a public body to obtain the hardware and software necessary for the technical readability of all existing trust_services.

- = -

name='idcons36'>

(36) Establishing a supervisory regime for all trust_service providers should ensure a level playing field for the security and accountability of their operations and services, thus contributing to the protection of users and to the functioning of the internal market.
Non-qualified trust_service providers should be subject to a light touch and reactive ex post supervisory activities justified by the nature of their services and operations.
The supervisory body should therefore have no general obligation to supervise non-qualified service providers.
The supervisory body should only take action when it is informed (for example, by the non-qualified trust_service provider itself, by another supervisory body, by a notification from a user or a business partner or on the basis of its own investigation) that a non-qualified trust_service provider does not comply with the requirements of this Regulation.

- = -

name='idcons55'>

(55) IT security certification based on international standards such as ISO 15408 and related evaluation methods and mutual recognition arrangements is an important tool for verifying the security of qualified electronic_signature creation devices and should be promoted.
However, innovative solutions and services such as mobile signing and cloud signing rely on technical and organisational solutions for qualified electronic_signature creation devices for which security standards may not yet be available or for which the first IT security certification is ongoing.
The level of security of such qualified electronic_signature creation devices could be evaluated by using alternative processes only where such security standards are not available or where the first IT security certification is ongoing.
Those processes should be comparable to the standards for IT security certification insofar as their security levels are equivalent.
Those processes could be facilitated by a peer review.

- = -

name='idcons63'>

(63) Electronic documents are important for further development of cross-border electronic transactions in the internal market.
This Regulation should establish the principle that an electronic_document should not be denied legal effect on the grounds that it is in an electronic form in order to ensure that an electronic transaction will not be rejected only on the grounds that a document is in electronic form.

- = -

name='idcons67'>

(67) Website authentication services provide a means by which a visitor to a website can be assured that there is a genuine and legitimate entity standing behind the website.
Those services contribute to the building of trust and confidence in conducting business online, as users will have confidence in a website that has been authenticated.
The provision and the use of website authentication services are entirely voluntary.
However, in order for website authentication to become a means to boosting trust, providing a better experience for the user and furthering growth in the internal market, this Regulation should lay down minimal security and liability obligations for the providers and their services.
To that end, the results of existing industry-led initiatives, for example the Certification Authorities/Browsers Forum — CA/B Forum, have been taken into account.
In addition, this Regulation should not impede the use of other means or methods to authenticate a website not falling under this Regulation nor should it prevent third country providers of website authentication services from providing their services to customers in the Union.
However, a third country provider should only have its website authentication services recognised as qualified in accordance with this Regulation, if an international agreement between the Union and the country of establishment of the provider has been concluded.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN