Sittings · Document

OPINION (COM(2021)0281 – C90200/2021 – 2021/0136(COD)) 2022-11-07

On the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity

Committee on Legal Affairs · Rapporteur: Pascal Arimont

AMENDMENTS

The Committee on Legal Affairs calls on the Committee on Industry, Research and Energy, as the committee responsible, to take into account the following amendments:

Amendment 1

Proposal for a regulation

Recital 1

Text proposed by the Commission	Amendment
(1) The Commission Communication of 19 February 2020, entitled “Shaping Europe’s Digital Future”16announces a revision of Regulation (EU) No 910/2014 of the European Parliament and of the Council with the aim of improving its effectiveness, extend its benefits to the private sector and promote trusted digital identities for all Europeans.	(1) The Commission Communication of 19 February 2020, entitled “Shaping Europe’s Digital Future”16 announces a revision of Regulation (EU) No 910/2014 of the European Parliament and of the Council with the aim of improving its effectiveness, extend its benefits to the private sector and to all citizens and promote trusted digital identities for all Europeans, in compliance with Union values.
_________________	_________________
16 COM/2020/67 final	16 COM(2020) 67 final

Amendment 2

Proposal for a regulation

Recital 4

Text proposed by the Commission	Amendment
(4) A more harmonised approach to digital identification should reduce the risks and costs of the current fragmentation due to the use of divergent national solutions and will strengthen the Single Market by allowing citizens, other residents as defined by national law and businesses to identify online in a convenient and uniform way across the Union. Everyone should be able to securely access public and private services relying on an improved ecosystem for trust services and on verified proofs of identity and attestations of attributes, such as a university degree legally recognised and accepted everywhere in the Union. The framework for a European Digital Identity aims to achieve a shift from the reliance on national digital identity solutions only, to the provision of electronic attestations of attributes valid at European level. Providers of electronic attestations of attributes should benefit from a clear and uniform set of rules and public administrations should be able to rely on electronic documents in a given format.	(4) A more harmonised approach to digital identification should reduce the risks and costs of the current fragmentation due to the use of divergent national solutions and will strengthen the Single Market by allowing citizens, other residents as defined by national law and businesses to identify online in a convenient and uniform way across the Union. Everyone should be able to securely access public and private services relying on a harmonised and improved ecosystem for trust services and on verified proofs of identity and attestations of attributes, such as a university degree legally recognised and accepted everywhere in the Union. The framework for a European Digital Identity aims to achieve a shift from the reliance on national digital identity solutions only, to the provision of electronic attestations of attributes valid at European level. Providers of electronic attestations of attributes should benefit from a harmonised, clear and uniform set of rules and public administrations should be able to rely on electronic documents in a given format. Given the variable impact that such digitalisation of administrative procedures can have on the public budget in different Member States, a harmonised framework should aim at streamlining the economic aspects applicable to the provision of electronic attestations of attributes, and thereby further reduce discrepancies among Member States.

Amendment 3

Proposal for a regulation

Recital 7

Text proposed by the Commission	Amendment
(7) It is necessary to set out the harmonised conditions for the establishment of a framework for European Digital Identity Wallets to be issued by Member States, which should empower all Union citizens and other residents as defined by national law to share securely data related to their identity in a user friendly and convenient way under the sole control of the user. Technologies used to achieve those objectives should be developed aiming towards the highest level of security, user convenience and wide usability. Member States should ensure equal access to digital identification to all their nationals and residents.	(7) It is necessary to set out the harmonised conditions for the establishment of a framework for European Digital Identity Wallets to be issued by Member States, which should empower all Union citizens and other residents as defined by national law to share securely data related to their identity in a user friendly and convenient way under the sole control of the user. Technologies used to achieve those objectives should be developed aiming towards the highest level of security, user convenience and wide usability. Member States should ensure that such framework does not lead to the widening of the digital divide and, to that end, they should ensure the voluntary use of, as well as equal and free of charge access to, digital identification to all their nationals and residents, including vulnerable persons, such as persons with disabilities, persons who experience functional limitations, such as elderly persons, persons with limited access to digital technologies and digital skills and migrants.

Amendment 4

Proposal for a regulation

Recital 9

Text proposed by the Commission	Amendment
(9) All European Digital Identity Wallets should allow users to electronically identify and authenticate online and offline across borders for accessing a wide range of public and private services. Without prejudice to Member States’ prerogatives as regards the identification of their nationals and residents, Wallets can also serve the institutional needs of public administrations, international organisations and the Union’s institutions, bodies, offices and agencies. Offline use would be important in many sectors, including in the health sector where services are often provided through face-to-face interaction and ePrescriptions should be able to rely on QR-codes or similar technologies to verify authenticity. Relying on the level of assurance “high”, the European Digital Identity Wallets should benefit from the potential offered by tamper-proof solutions such as secure elements, to comply with the security requirements under this Regulation. The European Digital Identity Wallets should also allow users to create and use qualified electronic signatures and seals which are accepted across the EU. To achieve simplification and cost reduction benefits to persons and businesses across the EU, including by enabling powers of representation and e-mandates, Member States should issue European Digital Identity Wallets relying on common standards to ensure seamless interoperability and a high level of security. Only Member States’ competent authorities can provide a high degree of confidence in establishing the identity of a person and therefore provide assurance that the person claiming or asserting a particular identity is in fact the person he or she claims to be. It is therefore necessary that the European Digital Identity Wallets rely on the legal identity of citizens, other residents or legal entities. Trust in the European Digital Identity Wallets would be enhanced by the fact that issuing parties are required to implement appropriate technical and organisational measures to ensure a level of security commensurate to the risks raised for the rights and freedoms of the natural persons, in line with Regulation (EU) 2016/679.	(9) All European Digital Identity Wallets should allow users, in a manner that is transparent and traceable by the user, to securely request and obtain, store, select, combine and share the necessary legal person identification data and electronic attestation of attributes, while ensuring that selective disclosure is possible, to electronically identify and authenticate online and offline across borders for accessing a wide range of public and private services, and to create and use qualified electronic signatures and seals which are accepted across the Union. Without prejudice to Member States’ prerogatives as regards the identification of their nationals and residents, Wallets can also serve the institutional needs of public administrations, international organisations and the Union’s institutions, bodies, offices and agencies. Offline use would be important in many sectors, including in the health sector where services are often provided through face-to-face interaction and ePrescriptions should be able to rely on QR-codes or similar technologies to verify authenticity. The European Digital Identity Wallet should also allow the user to consult the history of the transactions, transfer the wallet's data, restore the access on a different device and block access to the wallet in case of a security breach that leads to its suspension, revocation or withdrawal, and offer the possibility to contact support services of the wallet's issuer. Relying on the level of assurance “high”, the European Digital Identity Wallets should benefit from the potential offered by tamper-proof solutions such as secure elements, to comply with the security requirements under this Regulation. To achieve simplification and cost reduction benefits to persons and businesses across the EU, including by enabling powers of representation and e-mandates, Member States should issue European Digital Identity Wallets relying on common standards. Those European Digital Identity Wallets should be developed in a manner that ensures a high level of security, including the encryption of content. They should ensure seamless interoperability, for instance, by relying on the use of open-source technology, and should be made available on major operating systems. When developed through public procurement or on technologies developed through public-private partnerships with non-profit organisations, the resulting code should be open source. Only Member States’ competent authorities can provide a high degree of confidence in establishing the identity of a person and therefore provide assurance that the person claiming or asserting a particular identity is in fact the person he or she claims to be. It is therefore necessary that the European Digital Identity Wallets rely on the legal identity of citizens, other residents or legal entities. Trust in the European Digital Identity Wallets would be enhanced by the fact that issuing parties are required to implement appropriate technical and organisational measures to ensure a level of security commensurate to the risks raised for the rights and freedoms of the natural persons, in line with Regulation (EU) 2016/679.

Amendment 5

Proposal for a regulation

Recital 10

Text proposed by the Commission	Amendment
(10) In order to achieve a high level of security and trustworthiness, this Regulation establishes the requirements for European Digital Identity Wallets. The conformity of European Digital Identity Wallets with those requirements should be certified by accredited public or private sector bodies designated by Member States. Relying on a certification scheme based on the availability of commonly agreed standards with Member States should ensure a high level of trust and interoperability. Certification should in particular rely on the relevant European cybersecurity certifications schemes established pursuant to Regulation (EU) 2019/88120. Such certification should be without prejudice to certification as regards personal data processing pursuant to Regulation (EC) 2016/679	(10) In order to achieve a high level of security, accessibility and trustworthiness, this Regulation establishes the requirements for European Digital Identity Wallets. The conformity of European Digital Identity Wallets with those requirements should be certified by accredited public or private sector bodies designated by Member States. Relying on a certification scheme based on the availability of commonly agreed standards with Member States should ensure a high level of trust, security, accessibility and interoperability. Certification should in particular rely on the relevant European cybersecurity certifications schemes established pursuant to Regulation (EU) 2019/88120. Such certification should be without prejudice to certification as regards personal data processing pursuant to Regulation (EC) 2016/679
_________________	_________________
20 Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act), OJ L 151, 7.6.2019, p. 15	20 Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (OJ L 151, 7.6.2019, p. 15).

Amendment 6

Proposal for a regulation

Recital 11

Text proposed by the Commission	Amendment
(11) European Digital Identity Wallets should ensure the highest level of security for the personal data used for authentication irrespective of whether such data is stored locally or on cloud-based solutions, taking into account the different levels of risk. Using biometrics to authenticate is one of the identifications methods providing a high level of confidence, in particular when used in combination with other elements of authentication. Since biometrics represents a unique characteristic of a person, the use of biometrics requires organisational and security measures, commensurate to the risk that such processing may entail to the rights and freedoms of natural persons and in accordance with Regulation 2016/679.	(11) European Digital Identity Wallets should ensure the highest level of security for the personal data used for authentication irrespective of whether such data is stored locally or on cloud-based solutions, taking into account the different levels of risk. Using biometrics to authenticate is one of the identifications methods providing a high level of confidence, in particular when used in combination with other elements of authentication. Since biometrics represents a unique characteristic of a person, the use of biometrics requires organisational and security measures, commensurate to the risk that such processing may entail to the rights and freedoms of natural persons and in accordance with Regulation (EU)2016/679. The use of biometrics is highly recommended; however, there are some hardware solutions that do not allow for the use of biometrics and, in those cases, alternatives should be provided. It should be possible for potential users of these digital wallets who no longer wish to use them to permanently delete their data.

Amendment 7

Proposal for a regulation

Recital 12

Text proposed by the Commission	Amendment
(12) To ensure that the European Digital Identity framework is open to innovation, technological development and future-proof, Member States should be encouraged to set-up jointly sandboxes to test innovative solutions in a controlled and secure environment in particular to improve the functionality, protection of personal data, security and interoperability of the solutions and to inform future updates of technical references and legal requirements. This environment should foster the inclusion of European Small and Medium Enterprises, start-ups and individual innovators and researchers.	(12) To ensure that the European Digital Identity framework is open to innovation, technological development and future-proof, thus facilitating the transition to a genuine digital single market, Member States should be encouraged to set-up jointly regulatory sandboxes to test innovative solutions in a controlled and secure environment under the supervision of competent authorities, in particular to improve the functionality, security and interoperability of the solutions, to provide safeguards and risk mitigation measures needed to build trust and reliance on the solutions and ensure the effective protection of personal data and other fundamental rights and to inform future updates of technical references and legal requirements. This environment should foster the inclusion of European Small and Medium Enterprises, start-ups and individual innovators and researchers, without subjecting them to unnecessary administrative and financial burdens, while improving compliance and preventing the placing on the market of solutions not in line with Union legislation on data protection and cybersecurity. Any significant risks identified during the development and testing of innovative solutions shall result in immediate mitigation and, failing that, in the suspension of the development and testing process until such mitigation takes place.

Amendment 8

Proposal for a regulation

Recital 17

Text proposed by the Commission	Amendment
(17) Service providers use the identity data provided by the set of person identification data available from electronic identification schemes pursuant to Regulation (EU) No 910/2014 in order to match users from another Member State with the legal identity of that user. However, despite the use of the eIDAS data set, in many cases ensuring an accurate match requires additional information about the user and specific unique identification procedures at national level. To further support the usability of electronic identification means, this Regulation should require Member States to take specific measures to ensure a correct identity match in the process of electronic identification. For the same purpose, this Regulation should also extend the mandatory minimum data set and require the use of a unique and persistent electronic identifier in conformity with Union law in those cases where it is necessary to legally identify the user upon his/her request in a unique and persistent way.	(17) Service providers use the identity data provided by the set of person identification data available from electronic identification schemes pursuant to Regulation(EU) No 910/2014 in order to match users from another Member State with the legal identity of that user. However, despite the use of the eIDAS data set, in many cases ensuring an accurate match requires additional information about the user and specific identification procedures at national level. To further support the usability of electronic identification means, this Regulation should require Member States to take specific measures to ensure a correct identity match in the process of cross-border electronic identification. The use of person identification data or a combination of person identification data, including the use of unique and persistent identifiers issued by Member States or generated by the European Digital Identity Wallet, is essential to ensure that the identity of the user, in particular in the public sector and when mandated by Union or national law, can be verified. The law of a Member State may require the use of unique and persistent identifiers issued by that Member State. The European Digital Identity Wallet should, therefore, be capable of storing these identifiers and disclosing them upon request by the user in those cases where the identification of the user is required by law. A persistent and unique identifier may consist of either single or multiple identification data that can be sector- or relying-party-specific as long it serves to uniquely identify the user across the Union. In all cases, the mechanism provided to facilitate record matching should ensure that the user is protected against misuse of personal data, in accordance with this Regulation and applicable Union law, in particular Regulation (EU) 2016/679, including against the risk of profiling and tracking related to the use of the European Digital Identity Wallet.

Amendment 9

Proposal for a regulation

Recital 18

Text proposed by the Commission	Amendment
(18) In line with Directive (EU) 2019/88222 , persons with disabilities should be able to use the European digital identity wallets, trust services and end-user products used in the provision of those services on an equal basis with other users.	(18) In line with the United Nations Convention on the Rights of Persons with Disabilities (UNCRPD) and in accordance with the accessibility requirements under Directive (EU) 2019/88222 , persons with disabilities and persons with functional limitations should be able to use the European digital identity wallets, trust services and end-user products used in the provision of those services on an equal basis with other users.
__________________	__________________
22 Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70).	22 Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70).

Amendment 10

Proposal for a regulation

Recital 18 a (new)

Text proposed by the Commission	Amendment
	(18a) Persons under legal guardianship, such as children and people with mental disabilities, should be able to have a trusted third party in charge of using their European Digital Identity Wallets on their behalf, upon designation by a judicial authority. The modalities of use of European Digital Identity Wallets by the trusted third parties should be determined by Member States.

Amendment 11

Proposal for a regulation

Recital 20

Text proposed by the Commission	Amendment
(20) The provision and use of trust services are becoming increasingly important for international trade and cooperation. International partners of the EU are establishing trust frameworks inspired by Regulation (EU) No 910/2014. Therefore, in order to facilitate the recognition of such services and their providers, implementing legislation may set the conditions under which trust frameworks of third countries could be considered equivalent to the trust framework for qualified trust services and providers in this Regulation, as a complement to the possibility of the mutual recognition of trust services and providers established in the Union and in third countries in accordance with Article 218 of the Treaty.	(20) The provision and use of trust services are becoming increasingly important for international trade, competitiveness, innovation, security and cooperation. International partners of the EU are establishing trust frameworks inspired by Regulation (EU) No 910/2014. Therefore, in order to facilitate the recognition of such services and their providers, implementing legislation sets the conditions under which trust frameworks of third countries could be considered equivalent to the trust framework for qualified trust services and providers in this Regulation, as a complement to the possibility of the mutual recognition of trust services and providers established in the Union and in third countries in accordance with Article 218 of the Treaty.

Amendment 12

Proposal for a regulation

Recital 21

Text proposed by the Commission	Amendment
(21) This Regulation should build on Union acts ensuring contestable and fair markets in the digital sector. In particular, it builds on the Regulation XXX/XXXX [Digital Markets Act], which introduces rules for providers of core platform services designated as gatekeepers and, among others, prohibits gatekeepers to require business users to use, offer or interoperate with an identification service of the gatekeeper in the context of services offered by the business users using the core platform services of that gatekeeper. Article 6(1)(f) of the Regulation XXX/XXXX [Digital Markets Act] requires gatekeepers to allow business users and providers of ancillary services access to and interoperability with the same operating system, hardware or software features that are available or used in the provision by the gatekeeper of any ancillary services. According to Article 2 (15) of [Digital Markets Act] identification services constitute a type of ancillary services. Business users and providers of ancillary services should therefore be able to access such hardware or software features, such as secure elements in smartphones, and to interoperate with them through the European Digital Identity Wallets or Member States’ notified electronic identification means.	(21) This Regulation should rely on Regulation XXX/XXXX [Digital Markets Act], which, among others, requires gatekeepers to allow its business users to freely choose the identification service they want to use or interoperate with. This should cover European Digital Identity Wallets or Member States’ notified electronic identification means.

Amendment 13

Proposal for a regulation

Recital 26

Text proposed by the Commission	Amendment
(26) It should be possible to issue and handle trustworthy digital attributes and contribute to reducing administrative burden, empowering citizens and other residents to use them in their private and public transactions. Citizens and other residents should be able, for instance, to demonstrate ownership of a valid driving license issued by an authority in one Member State, which can be verified and relied upon by the relevant authorities in other Member States, to rely on their social security credentials or on future digital travel documents in a cross border context.	(26) It should be possible to issue and handle trustworthy digital attributes and contribute to reducing administrative burden, empowering citizens and other residents to use them in their private and public transactions under conditions of optimum security. Citizens and other residents should be able, for instance, to demonstrate ownership of a valid driving license issued by an authority in one Member State, which can be verified and relied upon by the relevant authorities in other Member States, to rely on their social security credentials or on future digital travel documents in a cross border context.

Amendment 14

Proposal for a regulation

Recital 27

Text proposed by the Commission	Amendment
(27) Any entity that collects, creates and issues attested attributes such as diplomas, licences, certificates of birth should be able to become a provider of electronic attestation of attributes. Relying parties should use the electronic attestations of attributes as equivalent to attestations in paper format. Therefore, an electronic attestation of attributes should not be denied legal effect on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic attestation of attributes. To that effect, general requirements should be laid down to ensure that a qualified electronic attestation of attributes has the equivalent legal effect of lawfully issued attestations in paper form. However, those requirements should apply without prejudice to Union or national law defining additional sector specific requirements as regards form with underlying legal effects and, in particular, the cross-border recognition of qualified electronic attestation of attributes, where appropriate.	(27) Any entity that collects, creates and issues attested attributes such as diplomas, licences, certificates of birth should be able to become a provider of electronic attestation of attributes and should be responsible for revoking the attestation in the event of falsification, identity theft, or any issuance based on an abusive request. Relying parties should use the electronic attestations of attributes as equivalent to attestations in paper format. Nevertheless, lawfully issued attestations of attributes in paper form should continue to be accepted by relying parties as an alternative to electronic attestations of attributes. An electronic attestation of attributes should not be denied legal effect solely on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic attestation of attributes. To that effect, general requirements should be laid down to ensure that a qualified electronic attestation of attributes has the equivalent legal effect of lawfully issued attestations in paper form. However, those requirements should apply without prejudice to Union or national law defining additional sector specific requirements as regards form with underlying legal effects and, in particular, the cross-border recognition of qualified electronic attestation of attributes, where appropriate. The Commission and Member States should involve professional organisations in laying down the attributes that concern them.

Amendment 15

Proposal for a regulation

Recital 28

Text proposed by the Commission	Amendment
(28) Wide availability and usability of the European Digital Identity Wallets require their acceptance by private service providers. Private relying parties providing services in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications should accept the use of European Digital Identity Wallets for the provision of services where strong user authentication for online identification is required by national or Union law or by contractual obligation. Where very large online platforms as defined in Article 25.1. of Regulation [reference DSA Regulation] require users to authenticate to access online services, those platforms should be mandated to accept the use of European Digital Identity Wallets upon voluntary request of the user. Users should be under no obligation to use the wallet to access private services, but if they wish to do so, large online platforms should accept the European Digital Identity Wallet for this purpose while respecting the principle of data minimisation. Given the importance of very large online platforms, due to their reach, in particular as expressed in number of recipients of the service and economic transactions this is necessary to increase the protection of users from fraud and secure a high level of data protection. Self-regulatory codes of conduct at Union level (‘codes of conduct’) should be developed in order to contribute to wide availability and usability of electronic identification means including European Digital Identity Wallets within the scope of this Regulation. The codes of conduct should facilitate wide acceptance of electronic identification means including European Digital Identity Wallets by those service providers which do not qualify as very large platforms and which rely on third party electronic identification services for user authentication. They should be developed within 12 months of the adoption of this Regulation. The Commission should assess the effectiveness of these provisions for the availability and usability for the user of the European Digital Identity Wallets after 18 months of their deployment and revise the provisions to ensure their acceptance by means of delegated acts in the light of this assessment.	(28) Wide availability and usability of the European Digital Identity Wallets require their acceptance by private service providers and trust by citizens regarding the processing of their personal data. Private relying parties providing services in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications should accept the use of European Digital Identity Wallets for the provision of services in an easily accessible and a non-discriminatory manner where strong user authentication for online identification is required by national or Union law. However, unless specific rules of Union or national law require users to identify themselves for legal purposes, the use of services under a pseudonym should always be allowed and should not be prohibited nor restricted by service providers by means of a contract or the terms and conditions applicable to the use of the service. Where very large online platforms as defined in Article 25.1. of Regulation [reference DSA Regulation], in accordance with the applicable rules of Union or national law, require users to authenticate to access online services, those platforms should be mandated to accept the use of European Digital Identity Wallets upon voluntary request of the user. The personal data requested should be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Users should be under no obligation to use the wallet to access private services. On the other hand, access to private services should not be restricted or hindered for users not using the wallet. If they wish to do so, large online platforms should accept the European Digital Identity Wallet for this purpose while respecting the principles of data minimisation and purpose limitation. Given the importance of very large online platforms, due to their reach, in particular as expressed in number of recipients of the service and economic transactions this is necessary to increase the protection of users from fraud and secure a high level of data protection. Self-regulatory codes of conduct at Union level (‘codes of conduct’) should be developed in order to contribute to wide availability and usability of electronic identification means including European Digital Identity Wallets within the scope of this Regulation. The codes of conduct should facilitate wide acceptance of electronic identification means including European Digital Identity Wallets by those service providers which do not qualify as very large platforms and which rely on third party electronic identification services for user authentication. They should be developed within 12 months of the adoption of this Regulation. The Commission should assess the effectiveness of these provisions for the availability and usability for the user of the European Digital Identity Wallets after 18 months of their deployment and revise the provisions to ensure their acceptance by means of delegated acts in the light of this assessment.

Amendment 16

Proposal for a regulation

Recital 32

Text proposed by the Commission	Amendment
(32) Website authentication services provide users with assurance that there is a genuine and legitimate entity standing behind the website. Those services contribute to the building of trust and confidence in conducting business online, as users will have confidence in a website that has been authenticated. The use of website authentication services by websites is voluntary. However, in order for website authentication to become a means to increasing trust, providing a better experience for the user and furthering growth in the internal market, this Regulation lays down minimal security and liability obligations for the providers of website authentication services and their services. To that end, web-browsers should ensure support and interoperability with Qualified certificates for website authentication pursuant to Regulation (EU) No 910/2014. They should recognise and display Qualified certificates for website authentication to provide a high level of assurance, allowing website owners to assert their identity as owners of a website and users to identify the website owners with a high degree of certainty. To further promote their usage, public authorities in Member States should consider incorporating Qualified certificates for website authentication in their websites.	deleted

Justification

(linked to deletion of amendment to Article 45)Out of scope - archiving has nothing to do with identification. There is no EU harmonisation on safe deposit boxes either.

Amendment 17

Proposal for a regulation

Recital 36

Text proposed by the Commission	Amendment
(36) In order to avoid fragmentation and barriers, due to diverging standards and technical restrictions, and to ensure a coordinated process to avoid endangering the implementation of the future European Digital Identity framework, a process for close and structured cooperation between the Commission, Member States and the private sector is needed. To achieve this objective, Member States should cooperate within the framework set out in the Commission Recommendation XXX/XXXX [Toolbox for a coordinated approach towards a European Digital Identity Framework]26 to identify a Toolbox for a European Digital Identity framework. The Tool box should include a comprehensive technical architecture and reference framework, a set of common standards and technical references and a set of guidelines and descriptions of best practices covering at least all aspects of the functionalities and interoperability of the European Digital Identity Wallets including eSignatures and of the qualified trust service for attestation of attributes as laid out in this regulation. In this context, Member States should also reach agreement on common elements of a business model and fee structure of the European Digital Identity Wallets, to facilitate take up, in particular by small and medium sized companies in a cross-border context. The content of the toolbox should evolve in parallel with and reflect the outcome of the discussion and process of adoption of the European Digital Identity Framework.	(36) In order to avoid fragmentation and barriers, due to diverging standards and technical restrictions, and to ensure a coordinated process to avoid endangering the implementation of the future European Digital Identity framework, a process for close and structured cooperation between the Commission, Member States and the private sector is needed. To achieve this objective, Member States should cooperate within the framework set out in the Commission Recommendation XXX/XXXX [Toolbox for a coordinated approach towards a European Digital Identity Framework]26to identify a Toolbox for a European Digital Identity framework. The Tool box should include a comprehensive technical architecture and reference framework for the decentralised self-sovereign architecture of the European Digital Identity Wallet, a set of common standards, including recognised existing standards, and technical references and a set of guidelines and descriptions of best practices covering at least all aspects of the functionalities and interoperability of the European Digital Identity Wallets including eSignatures and of the qualified trust service for attestation of attributes as laid out in this regulation. In this context, Member States should also reach agreement on common elements of a business model and fee structure of the European Digital Identity Wallets, to facilitate take up, in particular by small and medium sized companies in a cross-border context. The content of the toolbox should evolve in parallel with and reflect the outcome of the discussion and process of adoption of the European Digital Identity Framework.
__________________	__________________
26 [insert reference once adopted]	26 [insert reference once adopted]

Amendment 18

Proposal for a regulation

Recital 37

Text proposed by the Commission	Amendment
(37) The European Data Protection Supervisor has been consulted pursuant to Article 42 (1) of Regulation (EU) 2018/1525 of the European Parliament and of the Council27 .	(37) The European Data Protection Supervisor has been consulted pursuant to Article 42 (1) of Regulation (EU) 2018/1525 of the European Parliament and of the Council27, and has provided formal comments on 28 July 2021.
_________________	_________________
27 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).	27 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

Amendment 19

Proposal for a regulation

Article 1 – paragraph 1 – point 1

Regulation (EU) No 910/2014

Article 1 – paragraph 1 – introductory part

Text proposed by the Commission	Amendment
This Regulations aims at ensuring the proper functioning of the internal market and providing an adequate level of security of electronic identification means and trust services. For these purposes, this Regulation:	This Regulations aims at ensuring the proper functioning of the internal market, facilitating transition to a digital single market and providing an adequate level of security of electronic identification means and trust services. For these purposes, this Regulation:

Amendment 20

Proposal for a regulation

Article 1 – paragraph 1 – point 2 – point a

Regulation (EU) No 910/2014

Article 2 – paragraph 1

Text proposed by the Commission	Amendment
1. This Regulation applies to electronic identification schemes that have been notified by a Member State, European Digital Identity Wallets issued by Member States and to trust service providers that are established in the Union.;	1. This Regulation applies to electronic identification schemes that have been notified by a Member State, European Digital Identity Wallets issued by a Member State, under a mandate from a Member State or independently but recognised by a Member State, and to trust service providers that are established in the Union.

Amendment 21

Proposal for a regulation

Article 1 – paragraph 1 – point 2 – point b

Regulation (EU) No 910/2014

Article 2 – paragraph 3

Text proposed by the Commission	Amendment
3. This Regulation does not affect national or Union law related to the conclusion and validity of contracts or other legal or procedural obligations relating to sector specific requirements as regards form with underlying legal effects.	3. This Regulation does not affect national or Union law related to:

Amendment 22

Proposal for a regulation

Article 1 – paragraph 1 – point 2 – point b

Regulation (EU) No 910/2014

Article 2 – paragraph 3 – point a (new)

Text proposed by the Commission	Amendment
	(a) the conclusion and validity of contracts, or other legal or procedural obligations relating to form; or

Amendment 23

Proposal for a regulation

Article 1 – paragraph 1 – point 2 – point b

Regulation (EU) No 910/2014

Article 2 – paragraph 3 – point b (new)

Text proposed by the Commission	Amendment
	(b) sector-specific requirements for qualified electronic attestation of attributes as regards form with underlying legal effects, in particular in the context of the cross-border recognition of qualified electronic attestation of attributes.

Amendment 24

Proposal for a regulation

Article 1 – paragraph 1 – point 3 – point a

Regulation (EU) No 910/2014

Article 3 – paragraph 1 – point 2

Text proposed by the Commission	Amendment
(2) ‘electronic identification means’ means a material and/or immaterial unit, including European Digital Identity Wallets or ID cards following Regulation 2019/1157, containing person identification data and which is used for authentication for an online or offline service;	(2) ‘electronic identification means’ means a material and/or immaterial unit, including European Digital Identity Wallets or ID cards following Regulation 2019/1157, containing person identification data and which is used for authentication, online and offline, for public and private services;

Amendment 25

Proposal for a regulation

Article 1 – paragraph 1 – point 3 – point g

Regulation (EU) No 910/2014

Article 3 – paragraph 1 – point 29

Text proposed by the Commission	Amendment
(29) ‘certificate for electronic seal’ means an electronic attestation or set of attestations that links electronic seal validation data to a legal person and confirms the name of that person;	(29) ‘certificate for electronic seal’ means an electronic attestation or set of attestations that links electronic seal validation data to a legal person and confirms at least the name or the pseudonym of that person;

Amendment 26

Proposal for a regulation

Article 1 – paragraph 1 – point 3 – point i

Regulation (EU) No 910/2014

Article 3 – paragraph 1 – point 42

Text proposed by the Commission	Amendment
(42) ‘European Digital Identity Wallet’ is a product and service that allows the user to store identity data, credentials and attributes linked to her/his identity, to provide them to relying parties on request and to use them for authentication, online and offline, for a service in accordance with Article 6a; and to create qualified electronic signatures and seals;	(42) ‘European Digital Identity Wallet’ means a software product and service that allows the user, on a device under her/his control, to store identity data, credentials and attributes linked to her/his identity, to provide them to relying parties on request and to use them for authentication, online and offline, for a service in accordance with Article 6a; and to create qualified electronic signatures and seals;

Amendment 27

Proposal for a regulation

Article 1 – paragraph 1 – point 3 – point i

Regulation (EU) No 910/2014

Article 3 – paragraph 1 – point 46

Text proposed by the Commission	Amendment
(46) ‘authentic source’ is a repository or system, held under the responsibility of a public sector body or private entity, that contains attributes about a natural or legal person and is considered to be the primary source of that information or recognised as authentic in national law;	(46) ‘authentic source’ is a repository or system, held under the responsibility of a public sector body or private entity, that contains attributes about a natural or legal person and is considered to be the primary source of that information or recognised as authentic in Union and national law;

Amendment 28

Proposal for a regulation

Article 1 – paragraph 1 – point 3 – point i

Regulation (EU) No 910/2014

Article 3 – paragraph 1 – point 47

Text proposed by the Commission	Amendment
(47) ‘electronic archiving’ means a service ensuring the receipt, storage, deletion and transmission of electronic data or documents in order to guarantee their integrity, the accuracy of their origin and legal features throughout the conservation period;	(47) ‘electronic archiving’ means a service ensuring the receipt, storage, conversion, deletion and transmission of electronic data or documents or the digitization of physical documents in order to guarantee their integrity, the accuracy of their origin and legal features throughout the conservation period;

Amendment 29

Proposal for a regulation

Article 1 – paragraph 1 – point 3 – point i

Regulation (EU) No 910/2014

Article 3 – paragraph 1 – point 55

Text proposed by the Commission	Amendment
(55) ‘unique identification’ means a process where person identification data or person identification means are matched with or linked to an existing account belonging to the same person.	(55) ‘record matching’ means a process where person identification data or person identification means are matched with or linked to an existing account belonging to the same person;

Amendment 30

Proposal for a regulation

Article 1 – paragraph 1 – point 3 – point i

Regulation (EU) No 910/2014

Article 3 – paragraph 1 – point 55 a (new)

Text proposed by the Commission	Amendment
	(55a) ‘unique identifier’ means an identifier, which may consist of either single or multiple national or sectoral identification data and is associated with a single user within a given system;

Amendment 31

Proposal for a regulation

Article 1 – paragraph 1 – point 3 – point i

Regulation (EU) No 910/2014

Article 3 – paragraph 1 – point 55 b (new)

Text proposed by the Commission	Amendment
	(55b) ‘trusted third party’ means a natural person designated by a judicial authority within the framework of a legal guardianship regime, who is able to use the European Digital Identity Wallets on behalf of their holders.

Amendment 32

Proposal for a regulation

Article 1 – paragraph 1 – point 4

Regulation (EU) No 910/2014

Article 5 – title

Text proposed by the Commission	Amendment
Pseudonyms in electronic transaction	Personal data protection and pseudonyms in electronic transactions

Amendment 33

Proposal for a regulation

Article 1 – paragraph 1 – point 4

Regulation (EU) No 910/2014

Article 5 – paragraph -1 (new)

Text proposed by the Commission	Amendment
	1. Processing of personal data under this Regulation shall be carried out in accordance with Regulation (EU) 2016/679, in particular by implementing the principles of data minimisation, purpose limitation and data protection by design and by default.

Amendment 34

Proposal for a regulation

Article 1 – paragraph 1 – point 4

Regulation (EU) No 910/2014

Article 5 – paragraph 1

Text proposed by the Commission	Amendment
Without prejudice to the legal effect given to pseudonyms under national law, the use of pseudonyms in electronic transactions shall not be prohibited.	2. Without prejudice to the legal effect given to pseudonyms under national law and unless specific rules of the Union or national law require users to identify themselves for legal purposes, the use of pseudonyms in electronic transactions shall always be allowed and shall not be prohibited or restricted by means of a contract or the terms and conditions applicable to the use of the service.

Amendment 35

Proposal for a regulation