EIDAS 2014/0910 EN

1. This Regulation applies to electronic_identification schemes that have been notified by a Member State, and to trust_service providers that are established in the union.

2. This Regulation does not apply to the provision of trust_services that are used exclusively within closed systems resulting from national law or from agreements between a defined set of participants.

3. This Regulation does not affect national or union law related to the conclusion and validity of contracts or other legal or procedural obligations relating to form.

Article 9

Notification

1. The notifying Member State shall notify to the Commission the following information and, without undue delay, any subsequent changes thereto:

(a)	a description of the electronic_identification scheme, including its assurance levels and the issuer or issuers of electronic_identification means under the scheme;

(b)

the applicable supervisory regime and information on the liability regime with respect to the following:

(i)	the party issuing the electronic_identification means; and

(ii)	the party operating the authentication procedure;

(c)	the authority or authorities responsible for the electronic_identification scheme;

(d)	information on the entity or entities which manage the registration of the unique person_identification_data;

(e)	a description of how the requirements set out in the implementing acts referred to in Article 12(8) are met;

(f)	a description of the authentication referred to in point (f) of Article 7;

(g)	arrangements for suspension or revocation of either the notified electronic_identification scheme or authentication or the compromised parts concerned.

2. One year from the date of application of the implementing acts referred to in Articles 8(3) and 12(8), the Commission shall publish in the Official Journal of the European union a list of the electronic_identification schemes which were notified pursuant to paragraph 1 of this Article and the basic information thereon.

3. If the Commission receives a notification after the expiry of the period referred to in paragraph 2, it shall publish in the Official Journal of the European union the amendments to the list referred to in paragraph 2 within two months from the date of receipt of that notification.

4. A Member State may submit to the Commission a request to remove an electronic_identification scheme notified by that Member State from the list referred to in paragraph 2. The Commission shall publish in the Official Journal of the European union the corresponding amendments to the list within one month from the date of receipt of the Member State’s request.

5. The Commission may, by means of implementing acts, define the circumstances, formats and procedures of notifications under paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 10

Security breach

1. Where either the electronic_identification scheme notified pursuant to Article 9(1) or the authentication referred to in point (f) of Article 7 is breached or partly compromised in a manner that affects the reliability of the cross-border authentication of that scheme, the notifying Member State shall, without delay, suspend or revoke that cross-border authentication or the compromised parts concerned, and shall inform other Member States and the Commission.

2. When the breach or compromise referred to in paragraph 1 is remedied, the notifying Member State shall re-establish the cross-border authentication and shall inform other Member States and the Commission without undue delay.

3. If the breach or compromise referred to in paragraph 1 is not remedied within three months of the suspension or revocation, the notifying Member State shall notify other Member States and the Commission of the withdrawal of the electronic_identification scheme.

The Commission shall publish in the Official Journal of the European union the corresponding amendments to the list referred to in Article 9(2) without undue delay.

Article 14

International aspects

1. Trust services provided by trust_service providers established in a third country shall be recognised as legally equivalent to qualified trust_services provided by qualified trust_service providers established in the union where the trust_services originating from the third country are recognised under an agreement concluded between the union and the third country in question or an international organisation in accordance with Article 218 TFEU.

2. Agreements referred to in paragraph 1 shall ensure, in particular, that:

(a)

the requirements applicable to qualified trust_service providers established in the union and the qualified trust_services they provide are met by the trust_service providers in the third country or international organisations with which the agreement is concluded, and by the trust_services they provide;

(b)	the qualified trust_services provided by qualified trust_service providers established in the union are recognised as legally equivalent to trust_services provided by trust_service providers in the third country or international organisation with which the agreement is concluded.

Article 27

Electronic signatures in public services

1. If a Member State requires an advanced electronic_signature to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_signatures, advanced electronic_signatures based on a qualified certificate for electronic_signatures, and qualified electronic_signatures in at least the formats or using methods defined in the implementing acts referred to in paragraph 5.

2. If a Member State requires an advanced electronic_signature based on a qualified certificate to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_signatures based on a qualified certificate and qualified electronic_signatures in at least the formats or using methods defined in the implementing acts referred to in paragraph 5.

3. Member States shall not request for cross-border use in an online service offered by a public_sector_body an electronic_signature at a higher security level than the qualified electronic_signature.

4. The Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic_signatures. Compliance with the requirements for advanced electronic_signatures referred to in paragraphs 1 and 2 of this Article and in Article 26 shall be presumed when an advanced electronic_signature meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

5. By 18 September 2015, and taking into account existing practices, standards and union legal acts, the Commission shall, by means of implementing acts, define reference formats of advanced electronic_signatures or reference methods where alternative formats are used. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 37

Electronic seals in public services

1. If a Member State requires an advanced electronic_seal in order to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_seals, advanced electronic_seals based on a qualified certificate for electronic_seals and qualified electronic_seals at least in the formats or using methods defined in the implementing acts referred to in paragraph 5.

2. If a Member State requires an advanced electronic_seal based on a qualified certificate in order to use an online service offered by, or on behalf of, a public_sector_body, that Member State shall recognise advanced electronic_seals based on a qualified certificate and qualified electronic_seal at least in the formats or using methods defined in the implementing acts referred to in paragraph 5.

3. Member States shall not request for the cross-border use in an online service offered by a public_sector_body an electronic_seal at a higher security level than the qualified electronic_seal.

4. The Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic_seals. Compliance with the requirements for advanced electronic_seals referred to in paragraphs 1 and 2 of this Article and Article 36 shall be presumed when an advanced electronic_seal meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

5. By 18 September 2015, and taking into account existing practices, standards and legal acts of the union, the Commission shall, by means of implementing acts, define reference formats of advanced electronic_seals or reference methods where alternative formats are used. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 47

Exercise of the delegation

1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2. The power to adopt delegated acts referred to in Article 30(4) shall be conferred on the Commission for an indeterminate period of time from 17 September 2014.

3. The delegation of power referred to in Article 30(4) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

5. A delegated act adopted pursuant to Article 30(4) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

Article 52

Entry into force

1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European union.

2. This Regulation shall apply from 1 July 2016, except for the following:

(a)	Articles 8(3), 9(5), 12(2) to (9), 17(8), 19(4), 20(4), 21(4), 22(5), 23(3), 24(5), 27(4) and (5), 28(6), 29(2), 30(3) and (4), 31(3), 32(3), 33(2), 34(2), 37(4) and (5), 38(6), 42(2), 44(2), 45(2), and Articles 47 and 48 shall apply from 17 September 2014;

(b)	Article 7, Article 8(1) and (2), Articles 9, 10, 11 and Article 12(1) shall apply from the date of application of the implementing acts referred to in Articles 8(3) and 12(8);

(c)	Article 6 shall apply from three years as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8).

3. Where the notified electronic_identification scheme is included in the list published by the Commission pursuant to Article 9 before the date referred to in point (c) of paragraph 2 of this Article, the recognition of the electronic_identification means under that scheme pursuant to Article 6 shall take place no later than 12 months after the publication of that scheme but not before the date referred to in point (c) of paragraph 2 of this Article.

4. Notwithstanding point (c) of paragraph 2 of this Article, a Member State may decide that electronic_identification means under electronic_identification scheme notified pursuant to Article 9(1) by another Member State are recognised in the first Member State as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8). Member States concerned shall inform the Commission. The Commission shall make this information public.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 23 July 2014.

For the Parliament

The President

M. SCHULZ

For the Council

The President

S. GOZI

(1) OJ C 351, 15.11.2012, p. 73.

(2) Position of the European Parliament of 3 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.

(3) Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic_signatures (OJ L 13, 19.1.2000, p. 12).

(4) OJ C 50 E, 21.2.2012, p. 1.

(5) Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (OJ L 376, 27.12.2006, p. 36).

(6) Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

(7) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(8) Council Decision 2010/48/EC of 26 November 2009 concerning the conclusion, by the European Community, of the United Nations Convention on the Rights of Persons with Disabilities (OJ L 23, 27.1.2010, p. 35).

(9) Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, p. 30).

(10) Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of procedures by electronic means through the ‘points of single contact’ under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 274, 20.10.2009, p. 36).

(11) Commission Decision 2011/130/EU of 25 February 2011 establishing minimum requirements for the cross-border processing of documents signed electronically by competent authorities under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 53, 26.2.2011, p. 66).

(12) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

(13) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(14) OJ C 28, 30.1.2013, p. 6.

(15) Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC (OJ L 94, 28.3.2014, p. 65).

ANNEX I

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SIGNATURES

Qualified certificates for electronic_signatures shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic_signature;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least, the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)	at least the name of the signatory, or a pseudonym; if a pseudonym is used, it shall be clearly indicated;

(d)	electronic_signature validation_data that corresponds to the electronic_signature creation data;

(e)	details of the beginning and end of the certificate’s period of validity;

(f)	the certificate identity code, which must be unique for the qualified trust_service provider;

(g)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(h)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (g) is available free of charge;

(i)	the location of the services that can be used to enquire about the validity status of the qualified certificate;

(j)	where the electronic_signature creation data related to the electronic_signature validation_data is located in a qualified electronic_signature creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX II

REQUIREMENTS FOR QUALIFIED ELECTRONIC SIGNATURE CREATION DEVICES

Qualified electronic_signature creation devices shall ensure, by appropriate technical and procedural means, that at least:

(a)	the confidentiality of the electronic_signature creation data used for electronic_signature creation is reasonably assured;

(b)	the electronic_signature creation data used for electronic_signature creation can practically occur only once;

(c)	the electronic_signature creation data used for electronic_signature creation cannot, with reasonable assurance, be derived and the electronic_signature is reliably protected against forgery using currently available technology;

(d)	the electronic_signature creation data used for electronic_signature creation can be reliably protected by the legitimate signatory against use by others.

Qualified electronic_signature creation devices shall not alter the data to be signed or prevent such data from being presented to the signatory prior to signing.

Generating or managing electronic_signature creation data on behalf of the signatory may only be done by a qualified trust_service provider.

Without prejudice to point (d) of point 1, qualified trust_service providers managing electronic_signature creation data on behalf of the signatory may duplicate the electronic_signature creation data only for back-up purposes provided the following requirements are met:

(a)	the security of the duplicated datasets must be at the same level as for the original datasets;

(b)	the number of duplicated datasets shall not exceed the minimum needed to ensure continuity of the service.

ANNEX III

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SEALS

Qualified certificates for electronic_seals shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic_seal;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)	at least the name of the creator of the seal and, where applicable, registration number as stated in the official records;

(d)	electronic_seal validation_data, which corresponds to the electronic_seal creation data;

(e)	details of the beginning and end of the certificate’s period of validity;

(f)	the certificate identity code, which must be unique for the qualified trust_service provider;

(g)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(h)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (g) is available free of charge;

(i)	the location of the services that can be used to enquire as to the validity status of the qualified certificate;

(j)	where the electronic_seal creation data related to the electronic_seal validation_data is located in a qualified electronic_seal creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX IV

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR WEBSITE AUTHENTICATION

Qualified certificates for website authentication shall contain:

(a)	an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for website authentication;

(b)

a set of data unambiguously representing the qualified trust_service provider issuing the qualified certificates including at least the Member State in which that provider is established and:

—	for a legal person: the name and, where applicable, registration number as stated in the official records,

—	for a natural person: the person’s name;

(c)

for natural persons: at least the name of the person to whom the certificate has been issued, or a pseudonym. If a pseudonym is used, it shall be clearly indicated;

for legal persons: at least the name of the legal person to whom the certificate is issued and, where applicable, registration number as stated in the official records;

(d)	elements of the address, including at least city and State, of the natural or legal person to whom the certificate is issued and, where applicable, as stated in the official records;

(e)	the domain name(s) operated by the natural or legal person to whom the certificate is issued;

(f)	details of the beginning and end of the certificate’s period of validity;

(g)	the certificate identity code, which must be unique for the qualified trust_service provider;

(h)	the advanced electronic_signature or advanced electronic_seal of the issuing qualified trust_service provider;

(i)	the location where the certificate supporting the advanced electronic_signature or advanced electronic_seal referred to in point (h) is available free of charge;

(j)	the location of the certificate validity status services that can be used to enquire as to the validity status of the qualified certificate.

whereas

name='idcons2'>

(2) This Regulation seeks to enhance trust in electronic transactions in the internal market by providing a common foundation for secure electronic interaction between citizens, businesses and public authorities, thereby increasing the effectiveness of public and private online services, electronic business and electronic commerce in the union.

- = -

name='idcons4'>

(4) The Commission communication of 26 August 2010 entitled ‘A Digital Agenda for Europe’ identified the fragmentation of the digital market, the lack of interoperability and the rise in cybercrime as major obstacles to the virtuous cycle of the digital economy.
In its EU Citizenship Report 2010, entitled ‘Dismantling the obstacles to EU citizens’ rights’, the Commission further highlighted the need to solve the main problems that prevent union citizens from enjoying the benefits of a digital single market and cross-border digital services.

- = -

name='idcons6'>

(6) In its conclusions of 27 May 2011, the Council invited the Commission to contribute to the digital single market by creating appropriate conditions for the mutual recognition of key enablers across borders, such as electronic_identification, electronic_documents, electronic_signatures and electronic delivery services, and for interoperable e-government services across the European union.

- = -

name='idcons14'>

(14) Some conditions need to be set out in this Regulation with regard to which electronic_identification means have to be recognised and how the electronic_identification schemes should be notified.
Those conditions should help Member States to build the necessary trust in each other’s electronic_identification schemes and to mutually recognise electronic_identification means falling under their notified schemes.
The principle of mutual recognition should apply if the notifying Member State’s electronic_identification scheme meets the conditions of notification and the notification was published in the Official Journal of the European union.
However, the principle of mutual recognition should only relate to authentication for an online service.
The access to those online services and their final delivery to the applicant should be closely linked to the right to receive such services under the conditions set out in national legislation.

- = -

name='idcons15'>

(15) The obligation to recognise electronic_identification means should relate only to those means the identity assurance level of which corresponds to the level equal to or higher than the level required for the online service in question.
In addition, that obligation should only apply when the public_sector_body in question uses the assurance level ‘substantial’ or ‘high’ in relation to accessing that service online.
Member States should remain free, in accordance with union law, to recognise electronic_identification means having lower identity assurance levels.

- = -

name='idcons16'>

(16) Assurance levels should characterise the degree of confidence in electronic_identification means in establishing the identity of a person, thus providing assurance that the person claiming a particular identity is in fact the person to which that identity was assigned.
The assurance level depends on the degree of confidence that electronic_identification means provides in claimed or asserted identity of a person taking into account processes (for example, identity proofing and verification, and authentication), management activities (for example, the entity issuing electronic_identification means and the procedure to issue such means) and technical controls implemented.
Various technical definitions and descriptions of assurance levels exist as the result of union-funded Large-Scale Pilots, standardisation and international activities.
In particular, the Large-Scale Pilot STORK and ISO 29115 refer, inter alia, to levels 2, 3 and 4, which should be taken into utmost account in establishing minimum technical requirements, standards and procedures for the assurances levels low, substantial and high within the meaning of this Regulation, while ensuring consistent application of this Regulation in particular with regard to assurance level high related to identity proofing for issuing qualified certificates.
The requirements established should be technology-neutral.
It should be possible to achieve the necessary security requirements through different technologies.

- = -

name='idcons19'>

(19) The security of electronic_identification schemes is key to trustworthy cross-border mutual recognition of electronic_identification means.
In this context, Member States should cooperate with regard to the security and interoperability of the electronic_identification schemes at union level.
Whenever electronic_identification schemes require specific hardware or software to be used by relying parties at the national level, cross-border interoperability calls for those Member States not to impose such requirements and related costs on relying parties established outside of their territory.
In that case appropriate solutions should be discussed and developed within the scope of the interoperability framework.
Nevertheless technical requirements stemming from the inherent specifications of national electronic_identification means and likely to affect the holders of such electronic means (e.g.
smartcards), are unavoidable.

- = -

name='idcons21'>

(21) This Regulation should also establish a general legal framework for the use of trust_services.
However, it should not create a general obligation to use them or to install an access point for all existing trust_services.
In particular, it should not cover the provision of services used exclusively within closed systems between a defined set of participants, which have no effect on third parties.
For example, systems set up in businesses or public administrations to manage internal procedures making use of trust_services should not be subject to the requirements of this Regulation.
Only trust_services provided to the public having effects on third parties should meet the requirements laid down in the Regulation.
Neither should this Regulation cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards form laid down by national or union law.
In addition, it should not affect national form requirements pertaining to public registers, in particular commercial and land registers.

- = -

name='idcons24'>

(24) Member States may maintain or introduce national provisions, in conformity with union law, relating to trust_services as far as those services are not fully harmonised by this Regulation.
However, trust_services that comply with this Regulation should circulate freely in the internal market.

- = -

name='idcons33'>

(33) Provisions on the use of pseudonyms in certificates should not prevent Member States from requiring identification of persons pursuant to union or national law.

- = -

name='idcons34'>

(34) All Member States should follow common essential supervision requirements to ensure a comparable security level of qualified trust_services.
To ease the consistent application of those requirements across the union, Member States should adopt comparable procedures and should exchange information on their supervision activities and best practices in the field.

- = -

name='idcons39'>

(39) To enable the Commission and the Member States to assess the effectiveness of the breach notification mechanism introduced by this Regulation, supervisory bodies should be requested to provide summary information to the Commission and to European union Agency for Network and Information Security (ENISA).

- = -

name='idcons57'>

(57) To ensure legal certainty as regards the validity of the signature, it is essential to specify the components of a qualified electronic_signature, which should be assessed by the relying_party carrying out the validation.
Moreover, specifying the requirements for qualified trust_service providers that can provide a qualified validation service to relying parties unwilling or unable to carry out the validation of qualified electronic_signatures themselves, should stimulate the private and public sector to invest in such services.
Both elements should make qualified electronic_signature validation easy and convenient for all parties at union level.

- = -

name='idcons66'>

(66) It is essential to provide for a legal framework to facilitate cross-border recognition between existing national legal systems related to electronic_registered_delivery_services.
That framework could also open new market opportunities for union trust_service providers to offer new pan-European electronic_registered_delivery_services.

- = -

name='idcons67'>

(67) Website authentication services provide a means by which a visitor to a website can be assured that there is a genuine and legitimate entity standing behind the website.
Those services contribute to the building of trust and confidence in conducting business online, as users will have confidence in a website that has been authenticated.
The provision and the use of website authentication services are entirely voluntary.
However, in order for website authentication to become a means to boosting trust, providing a better experience for the user and furthering growth in the internal market, this Regulation should lay down minimal security and liability obligations for the providers and their services.
To that end, the results of existing industry-led initiatives, for example the Certification Authorities/Browsers Forum — CA/B Forum, have been taken into account.
In addition, this Regulation should not impede the use of other means or methods to authenticate a website not falling under this Regulation nor should it prevent third country providers of website authentication services from providing their services to customers in the union.
However, a third country provider should only have its website authentication services recognised as qualified in accordance with this Regulation, if an international agreement between the union and the country of establishment of the provider has been concluded.

- = -

name='idcons68'>

(68) The concept of ‘legal persons’, according to the provisions of the Treaty on the Functioning of the European union (TFEU) on establishment, leaves operators free to choose the legal form which they deem suitable for carrying out their activity.
Accordingly, ‘legal persons’, within the meaning of the TFEU, means all entities constituted under, or governed by, the law of a Member State, irrespective of their legal form.

- = -

name='idcons69'>

(69) The union institutions, bodies, offices and agencies are encouraged to recognise electronic_identification and trust_services covered by this Regulation for the purpose of administrative cooperation capitalising, in particular, on existing good practices and the results of ongoing projects in the areas covered by this Regulation.

- = -

name='idcons72'>

(72) When adopting delegated or implementing acts, the Commission should take due account of the standards and technical specifications drawn up by European and international standardisation organisations and bodies, in particular the European Committee for Standardisation (CEN), the European Telecommunications Standards Institute (ETSI), the International Organisation for Standardisation (ISO) and the International Telecommunication union (ITU), with a view to ensuring a high level of security and interoperability of electronic_identification and trust_services.

- = -

name='idcons75'>

(75) The application dates set out in this Regulation do not affect existing obligations that Member States already have under union law, in particular under Directive 2006/123/EC.

- = -

name='idcons76'>

(76) Since the objectives of this Regulation cannot be sufficiently achieved by the Member States but can rather, by reason of the scale of the action, be better achieved at union level, the union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European union.
In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN