EIDAS 2014/0910 EN

1. An electronic_identification scheme notified pursuant to Article 9(1) shall specify assurance levels low, substantial and/or high for electronic_identification means issued under that scheme.

2. The assurance levels low, substantial and high shall meet respectively the following criteria:

(a)

assurance level low shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a limited degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of misuse or alteration of the identity;

(b)

assurance level substantial shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a substantial degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of misuse or alteration of the identity;

(c)

assurance level high shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a higher degree of confidence in the claimed or asserted identity of a person than electronic_identification means with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent misuse or alteration of the identity.

3. By 18 September 2015, taking into account relevant international standards and subject to paragraph 2, the Commission shall, by means of implementing acts, set out minimum technical specifications, standards and procedures with reference to which assurance levels low, substantial and high are specified for electronic_identification means for the purposes of paragraph 1.

Those minimum technical specifications, standards and procedures shall be set out by reference to the reliability and quality of the following elements:

(a)	the procedure to prove and verify the identity of natural or legal persons applying for the issuance of electronic_identification means;

(b)	the procedure for the issuance of the requested electronic_identification means;

(c)	the authentication mechanism, through which the natural or legal person uses the electronic_identification means to confirm its identity to a relying_party;

(d)	the entity issuing the electronic_identification means;

(e)	any other body involved in the application for the issuance of the electronic_identification means; and

(f)	the technical and security specifications of the issued electronic_identification means.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 12

Cooperation and interoperability

1. The national electronic_identification schemes notified pursuant to Article 9(1) shall be interoperable.

2. For the purposes of paragraph 1, an interoperability framework shall be established.

3. The interoperability framework shall meet the following criteria:

(a)	it aims to be technology neutral and does not discriminate between any specific national technical solutions for electronic_identification within a Member State;

(b)	it follows European and international standards, where possible;

(c)	it facilitates the implementation of the principle of privacy by design; and

(d)	it ensures that personal data is processed in accordance with Directive 95/46/EC.

4. The interoperability framework shall consist of:

(a)	a reference to minimum technical requirements related to the assurance levels under Article 8;

(b)	a mapping of national assurance levels of notified electronic_identification schemes to the assurance levels under Article 8;

(c)	a reference to minimum technical requirements for interoperability;

(d)	a reference to a minimum set of person_identification_data uniquely representing a natural or legal person, which is available from electronic_identification schemes;

(e)	rules of procedure;

(f)	arrangements for dispute resolution; and

(g)	common operational security standards.

5. Member States shall cooperate with regard to the following:

(a)	the interoperability of the electronic_identification schemes notified pursuant to Article 9(1) and the electronic_identification schemes which Member States intend to notify; and

(b)	the security of the electronic_identification schemes.

6. The cooperation between Member States shall consist of:

(a)	the exchange of information, experience and good practice as regards electronic_identification schemes and in particular technical requirements related to interoperability and assurance levels;

(b)	the exchange of information, experience and good practice as regards working with assurance levels of electronic_identification schemes under Article 8;

(c)	peer review of electronic_identification schemes falling under this Regulation; and

(d)	examination of relevant developments in the electronic_identification sector.

7. By 18 March 2015, the Commission shall, by means of implementing acts, establish the necessary procedural arrangements to facilitate the cooperation between the Member States referred to in paragraphs 5 and 6 with a view to fostering a high level of trust and security appropriate to the degree of risk.

8. By 18 September 2015, for the purpose of setting uniform conditions for the implementation of the requirement under paragraph 1, the Commission shall, subject to the criteria set out in paragraph 3 and taking into account the results of the cooperation between Member States, adopt implementing acts on the interoperability framework as set out in paragraph 4.

9. The implementing acts referred to in paragraphs 7 and 8 of this Article shall be adopted in accordance with the examination procedure referred to in Article 48(2).

CHAPTER III

TRUST SERVICES

SECTION 1

General provisions

Article 20

Supervision of qualified trust_service providers

1. Qualified trust_service providers shall be audited at their own expense at least every 24 months by a conformity_assessment_body. The purpose of the audit shall be to confirm that the qualified trust_service providers and the qualified trust_services provided by them fulfil the requirements laid down in this Regulation. The qualified trust_service providers shall submit the resulting conformity assessment report to the supervisory body within the period of three working days after receiving it.

2. Without prejudice to paragraph 1, the supervisory body may at any time audit or request a conformity_assessment_body to perform a conformity assessment of the qualified trust_service providers, at the expense of those trust_service providers, to confirm that they and the qualified trust_services provided by them fulfil the requirements laid down in this Regulation. Where personal data protection rules appear to have been breached, the supervisory body shall inform the data protection authorities of the results of its audits.

3. Where the supervisory body requires the qualified trust_service provider to remedy any failure to fulfil requirements under this Regulation and where that provider does not act accordingly, and if applicable within a time limit set by the supervisory body, the supervisory body, taking into account, in particular, the extent, duration and consequences of that failure, may withdraw the qualified status of that provider or of the affected service it provides and inform the body referred to in Article 22(3) for the purposes of updating the trusted lists referred to in Article 22(1). The supervisory body shall inform the qualified trust_service provider of the withdrawal of its qualified status or of the qualified status of the service concerned.

4. The Commission may, by means of implementing acts, establish reference number of the following standards:

(a)	accreditation of the conformity assessment bodies and for the conformity assessment report referred to in paragraph 1;

(b)	auditing rules under which conformity assessment bodies will carry out their conformity assessment of the qualified trust_service providers as referred to in paragraph 1.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 27

Electronic signatures in public services

1. If a Member State requires an advanced electronic_signature to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_signatures, advanced electronic_signatures based on a qualified certificate for electronic_signatures, and qualified electronic_signatures in at least the formats or using methods defined in the implementing acts referred to in paragraph 5.

2. If a Member State requires an advanced electronic_signature based on a qualified certificate to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_signatures based on a qualified certificate and qualified electronic_signatures in at least the formats or using methods defined in the implementing acts referred to in paragraph 5.

3. Member States shall not request for cross-border use in an online service offered by a public_sector_body an electronic_signature at a higher security level than the qualified electronic_signature.

4. The Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic_signatures. Compliance with the requirements for advanced electronic_signatures referred to in paragraphs 1 and 2 of this Article and in Article 26 shall be presumed when an advanced electronic_signature meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

5. By 18 September 2015, and taking into account existing practices, standards and Union legal acts, the Commission shall, by means of implementing acts, define reference formats of advanced electronic_signatures or reference methods where alternative formats are used. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 37

Electronic seals in public services

1. If a Member State requires an advanced electronic_seal in order to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_seals, advanced electronic_seals based on a qualified certificate for electronic_seals and qualified electronic_seals at least in the formats or using methods defined in the implementing acts referred to in paragraph 5.

2. If a Member State requires an advanced electronic_seal based on a qualified certificate in order to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_seals based on a qualified certificate and qualified electronic_seal at least in the formats or using methods defined in the implementing acts referred to in paragraph 5.

3. Member States shall not request for the cross-border use in an online service offered by a public_sector_body an electronic_seal at a higher security level than the qualified electronic_seal.

4. The Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic_seals. Compliance with the requirements for advanced electronic_seals referred to in paragraphs 1 and 2 of this Article and Article 36 shall be presumed when an advanced electronic_seal meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

5. By 18 September 2015, and taking into account existing practices, standards and legal acts of the Union, the Commission shall, by means of implementing acts, define reference formats of advanced electronic_seals or reference methods where alternative formats are used. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 49

Review

The Commission shall review the application of this Regulation and shall report to the European Parliament and to the Council no later than 1 July 2020. The Commission shall evaluate in particular whether it is appropriate to modify the scope of this Regulation or its specific provisions, including Article 6, point (f) of Article 7 and Articles 34, 43, 44 and 45, taking into account the experience gained in the application of this Regulation, as well as technological, market and legal developments.

The report referred to in the first paragraph shall be accompanied, where appropriate, by legislative proposals.

In addition, the Commission shall submit a report to the European Parliament and the Council every four years after the report referred to in the first paragraph on the progress towards achieving the objectives of this Regulation.

whereas

(16) Assurance levels should characterise the degree of confidence in electronic_identification means in establishing the identity of a person, thus providing assurance that the person claiming a particular identity is in fact the person to which that identity was assigned.
The assurance level depends on the degree of confidence that electronic_identification means provides in claimed or asserted identity of a person taking into account processes (for example, identity proofing and verification, and authentication), management activities (for example, the entity issuing electronic_identification means and the procedure to issue such means) and technical controls implemented.
Various technical definitions and descriptions of assurance levels exist as the result of Union-funded Large-Scale Pilots, standardisation and international activities.
In particular, the Large-Scale Pilot STORK and ISO 29115 refer, inter alia, to levels 2, 3 and 4, which should be taken into utmost account in establishing minimum technical requirements, standards and procedures for the assurances levels low, substantial and high within the meaning of this Regulation, while ensuring consistent application of this Regulation in particular with regard to assurance level high related to identity proofing for issuing qualified certificates.
The requirements established should be technology-neutral.
It should be possible to achieve the necessary security requirements through different technologies.

- = -

(35) All trust_service providers should be subject to the requirements of this Regulation, in particular those on security and liability to ensure due diligence, transparency and accountability of their operations and services.
However, taking into account the type of services provided by trust_service providers, it is appropriate to distinguish as far as those requirements are concerned between qualified and non-qualified trust_service providers.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN