EIDAS 2014/0910 EN

1. When an electronic_identification using an electronic_identification means and authentication is required under national law or by administrative practice to access a service provided by a public_sector_body online in one Member State, the electronic_identification means issued in another Member State shall be recognised in the first Member State for the purposes of cross-border authentication for that service online, provided that the following conditions are met:

(a)	the electronic_identification means is issued under an electronic_identification scheme that is included in the list published by the Commission pursuant to Article 9;

(b)

the assurance level of the electronic_identification means corresponds to an assurance level equal to or higher than the assurance level required by the relevant public_sector_body to access that service online in the first Member State, provided that the assurance level of that electronic_identification means corresponds to the assurance level substantial or high;

(c)	the relevant public_sector_body uses the assurance level substantial or high in relation to accessing that service online.

Such recognition shall take place no later than 12 months after the Commission publishes the list referred to in point (a) of the first subparagraph.

2. An electronic_identification means which is issued under an electronic_identification scheme included in the list published by the Commission pursuant to Article 9 and which corresponds to the assurance level low may be recognised by public sector bodies for the purposes of cross-border authentication for the service provided online by those bodies.

Article 7

Eligibility for notification of electronic_identification schemes

An electronic_identification scheme shall be eligible for notification pursuant to Article 9(1) provided that all of the following conditions are met:

(a)

the electronic_identification means under the electronic_identification scheme are issued:

(i)	by the notifying Member State;

(ii)	under a mandate from the notifying Member State; or

(iii)

independently of the notifying Member State and are recognised by that Member State;

(b)	the electronic_identification means under the electronic_identification scheme can be used to access at least one service which is provided by a public_sector_body and which requires electronic_identification in the notifying Member State;

(c)	the electronic_identification scheme and the electronic_identification means issued thereunder meet the requirements of at least one of the assurance levels set out in the implementing act referred to in Article 8(3);

(d)

the notifying Member State ensures that the person_identification_data uniquely representing the person in question is attributed, in accordance with the technical specifications, standards and procedures for the relevant assurance level set out in the implementing act referred to in Article 8(3), to the natural or legal person referred to in point 1 of Article 3 at the time the electronic_identification means under that scheme is issued;

(e)

the party issuing the electronic_identification means under that scheme ensures that the electronic_identification means is attributed to the person referred to in point (d) of this Article in accordance with the technical specifications, standards and procedures for the relevant assurance level set out in the implementing act referred to in Article 8(3);

(f)

the notifying Member State ensures the availability of authentication online, so that any relying_party established in the territory of another Member State is able to confirm the person_identification_data received in electronic form.

For relying parties other than public sector bodies the notifying Member State may define terms of access to that authentication. The cross-border authentication shall be provided free of charge when it is carried out in relation to a service online provided by a public_sector_body.

Member States shall not impose any specific disproportionate technical requirements on relying parties intending to carry out such authentication, where such requirements prevent or significantly impede the interoperability of the notified electronic_identification schemes;

(g)

at least six months prior to the notification pursuant to Article 9(1), the notifying Member State provides the other Member States for the purposes of the obligation under Article 12(5) a description of that scheme in accordance with the procedural arrangements established by the implementing acts referred to in Article 12(7);

(h)	the electronic_identification scheme meets the requirements set out in the implementing act referred to in Article 12(8).

Article 8

Assurance levels of electronic_identification schemes

1. An electronic_identification scheme notified pursuant to Article 9(1) shall specify assurance levels low, substantial and/or high for electronic_identification means issued under that scheme.

2. The assurance levels low, substantial and high shall meet respectively the following criteria:

(a)

assurance level low shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a limited degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of misuse or alteration of the identity;

(b)

assurance level substantial shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a substantial degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of misuse or alteration of the identity;

(c)

assurance level high shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a higher degree of confidence in the claimed or asserted identity of a person than electronic_identification means with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent misuse or alteration of the identity.

3. By 18 September 2015, taking into account relevant international standards and subject to paragraph 2, the Commission shall, by means of implementing acts, set out minimum technical specifications, standards and procedures with reference to which assurance levels low, substantial and high are specified for electronic_identification means for the purposes of paragraph 1.

Those minimum technical specifications, standards and procedures shall be set out by reference to the reliability and quality of the following elements:

(a)	the procedure to prove and verify the identity of natural or legal persons applying for the issuance of electronic_identification means;

(b)	the procedure for the issuance of the requested electronic_identification means;

(c)	the authentication mechanism, through which the natural or legal person uses the electronic_identification means to confirm its identity to a relying_party;

(d)	the entity issuing the electronic_identification means;

(e)	any other body involved in the application for the issuance of the electronic_identification means; and

(f)	the technical and security specifications of the issued electronic_identification means.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 9

Notification

1. The notifying Member State shall notify to the Commission the following information and, without undue delay, any subsequent changes thereto:

(a)	a description of the electronic_identification scheme, including its assurance levels and the issuer or issuers of electronic_identification means under the scheme;

(b)

the applicable supervisory regime and information on the liability regime with respect to the following:

(i)	the party issuing the electronic_identification means; and

(ii)	the party operating the authentication procedure;

(c)	the authority or authorities responsible for the electronic_identification scheme;

(d)	information on the entity or entities which manage the registration of the unique person_identification_data;

(e)	a description of how the requirements set out in the implementing acts referred to in Article 12(8) are met;

(f)	a description of the authentication referred to in point (f) of Article 7;

(g)	arrangements for suspension or revocation of either the notified electronic_identification scheme or authentication or the compromised parts concerned.

2. One year from the date of application of the implementing acts referred to in Articles 8(3) and 12(8), the Commission shall publish in the Official Journal of the European Union a list of the electronic_identification schemes which were notified pursuant to paragraph 1 of this Article and the basic information thereon.

3. If the Commission receives a notification after the expiry of the period referred to in paragraph 2, it shall publish in the Official Journal of the European Union the amendments to the list referred to in paragraph 2 within two months from the date of receipt of that notification.

4. A Member State may submit to the Commission a request to remove an electronic_identification scheme notified by that Member State from the list referred to in paragraph 2. The Commission shall publish in the Official Journal of the European Union the corresponding amendments to the list within one month from the date of receipt of the Member State’s request.

5. The Commission may, by means of implementing acts, define the circumstances, formats and procedures of notifications under paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 10

Security breach

1. Where either the electronic_identification scheme notified pursuant to Article 9(1) or the authentication referred to in point (f) of Article 7 is breached or partly compromised in a manner that affects the reliability of the cross-border authentication of that scheme, the notifying Member State shall, without delay, suspend or revoke that cross-border authentication or the compromised parts concerned, and shall inform other Member States and the Commission.

2. When the breach or compromise referred to in paragraph 1 is remedied, the notifying Member State shall re-establish the cross-border authentication and shall inform other Member States and the Commission without undue delay.

3. If the breach or compromise referred to in paragraph 1 is not remedied within three months of the suspension or revocation, the notifying Member State shall notify other Member States and the Commission of the withdrawal of the electronic_identification scheme.

The Commission shall publish in the Official Journal of the European Union the corresponding amendments to the list referred to in Article 9(2) without undue delay.

Article 11

Liability

1. The notifying Member State shall be liable for damage caused intentionally or negligently to any natural or legal person due to a failure to comply with its obligations under points (d) and (f) of Article 7 in a cross-border transaction.

2. The party issuing the electronic_identification means shall be liable for damage caused intentionally or negligently to any natural or legal person due to a failure to comply with the obligation referred to in point (e) of Article 7 in a cross-border transaction.

3. The party operating the authentication procedure shall be liable for damage caused intentionally or negligently to any natural or legal person due to a failure to ensure the correct operation of the authentication referred to in point (f) of Article 7 in a cross-border transaction.

4. Paragraphs 1, 2 and 3 shall be applied in accordance with national rules on liability.

5. Paragraphs 1, 2 and 3 are without prejudice to the liability under national law of parties to a transaction in which electronic_identification means falling under the electronic_identification scheme notified pursuant to Article 9(1) are used.

Article 12

Cooperation and interoperability

1. The national electronic_identification schemes notified pursuant to Article 9(1) shall be interoperable.

2. For the purposes of paragraph 1, an interoperability framework shall be established.

3. The interoperability framework shall meet the following criteria:

(a)	it aims to be technology neutral and does not discriminate between any specific national technical solutions for electronic_identification within a Member State;

(b)	it follows European and international standards, where possible;

(c)	it facilitates the implementation of the principle of privacy by design; and

(d)	it ensures that personal data is processed in accordance with Directive 95/46/EC.

4. The interoperability framework shall consist of:

(a)	a reference to minimum technical requirements related to the assurance levels under Article 8;

(b)	a mapping of national assurance levels of notified electronic_identification schemes to the assurance levels under Article 8;

(c)	a reference to minimum technical requirements for interoperability;

(d)	a reference to a minimum set of person_identification_data uniquely representing a natural or legal person, which is available from electronic_identification schemes;

(e)	rules of procedure;

(f)	arrangements for dispute resolution; and

(g)	common operational security standards.

5. Member States shall cooperate with regard to the following:

(a)	the interoperability of the electronic_identification schemes notified pursuant to Article 9(1) and the electronic_identification schemes which Member States intend to notify; and

(b)	the security of the electronic_identification schemes.

6. The cooperation between Member States shall consist of:

(a)	the exchange of information, experience and good practice as regards electronic_identification schemes and in particular technical requirements related to interoperability and assurance levels;

(b)	the exchange of information, experience and good practice as regards working with assurance levels of electronic_identification schemes under Article 8;

(c)	peer review of electronic_identification schemes falling under this Regulation; and

(d)	examination of relevant developments in the electronic_identification sector.

7. By 18 March 2015, the Commission shall, by means of implementing acts, establish the necessary procedural arrangements to facilitate the cooperation between the Member States referred to in paragraphs 5 and 6 with a view to fostering a high level of trust and security appropriate to the degree of risk.

8. By 18 September 2015, for the purpose of setting uniform conditions for the implementation of the requirement under paragraph 1, the Commission shall, subject to the criteria set out in paragraph 3 and taking into account the results of the cooperation between Member States, adopt implementing acts on the interoperability framework as set out in paragraph 4.

9. The implementing acts referred to in paragraphs 7 and 8 of this Article shall be adopted in accordance with the examination procedure referred to in Article 48(2).

CHAPTER III

TRUST SERVICES

SECTION 1

General provisions

Article 47

Exercise of the delegation

1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2. The power to adopt delegated acts referred to in Article 30(4) shall be conferred on the Commission for an indeterminate period of time from 17 September 2014.

3. The delegation of power referred to in Article 30(4) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

5. A delegated act adopted pursuant to Article 30(4) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

Article 52

Entry into force

1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

2. This Regulation shall apply from 1 July 2016, except for the following:

(a)	Articles 8(3), 9(5), 12(2) to (9), 17(8), 19(4), 20(4), 21(4), 22(5), 23(3), 24(5), 27(4) and (5), 28(6), 29(2), 30(3) and (4), 31(3), 32(3), 33(2), 34(2), 37(4) and (5), 38(6), 42(2), 44(2), 45(2), and Articles 47 and 48 shall apply from 17 September 2014;

(b)	Article 7, Article 8(1) and (2), Articles 9, 10, 11 and Article 12(1) shall apply from the date of application of the implementing acts referred to in Articles 8(3) and 12(8);

(c)	Article 6 shall apply from three years as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8).

3. Where the notified electronic_identification scheme is included in the list published by the Commission pursuant to Article 9 before the date referred to in point (c) of paragraph 2 of this Article, the recognition of the electronic_identification means under that scheme pursuant to Article 6 shall take place no later than 12 months after the publication of that scheme but not before the date referred to in point (c) of paragraph 2 of this Article.

4. Notwithstanding point (c) of paragraph 2 of this Article, a Member State may decide that electronic_identification means under electronic_identification scheme notified pursuant to Article 9(1) by another Member State are recognised in the first Member State as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8). Member States concerned shall inform the Commission. The Commission shall make this information public.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 23 July 2014.

For the Parliament

The President

M. SCHULZ

For the Council

The President

S. GOZI

(1) OJ C 351, 15.11.2012, p. 73.

(2) Position of the European Parliament of 3 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.

(3) Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic_signatures (OJ L 13, 19.1.2000, p. 12).

(4) OJ C 50 E, 21.2.2012, p. 1.

(5) Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (OJ L 376, 27.12.2006, p. 36).

(6) Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

(7) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(8) Council Decision 2010/48/EC of 26 November 2009 concerning the conclusion, by the European Community, of the United Nations Convention on the Rights of Persons with Disabilities (OJ L 23, 27.1.2010, p. 35).

(9) Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, p. 30).

(10) Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of procedures by electronic means through the ‘points of single contact’ under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 274, 20.10.2009, p. 36).

(11) Commission Decision 2011/130/EU of 25 February 2011 establishing minimum requirements for the cross-border processing of documents signed electronically by competent authorities under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 53, 26.2.2011, p. 66).

(12) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

(13) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(14) OJ C 28, 30.1.2013, p. 6.

(15) Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC (OJ L 94, 28.3.2014, p. 65).

ANNEX I

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SIGNATURES

Qualified certificates for electronic_signatures shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic_signature;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least, the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)	at least the name of the signatory, or a pseudonym; if a pseudonym is used, it shall be clearly indicated;

(d)	electronic_signature validation_data that corresponds to the electronic_signature creation data;

(e)	details of the beginning and end of the certificate’s period of validity;

(f)	the certificate identity code, which must be unique for the qualified trust_service provider;

(g)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(h)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (g) is available free of charge;

(i)	the location of the services that can be used to enquire about the validity status of the qualified certificate;

(j)	where the electronic_signature creation data related to the electronic_signature validation_data is located in a qualified electronic_signature creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX II

REQUIREMENTS FOR QUALIFIED ELECTRONIC SIGNATURE CREATION DEVICES

Qualified electronic_signature creation devices shall ensure, by appropriate technical and procedural means, that at least:

(a)	the confidentiality of the electronic_signature creation data used for electronic_signature creation is reasonably assured;

(b)	the electronic_signature creation data used for electronic_signature creation can practically occur only once;

(c)	the electronic_signature creation data used for electronic_signature creation cannot, with reasonable assurance, be derived and the electronic_signature is reliably protected against forgery using currently available technology;

(d)	the electronic_signature creation data used for electronic_signature creation can be reliably protected by the legitimate signatory against use by others.

Qualified electronic_signature creation devices shall not alter the data to be signed or prevent such data from being presented to the signatory prior to signing.

Generating or managing electronic_signature creation data on behalf of the signatory may only be done by a qualified trust_service provider.

Without prejudice to point (d) of point 1, qualified trust_service providers managing electronic_signature creation data on behalf of the signatory may duplicate the electronic_signature creation data only for back-up purposes provided the following requirements are met:

(a)	the security of the duplicated datasets must be at the same level as for the original datasets;

(b)	the number of duplicated datasets shall not exceed the minimum needed to ensure continuity of the service.

ANNEX III

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SEALS

Qualified certificates for electronic_seals shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic_seal;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)	at least the name of the creator of the seal and, where applicable, registration number as stated in the official records;

(d)	electronic_seal validation_data, which corresponds to the electronic_seal creation data;

(e)	details of the beginning and end of the certificate’s period of validity;

(f)	the certificate identity code, which must be unique for the qualified trust_service provider;

(g)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(h)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (g) is available free of charge;

(i)	the location of the services that can be used to enquire as to the validity status of the qualified certificate;

(j)	where the electronic_seal creation data related to the electronic_seal validation_data is located in a qualified electronic_seal creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX IV

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR WEBSITE AUTHENTICATION

Qualified certificates for website authentication shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for website authentication;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)

for natural persons: at least the name of the person to whom the certificate has been issued, or a pseudonym. If a pseudonym is used, it shall be clearly indicated;

for legal persons: at least the name of the legal person to whom the certificate is issued and, where applicable, registration number as stated in the official records;

(d)	elements of the address, including at least city and State, of the natural or legal person to whom the certificate is issued and, where applicable, as stated in the official records;

(e)	the domain name(s) operated by the natural or legal person to whom the certificate is issued;

(f)	details of the beginning and end of the certificate’s period of validity;

(g)	the certificate identity code, which must be unique for the qualified trust_service provider;

(h)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(i)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (h) is available free of charge;

(j)	the location of the certificate validity status services that can be used to enquire as to the validity status of the qualified certificate.

whereas

(33) Provisions on the use of pseudonyms in certificates should not prevent Member States from requiring identification of persons pursuant to Union or national law.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN