keyboard_tab EIDAS 2014/0910 EN

whereas recognised:

• whereas (9) 2
• whereas (14) 1
• whereas (67) 1

definitions:

• electronic identification
• electronic identification means
• person identification data
• electronic identification scheme
• authentication
• relying party
• public sector body
• body governed by public law
• signatory
• electronic signature
• advanced electronic signature
• qualified electronic signature
• electronic signature creation data
• certificate for electronic signature
• qualified certificate for electronic signature
• trust service
• qualified trust service
• conformity assessment body
• trust service provider
• qualified trust service provider
• product
• electronic signature creation device
• qualified electronic signature creation device
• creator of a seal
• electronic seal
• advanced electronic seal
• qualified electronic seal
• electronic seal creation data
• certificate for electronic seal
• qualified certificate for electronic seal
• electronic seal creation device
• qualified electronic seal creation device
• electronic time stamp
• qualified electronic time stamp
• electronic document
• electronic registered delivery service
• qualified electronic registered delivery service
• certificate for website authentication
• qualified certificate for website authentication
• validation data
• validation

Article 6

Mutual recognition

1.   When an electronic_identification using an electronic_identification means and authentication is required under national law or by administrative practice to access a service provided by a public_sector_body online in one Member State, the electronic_identification means issued in another Member State shall be recognised in the first Member State for the purposes of cross-border authentication for that service online, provided that the following conditions are met:

(a)	the electronic_identification means is issued under an electronic_identification scheme that is included in the list published by the Commission pursuant to Article 9;

(b)

the assurance level of the electronic_identification means corresponds to an assurance level equal to or higher than the assurance level required by the relevant public_sector_body to access that service online in the first Member State, provided that the assurance level of that electronic_identification means corresponds to the assurance level substantial or high;

(c)	the relevant public_sector_body uses the assurance level substantial or high in relation to accessing that service online.

Such recognition shall take place no later than 12 months after the Commission publishes the list referred to in point (a) of the first subparagraph.

2.   An electronic_identification means which is issued under an electronic_identification scheme included in the list published by the Commission pursuant to Article 9 and which corresponds to the assurance level low may be recognised by public sector bodies for the purposes of cross-border authentication for the service provided online by those bodies.

Article 7

Eligibility for notification of electronic_identification schemes

An electronic_identification scheme shall be eligible for notification pursuant to Article 9(1) provided that all of the following conditions are met:

(a)	the electronic_identification means under the electronic_identification scheme are issued: (i) by the notifying Member State; (ii) under a mandate from the notifying Member State; or (iii) independently of the notifying Member State and are recognised by that Member State;

(b)	the electronic_identification means under the electronic_identification scheme can be used to access at least one service which is provided by a public_sector_body and which requires electronic_identification in the notifying Member State;

(c)	the electronic_identification scheme and the electronic_identification means issued thereunder meet the requirements of at least one of the assurance levels set out in the implementing act referred to in Article 8(3);

(d)

the notifying Member State ensures that the person_identification_data uniquely representing the person in question is attributed, in accordance with the technical specifications, standards and procedures for the relevant assurance level set out in the implementing act referred to in Article 8(3), to the natural or legal person referred to in point 1 of Article 3 at the time the electronic_identification means under that scheme is issued;

(e)

the party issuing the electronic_identification means under that scheme ensures that the electronic_identification means is attributed to the person referred to in point (d) of this Article in accordance with the technical specifications, standards and procedures for the relevant assurance level set out in the implementing act referred to in Article 8(3);

(f)

the notifying Member State ensures the availability of authentication online, so that any relying_party established in the territory of another Member State is able to confirm the person_identification_data received in electronic form. For relying parties other than public sector bodies the notifying Member State may define terms of access to that authentication. The cross-border authentication shall be provided free of charge when it is carried out in relation to a service online provided by a public_sector_body. Member States shall not impose any specific disproportionate technical requirements on relying parties intending to carry out such authentication, where such requirements prevent or significantly impede the interoperability of the notified electronic_identification schemes;

(g)

at least six months prior to the notification pursuant to Article 9(1), the notifying Member State provides the other Member States for the purposes of the obligation under Article 12(5) a description of that scheme in accordance with the procedural arrangements established by the implementing acts referred to in Article 12(7);

(h)	the electronic_identification scheme meets the requirements set out in the implementing act referred to in Article 12(8).

Article 14

International aspects

1.   Trust services provided by trust_service providers established in a third country shall be recognised as legally equivalent to qualified trust_services provided by qualified trust_service providers established in the Union where the trust_services originating from the third country are recognised under an agreement concluded between the Union and the third country in question or an international organisation in accordance with Article 218 TFEU.

2.   Agreements referred to in paragraph 1 shall ensure, in particular, that:

(a)

the requirements applicable to qualified trust_service providers established in the Union and the qualified trust_services they provide are met by the trust_service providers in the third country or international organisations with which the agreement is concluded, and by the trust_services they provide;

(b)	the qualified trust_services provided by qualified trust_service providers established in the Union are recognised as legally equivalent to trust_services provided by trust_service providers in the third country or international organisation with which the agreement is concluded.

Article 24

Requirements for qualified trust_service providers

1.   When issuing a qualified certificate for a trust_service, a qualified trust_service provider shall verify, by appropriate means and in accordance with national law, the identity and, if applicable, any specific attributes of the natural or legal person to whom the qualified certificate is issued.

The information referred to in the first subparagraph shall be verified by the qualified trust_service provider either directly or by relying on a third party in accordance with national law:

(a)	by the physical presence of the natural person or of an authorised representative of the legal person; or

(b)

remotely, using electronic_identification means, for which prior to the issuance of the qualified certificate, a physical presence of the natural person or of an authorised representative of the legal person was ensured and which meets the requirements set out in Article 8 with regard to the assurance levels ‘substantial’ or ‘high’; or

(c)	by means of a certificate of a qualified electronic_signature or of a qualified electronic_seal issued in compliance with point (a) or (b); or

(d)	by using other identification methods recognised at national level which provide equivalent assurance in terms of reliability to physical presence. The equivalent assurance shall be confirmed by a conformity_assessment_body.

2.   A qualified trust_service provider providing qualified trust_services shall:

(a)	inform the supervisory body of any change in the provision of its qualified trust_services and an intention to cease those activities;

(b)

employ staff and, if applicable, subcontractors who possess the necessary expertise, reliability, experience, and qualifications and who have received appropriate training regarding security and personal data protection rules and shall apply administrative and management procedures which correspond to European or international standards;

(c)	with regard to the risk of liability for damages in accordance with Article 13, maintain sufficient financial resources and/or obtain appropriate liability insurance, in accordance with national law;

(d)	before entering into a contractual relationship, inform, in a clear and comprehensive manner, any person seeking to use a qualified trust_service of the precise terms and conditions regarding the use of that service, including any limitations on its use;

(e)	use trustworthy systems and products that are protected against modification and ensure the technical security and reliability of the processes supported by them;

(f)

use trustworthy systems to store data provided to it, in a verifiable form so that: (i) they are publicly available for retrieval only where the consent of the person to whom the data relates has been obtained, (ii) only authorised persons can make entries and changes to the stored data, (iii) the data can be checked for authenticity;

(g)	take appropriate measures against forgery and theft of data;

(h)

record and keep accessible for an appropriate period of time, including after the activities of the qualified trust_service provider have ceased, all relevant information concerning data issued and received by the qualified trust_service provider, in particular, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service. Such recording may be done electronically;

(i)	have an up-to-date termination plan to ensure continuity of service in accordance with provisions verified by the supervisory body under point (i) of Article 17(4);

(j)	ensure lawful processing of personal data in accordance with Directive 95/46/EC;

(k)	in case of qualified trust_service providers issuing qualified certificates, establish and keep updated a certificate database.

3.   If a qualified trust_service provider issuing qualified certificates decides to revoke a certificate, it shall register such revocation in its certificate database and publish the revocation status of the certificate in a timely manner, and in any event within 24 hours after the receipt of the request. The revocation shall become effective immediately upon its publication.

4.   With regard to paragraph 3, qualified trust_service providers issuing qualified certificates shall provide to any relying_party information on the validity or revocation status of qualified certificates issued by them. This information shall be made available at least on a per certificate basis at any time and beyond the validity period of the certificate in an automated manner that is reliable, free of charge and efficient.

5.   The Commission may, by means of implementing acts, establish reference numbers of standards for trustworthy systems and products, which comply with the requirements under points (e) and (f) of paragraph 2 of this Article. Compliance with the requirements laid down in this Article shall be presumed where trustworthy systems and products meet those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 4

Electronic signatures

Article 25

Legal effects of electronic_signatures

1.   An electronic_signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic_signatures.

2.   A qualified electronic_signature shall have the equivalent legal effect of a handwritten signature.

3.   A qualified electronic_signature based on a qualified certificate issued in one Member State shall be recognised as a qualified electronic_signature in all other Member States.

Article 35

Legal effects of electronic_seals

1.   An electronic_seal shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic_seals.

2.   A qualified electronic_seal shall enjoy the presumption of integrity of the data and of correctness of the origin of that data to which the qualified electronic_seal is linked.

3.   A qualified electronic_seal based on a qualified certificate issued in one Member State shall be recognised as a qualified electronic_seal in all other Member States.

Article 41

Legal effect of electronic_time_stamps

1.   An electronic_time_stamp shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic_time_stamp.

2.   A qualified electronic_time_stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound.

3.   A qualified electronic_time_stamp issued in one Member State shall be recognised as a qualified electronic_time_stamp in all Member States.

Article 52

Entry into force

1.   This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

2.   This Regulation shall apply from 1 July 2016, except for the following:

(a)	Articles 8(3), 9(5), 12(2) to (9), 17(8), 19(4), 20(4), 21(4), 22(5), 23(3), 24(5), 27(4) and (5), 28(6), 29(2), 30(3) and (4), 31(3), 32(3), 33(2), 34(2), 37(4) and (5), 38(6), 42(2), 44(2), 45(2), and Articles 47 and 48 shall apply from 17 September 2014;

(b)	Article 7, Article 8(1) and (2), Articles 9, 10, 11 and Article 12(1) shall apply from the date of application of the implementing acts referred to in Articles 8(3) and 12(8);

(c)	Article 6 shall apply from three years as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8).

3.   Where the notified electronic_identification scheme is included in the list published by the Commission pursuant to Article 9 before the date referred to in point (c) of paragraph 2 of this Article, the recognition of the electronic_identification means under that scheme pursuant to Article 6 shall take place no later than 12 months after the publication of that scheme but not before the date referred to in point (c) of paragraph 2 of this Article.

4.   Notwithstanding point (c) of paragraph 2 of this Article, a Member State may decide that electronic_identification means under electronic_identification scheme notified pursuant to Article 9(1) by another Member State are recognised in the first Member State as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8). Member States concerned shall inform the Commission. The Commission shall make this information public.

---

(1)  OJ C 351, 15.11.2012, p. 73.

(2)  Position of the European Parliament of 3 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.

(3)  Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic_signatures (OJ L 13, 19.1.2000, p. 12).

(4)  OJ C 50 E, 21.2.2012, p. 1.

(5)  Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (OJ L 376, 27.12.2006, p. 36).

(6)  Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

(7)  Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(8)  Council Decision 2010/48/EC of 26 November 2009 concerning the conclusion, by the European Community, of the United Nations Convention on the Rights of Persons with Disabilities (OJ L 23, 27.1.2010, p. 35).

(9)  Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, p. 30).

(10)  Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of procedures by electronic means through the ‘points of single contact’ under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 274, 20.10.2009, p. 36).

(11)  Commission Decision 2011/130/EU of 25 February 2011 establishing minimum requirements for the cross-border processing of documents signed electronically by competent authorities under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 53, 26.2.2011, p. 66).

(12)  Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

(13)  Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(14)  OJ C 28, 30.1.2013, p. 6.

(15)  Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC (OJ L 94, 28.3.2014, p. 65).

---

---

---

---