On the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity
JURI-PA-731697
Committee on Legal Affairs · Rapporteur: Pascal Arimont
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
The Committee on Legal Affairs proposes amendments to the Commission's proposal for a regulation amending Regulation (EU) No 910/2014 on a European Digital Identity framework.¶¶ The amendments require Member States to issue European Digital Identity Wallets under a notified electronic identification scheme, free of charge to natural persons, and to ensure equal access including for vulnerable persons.¶¶¶ They set rules on wallet functions: secure request, storage, combination and sharing of identity data and attestations, selective disclosure, qualified electronic signatures and seals, user access to transaction history, data transfer and restoration, and blocking access after a security breach.¶¶¶ They require private relying parties in listed sectors to accept wallets where strong user authentication is required, and very large online platforms to accept wallets on voluntary request, while allowing anonymous or pseudonymous use unless identification is required by law.¶¶¶ They require web-browsers to recognise and display qualified certificates for website authentication, with an exemption for micro and small enterprises in their first 5 years.¶¶ They set deadlines for the Commission to adopt delegated and implementing acts, within 6 or 12 months of entry into force, on technical specifications, standards and procedures.¶¶¶
Committee position. The Committee on Legal Affairs proposes amendments to the Commission's proposal, calling on the Committee on Industry, Research and Energy to take them into account. The amendments add requirements on wallet functions, access, acceptance by private parties, website authentication and Commission delegated and implementing acts.¶¶
Key points
- The Committee on Legal Affairs calls on the Committee on Industry, Research and Energy to take into account its amendments to the proposed regulation.¶
- Member States should ensure equal access to digital identification for all nationals and residents, including vulnerable persons such as persons with disabilities, elderly persons and persons with limited access to digital technologies.¶
- Wallets should let users transparently and traceably request, obtain, store, select, combine and share legal person identification data and electronic attestations of attributes, with selective disclosure possible, and use qualified electronic signatures and seals accepted across the Union.¶¶¶
- Wallets should let users consult their transaction history, transfer and restore wallet data, block access after a security breach, and contact the issuer's support services.¶¶
- Member States should notify, within 12 months of entry into force, at least one electronic identification scheme including at least the European Digital Identity Wallet issued under Article 6a.¶
- Wallets should be issued under a notified electronic identification scheme of level of assurance 'high' and their use should be free of charge to natural persons.¶
- Private relying parties in transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications should accept wallets in an easily accessible and non-discriminatory manner where strong user authentication is required by law or contract.¶¶
- Very large online platforms should accept wallets upon voluntary request of the user, and users should not be restricted or hindered for not using a wallet.
- The use of pseudonyms in electronic transactions or anonymous use should be permitted and not restricted unless specific rules of Union or national law require users to identify themselves for legal purposes.¶
- Web-browsers should recognise and display qualified certificates for website authentication, with an exemption for microenterprises and small enterprises in their first 5 years as web-browsing service providers.¶¶
- The Commission should adopt delegated acts within 6 or 12 months of entry into force to supplement the regulation with technical and operational specifications, minimum technical specifications and specifications for qualified certificates.¶¶¶
- The Commission should adopt implementing acts within 6 or 12 months of entry into force to establish reference standards, formats and procedures, following the examination procedure in Article 48(2).¶¶¶
Who is affected
- Member States, which must issue wallets, ensure equal access and notify identification schemes.¶¶¶
- Natural persons and residents, who can use wallets free of charge and use services anonymously or pseudonymously.¶
- Private relying parties in listed sectors, which must accept wallets where strong authentication is required.¶¶
- Very large online platforms, which must accept wallets on voluntary user request.
- Web-browsers, which must recognise and display qualified certificates for website authentication.¶¶
Figures and deadlines
- Within 6 months of entry into force, the Commission shall adopt delegated acts on technical and operational specifications for wallet requirements.¶
- Within 6 months of entry into force, the Commission shall adopt implementing acts establishing reference standards for wallet requirements.¶
- Within 12 months after entry into force, Member States shall notify at least one electronic identification scheme including at least the European Digital Identity Wallet.¶
- Within 12 months of entry into force, the Commission shall adopt delegated acts on minimum technical specifications for verification of identity and attributes.¶
- Within 12 months of entry into force, the Commission shall adopt implementing acts setting out standards and procedures for verification of identity and attributes.¶
- Within 12 months of entry into force, the Commission shall adopt delegated acts establishing specifications for qualified certificates for website authentication.¶
- Within 12 months of entry into force, the Commission shall adopt implementing acts providing reference numbers of standards for qualified certificates for website authentication.¶
- Web-browsers that are microenterprises or small enterprises are exempt from support and interoperability obligations in their first 5 years of operating.¶