EIDAS 2014/0910 EN

An electronic_identification scheme shall be eligible for notification pursuant to Article 9(1) provided that all of the following conditions are met:

(a)

the electronic_identification means under the electronic_identification scheme are issued:

(i)	by the notifying Member State;

(ii)	under a mandate from the notifying Member State; or

(iii)

independently of the notifying Member State and are recognised by that Member State;

(b)	the electronic_identification means under the electronic_identification scheme can be used to access at least one service which is provided by a public_sector_body and which requires electronic_identification in the notifying Member State;

(c)	the electronic_identification scheme and the electronic_identification means issued thereunder meet the requirements of at least one of the assurance levels set out in the implementing act referred to in Article 8(3);

(d)

the notifying Member State ensures that the person_identification_data uniquely representing the person in question is attributed, in accordance with the technical specifications, standards and procedures for the relevant assurance level set out in the implementing act referred to in Article 8(3), to the natural or legal person referred to in point 1 of Article 3 at the time the electronic_identification means under that scheme is issued;

(e)

the party issuing the electronic_identification means under that scheme ensures that the electronic_identification means is attributed to the person referred to in point (d) of this Article in accordance with the technical specifications, standards and procedures for the relevant assurance level set out in the implementing act referred to in Article 8(3);

(f)

the notifying Member State ensures the availability of authentication online, so that any relying_party established in the territory of another Member State is able to confirm the person_identification_data received in electronic form.

For relying parties other than public sector bodies the notifying Member State may define terms of access to that authentication. The cross-border authentication shall be provided free of charge when it is carried out in relation to a service online provided by a public_sector_body.

Member States shall not impose any specific disproportionate technical requirements on relying parties intending to carry out such authentication, where such requirements prevent or significantly impede the interoperability of the notified electronic_identification schemes;

(g)

at least six months prior to the notification pursuant to Article 9(1), the notifying Member State provides the other Member States for the purposes of the obligation under Article 12(5) a description of that scheme in accordance with the procedural arrangements established by the implementing acts referred to in Article 12(7);

(h)	the electronic_identification scheme meets the requirements set out in the implementing act referred to in Article 12(8).

Article 8

Assurance levels of electronic_identification schemes

1. An electronic_identification scheme notified pursuant to Article 9(1) shall specify assurance levels low, substantial and/or high for electronic_identification means issued under that scheme.

2. The assurance levels low, substantial and high shall meet respectively the following criteria:

(a)

assurance level low shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a limited degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of misuse or alteration of the identity;

(b)

assurance level substantial shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a substantial degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of misuse or alteration of the identity;

(c)

assurance level high shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a higher degree of confidence in the claimed or asserted identity of a person than electronic_identification means with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent misuse or alteration of the identity.

3. By 18 September 2015, taking into account relevant international standards and subject to paragraph 2, the Commission shall, by means of implementing acts, set out minimum technical specifications, standards and procedures with reference to which assurance levels low, substantial and high are specified for electronic_identification means for the purposes of paragraph 1.

Those minimum technical specifications, standards and procedures shall be set out by reference to the reliability and quality of the following elements:

(a)	the procedure to prove and verify the identity of natural or legal persons applying for the issuance of electronic_identification means;

(b)	the procedure for the issuance of the requested electronic_identification means;

(c)	the authentication mechanism, through which the natural or legal person uses the electronic_identification means to confirm its identity to a relying_party;

(d)	the entity issuing the electronic_identification means;

(e)	any other body involved in the application for the issuance of the electronic_identification means; and

(f)	the technical and security specifications of the issued electronic_identification means.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 12

Cooperation and interoperability

1. The national electronic_identification schemes notified pursuant to Article 9(1) shall be interoperable.

2. For the purposes of paragraph 1, an interoperability framework shall be established.

3. The interoperability framework shall meet the following criteria:

(a)	it aims to be technology neutral and does not discriminate between any specific national technical solutions for electronic_identification within a Member State;

(b)	it follows European and international standards, where possible;

(c)	it facilitates the implementation of the principle of privacy by design; and

(d)	it ensures that personal data is processed in accordance with Directive 95/46/EC.

4. The interoperability framework shall consist of:

(a)	a reference to minimum technical requirements related to the assurance levels under Article 8;

(b)	a mapping of national assurance levels of notified electronic_identification schemes to the assurance levels under Article 8;

(c)	a reference to minimum technical requirements for interoperability;

(d)	a reference to a minimum set of person_identification_data uniquely representing a natural or legal person, which is available from electronic_identification schemes;

(e)	rules of procedure;

(f)	arrangements for dispute resolution; and

(g)	common operational security standards.

5. Member States shall cooperate with regard to the following:

(a)	the interoperability of the electronic_identification schemes notified pursuant to Article 9(1) and the electronic_identification schemes which Member States intend to notify; and

(b)	the security of the electronic_identification schemes.

6. The cooperation between Member States shall consist of:

(a)	the exchange of information, experience and good practice as regards electronic_identification schemes and in particular technical requirements related to interoperability and assurance levels;

(b)	the exchange of information, experience and good practice as regards working with assurance levels of electronic_identification schemes under Article 8;

(c)	peer review of electronic_identification schemes falling under this Regulation; and

(d)	examination of relevant developments in the electronic_identification sector.

7. By 18 March 2015, the Commission shall, by means of implementing acts, establish the necessary procedural arrangements to facilitate the cooperation between the Member States referred to in paragraphs 5 and 6 with a view to fostering a high level of trust and security appropriate to the degree of risk.

8. By 18 September 2015, for the purpose of setting uniform conditions for the implementation of the requirement under paragraph 1, the Commission shall, subject to the criteria set out in paragraph 3 and taking into account the results of the cooperation between Member States, adopt implementing acts on the interoperability framework as set out in paragraph 4.

9. The implementing acts referred to in paragraphs 7 and 8 of this Article shall be adopted in accordance with the examination procedure referred to in Article 48(2).

CHAPTER III

TRUST SERVICES

SECTION 1

General provisions

Article 22

Trusted lists

1. Each Member State shall establish, maintain and publish trusted lists, including information related to the qualified trust_service providers for which it is responsible, together with information related to the qualified trust_services provided by them.

2. Member States shall establish, maintain and publish, in a secured manner, the electronically signed or sealed trusted lists referred to in paragraph 1 in a form suitable for automated processing.

3. Member States shall notify to the Commission, without undue delay, information on the body responsible for establishing, maintaining and publishing national trusted lists, and details of where such lists are published, the certificates used to sign or seal the trusted lists and any changes thereto.

4. The Commission shall make available to the public, through a secure channel, the information referred to in paragraph 3 in electronically signed or sealed form suitable for automated processing.

5. By 18 September 2015 the Commission shall, by means of implementing acts, specify the information referred to in paragraph 1 and define the technical specifications and formats for trusted lists applicable for the purposes of paragraphs 1 to 4. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 23

EU trust mark for qualified trust_services

1. After the qualified status referred to in the second subparagraph of Article 21(2) has been indicated in the trusted list referred to in Article 22(1), qualified trust_service providers may use the EU trust mark to indicate in a simple, recognisable and clear manner the qualified trust_services they provide.

2. When using the EU trust mark for the qualified trust_services referred to in paragraph 1, qualified trust_service providers shall ensure that a link to the relevant trusted list is made available on their website.

3. By 1 July 2015 the Commission shall, by means of implementing acts, provide for specifications with regard to the form, and in particular the presentation, composition, size and design of the EU trust mark for qualified trust_services. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 24

Requirements for qualified trust_service providers

1. When issuing a qualified certificate for a trust_service, a qualified trust_service provider shall verify, by appropriate means and in accordance with national law, the identity and, if applicable, any specific attributes of the natural or legal person to whom the qualified certificate is issued.

The information referred to in the first subparagraph shall be verified by the qualified trust_service provider either directly or by relying on a third party in accordance with national law:

(a)	by the physical presence of the natural person or of an authorised representative of the legal person; or

(b)

remotely, using electronic_identification means, for which prior to the issuance of the qualified certificate, a physical presence of the natural person or of an authorised representative of the legal person was ensured and which meets the requirements set out in Article 8 with regard to the assurance levels ‘substantial’ or ‘high’; or

(c)	by means of a certificate of a qualified electronic_signature or of a qualified electronic_seal issued in compliance with point (a) or (b); or

(d)	by using other identification methods recognised at national level which provide equivalent assurance in terms of reliability to physical presence. The equivalent assurance shall be confirmed by a conformity_assessment_body.

2. A qualified trust_service provider providing qualified trust_services shall:

(a)	inform the supervisory body of any change in the provision of its qualified trust_services and an intention to cease those activities;

(b)

employ staff and, if applicable, subcontractors who possess the necessary expertise, reliability, experience, and qualifications and who have received appropriate training regarding security and personal data protection rules and shall apply administrative and management procedures which correspond to European or international standards;

(c)	with regard to the risk of liability for damages in accordance with Article 13, maintain sufficient financial resources and/or obtain appropriate liability insurance, in accordance with national law;

(d)	before entering into a contractual relationship, inform, in a clear and comprehensive manner, any person seeking to use a qualified trust_service of the precise terms and conditions regarding the use of that service, including any limitations on its use;

(e)	use trustworthy systems and products that are protected against modification and ensure the technical security and reliability of the processes supported by them;

(f)

use trustworthy systems to store data provided to it, in a verifiable form so that:

(i)	they are publicly available for retrieval only where the consent of the person to whom the data relates has been obtained,

(ii)	only authorised persons can make entries and changes to the stored data,

(iii)

the data can be checked for authenticity;

(g)	take appropriate measures against forgery and theft of data;

(h)

record and keep accessible for an appropriate period of time, including after the activities of the qualified trust_service provider have ceased, all relevant information concerning data issued and received by the qualified trust_service provider, in particular, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service. Such recording may be done electronically;

(i)	have an up-to-date termination plan to ensure continuity of service in accordance with provisions verified by the supervisory body under point (i) of Article 17(4);

(j)	ensure lawful processing of personal data in accordance with Directive 95/46/EC;

(k)	in case of qualified trust_service providers issuing qualified certificates, establish and keep updated a certificate database.

3. If a qualified trust_service provider issuing qualified certificates decides to revoke a certificate, it shall register such revocation in its certificate database and publish the revocation status of the certificate in a timely manner, and in any event within 24 hours after the receipt of the request. The revocation shall become effective immediately upon its publication.

4. With regard to paragraph 3, qualified trust_service providers issuing qualified certificates shall provide to any relying_party information on the validity or revocation status of qualified certificates issued by them. This information shall be made available at least on a per certificate basis at any time and beyond the validity period of the certificate in an automated manner that is reliable, free of charge and efficient.

5. The Commission may, by means of implementing acts, establish reference numbers of standards for trustworthy systems and products, which comply with the requirements under points (e) and (f) of paragraph 2 of this Article. Compliance with the requirements laid down in this Article shall be presumed where trustworthy systems and products meet those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 4

Electronic signatures

Article 28

Qualified certificates for electronic_signatures

1. Qualified certificates for electronic_signatures shall meet the requirements laid down in Annex I.

2. Qualified certificates for electronic_signatures shall not be subject to any mandatory requirement exceeding the requirements laid down in Annex I.

3. Qualified certificates for electronic_signatures may include non-mandatory additional specific attributes. Those attributes shall not affect the interoperability and recognition of qualified electronic_signatures.

4. If a qualified certificate for electronic_signatures has been revoked after initial activation, it shall lose its validity from the moment of its revocation, and its status shall not in any circumstances be reverted.

5. Subject to the following conditions, Member States may lay down national rules on temporary suspension of a qualified certificate for electronic_signature:

(a)	if a qualified certificate for electronic_signature has been temporarily suspended that certificate shall lose its validity for the period of suspension;

(b)	the period of suspension shall be clearly indicated in the certificate database and the suspension status shall be visible, during the period of suspension, from the service providing information on the status of the certificate.

6. The Commission may, by means of implementing acts, establish reference numbers of standards for qualified certificates for electronic_signature. Compliance with the requirements laid down in Annex I shall be presumed where a qualified certificate for electronic_signature meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 30

Certification of qualified electronic_signature creation devices

1. Conformity of qualified electronic_signature creation devices with the requirements laid down in Annex II shall be certified by appropriate public or private bodies designated by Member States.

2. Member States shall notify to the Commission the names and addresses of the public or private body referred to in paragraph 1. The Commission shall make that information available to Member States.

3. The certification referred to in paragraph 1 shall be based on one of the following:

(a)	a security evaluation process carried out in accordance with one of the standards for the security assessment of information technology products included in the list established in accordance with the second subparagraph; or

(b)

a process other than the process referred to in point (a), provided that it uses comparable security levels and provided that the public or private body referred to in paragraph 1 notifies that process to the Commission. That process may be used only in the absence of standards referred to in point (a) or when a security evaluation process referred to in point (a) is ongoing.

The Commission shall, by means of implementing acts, establish a list of standards for the security assessment of information technology products referred to in point (a). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

4. The Commission shall be empowered to adopt delegated acts in accordance with Article 47 concerning the establishment of specific criteria to be met by the designated bodies referred to in paragraph 1 of this Article.

Article 38

Qualified certificates for electronic_seals

1. Qualified certificates for electronic_seals shall meet the requirements laid down in Annex III.

2. Qualified certificates for electronic_seals shall not be subject to any mandatory requirements exceeding the requirements laid down in Annex III.

3. Qualified certificates for electronic_seals may include non-mandatory additional specific attributes. Those attributes shall not affect the interoperability and recognition of qualified electronic_seals.

4. If a qualified certificate for an electronic_seal has been revoked after initial activation, it shall lose its validity from the moment of its revocation, and its status shall not in any circumstances be reverted.

5. Subject to the following conditions, Member States may lay down national rules on temporary suspension of qualified certificates for electronic_seals:

(a)	if a qualified certificate for electronic_seal has been temporarily suspended, that certificate shall lose its validity for the period of suspension;

(b)	the period of suspension shall be clearly indicated in the certificate database and the suspension status shall be visible, during the period of suspension, from the service providing information on the status of the certificate.

6. The Commission may, by means of implementing acts, establish reference numbers of standards for qualified certificates for electronic_seals. Compliance with the requirements laid down in Annex III shall be presumed where a qualified certificate for electronic_seal meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 49

Review

The Commission shall review the application of this Regulation and shall report to the European Parliament and to the Council no later than 1 July 2020. The Commission shall evaluate in particular whether it is appropriate to modify the scope of this Regulation or its specific provisions, including Article 6, point (f) of Article 7 and Articles 34, 43, 44 and 45, taking into account the experience gained in the application of this Regulation, as well as technological, market and legal developments.

The report referred to in the first paragraph shall be accompanied, where appropriate, by legislative proposals.

In addition, the Commission shall submit a report to the European Parliament and the Council every four years after the report referred to in the first paragraph on the progress towards achieving the objectives of this Regulation.

whereas

(13) Member States should remain free to use or to introduce means for the purposes of electronic_identification for accessing online services.
They should also be able to decide whether to involve the private sector in the provision of those means.
Member States should not be obliged to notify their electronic_identification schemes to the Commission.
The choice to notify the Commission of all, some or none of the electronic_identification schemes used at national level to access at least public online services or specific services is up to Member States.

- = -

(19) The security of electronic_identification schemes is key to trustworthy cross-border mutual recognition of electronic_identification means.
In this context, Member States should cooperate with regard to the security and interoperability of the electronic_identification schemes at Union level.
Whenever electronic_identification schemes require specific hardware or software to be used by relying parties at the national level, cross-border interoperability calls for those Member States not to impose such requirements and related costs on relying parties established outside of their territory.
In that case appropriate solutions should be discussed and developed within the scope of the interoperability framework.
Nevertheless technical requirements stemming from the inherent specifications of national electronic_identification means and likely to affect the holders of such electronic means (e.g.
smartcards), are unavoidable.

- = -

(48) While a high level of security is needed to ensure mutual recognition of electronic_signatures, in specific cases, such as in the context of Commission Decision 2009/767/EC (10), electronic_signatures with a lower security assurance should also be accepted.

- = -

(52) The creation of remote electronic_signatures, where the electronic_signature creation environment is managed by a trust_service provider on behalf of the signatory, is set to increase in the light of its multiple economic benefits.
However, in order to ensure that such electronic_signatures receive the same legal recognition as electronic_signatures created in an entirely user-managed environment, remote electronic_signature service providers should apply specific management and administrative security procedures and use trustworthy systems and products, including secure electronic communication channels, in order to guarantee that the electronic_signature creation environment is reliable and is used under the sole control of the signatory.
Where a qualified electronic_signature has been created using a remote electronic_signature creation device, the requirements applicable to qualified trust_service providers set out in this Regulation should apply.

- = -

(54) Cross-border interoperability and recognition of qualified certificates is a precondition for cross-border recognition of qualified electronic_signatures.
Therefore, qualified certificates should not be subject to any mandatory requirements exceeding the requirements laid down in this Regulation.
However, at national level, the inclusion of specific attributes, such as unique identifiers, in qualified certificates should be allowed, provided that such specific attributes do not hamper cross-border interoperability and recognition of qualified certificates and electronic_signatures.

- = -

(72) When adopting delegated or implementing acts, the Commission should take due account of the standards and technical specifications drawn up by European and international standardisation organisations and bodies, in particular the European Committee for Standardisation (CEN), the European Telecommunications Standards Institute (ETSI), the International Organisation for Standardisation (ISO) and the International Telecommunication Union (ITU), with a view to ensuring a high level of security and interoperability of electronic_identification and trust_services.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN