Sittings · Document
DRAFT REPORT (COM(2021)0281 – C90200/2021 – 2021/0136(COD)) 2022-05-31
On the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity
Committee on Industry, Research and Energy · Rapporteur: Romana Jerković
DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION
on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity
(COM(2021)0281 – C90200/2021 – 2021/0136(COD))
(Ordinary legislative procedure: first reading)
The European Parliament,
– having regard to the Commission proposal to Parliament and the Council (COM(2021)0281),
– having regard to Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90200/2021),
– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,
– having regard to the reasoned opinions submitted, within the framework of Protocol No 2 on the application of the principles of subsidiarity and proportionality, by the Czech Senate, the Spanish Parliament, the Netherlands Senate and the Portuguese Parliament, asserting that the draft legislative act does not comply with the principle of subsidiarity,
– having regard to the opinion of the European Economic and Social Committee of 20 October 2021,
– having regard to the opinion of the Committee of the Regions of 13 October 2021,
– having regard to Rule 59 of its Rules of Procedure,
– having regard to the opinions of the Committee on the Internal Market and Consumer Protection, the Committee on Legal Affairs and the Committee on Civil Liberties, Justice and Home Affairs,
– having regard to the report of the Committee on Industry, Research and Energy (A90000/2022),
1. Adopts its position at first reading hereinafter set out;
2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;
3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.
Amendment 1
Proposal for a regulation
Recital 3 a (new)
| Text proposed by the Commission | Amendment |
| (3a) The Commission Declaration of 26 January 2022 entitled “European Declaration on Digital rights and Principles for the Digital Decade”1a highlights that everyone should have access to digital technologies, products and services that are safe, secure, and privacy-protective by design and undertakes to protecting the interests of people, businesses and public institutions against cybercrime, data breaches and cyberattacks, including protecting digital identity from identity theft or manipulation. | |
| __________________ | |
| 1a COM(2022)0028. |
Or. en
Amendment 2
Proposal for a regulation
Recital 3 b (new)
| Text proposed by the Commission | Amendment |
| (3b) All Union citizens have the inalienable right to a digital identity that is under their sole control and that enables them to exercise their rights as citizens in the digital environment and to participate in the digital economy. A European digital identity should be legally recognised throughout in the Union. |
Or. en
Amendment 3
Proposal for a regulation
Recital 3 c (new)
| Text proposed by the Commission | Amendment |
| (3c) In the context of this Regulation, natural and legal persons can have a digital identity. The implementing technologies and standards developed in the application of this Regulation could be extended to establish digital identities for connected objects in order to develop a trust layer for the development of Internet of Things. |
Or. en
Amendment 4
Proposal for a regulation
Recital 4
| Text proposed by the Commission | Amendment |
| (4) A more harmonised approach to digital identification should reduce the risks and costs of the current fragmentation due to the use of divergent national solutions and will strengthen the Single Market by allowing citizens, other residents as defined by national law and businesses to identify online in a convenient and uniform way across the Union. Everyone should be able to securely access public and private services relying on an improved ecosystem for trust services and on verified proofs of identity and attestations of attributes, such as a university degree legally recognised and accepted everywhere in the Union. The framework for a European Digital Identity aims to achieve a shift from the reliance on national digital identity solutions only, to the provision of electronic attestations of attributes valid at European level. Providers of electronic attestations of attributes should benefit from a clear and uniform set of rules and public administrations should be able to rely on electronic documents in a given format. | (4) A more harmonised approach to digital identification should reduce the risks and costs of the current fragmentation due to the use of divergent national solutions and will strengthen the Single Market by allowing citizens, other residents as defined by national law and businesses to identify and to authenticate online and offline in a convenient and uniform way across the Union. Everyone should be able to securely access public and private services relying on an improved ecosystem for trust services and on verified proofs of identity and attestations of attributes, such as a university degree legally recognised and accepted everywhere in the Union. The framework for a European Digital Identity aims to complement national digital identity solutions by building a true internal market for the cross-border provision of electronic attestations of attributes that are legally recognised and accepted throughout in the Union. Providers of electronic attestations of attributes should benefit from a clear and uniform set of rules and public administrations should be able to rely on electronic documents in a given format. |
Or. en
Amendment 5
Proposal for a regulation
Recital 5
| Text proposed by the Commission | Amendment |
| (5) To support the competitiveness of European businesses, online service providers should be able to rely on digital identity solutions recognised across the Union, irrespective of the Member State in which they have been issued, thus benefiting from a harmonised European approach to trust, security and interoperability. Users and service providers alike should be able to benefit from the same legal value provided to electronic attestations of attributes across the Union. | (5) To support the competitiveness of European businesses, online service providers should be able to rely on digital identity solutions recognised across the Union, irrespective of the Member State in which they have been issued, thus benefiting from a harmonised European approach to trust, security and interoperability. Users and service providers alike should be able to benefit from the same legal value provided to electronic attestations of attributes across the Union. Harmonised digital identity framework has the potential to significantly reduce operational costs linked to identification procedures, for example during the on-boarding of new customers, and to reduce expenditures or damages related to cybercrimes, such as data theft and online fraud, to support innovation and competitiveness, and to promote digital transformation of the Union’s small and medium sized enterprises (SMEs). |
Or. en
Amendment 6
Proposal for a regulation
Recital 5 a (new)
| Text proposed by the Commission | Amendment |
| (5a) A fully harmonised digital identity framework can enable economic value creation for individuals and businesses by fostering increased inclusion, which provides greater access to goods and services, by increasing formalisation, which helps reduce fraud, protects rights, and increases transparency, by reducing operational costs, which supports innovation and competitiveness, and by promoting digitisation, which drives efficiencies and ease of use. |
Or. en
Amendment 7
Proposal for a regulation
Recital 5 b (new)
| Text proposed by the Commission | Amendment |
| (5b) In order to encourage digitalisation of the Member States’ public sector services and to ensure wide up-take of the European digital identity framework and the European Digital Identity Wallets, this Regulation should support the use of the ‘once only’ principle in order to reduce administrative burden, to support cross-border mobility of citizens and businesses, and to foster development of interoperable e-government services across the Union. The cross-border application of the ‘once only’ principle should result in citizens and businesses not having to supply the same data to public authorities more than once, and that it should also be possible to use those data at the request of the user for the purposes of completing cross-border online procedures. |
Or. en
Amendment 8
Proposal for a regulation
Recital 6
| Text proposed by the Commission | Amendment |
| (6) Regulation (EU) No 2016/67919 applies to the processing of personal data in the implementation of this Regulation. Therefore, this Regulation should lay down specific safeguards to prevent providers of electronic identification means and electronic attestation of attributes from combining personal data from other services with the personal data relating to the services falling within the scope of this Regulation. | (6) Regulation (EU) No 2016/67919 applies to the processing of personal data in the implementation of this Regulation. Therefore, this Regulation should complement Regulation (EU) No 2016/679 by laying down specific safeguards to prevent providers of electronic identification means and electronic attestation of attributes from combining personal data from other services with the personal data relating to the services falling within the scope of this Regulation and to eliminate or reduce to the minimum citizens' digital footprint when using the internet by using the European Digital Identity Wallet. Specific rules of this Regulation should not be regarded as lex specialis to the Regulation (EU) 2016/679. |
| __________________ | __________________ |
| 19 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1 | 19 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1 |
Or. en
Amendment 9
Proposal for a regulation
Recital 6 a (new)
| Text proposed by the Commission | Amendment |
| (6a) The European Digital Identity Wallet should have the function of transaction history embedded into the design. Such a function should allow the user to track all transactions executed through the wallet, with at least the following data: the time and date of the transaction, the counterpart identification, the data requested and the data shared. That information should be stored even if the transaction was not concluded. The information contained in the transaction history should be non-repudiable for any legal purpose. Such a function should be active by default. |
Or. en
Amendment 10
Proposal for a regulation
Recital 6 b (new)
| Text proposed by the Commission | Amendment |
| (6b) Zero Knowledge Proof (ZKP) allows verification of a claim without revealing the data that proves it, based on cryptographic algorithms. The European Digital Identity Wallet should allow for verification of claims inferred from personal data identification or attestation of attributes without having to provide the source data, to preserve the privacy of the user of the European Digital Identity Wallet, while presenting a proof with legal effect. Such approach would allow the holder to demonstrate, for example, that he or she is an adult or where he or she is located if that information is needed to access a certain service. In addition, ZKP could help fight against bots and disinformation attacks, as platforms could verify that an action on their platform (content, vote, comment, etc.) is executed by a real person located in the Union, while preserving the right to anonymity. |
Or. en
Amendment 11
Proposal for a regulation
Recital 7
| Text proposed by the Commission | Amendment |
| (7) It is necessary to set out the harmonised conditions for the establishment of a framework for European Digital Identity Wallets to be issued by Member States, which should empower all Union citizens and other residents as defined by national law to share securely data related to their identity in a user friendly and convenient way under the sole control of the user. Technologies used to achieve those objectives should be developed aiming towards the highest level of security, user convenience and wide usability. Member States should ensure equal access to digital identification to all their nationals and residents. | (7) It is necessary to set out the harmonised conditions for the establishment of a framework for European Digital Identity Wallets to be issued by Member States, which should empower all Union citizens and other residents as defined by national law to share securely data related to their identity under the sole control of the user and to receive securely the data in a user-friendly way. Technologies used to achieve those objectives should be developed aiming towards the highest level of security, user convenience and wide usability. Member States should ensure equal access to digital identification to all their nationals and residents. |
Or. en
Amendment 12
Proposal for a regulation
Recital 7 a (new)
| Text proposed by the Commission | Amendment |
| (7a) The Commission should, when adopting implementing acts, take due account of the open standards and standards and technical specifications drawn up by European and international standardisation organisations and bodies, in particular the European Committee for Standardisation (CEN), the European Telecommunications Standards Institute (ETSI), the International Organisation for Standardisation (ISO) and the International Telecommunication Union (ITU), as well as of the security standards referred to in Article 32 of Regulation (EU) 2016/679 and Article 22 of Regulation (EU) 2018/1725. |
Or. en
Amendment 13
Proposal for a regulation
Recital 7 b (new)
| Text proposed by the Commission | Amendment |
| (7b) In order to help bridge the digital divide and in order to promote social inclusion, civic participation, access to education and the labour market, Member States should ensure equal access to electronic identification means to all their nationals and residents, including vulnerable persons, such as persons with disabilities, older people, socioeconomically disadvantaged groups and individuals, refugees and persons with limited access to the internet infrastructure and the digital skills. |
Or. en
Amendment 14
Proposal for a regulation
Recital 9
| Text proposed by the Commission | Amendment |
| (9) All European Digital Identity Wallets should allow users to electronically identify and authenticate online and offline across borders for accessing a wide range of public and private services. Without prejudice to Member States’ prerogatives as regards the identification of their nationals and residents, Wallets can also serve the institutional needs of public administrations, international organisations and the Union’s institutions, bodies, offices and agencies. Offline use would be important in many sectors, including in the health sector where services are often provided through face-to-face interaction and ePrescriptions should be able to rely on QR-codes or similar technologies to verify authenticity. Relying on the level of assurance “high”, the European Digital Identity Wallets should benefit from the potential offered by tamper-proof solutions such as secure elements, to comply with the security requirements under this Regulation. The European Digital Identity Wallets should also allow users to create and use qualified electronic signatures and seals which are accepted across the EU. To achieve simplification and cost reduction benefits to persons and businesses across the EU, including by enabling powers of representation and e-mandates, Member States should issue European Digital Identity Wallets relying on common standards to ensure seamless interoperability and a high level of security. Only Member States’ competent authorities can provide a high degree of confidence in establishing the identity of a person and therefore provide assurance that the person claiming or asserting a particular identity is in fact the person he or she claims to be. It is therefore necessary that the European Digital Identity Wallets rely on the legal identity of citizens, other residents or legal entities. Trust in the European Digital Identity Wallets would be enhanced by the fact that issuing parties are required to implement appropriate technical and organisational measures to ensure a level of security commensurate to the risks raised for the rights and freedoms of the natural persons, in line with Regulation (EU) 2016/679. | (9) All European Digital Identity Wallets should allow users to electronically identify and authenticate online and offline across borders for accessing a wide range of public and private services. Without prejudice to Member States’ prerogatives as regards the identification of their nationals and residents, Wallets can also serve the institutional needs of public administrations, international organisations and the Union’s institutions, bodies, offices and agencies. Offline use would be important in many sectors, including in the health sector where services are often provided through face-to-face interaction and ePrescriptions should be able to rely on QR-codes or similar technologies to verify authenticity. Relying on the level of assurance “high”, the European Digital Identity Wallets should benefit from the potential offered by tamper-proof solutions such as secure elements and state of the art encryption, to comply with the security requirements under this Regulation. The European Digital Identity Wallets should also allow users to create and use qualified electronic signatures and seals which are accepted across the EU. To achieve simplification and cost reduction benefits to persons and businesses across the EU, including by enabling powers of representation and e-mandates, Member States should issue European Digital Identity Wallets relying on common standards and technical specifications to ensure seamless interoperability and to adequately increase the level of IT security, strengthen robustness against cyber-attacks and thus significantly reduce the potential risks of ongoing digitalisation for citizens and businesses. Only Member States’ competent authorities can provide a high degree of confidence in establishing the identity of a person and therefore provide assurance that the person claiming or asserting a particular identity is in fact the person he or she claims to be. It is therefore necessary that the European Digital Identity Wallets rely on the legal identity of citizens, other residents or legal entities. Trust in the European Digital Identity Wallets would be enhanced by the fact that issuing parties are required to implement appropriate technical and organisational measures to ensure a highest level of security that is commensurate to the risks raised for the rights and freedoms of the natural persons, in line with Regulation (EU) 2016/679. |
Or. en
Amendment 15
Proposal for a regulation
Recital 11
| Text proposed by the Commission | Amendment |
| (11) European Digital Identity Wallets should ensure the highest level of security for the personal data used for authentication irrespective of whether such data is stored locally or on cloud-based solutions, taking into account the different levels of risk. Using biometrics to authenticate is one of the identifications methods providing a high level of confidence, in particular when used in combination with other elements of authentication. Since biometrics represents a unique characteristic of a person, the use of biometrics requires organisational and security measures, commensurate to the risk that such processing may entail to the rights and freedoms of natural persons and in accordance with Regulation 2016/679. | (11) European Digital Identity Wallets should ensure the highest level of security for the personal data used for identification and authentication, irrespective of whether such data is stored locally or on cloud-based solutions, and taking into account the different levels of risk. Using biometrics to identify and authenticate should not be a precondition for using European Digital Identity Wallet, notwithstanding the requirement for strong user authentication. Biometric data used for the purpose to identify and authenticate a natural person in the context of this Regulation should not be stored in the cloud. Using biometrics is one of the identifications methods providing a high level of confidence, in particular when used in combination with other elements of authentication. Since biometrics represents a unique characteristic of a person, the use of biometrics requires organisational and security measures, commensurate to the risk that such processing may entail to the rights and freedoms of natural persons and in accordance with Regulation 2016/679. Storing information from the European Digital Identity Wallet in the cloud should be an optional feature only active after the user has given explicit consent. Where the European Digital Identity Wallet is provided on the smartphone of the user its cryptographic material should be, when available, stored in the secure elements of the device. |
Or. en
Amendment 16
Proposal for a regulation
Recital 17 a (new)
| Text proposed by the Commission | Amendment |
| (17a) When accessing public and private services cross-borders, authentication and identification of a user of the Wallet should be possible. The receiving Member States should be able to unequivocally identify the user upon their request in those cases where identification of the user is required by law. In order to ensure high-level of trust and security of personal data, different technical solutions should be considered, including the use or combination of various cryptographic techniques, such as cryptographically verifiable identifiers, unique user-generated digital pseudonyms, self-sovereign identities and domain specific identifiers using state of the art encryption technology. |
Or. en
Amendment 17
Proposal for a regulation
Recital 19
| Text proposed by the Commission | Amendment |
| (19) This Regulation should not cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards form laid down by national or Union law. In addition, it should not affect national form requirements pertaining to public registers, in particular commercial and land registers. | (19) This Regulation should not cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards to forms laid down by national or Union law. |
Or. en
Amendment 18
Proposal for a regulation
Recital 21 a (new)
| Text proposed by the Commission | Amendment |
| (21a) This Regulation seeks to facilitate creation, choice and switching between different European Digital Identity Wallets. In order to avoid lock-in effects, the issuers of the European Digital Identity Wallets should at the request of the user of the Wallet, provide for effective portability of data, including provisions of continuous and real-time access to services, and not be allowed to use contractual, economic or technical barriers to prevent or to discourage effective switching between different European Digital Identity Wallets. |
Or. en
Amendment 19
Proposal for a regulation
Recital 23
| Text proposed by the Commission | Amendment |
| (23) Due consideration should be given to ensure effective cooperation between the NIS and eIDAS authorities. In cases where the supervisory body under this Regulation is different from the competent authorities designated under Directive XXXX/XXXX [NIS2], those authorities should cooperate closely, in a timely manner by exchanging the relevant information in order to ensure effective supervision and compliance of trust service providers with the requirements set out in this Regulation and Directive XXXX/XXXX [NIS2]. In particular, the supervisory bodies under this Regulation should be entitled to request the competent authority under Directive XXXXX/XXXX [NIS2] to provide the relevant information needed to grant the qualified status and to carry out supervisory actions to verify compliance of the trust service providers with the relevant requirements under NIS 2 or require them to remedy non-compliance. | (23) Due consideration should be given to ensure effective cooperation between the NIS and eIDAS authorities. In cases where the national competent authority under this Regulation is different from the competent authorities designated under Directive XXXX/XXXX [NIS2], those authorities should cooperate closely, in a timely manner by exchanging the relevant information in order to ensure effective supervision and compliance of trust service providers with the requirements set out in this Regulation and Directive XXXX/XXXX [NIS2]. In particular, the national competent authorities under this Regulation should be entitled to request the competent authority under Directive XXXXX/XXXX [NIS2] to provide the relevant information needed to grant the qualified status and to carry out supervisory actions to verify compliance of the trust service providers with the relevant requirements under NIS 2 or require them to remedy non-compliance. |
Or. en
Amendment 20
Proposal for a regulation
Recital 28
| Text proposed by the Commission | Amendment |
| (28) Wide availability and usability of the European Digital Identity Wallets require their acceptance by private service providers. Private relying parties providing services in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications should accept the use of European Digital Identity Wallets for the provision of services where strong user authentication for online identification is required by national or Union law or by contractual obligation. Where very large online platforms as defined in Article 25.1. of Regulation [reference DSA Regulation] require users to authenticate to access online services, those platforms should be mandated to accept the use of European Digital Identity Wallets upon voluntary request of the user. Users should be under no obligation to use the wallet to access private services, but if they wish to do so, large online platforms should accept the European Digital Identity Wallet for this purpose while respecting the principle of data minimisation. Given the importance of very large online platforms, due to their reach, in particular as expressed in number of recipients of the service and economic transactions this is necessary to increase the protection of users from fraud and secure a high level of data protection. Self-regulatory codes of conduct at Union level (‘codes of conduct’) should be developed in order to contribute to wide availability and usability of electronic identification means including European Digital Identity Wallets within the scope of this Regulation. The codes of conduct should facilitate wide acceptance of electronic identification means including European Digital Identity Wallets by those service providers which do not qualify as very large platforms and which rely on third party electronic identification services for user authentication. They should be developed within 12 months of the adoption of this Regulation. The Commission should assess the effectiveness of these provisions for the availability and usability for the user of the European Digital Identity Wallets after 18 months of their deployment and revise the provisions to ensure their acceptance by means of delegated acts in the light of this assessment. | (28) Wide availability and usability of the European Digital Identity Wallets require their acceptance by private service providers. Private relying parties providing services in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications should accept the use of European Digital Identity Wallets for the provision of services where strong user authentication for online identification is required by national or Union law or by contractual obligation. The information requested from the user via the European Digital Identity Wallet should be necessary and proportionate for the intended use case of the relying party and follow the principle of data minimisation. Where very large online platforms as defined in Article 25.1. of Regulation [reference DSA Regulation] require users to identify or to authenticate to access online services, those platforms should be mandated to accept the use of European Digital Identity Wallets upon voluntary request of the user. Users should be under no obligation to use the wallet to access private services, but if they wish to do so, large online platforms should accept the European Digital Identity Wallet for this purpose while respecting the principle of data minimisation. Given the importance of very large online platforms, due to their reach, in particular as expressed in number of recipients of the service and economic transactions this is necessary to increase the protection of users from fraud and secure a high level of data protection. Self-regulatory codes of conduct at Union level (‘codes of conduct’) should be developed in order to contribute to wide availability and usability of electronic identification means including European Digital Identity Wallets within the scope of this Regulation. The codes of conduct should facilitate wide acceptance of electronic identification means including European Digital Identity Wallets by those service providers which do not qualify as very large platforms and which rely on third party electronic identification services for user authentication. They should be developed within 12 months of the adoption of this Regulation. The Commission should assess the effectiveness of these provisions for the availability and usability for the user of the European Digital Identity Wallets after 18 months of their deployment and revise the provisions to ensure their acceptance by means of delegated acts in the light of this assessment. |
Or. en
Amendment 21
Proposal for a regulation
Recital 29
| Text proposed by the Commission | Amendment |
| (29) The European Digital Identity Wallet should technically enable the selective disclosure of attributes to relying parties. This feature should become a basic design feature thereby reinforcing convenience and personal data protection including minimisation of processing of personal data. | (29) The design of the European Digital Identity Wallet should technically enable the selective disclosure of attributes to relying parties. Privacy by design should become a standard design feature of the European Digital Identity Wallet, thereby reinforcing user control, convenience and personal data protection including minimisation of processing of personal data. In general, insofar as personal data are concerned, the processing of such data should rely upon the grounds for processing provided in Article 5(1), point (c), of Regulation (EU) 2016/679. |
Or. en
Amendment 22
Proposal for a regulation
Recital 30 a (new)
| Text proposed by the Commission | Amendment |
| (30a) Authentic sources that are users of a European Digital Identity Wallets should be able to issue non-qualified electronic attestation of attributes directly using the European Digital Identity Wallets. Alternatively, they should be able to use any trust service provider compliant with the technical specifications and standards of the European Digital Identity Wallets framework to issue electronic attestation of attributes on their behalf. Non-qualified attestations of attributes do not receive the same assumption of high level of assurance as the qualified electronic attestation of attributes, but they nevertheless provide the potential for many use cases (e.g. fidelity credentials, club membership credentials, coupon credentials, etc.) providing for the necessary flexibility and anticipating future evolution of the framework, including increasing the overall usability of the framework for the users of the European Digital Identity Wallets. |
Or. en
Amendment 23
Proposal for a regulation
Recital 31 a (new)
| Text proposed by the Commission | Amendment |
| (31a) Strong user authentication covers sectorial use cases that mandate strong authentication using two factors. For example, strong user authentication supports strong customer authentication requirements for account login and initiation of transactions in the field of payment services. |
Or. en
Amendment 24
Proposal for a regulation
Recital 36
| Text proposed by the Commission | Amendment |
| (36) In order to avoid fragmentation and barriers, due to diverging standards and technical restrictions, and to ensure a coordinated process to avoid endangering the implementation of the future European Digital Identity framework, a process for close and structured cooperation between the Commission, Member States and the private sector is needed. To achieve this objective, Member States should cooperate within the framework set out in the Commission Recommendation XXX/XXXX [Toolbox for a coordinated approach towards a European Digital Identity Framework]26 to identify a Toolbox for a European Digital Identity framework. The Toolbox should include a comprehensive technical architecture and reference framework, a set of common standards and technical references and a set of guidelines and descriptions of best practices covering at least all aspects of the functionalities and interoperability of the European Digital Identity Wallets including eSignatures and of the qualified trust service for attestation of attributes as laid out in this regulation. In this context, Member States should also reach agreement on common elements of a business model and fee structure of the European Digital Identity Wallets, to facilitate take up, in particular by small and medium sized companies in a cross-border context. The content of the toolbox should evolve in parallel with and reflect the outcome of the discussion and process of adoption of the European Digital Identity Framework. | (36) In order to avoid fragmentation and barriers, due to diverging standards and technical restrictions, and to ensure a coordinated process to avoid endangering the implementation of the future European Digital Identity framework, a process for close and structured cooperation between the Commission, Member States and the private sector is needed. To achieve this objective, Member States should cooperate within the European Digital Identity Board. The European Digital Identity Board should propose a comprehensive technical architecture and reference framework, a set of common standards, including recognised existing standards, and technical references and a set of guidelines and descriptions of best practices covering at least all aspects of the functionalities and interoperability of the European Digital Identity Wallets including eSignatures and of the qualified trust service for attestation of attributes as laid out in this regulation. In this context, Member States should also reach agreement on common elements of a business model and fee structure of the European Digital Identity Wallets, to facilitate take up, in particular by SMEs in a cross-border context. |
| __________________ | __________________ |
| 26 [insert reference once adopted] | 26 [insert reference once adopted] |
Or. en
Amendment 25
Proposal for a regulation
Article 1 – paragraph 1 – point 1
Regulation (EU) No 910/2014
Article 1 – paragraph 1 – point (d)
| Text proposed by the Commission | Amendment |
| (d) lays down the conditions for the issuing of European Digital Identity Wallets by Member States. | (d) lays down the conditions for the issuing of European Digital Identity Wallets. |
Or. en
Amendment 26
Proposal for a regulation
Article 1 – paragraph 1 – point 2 – point a
Regulation (EU) No 910/2014
Article 2 – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. This Regulation applies to electronic identification schemes that have been notified by a Member State, European Digital Identity Wallets issued by Member States and to trust service providers that are established in the Union. | 1. This Regulation applies to electronic identification schemes that have been notified by a Member State, to European Digital Identity Wallets and to trust service providers that are established in the Union. |
Or. en
Amendment 27
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point a
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 2
| Text proposed by the Commission | Amendment |
| (2) ‘electronic identification means’ means a material and/or immaterial unit, including European Digital Identity Wallets or ID cards following Regulation 2019/1157, containing person identification data and which is used for authentication for an online or offline service; | (2) ‘electronic identification means’ means a material and/or immaterial unit, containing person identification data and which is used for identification and authentication for an online and offline service; |
Or. en
Amendment 28
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point a a (new)
Regulation (EU) No 910/2014
Article 3 – paragraph 1– point 3
| Present text | Amendment |
| (aa) point 3 is replaced by the following: | |
| (3) ‘person identification data’ means a set of data enabling the identity of a natural or legal person, or a natural person representing a legal person to be established; | (3) ‘person identification data’ means a qualified electronic attributes composed of a set of data establishing the identity of a natural or legal person, or a natural person representing a legal person to be established;'; |
Or. en
Amendment 29
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point b a (new)
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 4 a (new)
| Text proposed by the Commission | Amendment |
| (ba) the following point is inserted: | |
| (4a) ‘user’ means a natural or legal person, or a natural person representing a legal person using trust services, electronic identification means and European Digital Identity Wallets, provided according to this Regulation; |
Or. en
Amendment 30
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point b b (new)
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 4 b (new)
| Text proposed by the Commission | Amendment |
| (bb) the following point is inserted: | |
| (4b) 'identification' means the act of unequivocally associating a natural or legal person with its person identification data; |
Or. en
Amendment 31
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point b c (new)
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 5 a (new)
| Text proposed by the Commission | Amendment |
| (bc) the following point is inserted: | |
| (5a) ‘zero knowledge proof’ means any cryptographic method by which a relying party can validate that a given statement based on the electronic attestation of attributes held in the user’s European Digital Identity Wallet is true, without conveying any data related to those electronic attestation of attributes to the relying party; |
Or. en
Amendment 32
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point i
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 42
| Text proposed by the Commission | Amendment |
| (42) ‘European Digital Identity Wallet’ is a product and service that allows the user to store identity data, credentials and attributes linked to her/his identity, to provide them to relying parties on request and to use them for authentication, online and offline, for a service in accordance with Article 6a; and to create qualified electronic signatures and seals; | (42) 'European Digital Identity Wallet' means a product and service that operates like electronic identifications means and that allows the user to store and manage identity data credentials and attributes linked to her/his identity, to provide them to relying parties on request, to create qualified electronic signatures and seals, and to use them for identification and authentication, online and offline, for accessing public and private service in accordance with Article 6a; |
Or. en
Amendment 33
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point i
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 43
| Text proposed by the Commission | Amendment |
| (43) ‘attribute’ is a feature, characteristic or quality of a natural or legal person or of an entity, in electronic form; | (43) ‘attribute’ means a characteristic or quality of a natural or legal person or of an entity, in electronic form; |
Or. en
Amendment 34
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point i
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 50
| Text proposed by the Commission | Amendment |
| (50) ‘strong user authentication’ means an authentication based on the use of two or more elements categorised as user knowledge , possession and inherence that are independent, in such a way that the breach of one does not compromise the reliability of the others, and is designed in such a way to protect the confidentiality of the authentication data; | (50) ‘strong user authentication’ means a means of confirming user's identity based on the use of at least two authentication factors categorised as user knowledge, possession and inherence that are independent, in such a way that the breach of one does not compromise the reliability of the others, and is designed in such a way to protect the confidentiality of the authentication data; |
Or. en
Amendment 35
Proposal for a regulation
Article 1 – paragraph 1 – point 3 a (new)
Regulation (EU) No 910/2014
Article 4 – paragraph 2
| Present text | Amendment |
| (3a) Article 4(2) is replaced by the following: | |
| 2. Products and trust services that comply with this Regulation shall be permitted to circulate freely in the internal market. | “2. Products and services that comply with this Regulation shall be permitted to circulate freely in the internal market.” |
Or. en
(Regulation (EU) 910/2014)
Amendment 36
Proposal for a regulation
Article 1 – paragraph 1 – point 4
Regulation (EU) No 910/2014
Article 5 – title
| Text proposed by the Commission | Amendment |
| Pseudonyms in electronic transaction | Pseudonyms in electronic transactions |
Or. en
Amendment 37
Proposal for a regulation
Article 1 – paragraph 1 – point 4
Regulation (EU) No 910/2014
Article 5 – paragraph 1
| Text proposed by the Commission | Amendment |
| Without prejudice to the legal effect given to pseudonyms under national law, the use of pseudonyms in electronic transactions shall not be prohibited.; | Without prejudice to the legal effect given to pseudonyms and self-sovereign identities under national law, their use in electronic transactions shall not be prohibited. |
Or. en
Amendment 38
Proposal for a regulation
Article 1 – paragraph 1 – point 4 a (new)
Regulation (EU) No 910/2014
Article 1 – paragraph 5a (new)
| Text proposed by the Commission | Amendment |
| (4a) the following article is inserted: | |
| 'Article 5a | |
| Protection of personal data | |
| 1. Processing of personal data shall be carried out in accordance with Regulation (EU) 2016/679, in particular by implementing principle of privacy by design and by default. | |
| 2. Attributes and person identification data relating to natural persons are personal data as defined in Article 4, point (1), of Regulation (EU) 2016/679.' |
Or. en
Amendment 39
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. For the purpose of ensuring that all natural and legal persons in the Union have secure, trusted and seamless access to cross-border public and private services, each Member State shall issue a European Digital Identity Wallet within 12 months after the entry into force of this Regulation. | 1. For the purpose of ensuring that all natural and legal persons in the Union have secure, trusted and seamless access to cross-border public and private services, each Member State shall issue at least one European Digital Identity Wallet by … [12 months after the entry into force of this amending Regulation]. |
Or. en
Amendment 40
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 2 – point c
| Text proposed by the Commission | Amendment |
| (c) independently but recognised by a Member State. | (c) by an organisation established in the Union. |
Or. en
Amendment 41
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 3 – point a
| Text proposed by the Commission | Amendment |
| (a) securely request and obtain, store, select, combine and share, in a manner that is transparent to and traceable by the user, the necessary legal person identification data and electronic attestation of attributes to authenticate online and offline in order to use online public and private services; | (a) securely request and obtain, validate, store, select, issue, combine, share and exchange, in a manner that is transparent to and traceable by the user, the electronic attestation of attributes, including person identification data, and to securely authenticate and identify online and offline in order to use online public and private services; |
Or. en
Amendment 42
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a– paragraph 3 – point a a (new)
| Text proposed by the Commission | Amendment |
| (aa) securely authenticate, identify, receive and exchange electronic attestations of attributes directly from other European Digital Identity Wallets; |
Or. en
Amendment 43
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a– paragraph 3 – point a b (new)
| Text proposed by the Commission | Amendment |
| (ab) easily report to the competent national authority where a relying party is established if an unlawful or inappropriate request of data is received; |
Or. en
Amendment 44
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a– paragraph 3 – point a c (new)
| Text proposed by the Commission | Amendment |
| (ac) sign and validate qualified electronic signatures; |
Or. en
Amendment 45
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a– paragraph 3 – point a d (new)
| Text proposed by the Commission | Amendment |
| (ad) create and validate qualified electronic seals; |
Or. en
Amendment 46
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a– paragraph 3 – point a e (new)
| Text proposed by the Commission | Amendment |
| (ae) transfer own electronic attestation of attributes and configurations to another European Digital Identity Wallet belonging to the same user. |
Or. en
Amendment 47
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 3 – point b
| Text proposed by the Commission | Amendment |
| (b) sign by means of qualified electronic signatures. | deleted |
Or. en
Amendment 48
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – introductory part
| Text proposed by the Commission | Amendment |
| 4. Digital Identity Wallets shall, in particular: | 4. European Digital Identity Wallets shall, in particular: |
Or. en
Amendment 49
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 1
| Text proposed by the Commission | Amendment |
| (1) to qualified and non-qualified trust service providers issuing qualified and non-qualified electronic attestations of attributes or other qualified and non-qualified certificates for the purpose of issuing such attestations and certificates to the European Digital Identity Wallet; | (1) for users to obtain electronic attestations of attributes; |
Or. en
Amendment 50
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 2
| Text proposed by the Commission | Amendment |
| (2) for relying parties to request and validate person identification data and electronic attestations of attributes; | (2) for relying parties to request and validate electronic attestation of attributes, including person identification data, or zero knowledge proof inferred from them; |
Or. en
Amendment 51
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 3
| Text proposed by the Commission | Amendment |
| (3) for the presentation to relying parties of person identification data, electronic attestation of attributes or other data such as credentials, in local mode not requiring internet access for the wallet; | (3) for users to present electronic attestation of attributes to relying parties; |
Or. en
Amendment 52
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 3 a (new)
| Text proposed by the Commission | Amendment |
| (3a) for users to transfer his or her own electronic attestation of attributes and configurations to another European Digital Identity Wallet belonging to the same user; |
Or. en
Amendment 53
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 3 b (new)
| Text proposed by the Commission | Amendment |
| (3b) for users to authenticate, identify and to receive electronic attestations of attributes directly from other European Digital Identity Wallets; |
Or. en
Amendment 54
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – pointa) – point 4
| Text proposed by the Commission | Amendment |
| (4) for the user to allow interaction with the European Digital Identity Wallet and display an “EU Digital Identity Wallet Trust Mark”; | (4) for users to allow interaction with the European Digital Identity Wallet; |
Or. en
Amendment 55
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 4 a (new)
| Text proposed by the Commission | Amendment |
| (4a) for issuers of electronic attestation of attributes to issue them; |
Or. en
Amendment 56
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point b
| Text proposed by the Commission | Amendment |
| (b) ensure that trust service providers of qualified attestations of attributes cannot receive any information about the use of these attributes; | deleted |
Or. en
Amendment 57
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point d
| Text proposed by the Commission | Amendment |
| (d) provide a mechanism to ensure that the relying party is able to authenticate the user and to receive electronic attestations of attributes; | (d) provide a mechanism to ensure that the relying party is able to anonymously authenticate the user and to receive electronic attestations of attributes that can be validated in the form of selective disclosures and minimise the processing of personal data; |
Or. en
Amendment 58
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point e a (new)
| Text proposed by the Commission | Amendment |
| (ea) provide a recovery mechanism for the user to safeguard the content of the European Digital Identity Wallet, including person identification data, attributes, electronic attestations of attributes and credentials, in the case of unavailability, loss or stealing of the corresponding device, such safeguard mechanism preserving authenticity, confidentiality, integrity and privacy; |
Or. en
Amendment 59
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a –paragraph 4 – point e b (new)
| Text proposed by the Commission | Amendment |
| (eb) provide a mechanism for the synchronization of European Digital Identity Wallets belonging to the same user, upon his or her request; |
Or. en
Amendment 60
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point e c (new)
| Text proposed by the Commission | Amendment |
| (ec) have the functionality to record all transactions and to provide a mechanism for the user to receive, upon request, the data that has been recorded, such data to be provided to the user in a structured, human-readable and machine-readable format; |
Or. en
Amendment 61
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point e d (new)
| Text proposed by the Commission | Amendment |
| (ed) be interoperable by design in the framework of this Regulation; |
Or. en
Amendment 62
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point e e (new)
| Text proposed by the Commission | Amendment |
| (ee) display an “EU Digital Identity Wallet Trust Mark” for the recognition of qualified electronic attestation of attributes; |
Or. en
Amendment 63
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 5 – introductory part
| Text proposed by the Commission | Amendment |
| 5. Member States shall provide validation mechanisms for the European Digital Identity Wallets: | 5. Member States shall provide interoperable validation mechanisms for the European Digital Identity Wallets: |
Or. en
Amendment 64
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 5 – point c a (new)
| Text proposed by the Commission | Amendment |
| (ca) to allow users to easily authenticate relying parties. |
Or. en
Amendment 65
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 5 a (new)
| Text proposed by the Commission | Amendment |
| 5a. The Commission shall keep a public register of all issuers of European Digital Identity Wallets, including their main specifications, to ensure transparency and to facilitate their comparison. Member States shall make this information publicly available to its citizens and businesses. |
Or. en
Amendment 66
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 5 b (new)
| Text proposed by the Commission | Amendment |
| 5b. Member States shall raise awareness on the benefits of the European Digital Identity Wallet through communication campaigns and ensure their citizens are well trained in its use in order to facilitate wide up-take and trust in the new framework. |
Or. en
Amendment 67
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 5 c (new)
| Text proposed by the Commission | Amendment |
| 5 c. Access to government services, the labour market and freedom to conduct business shall not be restricted or hindered for natural and legal persons not using the European Digital Identity Wallet. Natural and legal persons using the European Digital Identity Wallet shall not be granted privileged access to public and private services. |
Or. en
Amendment 68
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 6
| Text proposed by the Commission | Amendment |
| 6. The European Digital Identity Wallets shall be issued under a notified electronic identification scheme of level of assurance ‘high’. The use of the European Digital Identity Wallets shall be free of charge to natural persons. | 6. The European Digital Identity Wallets shall be issued under a notified electronic identification scheme of level of assurance ‘high’ and shall ensure cybersecurity by design. In particular, European Digital Identity Wallets shall provide the necessary security functionalities at the state of the art and offer resistance to skilled attackers, ensure the confidentiality, integrity and availability of the content of the European Digital Identity Wallet, including person identification data, attributes, electronic attestations of attributes and credentials and request the secure, explicit and active user confirmation of its operation. |
Or. en
Amendment 69
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 6 a (new)
| Text proposed by the Commission | Amendment |
| 6 a. The use of the European Digital Identity Wallets shall be on a voluntary basis. European Digital Identity Wallets issued or mandated by the Member States shall be free of charge to all natural and legal persons. |
Or. en
Amendment 70
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 7
| Text proposed by the Commission | Amendment |
| 7. The user shall be in full control of the European Digital Identity Wallet. The issuer of the European Digital Identity Wallet shall not collect information about the use of the wallet which are not necessary for the provision of the wallet services, nor shall it combine person identification data and any other personal data stored or relating to the use of the European Digital Identity Wallet with personal data from any other services offered by this issuer or from third-party services which are not necessary for the provision of the wallet services, unless the user has expressly requested it. Personal data relating to the provision of European Digital Identity Wallets shall be kept physically and logically separate from any other data held. If the European Digital Identity Wallet is provided by private parties in accordance to paragraph 1 (b) and (c), the provisions of article 45f paragraph 4 shall apply mutatis mutandis. | 7. The user shall be in full control of the European Digital Identity Wallet and its own data. The issuer of the European Digital Identity Wallet shall ensure that it is built on privacy by design principle. In particular, the EDIW shall have the following features: |
| (a) for issuers of the European Digital Identity Wallet it shall be technologically impossible to receive any information on the use of the Wallet or its attributes. For the purpose of protecting user data against loss or corruption, encrypted synchronization and encrypted backup functions shall be permitted, with the previous explicit consent of the user. The issuer of the European Digital Identity Wallet shall not combine person identification data and any other personal data stored or relating to the use of the European Digital Identity Wallet with personal data from any other services offered by this issuer or from third-party services which are not necessary for the provision of the Wallet services. Personal data relating to the provision of European Digital Identity Wallets shall be kept physically and logically separate from any other data held. If the European Digital Identity Wallet is provided by private parties, the provisions of Article 45f, paragraph 4, shall apply mutatis mutandis; | |
| (b) for issuers of the electronic attestation of attributes it shall be technologically impossible to receive any information about the use of these attributes and about the use of the European Digital Identity Wallet; | |
| (c) for relying parties it shall be technologically impossible to receive any information other than that that the user has consented to. |
Or. en
Amendment 71
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 9
| Text proposed by the Commission | Amendment |
| 9. Article 24(2), points (b), (e), (g), and (h) shall apply mutatis mutandis to Member States issuing the European Digital Identity Wallets. | 9. Article 24(2), points (b), (e), (g), and (h) shall apply mutatis mutandis to issuers of European Digital Identity Wallets. |
Or. en
Amendment 72
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a –paragraph 10
| Text proposed by the Commission | Amendment |
| 10. The European Digital Identity Wallet shall be made accessible for persons with disabilities in accordance with the accessibility requirements of Annex I to Directive 2019/882. | 10. The European Digital Identity Wallet shall be made accessible for persons with disabilities or with special needs, including older people, in accordance with the accessibility requirements of Annex I to Directive 2019/882. |
Or. en
Amendment 73
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 11
| Text proposed by the Commission | Amendment |
| 11. Within 6 months of the entering into force of this Regulation, the Commission shall establish technical and operational specifications and reference standards for the requirements referred to in paragraphs 3, 4 and 5 by means of an implementing act on the implementation of the European Digital Identity Wallet. This implementing act shall be adopted in accordance with the examination procedure referred to in Article 48(2). | 11. By … [6 months of the entering into force of this amending Regulation], the Commission shall reference standards for the requirements referred to in this Article by means of an implementing act on the implementation of the European Digital Identity Wallet. This implementing act shall be adopted in accordance with the examination procedure referred to in Article 48(2). |
Or. en
Amendment 74
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 11a (new)
| Text proposed by the Commission | Amendment |
| 11a. By ... [6 months after the date of entry into force of this amending Regulation], the Commission shall adopt a delegated act in accordance with Article 47 concerning the establishment of technical and operational specifications for the requirements referred to in this Article.' |
Or. en
Amendment 75
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6b – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. Where relying parties intend to rely upon European Digital Identity Wallets issued in accordance with this Regulation, they shall communicate it to the Member State where the relying party is established to ensure compliance with requirements set out in Union law or national law for the provision of specific services. When communicating their intention to rely on European Digital Identity wallets, they shall also inform about the intended use of the European Digital Identity Wallet. | 1. Where legal persons acting as a relying party intend to rely upon European Digital Identity Wallets issued in accordance with this Regulation, they shall communicate it to the Member State where the legal person is established to ensure compliance with requirements set out in Union law or national law for the provision of specific services. When communicating their intention to rely on European Digital Identity wallets, they shall also inform competent national authority about the intended use of the European Digital Identity Wallet with the justification of the data being requested. Member States shall scrutinize requested use cases of the European Digital Identity Wallet in regards to the potential privacy implications of the data exchanged and the purpose of the processing of personal data. In cases of privacy breaches, the cases shall be forwarded to competent national authorities for further assessment and enforcement. |
Or. en
Amendment 76
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6b – paragraph 1 a (new)
| Text proposed by the Commission | Amendment |
| 1 a. Where relying parties intend to rely upon European Digital Identity Wallets issued in accordance with this Regulation, they shall mutually authenticate themselves to the European Digital Identity Wallet of the user, before any form of transaction can take place. |
Or. en
Amendment 77
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6b – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Member States shall implement a common mechanism for the authentication of relying parties | 2. Member States shall implement a common mechanism for the authentication of relying parties. Member States may revoke the authorisation of relying parties in the case of illegal or fraudulent use of the European Digital Identity Wallet in their country. |
Or. en
Amendment 78
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6b – paragraph 2 a (new)
| Text proposed by the Commission | Amendment |
| 2a. Relying parties shall specify to the user a clear and lawful purpose for each request to access electronic attribute attestation, including person identification data. |
Or. en
Amendment 79
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6b – paragraph 3
| Text proposed by the Commission | Amendment |
| 3. Relying parties shall be responsible for carrying out the procedure for authenticating person identification data and electronic attestation of attributes originating from European Digital Identity Wallets. | 3. Relying parties shall be responsible for carrying out the procedure for authenticating and validating electronic attestations of attributes, including person identification data, originating from European Digital Identity Wallets. European Digital Identity Wallets of the relying party may be used for that purpose. |
Or. en
Amendment 80
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6b – paragraph 4
| Text proposed by the Commission | Amendment |
| 4. Within 6 months of the entering into force of this Regulation, the Commission shall establish technical and operational specifications for the requirements referred to in paragraphs 1 and 2 by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(10). | 4. By … [6 months of the entering into force of this amending Regulation], the Commission shall establish technical and operational specifications for the requirements referred to in this Article by means of a delegated act as referred to in Article 6a(11a). |
Or. en
Amendment 81
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6c – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. European Digital Identity Wallets that have been certified or for which a statement of conformity has been issued under a cybersecurity scheme pursuant to Regulation (EU) 2019/881 and the references of which have been published in the Official Journal of the European Union shall be presumed to be compliant with the cybersecurity relevant requirements set out in Article 6a paragraphs 3, 4 and 5 in so far as the cybersecurity certificate or statement of conformity or parts thereof cover those requirements. | 1. European Digital Identity Wallets that have been certified under a cybersecurity scheme pursuant to Regulation (EU) 2019/881 and the references of which have been published in the Official Journal of the European Union shall be presumed to be compliant with the cybersecurity relevant requirements set out in Article 6a of this Regulation, in so far as the cybersecurity certificate or parts thereof cover those requirements. If European cybersecurity certification schemes are available, certificates shall be issued by a national cybersecurity certification authority pursuant to that Regulation or on the basis of a general delegation of the task to a conformity assessment body by the national cybersecurity certification authority. |
Or. en
Justification
Statements of conformity are issued when certification is performed at level "Basic" of the CSA, which is the lowest security level. Level "Basic" is not suitable for a European Digital Identity Wallet. Therefore, only "certificate" is relevant for Article 6c(1), "statement of conformity" is deleted.
Amendment 82
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6c – paragraph 3
| Text proposed by the Commission | Amendment |
| 3. The conformity of European Digital Identity Wallets with the requirements laid down in article 6a paragraphs 3, 4 and 5 shall be certified by accredited public or private bodies designated by Member States. | 3. The conformity of European Digital Identity Wallets with the requirements laid down in Article 6a shall be certified by accredited public or private bodies designated by Member States. The Commission shall adopt implementing acts to define a harmonised procedure for the accreditation of such bodies. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2). |
Or. en
Amendment 83
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6c – paragraph 4
| Text proposed by the Commission | Amendment |
| 4. Within 6 months of the entering into force of this Regulation, the Commission shall, by means of implementing acts, establish a list of standards for the certification of the European Digital Identity Wallets referred to in paragraph 3. | 4. By … [6 months of the entering into force of this amending Regulation], the Commission shall, by means of implementing acts, establish a list of standards for the certification of the European Digital Identity Wallets referred to in paragraph 3. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2). |
Or. en
Amendment 84
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6d – paragraph 3
| Text proposed by the Commission | Amendment |
| 3. Within 6 months of the entering into force of this Regulation, the Commission shall define formats and procedures applicable for the purposes of paragraph 1. by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(10). | 3. By … [6 months of the entering into force of this amending Regulation], the Commission shall define formats and procedures applicable for the purposes of paragraph 1 by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11). |
Or. en
Amendment 85
Proposal for a regulation
Article 1 – paragraph 1 – point 9
Regulation (EU) No 910/2014
Article 7 – paragraph 1 – introductory part
| Text proposed by the Commission | Amendment |
| Pursuant to Article 9(1) Member States shall notify, within 12 months after the entry into force of this Regulation at least one electronic identification scheme including at least one identification means: | Pursuant to Article 9(1) Member States shall notify, within 12 months after the entry into force of this Regulation at least one electronic identification scheme including at least one identification means that fulfil all the following criteria: |
Or. en
Amendment 86
Proposal for a regulation
Article 1 – paragraph 1 – point 10 a (new)
Regulation (EU) No 910/2014
Article 10 – title
| Text proposed by the Commission | Amendment |
| (10a) in Article 10, the titleis replaced by the following: | |
| 'Security breach of electronic identification schemes for cross-border authentication' |
Or. en
Amendment 87
Proposal for a regulation
Article 1 – paragraph 1 – point 11
Regulation (EU) No 910/2014
Article 10a – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. Where European Digital Wallets issued pursuant to Article 6a and the validation mechanisms referred to in Article 6a(5) points (a), (b) and (c) are breached or partly compromised in a manner that affects their reliability or the reliability of the other European Digital Identity Wallets, the issuing Member State shall, without delay, suspend the issuance and revoke the validity of the European Digital Identity Wallet and inform the other Member States and the Commission accordingly. | 1. Where European Digital Identity Wallets issued pursuant to Article 6a or the validation mechanisms referred to in Article 6a(5) points (a), (b) and (c) are breached or partly compromised in a manner that affects their reliability and the confidentiality, integrity or availability of user data, or the reliability of other European Digital Identity Wallets, the issuer of the compromised European Digital Identity Wallet shall, without delay, suspend the issuance and revoke the validity of the European Digital Identity Wallet and inform single point of contact pursuant to Article 46a and the affected users. |
Or. en
Amendment 88
Proposal for a regulation
Article 1 – paragraph 1 – point 11
Regulation (EU) No 910/2014
Article 10a – paragraph 1 a (new)
| Text proposed by the Commission | Amendment |
| 1a. After notification of the security breach of the European Digital Identity Wallet, the single point of contact shall liaise with the relevant national competent authorities and, when necessary, with EDIB, EDPB, the Commission and ENISA. |
Or. en
Amendment 89
Proposal for a regulation
Article 1 – paragraph 1 – point 11
Regulation (EU) No 910/2014
Article 10a – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Where the breach or compromise referred to in paragraph 1 is remedied, the issuing Member State shall re-establish the issuance and the use of the European Digital Identity Wallet and inform other Member States and the Commission without undue delay. | 2. Where the breach or compromise referred to in paragraph 1 is remedied, the issuer of the European Digital Identity Wallet shall re-establish the issuance and the use of the European Digital Identity Wallet and inform national competent authorities of other Member States, the affected users and the Commission without undue delay. |
Or. en
Amendment 90
Proposal for a regulation
Article 1 – paragraph 1 – point 11
Regulation (EU) No 910/2014
Article 10a – paragraph 3
| Text proposed by the Commission | Amendment |
| 3. If the breach or compromise referred to in paragraph 1 is not remedied within three months of the suspension or revocation, the Member State concerned shall withdraw the European Digital Wallet concerned and inform the other Member States and the Commission on the withdrawal accordingly. Where it is justified by the severity of the breach, the European Digital Identity Wallet concerned shall be withdrawn without delay. | 3. If the breach or compromise referred to in paragraph 1 is not remedied within three months of the suspension or revocation, the Member State concerned shall withdraw the European Digital Identity Wallet concerned and inform the other Member States and the Commission on the withdrawal accordingly. Where it is justified by the severity of the breach, the European Digital Identity Wallet concerned shall be withdrawn without delay. |
Or. en
Amendment 91
Proposal for a regulation
Article 1 – paragraph 1 – point 11
Regulation (EU) No 910/2014
Article 10a – paragraph 5
| Text proposed by the Commission | Amendment |
| 5. Within 6 months of the entering into force of this Regulation, the Commission shall further specify the measures referred to in paragraphs 1 and 3 by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(10). | 5. By … [6 months of the entering into force of this amending Regulation], the Commission shall further specify the measures referred to in paragraphs 1 and 3 by means of a delegated act adopted in accordance with Article 47. |
Or. en
Amendment 92
Proposal for a regulation
Article 1 – paragraph 1 – point 12
Regulation (EU) No 910/2014
Article 11a – title
| Text proposed by the Commission | Amendment |
| Unique Identification | Cross-border user Identification |
Or. en
Amendment 93
Proposal for a regulation
Article 1 – paragraph 1 – point 12
Regulation (EU) No 910/2014
Article 11a – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. When notified electronic identification means and the European Digital Identity Wallets are used for authentication, Member States shall ensure unique identification. | 1. When notified electronic identification means and the European Digital Identity Wallets are used for cross-border authentication and identification, Member States shall ensure user identification. |
Or. en
Amendment 94
Proposal for a regulation
Article 1 – paragraph 1 – point 12
Regulation (EU) No 910/2014
Article 11a – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Member States shall, for the purposes of this Regulation, include in the minimum set of person identification data referred to in Article 12.4.(d), a unique and persistent identifier in conformity with Union law, to identify the user upon their request in those cases where identification of the user is required by law. | 2. In order to ensure interoperability of European Digital Identity Wallets, Member States shall provide a minimum set of person identification data, in conformity with national and Union law, which can unequivocally identify the user upon their request in those cases where identification of the user is required by law. |
Or. en
Amendment 95
Proposal for a regulation
Article 1 – paragraph 1 – point 12
Regulation (EU) No 910/2014
Article 11a – pargraph 3
| Text proposed by the Commission | Amendment |
| 3. Within 6 months of the entering into force of this Regulation, the Commission shall further specify the measures referred to in paragraph 1 and 2 by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(10). | 3. By … [6 months of the entering into force of this amending Regulation], the Commission shall lay down further technical specifications that are privacy enhancing and that will ensure trustworthy, secure and interoperable cross-border authentication and identification of users by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11). |
Or. en
Amendment 96
Proposal for a regulation
Article 1 – paragraph 1 – point 13 – point -a (new)
Regulation (EU) No 910/2014
Article 12 – title
| Present text | Amendment |
| (-a) in Article 12, the title is replaced by the following: | |
| Cooperation and interoperability | ‘Interoperability' |
Or. en
Amendment 97
Proposal for a regulation
Article 1 – paragraph 1 – point 13 – point -a a (new)
Regulation (EU) No 910/2014
Article 12 – paragraph 3 – point (c)
| Present text | Amendment |
| (-aa) in paragraph 3, point (c) is replaced by the following: | |
| (c) it facilitates the implementation of the principle of privacy by design; and | '(c) it ensures that personal data is processed in accordance with Regulation (EU) 2016/679.' |
Or. en
Amendment 98
Proposal for a regulation
Article 1 – paragraph 1 – point 13 – point a
Regulation (EU) No 910/2014
Article 12 – paragraph 3 – point d
| Text proposed by the Commission | Amendment |
| (a) in paragraph 3, points (c) and (d) are deleted; | (a) in paragraph 3, points (d) is deleted; |
Or. en
Amendment 99
Proposal for a regulation
Article 1 – paragraph 1 – point 13 – point b
Regulation (EU) No 910/2014
Article 12 – paragraph 4 – point d
| Text proposed by the Commission | Amendment |
| (d) a reference to a minimum set of person identification data necessary to uniquely and persistently represent a natural or legal person;; | (d) a reference to a minimum set of person identification data necessary to uniquely and persistently represent a natural or legal person, available from electronic identification schemes. In general, insofar as personal data are concerned, the risks to the rights of individuals shall be assessed based on Article 25(1) of Regulation (EU) 2016/679; |
Or. en
Amendment 100
Proposal for a regulation
Article 1 – paragraph 1 – point 13 – point b a (new)
Regulation (EU) No 910/2014
Article 12 – paragraphs 5, 6 and 7
| Text proposed by the Commission | Amendment |
| (b a) paragraphs 5, 6 and 7 are deleted; |
Or. en
Amendment 101
Proposal for a regulation
Article 1 – paragraph 1 – point 13 – point c a (new)
Regulation (EU) No 910/2014
Article 12 – paragraph 9
| Present text | Amendment |
| (ca) paragraph 9 is replaced by the following: | |
| 9. The implementing acts referred to in paragraphs 7 and 8 of this Article shall be adopted in accordance with the examination procedure referred to in Article 48(2). | '9. The implementing acts referred to in paragraph 8 of this Article shall be adopted in accordance with the examination procedure referred to in Article 48(2). |
Or. en
Amendment 102
Proposal for a regulation
Article 1 – paragraph 1 – point 14
Regulation (EU) No 910/2014
Article 12a – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. The peer-review of electronic identification schemes referred to in Article 12(6), point (c) shall not apply to electronic identification schemes or part of such schemes certified in accordance with paragraph 1. Member States may use a certificate or a Union statement of conformity issued in accordance with a relevant European cybersecurity certification scheme established pursuant to Regulation (EU) 2019/881 to demonstrate compliance of such schemes with the requirements set out in Article 8(2) regarding the assurance levels of electronic identification schemes. | 2. The peer-review of electronic identification schemes referred to in Article 46(5), point (c), of this Regulation shall not apply to electronic identification schemes or part of such schemes certified in accordance with paragraph 1. Member States may use a certificate or a Union statement of conformity issued in accordance with a relevant European cybersecurity certification scheme established pursuant to Regulation (EU) 2019/881 to demonstrate compliance of such schemes with the requirements set out in Article 8(2) of this Regulation regarding the assurance levels of electronic identification schemes. |
Or. en
Amendment 103
Proposal for a regulation
Article 1 – paragraph 1 – point 14
Regulation (EU) No 910/2014
Article 12a – paragraph 2 a (new)
| Text proposed by the Commission | Amendment |
| 2a. The certification scheme used to demonstrate conformity pursuant to paragraph 1 shall include a two-year vulnerability assessment of the certified product and a continuous threat monitoring, unless such a certification scheme has been established pursuant to Regulation (EU) 2019/881. |
Or. en
Amendment 104
Proposal for a regulation
Article 1 – paragraph 1 – point 16
Regulation (EU) No 910/2014
Article 12b – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Where private relying parties providing services are required by national or Union law, to use strong user authentication for online identification, or where strong user authentication is required by contractual obligation, including in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications, private relying parties shall also accept the use of European Digital Identity Wallets issued in accordance with Article 6a. | 2. Where private relying parties providing services are required by national or Union law, to use strong user authentication for online identification, or where strong user authentication is required by contractual obligation, including in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, educational and professional qualifications, or telecommunications, private relying parties shall also accept the use of European Digital Identity Wallets issued in accordance with Article 6a. |
Or. en
Amendment 105
Proposal for a regulation
Article 1 – paragraph 1 – point 16
Regulation (EU) No 910/2014
Article 12b – paragraph 4
| Text proposed by the Commission | Amendment |
| 4. The Commission shall encourage and facilitate the development of self-regulatory codes of conduct at Union level (‘codes of conduct’), in order to contribute to wide availability and usability of European Digital Identity Wallets within the scope of this Regulation. These codes of conduct shall ensure acceptance of electronic identification means including European Digital Identity Wallets within the scope of this Regulation in particular by service providers relying on third party electronic identification services for user authentication. The Commission will facilitate the development of such codes of conduct in close cooperation with all relevant stakeholders and encourage service providers to complete the development of codes of conduct within 12 months of the adoption of this Regulation and effectively implement them within 18 months of the adoption of the Regulation. | 4. The Commission shall in cooperation with the Member States, industry and the relevant stakeholders, including civil society, encourage and facilitate the development of self-regulatory codes of conduct at Union level (‘codes of conduct’), in order to contribute to wide availability and usability of European Digital Identity Wallets within the scope of this Regulation. These codes of conduct shall ensure acceptance of electronic identification means including European Digital Identity Wallets within the scope of this Regulation in particular by service providers relying on third party electronic identification services for user authentication. The Commission will facilitate the development of such codes of conduct in close cooperation with all relevant stakeholders and encourage service providers to complete the development of codes of conduct within 12 months of the adoption of this Regulation and effectively implement them within 18 months of the adoption of the Regulation. |
Or. en
Amendment 106
Proposal for a regulation
Article 1 – paragraph 1 – point 19
Regulation (EU) No 910/2014
Article 15 – paragraph 1
| Text proposed by the Commission | Amendment |
| The provision of Trust services and end-user products used in the provision of those services shall be made accessible for persons with disabilities in accordance with the accessibility requirements of Annex I of Directive 2019/882 on the accessibility requirements for products and services.; | The provision of Trust services and end-user products used in the provision of those services shall be made accessible for persons with disabilities or with special needs, including older people, in accordance with the accessibility requirements of Annex I of Directive 2019/882 on the accessibility requirements for products and services.; |
Or. en
Amendment 107
Proposal for a regulation
Article 1 – paragraph 1 – point 20 – introductory part
Regulation (EU) No 910/2014
Article 17
| Text proposed by the Commission | Amendment |
| (20) Article 17 is amended as follows: | (20) Article 17 is deleted; |
Or. en
Amendment 108
Proposal for a regulation
Article 1 – paragraph 1 – point 20 – point a
Regulation (EU) No 910/2014
Article 17 – paragraph 4 – points c and f
| Text proposed by the Commission | Amendment |
| (a) paragraph 4 is amended as follows: | deleted |
| (1) point (c) of paragraph 4 is replaced by the following: | |
| (c) to inform the relevant national competent authorities of the Member States concerned, designated pursuant to Directive (EU) XXXX/XXXX [NIS2], of any significant breaches of security or loss of integrity they become aware of in the performance of their tasks. where the significant breach of security or loss of integrity concerns other Member States, the supervisory body shall inform the single point of contact of the Member State concerned designated pursuant to Directive (EU) XXXX/XXXX (NIS2);; | |
| (2) point (f) is replaced by the following: | |
| (f) to cooperate with supervisory authorities established under Regulation (EU) 2016/679, in particular, by informing them without undue delay, about the results of audits of qualified trust service providers, where personal data protection rules have been breached and about security breaches which constitute personal data breaches;; |
Or. en
Amendment 109
Proposal for a regulation
Article 1 – paragraph 1 – point 20 – point b
Regulation (EU) No 910/2014
Article 17 – paragraph 6
| Text proposed by the Commission | Amendment |
| (b) paragraph 6 is replaced by the following: | deleted |
| ‘6. By 31 March each year, each supervisory body shall submit to the Commission a report on its main activities during the previous calendar year.’; |
Or. en
Amendment 110
Proposal for a regulation
Article 1 – paragraph 1 – point 20 – point c
Regulation (EU) No 910/2014
Article 17 – paragraph 8
| Text proposed by the Commission | Amendment |
| (c) paragraph 8 is replaced by the following: | deleted |
| ‘8. Within 12 months of the entering into force of this Regulation, the Commission shall, by means of implementing acts, further specify the tasks of the Supervisory Authorities referred to in paragraph 4 and define the formats and procedures for the report referred to in paragraph 6. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).’; |
Or. en
Amendment 111
Proposal for a regulation
Article 1 – paragraph 1 – point 21 – introductory part
Regulation (EU) No 910/2014
Article 18
| Text proposed by the Commission | Amendment |
| (21) Article 18 is amended as follows: | (21) Article 18 is deleted; |
Or. en
Amendment 112
Proposal for a regulation
Article 1 – paragraph 1 – point 21 – point a
Regulation (EU) No 910/2014
Article 18
| Text proposed by the Commission | Amendment |
| (a) the title of Article 18 is replaced by the following: | deleted |
| Mutual assistance and cooperation; |
Or. en
Amendment 113
Proposal for a regulation
Article 1 – paragraph 1 – point 21 – point b
Regulation (EU) No 910/2014
Article 18
| Text proposed by the Commission | Amendment |
| (b) paragraph 1 is replaced by the following: | deleted |
| 1. Supervisory bodies shall cooperate with a view to exchanging good practice and information regarding the provision of trust services.; |
Or. en
Amendment 114
Proposal for a regulation
Article 1 – paragraph 1 – point 21 – point c
Regulation (EU) No 910/2014
Article 18
| Text proposed by the Commission | Amendment |
| (c) the following paragraphs 4 and 5 are added: | deleted |
| 4. Supervisory bodies and national competent authorities under Directive (EU) XXXX/XXXX of the European Parliament and of the Council [NIS2] shall cooperate and assist each other to ensure that trust service providers comply with the requirements laid down in this Regulation and in Directive (EU) XXXX/XXXX [NIS2]. The supervisory body shall request the national competent authority under Directive XXXX/XXXX [NIS2] to carry out supervisory actions to verify compliance of the trust service providers with the requirements under Directive XXXX/XXXX (NIS2), to require the trust service providers to remedy any failure to comply with those requirements, to provide timely the results of any supervisory activities linked to trust service providers and to inform the supervisory bodies about relevant incidents notified in accordance with Directive XXXX/XXXX [NIS2]. | |
| 5. Within 12 months of the entering into force of this Regulation, the Commission shall, by means of implementing acts, establish the necessary procedural arrangements to facilitate the cooperation between the Supervisory Authorities referred to in paragraph 1.; |
Or. en
Amendment 115
Proposal for a regulation
Article 1 – paragraph 1 – point 25 – point a
Regulation (EU) 910/2014
Article 24 – paragraph 1 – point c
| Text proposed by the Commission | Amendment |
| (c) by using other identification methods which ensure the identification of the natural person with a high level of confidence, the conformity of which shall be confirmed by a conformity assessment body; | (c) by using other identification methods which ensure the identification of the natural person with a high level of confidence and security, the conformity of which shall be confirmed by a conformity assessment body and which shall comply with the up-to-date standards on ID proofing with a view of ensuring a high level of security and interoperability of electronic identification and trust services in the Union; |
Or. en
Amendment 116
Proposal for a regulation
Article 1 – paragraph 1 – point 25 – point c – point 4
Regulation (EU) 910/2014
Article 24 – paragraph 2 – point j
| Text proposed by the Commission | Amendment |
| (4) point (j) is deleted; | (4) point (j) is replaced by the following: |
| '(j) ensure lawful processing of personal data in accordance with Regulation (EU) 2016/679; |
Or. en
Amendment 117
Proposal for a regulation
Article 1 – paragraph 1 – point 25 – point f
Regulation (EU) 910/2014
Article 24 – paragraph 6
| Text proposed by the Commission | Amendment |
| 6. The Commission shall be empowered to adopt delegated acts regarding the additional measures referred to in paragraph 2(fa).; | 6. The Commission shall be empowered to adopt delegated acts regarding the additional measures referred to in paragraph 2(fa). Those delegated acts shall start to apply from 24 months after they have entered into force, unless duly justified by a major security risk. |
Or. en
Amendment 118
Proposal for a regulation
Article 1 – paragraph 1 – point 35
Regulation (EU) 910/2014
Article 39a – title
| Text proposed by the Commission | Amendment |
| Requirements for a qualified service for the management of remote electronic seal creation devices | Requirements for generating, managing and duplicating electronic seal creation data and for a qualified service for the management of remote electronic seal creation devices |
Or. en
Amendment 119
Proposal for a regulation
Article 1 – paragraph 1 – point 35
Regulation (EU) 910/2014
Article 39a – paragraph 1
| Text proposed by the Commission | Amendment |
| Article 29a shall apply mutatis mutandis to a qualified service for the management of remote electronic seal creation devices.; | Article 29(1a) and 29a shall apply mutatis mutandis to a qualified service for the management of remote electronic seal creation devices.; |
Or. en
Amendment 120
Proposal for a regulation
Article 1 – paragraph 1 – point 38
Regulation (EU) 910/2014
Article 45
| Text proposed by the Commission | Amendment |
| (38) Article 45 is replaced by the following: | deleted |
| ‘Article 45 | |
| Requirements for qualified certificates for website authentication | |
| 1. Qualified certificates for website authentication shall meet the requirements laid down in Annex IV. Qualified certificates for website authentication shall be deemed compliant with the requirements laid down in Annex IV where they meet the standards referred to in paragraph 3. | |
| 2. Qualified certificates for website authentication referred to in paragraph 1 shall be recognised by web-browsers. For those purposes web-browsers shall ensure that the identity data provided using any of the methods is displayed in a user friendly manner. Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1, with the exception of enterprises, considered to be microenterprises and small enterprises in accordance with Commission Recommendation 2003/361/EC in the first 5 years of operating as providers of web-browsing services. | |
| 3. Within 12 months of the entering into force of this Regulation, the Commission shall, by means of implementing acts, provide the specifications and reference numbers of standards for qualified certificates for website authentication referred to in paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).’; |
Or. en
Amendment 121
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) 910/2014
Article 45a – paragraph 3 a (new)
| Text proposed by the Commission | Amendment |
| 3a. Lawfully issued attestations presented to the relying parties in the paper form instead of electronic attestations of attributes shall not be denied by relying parties. |
Or. en
Amendment 122
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) 910/2014
Article 45c – title
| Text proposed by the Commission | Amendment |
| Requirements for qualified attestation of attributes | Requirements for qualified electronic attestation of attributes |
Or. en
Amendment 123
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) No 910/2014
Article 45c – paragraph 4
| Text proposed by the Commission | Amendment |
| 4. Within 6 months of the entering into force of this Regulation, the Commission shall establish reference numbers of standards for qualified electronic attestations of attributes by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(10). | 4. By … [6 months of the entering into force of this amending Regulation], the Commission shall establish reference numbers of standards for qualified electronic attestations of attributes by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11). |
Or. en
Amendment 124
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) No 910/2014
Article 45d – paragraph 1 a (new)
| Text proposed by the Commission | Amendment |
| 1a. Authentic sources may issue non-qualified electronic attestation of attributes at the request of the user. |
Or. en
Amendment 125
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) No 910/2014
Article 45d – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Within 6 months of the entering into force of this Regulation, taking into account relevant international standards, the Commission shall set out the minimum technical specifications, standards and procedures with reference to the catalogue of attributes and schemes for the attestation of attributes and verification procedures for qualified electronic attestations of attributes by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(10). | 2. By … [6 months of the entering into force of this amending Regulation], taking into account relevant international standards, the Commission shall set out the minimum technical specifications, standards and procedures with reference to the catalogue of attributes and schemes for the attestation of attributes and verification procedures for qualified electronic attestations of attributes by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11). |
Or. en
Amendment 126
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) No 910/2014
Article 45e – paragraph 1 a (new)
| Text proposed by the Commission | Amendment |
| 1a. Public registers shall issue its qualified electronic attestation of attributes to the user of an European Digital Identity Wallet at his or her request. |
Or. en
Amendment 127
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) No 910/2014
Article 45e – paragraph 1 b (new)
| Text proposed by the Commission | Amendment |
| 1b. Non-qualified attestation of attributes can be issued by any trust service provider or directly through a European Digital Identity Wallet. |
Or. en
Amendment 128
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) No 910/2014
Article 45f – paragraph 4
| Text proposed by the Commission | Amendment |
| 4. Providers of qualified electronic attestation of attributes’ services shall provide such services under a separate legal entity. | deleted |
Or. en
Amendment 129
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) No 910/2014
Article 45f – paragraph 4 a (new)
| Text proposed by the Commission | Amendment |
| 4a. Providers of qualified electronic attestation of attributes’ service shall ensure that personal data, including anonymised or cryptographically protected data, are stored and processed only in the territory of the Union and that only Union and national law and applies to those personal data. Providers of qualified electronic attestation of attribute’s services shall keep at the disposal of the Member States and the Commission the proof of the technical and organisational means that they put in place to ensure that only Union and national law applies to those personal data. |
Or. en
Amendment 130
Proposal for a regulation
Article 1 – paragraph 1 – point 39
Regulation (EU) No 910/2014
Article 45i – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
| (a) they are created by one or more qualified trust service provider or providers; | (a) they are created or maintained by one or more qualified trust service provider or providers; |
Or. en
Amendment 131
Proposal for a regulation
Article 1 – paragraph 1 – point 39 a (new)
Regulation (EU) No 910/2014
Chapter IV a (new)
| Text proposed by the Commission | Amendment |
| (39a) the following chapter is inserted: | |
| ' CHAPTER IVa | |
| GOVERNANCE | |
| Article 46a | |
| National competent authority and single point of contact | |
| 1. Each Member State shall establish one or more new national competent authorities to carry out the tasks assigned to them under Article 46b or designate and existing body for that purpose. | |
| 2. Each Member State shall designate one national single point of contact on European digital identity framework (single point of contact). Where a Member State designates only one competent authority, that competent authority shall also be the single point of contact for that Member State. | |
| 3. Each single point of contact shall exercise a liaison function to ensure cross-border cooperation of its Member State’s authorities with the relevant authorities in other Member States, and, where appropriate, the Commission and ENISA, as well as to ensure cross-sectorial cooperation with other national competent authorities within its Member State. | |
| 4. Member States shall ensure that the competent authorities referred to in paragraph 1 have the necessary powers and adequate resources to carry out, in an effective and efficient manner, the tasks assigned to them and thereby to fulfil the objectives of this Regulation. Member States shall ensure effective, efficient and secure cooperation of the designated representatives in the European Digital Identity Board referred to in Article 46c. | |
| 5. Each Member State shall notify to the Commission, without undue delay, the designation of the competent authority referred to in paragraph 1 and single point of contact referred to in paragraph 3, their tasks, and any subsequent change thereto. Each Member State shall make public their designation. The Commission shall publish the list of the designated single points of contacts. | |
| Article 46b | |
| Tasks of the national competent authorities | |
| 1. The national competent authorities shall carry the following tasks: | |
| (a) to monitor and enforce the application of this Regulation; | |
| (b) to supervise issuers of European Digital Identity Wallets established in its territory through ex ante and ex post supervisory activities, ensuring that those issuers of European Digital Identity Wallet meet the requirements laid down in this Regulation and to take corrective actions when they fail to do so; | |
| (c) to supervise allegedly unlawful or inappropriate behaviours of relying parties established in its territory, in particular when such behaviours have been reported through European Digital Identity Wallets and apply corrective actions if necessary; | |
| (d) to supervise qualified trust service providers established in the territory of the designating Member State through ex ante and ex post supervisory activities, that those qualified trust service providers and the qualified trust services that they provide meet the requirements laid down in this Regulation; | |
| (e) to take action if necessary, in relation to non-qualified trust service providers established in the territory of the designating Member State, through ex post supervisory activities, when informed that those non-qualified trust service providers or the trust services they provide allegedly do not meet the requirements laid down in this Regulation; | |
| (f) to analyse the conformity assessment reports referred to in Articles 20(1) and 21(1); | |
| (g) to inform the relevant national competent authorities of the Member States concerned, designated pursuant to Directive (EU) XXXX/XXXX [NIS2], of any significant breaches of security or loss of integrity they become aware of in the performance of their tasks and, in the case of a significant breach of security or loss of integrity which concerns other Member States, to inform the single point of contact of the Member State concerned designated pursuant to Directive (EU) XXXX/XXXX (NIS2); | |
| (h) to report to the Commission about its main activities in accordance with paragraph 2; | |
| (i) to carry out audits or request a conformity assessment body to perform a conformity assessment of the qualified trust service providers in accordance with Article 20(2); | |
| (j) to cooperate with supervisory authorities established under Regulation (EU) 2016/679, in particular, by informing them without undue delay, about the results of audits of qualified trust service providers where personal data protection rules have been breached and about security breaches which constitute personal data breaches; | |
| (k) to grant qualified status to trust service providers and to the services they provide and to withdraw this status in accordance with Articles 20 and 21; | |
| (l) to inform the body responsible for the national trusted list referred to in Article 22(3) about its decisions to grant or to withdraw qualified status, unless that body is also the national competent authority ; | |
| (m) to verify the existence and correct application of provisions on termination plans in cases where the qualified trust service provider ceases its activities, including how information is kept accessible in accordance with Article 24(2), point (h); | |
| (n) to require that trust service providers and issuers of EDIW’s remedy any failure to fulfil the requirements laid down in this Regulation; | |
| (o) to cooperate with other national competent authorities and provide them with assistance in accordance with Article 46c. | |
| 2. By 31 March each year, each national competent authority shall submit to the Commission a report on its main activities during the previous calendar year. | |
| 3. The Commission shall make the annual report referred to in paragraph 2 available to the European Parliament and the Council. | |
| 4. By … [12 months of the entering into force of this amending Regulation], the Commission shall, by means of implementing acts, define the formats and procedures for the report referred to in paragraph 1, point (h). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2). | |
| 5. By … [12 months of the entering into force of this amending Regulation], the Commission shall adopt a delegated act in accordance with Article 47 to further specify the tasks of the national competent authorities referred to in paragraph 1. | |
| Article 46c | |
| The European Digital Identity Board | |
| 1. The European Digital Identity Board (the ‘EDIB’) shall be established. | |
| 2. The EDIB shall be composed of national competent authorities and the Commission. | |
| 3. Stakeholders and all relevant third parties may be invited to attend meetings of the EDIB and to participate in its work. | |
| 4. ENISA shall be invited when issues regarding cyber threats, notification of breaches, cybersecurity certificates or standards or other issues pertaining to the security are discussed. | |
| 5. The EDIB shall have the following tasks: | |
| (a) assist the Commission in the preparation of legislative proposals and policy initiatives in the field of digital wallets, electronic identification means and trust services; | |
| (b) assist and cooperate with the Commission on the preparation of implementing and delegated acts pursuant to this Regulation; | |
| (c) support the consistent application of this Regulation, for the purpose of: | |
| (i) exchanging good practices and information regarding the application of the provisions of this Regulation; | |
| (ii) examining the relevant developments in the digital wallet, electronic identification and trust services sectors; | |
| (iii) organising regular joint meetings with relevant interested parties from across the Union to discuss activities carried out by the Board and gather input on emerging policy challenges; | |
| (iv) issuing common guidelines on the implementation of the Regulation; | |
| (v) supporting the Commission in identifying technical specifications and standards for the common interface for European Digital Identity Wallets pursuant to Article 6a(4a); | |
| (vi) supporting the Commission in the identification of technical specifications and standards for validation mechanism pursuant to Article 6a(5); | |
| (vii) peer reviewing electronic identification schemes falling under this Regulation; | |
| (viii) mapping standards for attestation of attributes, exchanging on plans by Member States to develop new attributes standards allowing for a common development at European level if necessary; | |
| (ix) with the support of ENISA, exchanging information, experience and good practice as regards to all cybersecurity aspects of the European Digital Identity Wallet, the electronic identification schemes and trust services; | |
| (x) national competent authorities under this Regulation and national competent authorities under Directive (EU) XXXX/XXXX of the European Parliament and of the Council [NIS2] shall cooperate to ensure the continuation of current practices and to build on the knowledge and experience gained in the application of the eIDAS Regulation. In addition, they shall collaborate as to ensure a coherent implementation of the Directive (EU) XXXX/XXXX of the European Parliament and of the Council [NIS2]; | |
| (xi) providing guidance in relation to the development and implementation of policies on notification of breaches, coordinated vulnerability disclosure and common measures as referred to in Articles 10 and 10a; | |
| (xii) exchanging best practices and information in relation to the cybersecurity measures of this Regulation and on Directive (EU) XXXX/XXXX of the European Parliament and of the Council [NIS2] as regards to trust services, in relation to cyber threats, incidents, vulnerabilities, awareness-raising initiatives, trainings, exercises and skills, capacity building, standards and technical specifications capacity as well as standards and technical specifications; | |
| (xiii) carrying out coordinated security risk assessments in cooperation with ENISA. | |
| 6. In the framework of the EIDB, Member States may seek mutual assistance: | |
| (a) upon receipt of a justified request from a national competent authority, EIDB shall provide that national competent authority with assistance so that it can be carried out in a consistent manner, which may cover, in particular, information requests and supervisory measures, such as requests to carry out inspections related to the conformity assessment reports as referred to in Articles 20 and 21 regarding the provision of trust services; | |
| (b) where appropriate, Member States may authorise their respective national competent authorities to carry out joint investigations in which staff from other Member States’ competent national authority is involved. The arrangements and procedures for such joint actions shall be agreed upon and established by the Member States concerned in accordance with their national law. | |
| 7. By … [6 months after the date of entry into force of this amending Regulation] and every two years thereafter, the EIDB shall establish a work programme in respect of actions to be undertaken to implement its objectives and tasks. | |
| 8. The Commission may adopt implementing acts laying down procedural arrangements necessary for the functioning of the EIDB. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).'; |
Or. en
Amendment 132
Proposal for a regulation
Article 1 – paragraph 1 – point 40
Regulation (EU) No 910/2014
Article 48a – paragraph 2 – point (b)
| Text proposed by the Commission | Amendment |
| (b) the type and number of services accepting the use of the European Digital Wallet; | (b) the type and number of services accepting the use of the European Digital Wallet, including the number of rejected applications and their reasoning; |
Or. en
Amendment 133
Proposal for a regulation
Article 1 – paragraph 1 – point 42
Regulation (EU) No 910/2014
Article 51 – paragraph 2 a (new)
| Text proposed by the Commission | Amendment |
| 2a. From the date of entry into force of the implementing acts pursuant to Article 20(4), qualified trust service providers shall continue to be considered to be qualified trust service providers until the renewal of their audit as set out in Article 20(1). |
Or. en
Amendment 134
Proposal for a regulation
Annex V – paragraph 1 – point g
Regulation (EU) No 910/2014
Annex V – paragraph 1 – point g
| Text proposed by the Commission | Amendment |
| (g) the advanced electronic signature or advanced electronic seal of the issuing qualified trust service provider; | (g) the qualified electronic signature or qualified electronic seal of the issuing qualified trust service provider; |
Or. en
Amendment 135
Proposal for a regulation
Annex VI – paragraph 1 – point 2
Regulation (EU) No 910/2014
Annex VI – paragraph 1 – point 2
| Text proposed by the Commission | Amendment |
| 2. Age; | 2. Date of birth; |
Or. en
Amendment 136
Proposal for a regulation
Annex VI – paragraph 1 – point 6
Regulation (EU) No 910/2014
Annex VI – paragraph 1 – point 6
| Text proposed by the Commission | Amendment |
| 6. Nationality; | 6. Nationalities; |
Or. en
Amendment 137
Proposal for a regulation
Annex VI – paragraph 1 – point 10
Regulation (EU) No 910/2014
Annex VI – paragraph 1 – point 10
| Text proposed by the Commission | Amendment |
| 10. Financial and company data. | 10. Company data. |
Or. en
Amendment 138
Proposal for a regulation
Annex VI – paragraph 1 – point 10 a (new)
Regulation (EU) No 910/2014
Annex VI – paragraph 1 – point 10 a (new)
| Text proposed by the Commission | Amendment |
| 10a. Identity photo; |
Or. en
Amendment 139
Proposal for a regulation
Annex VI – paragraph 1 – point 10 b (new)
Regulation (EU) No 910/2014
Annex VI – paragraph 1 – point 10 b (new)
| Text proposed by the Commission | Amendment |
| 10b. E-mail address. |
Or. en