EIDAS 2014/0910 EN

1. When an electronic_identification using an electronic_identification means and authentication is required under national law or by administrative practice to access a service provided by a public_sector_body online in one Member State, the electronic_identification means issued in another Member State shall be recognised in the first Member State for the purposes of cross-border authentication for that service online, provided that the following conditions are met:

(a)	the electronic_identification means is issued under an electronic_identification scheme that is included in the list published by the Commission pursuant to Article 9;

(b)

the assurance level of the electronic_identification means corresponds to an assurance level equal to or higher than the assurance level required by the relevant public_sector_body to access that service online in the first Member State, provided that the assurance level of that electronic_identification means corresponds to the assurance level substantial or high;

(c)	the relevant public_sector_body uses the assurance level substantial or high in relation to accessing that service online.

Such recognition shall take place no later than 12 months after the Commission publishes the list referred to in point (a) of the first subparagraph.

2. An electronic_identification means which is issued under an electronic_identification scheme included in the list published by the Commission pursuant to Article 9 and which corresponds to the assurance level low may be recognised by public sector bodies for the purposes of cross-border authentication for the service provided online by those bodies.

Article 12

Cooperation and interoperability

1. The national electronic_identification schemes notified pursuant to Article 9(1) shall be interoperable.

2. For the purposes of paragraph 1, an interoperability framework shall be established.

3. The interoperability framework shall meet the following criteria:

(a)	it aims to be technology neutral and does not discriminate between any specific national technical solutions for electronic_identification within a Member State;

(b)	it follows European and international standards, where possible;

(c)	it facilitates the implementation of the principle of privacy by design; and

(d)	it ensures that personal data is processed in accordance with Directive 95/46/EC.

4. The interoperability framework shall consist of:

(a)	a reference to minimum technical requirements related to the assurance levels under Article 8;

(b)	a mapping of national assurance levels of notified electronic_identification schemes to the assurance levels under Article 8;

(c)	a reference to minimum technical requirements for interoperability;

(d)	a reference to a minimum set of person_identification_data uniquely representing a natural or legal person, which is available from electronic_identification schemes;

(e)	rules of procedure;

(f)	arrangements for dispute resolution; and

(g)	common operational security standards.

5. Member States shall cooperate with regard to the following:

(a)	the interoperability of the electronic_identification schemes notified pursuant to Article 9(1) and the electronic_identification schemes which Member States intend to notify; and

(b)	the security of the electronic_identification schemes.

6. The cooperation between Member States shall consist of:

(a)	the exchange of information, experience and good practice as regards electronic_identification schemes and in particular technical requirements related to interoperability and assurance levels;

(b)	the exchange of information, experience and good practice as regards working with assurance levels of electronic_identification schemes under Article 8;

(c)	peer review of electronic_identification schemes falling under this Regulation; and

(d)	examination of relevant developments in the electronic_identification sector.

7. By 18 March 2015, the Commission shall, by means of implementing acts, establish the necessary procedural arrangements to facilitate the cooperation between the Member States referred to in paragraphs 5 and 6 with a view to fostering a high level of trust and security appropriate to the degree of risk.

8. By 18 September 2015, for the purpose of setting uniform conditions for the implementation of the requirement under paragraph 1, the Commission shall, subject to the criteria set out in paragraph 3 and taking into account the results of the cooperation between Member States, adopt implementing acts on the interoperability framework as set out in paragraph 4.

9. The implementing acts referred to in paragraphs 7 and 8 of this Article shall be adopted in accordance with the examination procedure referred to in Article 48(2).

CHAPTER III

TRUST SERVICES

SECTION 1

General provisions

Article 18

Mutual assistance

1. Supervisory bodies shall cooperate with a view to exchanging good practice.

A supervisory body shall, upon receipt of a justified request from another supervisory body, provide that body with assistance so that the activities of supervisory bodies can be carried out in a consistent manner. Mutual assistance may cover, in particular, information requests and supervisory measures, such as requests to carry out inspections related to the conformity assessment reports as referred to in Articles 20 and 21.

2. A supervisory body to which a request for assistance is addressed may refuse that request on any of the following grounds:

(a)	the supervisory body is not competent to provide the requested assistance;

(b)	the requested assistance is not proportionate to supervisory activities of the supervisory body carried out in accordance with Article 17;

(c)	providing the requested assistance would be incompatible with this Regulation.

3. Where appropriate, Member States may authorise their respective supervisory bodies to carry out joint investigations in which staff from other Member States’ supervisory bodies is involved. The arrangements and procedures for such joint actions shall be agreed upon and established by the Member States concerned in accordance with their national law.

Article 27

Electronic signatures in public services

1. If a Member State requires an advanced electronic_signature to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_signatures, advanced electronic_signatures based on a qualified certificate for electronic_signatures, and qualified electronic_signatures in at least the formats or using methods defined in the implementing acts referred to in paragraph 5.

2. If a Member State requires an advanced electronic_signature based on a qualified certificate to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_signatures based on a qualified certificate and qualified electronic_signatures in at least the formats or using methods defined in the implementing acts referred to in paragraph 5.

3. Member States shall not request for cross-border use in an online service offered by a public_sector_body an electronic_signature at a higher security level than the qualified electronic_signature.

4. The Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic_signatures. Compliance with the requirements for advanced electronic_signatures referred to in paragraphs 1 and 2 of this Article and in Article 26 shall be presumed when an advanced electronic_signature meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

5. By 18 September 2015, and taking into account existing practices, standards and Union legal acts, the Commission shall, by means of implementing acts, define reference formats of advanced electronic_signatures or reference methods where alternative formats are used. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 37

Electronic seals in public services

1. If a Member State requires an advanced electronic_seal in order to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_seals, advanced electronic_seals based on a qualified certificate for electronic_seals and qualified electronic_seals at least in the formats or using methods defined in the implementing acts referred to in paragraph 5.

2. If a Member State requires an advanced electronic_seal based on a qualified certificate in order to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_seals based on a qualified certificate and qualified electronic_seal at least in the formats or using methods defined in the implementing acts referred to in paragraph 5.

3. Member States shall not request for the cross-border use in an online service offered by a public_sector_body an electronic_seal at a higher security level than the qualified electronic_seal.

4. The Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic_seals. Compliance with the requirements for advanced electronic_seals referred to in paragraphs 1 and 2 of this Article and Article 36 shall be presumed when an advanced electronic_seal meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

5. By 18 September 2015, and taking into account existing practices, standards and legal acts of the Union, the Commission shall, by means of implementing acts, define reference formats of advanced electronic_seals or reference methods where alternative formats are used. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

whereas

(20) Cooperation by Member States should facilitate the technical interoperability of the notified electronic_identification schemes with a view to fostering a high level of trust and security appropriate to the degree of risk.
The exchange of information and the sharing of best practices between Member States with a view to their mutual recognition should help such cooperation.

- = -

(32) It should be incumbent on all trust_service providers to apply good security practice appropriate to the risks related to their activities so as to boost users’ trust in the single market.

- = -

(34) All Member States should follow common essential supervision requirements to ensure a comparable security level of qualified trust_services.
To ease the consistent application of those requirements across the Union, Member States should adopt comparable procedures and should exchange information on their supervision activities and best practices in the field.

- = -

(40) To enable the Commission and the Member States to assess the effectiveness of the enhanced supervision mechanism introduced by this Regulation, supervisory bodies should be requested to report on their activities.
This would be instrumental in facilitating the exchange of good practice between supervisory bodies and would ensure the verification of the consistent and efficient implementation of the essential supervision requirements in all Member States.

- = -

(53) The suspension of qualified certificates is an established operational practice of trust_service providers in a number of Member States, which is different from revocation and entails the temporary loss of validity of a certificate.
Legal certainty calls for the suspension status of a certificate to always be clearly indicated.
To that end, trust_service providers should have the responsibility to clearly indicate the status of the certificate and, if suspended, the precise period of time during which the certificate has been suspended.
This Regulation should not impose the use of suspension on trust_service providers or Member States, but should provide for transparency rules when and where such a practice is available.

- = -

(64) When addressing formats of advanced electronic_signatures and seals, the Commission should build on existing practices, standards and legislation, in particular Commission Decision 2011/130/EU (11).

- = -

(69) The Union institutions, bodies, offices and agencies are encouraged to recognise electronic_identification and trust_services covered by this Regulation for the purpose of administrative cooperation capitalising, in particular, on existing good practices and the results of ongoing projects in the areas covered by this Regulation.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN