Sittings · Document
On the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity
Committee on the Internal Market and Consumer Protection · Rapporteur: Andrus Ansip
SHORT JUSTIFICATION
In June 2021, as part of the “Europe Fit for the Digital Age” package, the European Commission proposed a Regulation amending Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market (eIDAS Regulation). This new proposal for an amending Regulation on a framework for a European Digital Identity is an important step towards European integration and a very significant contribution to the prosperity and development of the EU Digital Single Market. Enabling our citizens to prove their identity so they can access online public administrations, private services or simply to attest a personal identity attribute, such as medical certificates, professional qualifications or driving licences, means that we are bridging the digital gap between Member States and finally getting rid of the digital identity “border”. Nevertheless, this draft opinion aims at improving the content of this proposal in light of the digital transition.
The COVID-19 pandemic has had a unique catalysing effect on the digital transition. As a consequence, the demand for means to identify and authenticate online, as well as to digitally exchange information related to our identity with high security and privacy standards, has increased across Europe. At present, eIDAS is the EU’s only cross-border framework for trusted electronic identification (eID) of natural and legal persons, and trust services. The new European Digital Identity Wallets, a key aspect of the proposal, will enable all European citizens, consumers and businesses, to securely access services online without having to use identification means currently offered by big platforms for example or unnecessarily share personal data. With this solution, users will have full control of the data they share, ensuring a high level of consumer protection The proposed Regulation also aspires to provide effective access to trusted and secure digital identity solutions with cross-border operability in order to address the demands of citizens and the market more broadly. Public and private services alike will be able to safely rely on digital identity solutions, again crucially across borders within the Union.
As rapporteur for the IMCO Committee, I regard the implementation of a cross-border legal framework for trusted digital identities to be an essential tool to strengthen the European Single Market and consumer protection, in an increasingly digital worldwide economy. The current situation with weak or non-existent digital verification represents a considerable burden both in terms of cost and bureaucracy - on average, businesses in Europe spend six to seven weeks verifying the identity of potential business partners or clients before starting to conduct business. This is compounded by the differing operational and regulatory requirements across Member States.
This revision presents an opportunity to bring about a situation in which European citizens and consumers, already often working cross-border on a daily basis, can use medical prescriptions in neighbouring countries to buy medicines or easily rent a car; move around for work and easily register in a new country without unnecessary administrative burden; and, particularly in the case of our elderly citizens, feel at ease knowing they can prove their identity in any European hospital. As rapporteur, I firmly believe that these goals can be facilitated with a cross-border eID, which would effectively take on the role of a passport for the digital world. This is the time to keep our ambitions high, and to ensure the swift and effective implementation of a user-friendly service that will empower our citizens by giving them full control of the data they share, when accessing both public and private online services in the EU.
AMENDMENTS
The Committee on the Internal Market and Consumer Protection calls on the Committee on Industry, Research and Energy, as the committee responsible, to take into account the following amendments:
Amendment 1
Proposal for a regulation
Recital 9
| Text proposed by the Commission | Amendment |
| (9) All European Digital Identity Wallets should allow users to electronically identify and authenticate online and offline across borders for accessing a wide range of public and private services. Without prejudice to Member States’ prerogatives as regards the identification of their nationals and residents, Wallets can also serve the institutional needs of public administrations, international organisations and the Union’s institutions, bodies, offices and agencies. Offline use would be important in many sectors, including in the health sector where services are often provided through face-to-face interaction and ePrescriptions should be able to rely on QR-codes or similar technologies to verify authenticity. Relying on the level of assurance “high”, the European Digital Identity Wallets should benefit from the potential offered by tamper-proof solutions such as secure elements, to comply with the security requirements under this Regulation. The European Digital Identity Wallets should also allow users to create and use qualified electronic signatures and seals which are accepted across the EU. To achieve simplification and cost reduction benefits to persons and businesses across the EU, including by enabling powers of representation and e-mandates, Member States should issue European Digital Identity Wallets relying on common standards to ensure seamless interoperability and a high level of security. Only Member States’ competent authorities can provide a high degree of confidence in establishing the identity of a person and therefore provide assurance that the person claiming or asserting a particular identity is in fact the person he or she claims to be. It is therefore necessary that the European Digital Identity Wallets rely on the legal identity of citizens, other residents or legal entities. Trust in the European Digital Identity Wallets would be enhanced by the fact that issuing parties are required to implement appropriate technical and organisational measures to ensure a level of security commensurate to the risks raised for the rights and freedoms of the natural persons, in line with Regulation (EU) 2016/679. | (9) All European Digital Identity Wallets should allow users to electronically identify and authenticate online and offline across borders for accessing a wide range of public and private services. Without prejudice to Member States’ prerogatives as regards the identification of their nationals and residents, Wallets can also serve the institutional needs of public administrations, international organisations and the Union’s institutions, bodies, offices and agencies. Offline use would be important in many sectors, including in the health sector where services are often provided through face-to-face interaction and ePrescriptions should be able to rely on QR-codes or similar technologies to verify authenticity. Relying on the level of assurance “high”, the European Digital Identity Wallets should benefit from the potential offered by tamper-proof solutions such as secure elements as well as software-based technologies with high security and privacy standards, to comply with the security requirements under this Regulation. The European Digital Identity Wallets should also allow users to create and use qualified electronic signatures and seals which are accepted across the EU. To achieve simplification and cost reduction benefits to persons and businesses across the EU, including by enabling powers of representation and e-mandates, Member States should issue European Digital Identity Wallets relying on common standards to ensure seamless interoperability and a high level of security. Only Member States’ competent authorities can provide a high degree of confidence in establishing the identity of a person and therefore provide assurance that the person claiming or asserting a particular identity is in fact the person he or she claims to be. It is therefore necessary that the European Digital Identity Wallets rely on the legal identity of citizens, other residents or legal entities. Trust in the European Digital Identity Wallets would be enhanced by the fact that issuing parties are required to implement appropriate technical and organisational measures to ensure a level of security commensurate to the risks raised for the rights and freedoms of the natural persons, in line with Regulation (EU) 2016/679. |
Or. en
Justification
To take into account also software-based technologies. Software-based security not relying on a specific hardware or a specific telecom provider could enable significantly shorter supply chains as well as better digital sovereignty of the EU. This kind of technology also enables more flexible mitigation of any usability flaw or security risk, since there is no need to replace any physical component.
Amendment 2
Proposal for a regulation
Article 1 – paragraph 1 – point 1
Regulation (EU) 910/2014
Article 1 – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
| (a) lays down the conditions under which Member States shall provide and recognise electronic identification means of natural and legal persons, falling under a notified electronic identification scheme of another Member State; | (a) lays down the conditions under which Member States provide and recognise electronic identification means of natural and legal persons, falling under a notified electronic identification scheme of another Member State; |
Or. en
Justification
This is a linguistic remark for the text to be coherent with the specified provisions in this article.
Amendment 3
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) 910/2014
Article 6a – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. For the purpose of ensuring that all natural and legal persons in the Union have secure, trusted and seamless access to cross-border public and private services, each Member State shall issue a European Digital Identity Wallet within 12 months after the entry into force of this Regulation. | 1. For the purpose of strengthening the digital single market and ensuring that all natural and legal persons in the Union have secure, trusted and seamless access to cross-border public and private services, while strengthening consumer choice, trust and control over these services, each Member State shall issue a European Digital Identity Wallet within 12 months after the entry into force of this Regulation. |
Or. en
Justification
To highlight the impact of the Digital Identity Wallets on the Digital Single Market, while underscoring consumers’ control over these services.
Amendment 4
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) 910/2014
Article 6a – paragraph 3 – point b a (new)
| Text proposed by the Commission | Amendment |
| (ba) securely use his or her digital identity, across-borders and across-sectors. |
Or. en
Justification
This addition emphasizes the importance for users to securely use their identities when utilizing Digital Identity Wallets cross-border and cross-sector.
Amendment 5
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) 910/2014
Article 6a – paragraph 6
| Text proposed by the Commission | Amendment |
| 6. The European Digital Identity Wallets shall be issued under a notified electronic identification scheme of level of assurance ‘high’. The use of the European Digital Identity Wallets shall be free of charge to natural persons. | 6. The European Digital Identity Wallets shall be issued under a notified electronic identification scheme of level of assurance ‘high’. |
Or. en
Justification
To stress that the Digital Identity Wallets are free of charge to all users and without discrimination, Article 6 (a) paragraph 6 has been split into paragraphs 6 and 6a.
Amendment 6
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) 910/2014
Article 6a – paragraph 6 a (new)
| Text proposed by the Commission | Amendment |
| 6a. The use of European Digital Identity Wallets shall be free of charge to all users. |
Or. en
Justification
To stress that the Digital Identity Wallets are free of charge to all users and without discrimination. Article 6 (a) paragraph 6 has been split into paragraphs 6 and 6a.
Amendment 7
Proposal for a regulation
Article 1 – paragraph 1 – point 9
Regulation (EU) 910/2014
Article 7 – paragraph 1 – introductory part
| Text proposed by the Commission | Amendment |
| Pursuant to Article 9(1) Member States shall notify, within 12 months after the entry into force of this Regulation at least one electronic identification scheme including at least one identification means: | Pursuant to Article 9(1) Member States shall notify, within 12 months after the entry into force of this Regulation at least one electronic identification scheme, including at least one identification means, which shall comply with all of the following conditions: |
Or. en
Justification
It is necessary to clarify that the list of conditions is cumulative, in line with the introductory sentence of Article 7, paragraph 1, of the eIDAS Regulation.
Amendment 8
Proposal for a regulation
Article 1 – paragraph 1 – point 10
Regulation (EU) 910/2014
Article 9 – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. The Commission shall publish in the Official Journal of the European Union a list of the electronic identification schemes which were notified pursuant to paragraph 1 of this Article and the basic information thereon. | 2. The Commission shall, without undue delay after receipt of the notification referred to in paragraph 1, publish in the Official Journal of the European Union a list of the electronic identification schemes which were notified pursuant to paragraph 1 of this Article and the basic information thereon. |
Or. en
Justification
It is necessary to ensure a swift publication of the notified national eID schemes by the Commission.
Amendment 9
Proposal for a regulation
Article 1 – paragraph 1 – point 16
Regulation (EU) 910/2014
Article 12b – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Where private relying parties providing services are required by national or Union law, to use strong user authentication for online identification, or where strong user authentication is required by contractual obligation, including in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications, private relying parties shall also accept the use of European Digital Identity Wallets issued in accordance with Article 6a. | 2. Where private relying parties providing services are required by national or Union law, to use strong user authentication for online identification, or where strong user authentication is required by contractual obligation, including in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, education and professional qualifications or telecommunications, private relying parties shall also accept the use of European Digital Identity Wallets issued in accordance with Article 6a. |
Or. en
Justification
To include professional qualifications not covered by education.
Amendment 10
Proposal for a regulation
Article 1 – paragraph 1 – point 16
Regulation (EU) 910/2014
Article 12c – paragraph 1 – subparagraph 1 – introductory part
| Text proposed by the Commission | Amendment |
| Where electronic identification using an electronic identification means and authentication is required under national law or by administrative practice to access an online service provided by a public sector body in a Member State, the electronic identification means, issued in another Member State shall be recognised in the first Member State for the purposes of cross-border authentication for that online service, provided that the following conditions are met: | Where electronic identification using an electronic identification means and authentication is required under national law or by administrative practice to access an online service provided by a public sector body in a Member State, the electronic identification means, issued in another Member State shall be recognised in the first Member State for the purposes of cross-border authentication for that online service and ensuring mutual recognition, provided that the following conditions are met: |
Or. en
Justification
To harmonise the text.
Amendment 11
Proposal for a regulation
Article 1 – paragraph 1 – point 38
Regulation (EU) 910/2014
Article 45 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. Qualified certificates for website authentication shall meet the requirements laid down in Annex IV. Qualified certificates for website authentication shall be deemed compliant with the requirements laid down in Annex IV where they meet the standards referred to in paragraph 3. | 1. Qualified certificates for website authentication shall comply with the requirements laid down in Annex IV. Qualified certificates for website authentication shall be deemed compliant with the requirements laid down in Annex IV where they meet the standards referred to in paragraph 3. |
Or. en
Justification
Linguistic improvement.
ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT
The following list is drawn up on a purely voluntary basis under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the draft opinion:
| Entity and/or person |
| Deutsche Telekom |
| Bundesdruckerei GmbH |
| Cybernetica |
| BSA / The Software Alliance |
| United Internet |
| Eurosmart |
| European Telecommunication Standards Institute |
| THALES |
| Norton LifeLock |
| EUROCHAMBRES |
| DigiCert |
| Onfido |
| Mozilla |
| Electronic IDentification |
| Foundation for Internet Domain Registration in the Netherlands |