On the proposal for a regulation of the European Parliament and of the Council Amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity
LIBE-AD-732601
Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Cristian Terheş
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
The Committee on Civil Liberties, Justice and Home Affairs proposes amendments to the proposed regulation amending Regulation (EU) No 910/2014 on a European Digital Identity framework.¶¶ The amendments add data protection safeguards: purpose limitation, data minimisation, data protection by design and by default, and compliance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive 2002/58/EC.¶¶ They require Member States to register service providers before they rely on the Wallets, allow users to complain, and require relying parties to be on a publicly available list.¶¶ They make Wallet use optional and free of charge, ban discrimination and disadvantages for non-users, and require access to services and the labour market not to depend on the Wallet.¶ They require user control, decentralised architecture, selective disclosure, pseudonym use, and the ability to withdraw consent, refuse requests, transfer data and block access after a breach.¶¶¶
Committee position. The committee proposes amendments to strengthen data protection, user control and transparency in the European Digital Identity framework, and to make Wallet use optional and non-discriminatory.¶¶
Key points
- The committee calls on the Committee on Industry, Research and Energy to take its amendments into account.¶
- Personal data processing must follow data minimisation, purpose limitation and data protection by design and by default, under Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive 2002/58/EC.¶¶
- Service providers must register with Member States before relying on the Wallets; users may complain about a relying party's use of the Wallets.¶
- Member States must publish minimum information on privacy settings, technical architecture, security frameworks and where personal data is processed.¶
- The Wallet should let users choose what data to share, minimise shared data and manage and control it.¶
- Biometrics must not be a precondition for using the Wallet; cloud storage of Wallet information requires explicit user consent.¶
- Member States should set up joint sandboxes to test innovative solutions while preventing solutions that infringe Union data protection and IT security law.¶
- The Wallet must enable selective disclosure, prevent tracking and linking across relying parties, and allow pseudonymous use unless Union or national law requires identification.¶¶
- Relying parties must be duly registered on a publicly available list, and their information requests must be visible there.¶
- Users must be able to make informed decisions, refuse requests in whole or in part, see a full transaction history, withdraw consent and exercise data subject rights.¶¶
- Users must be able to access a readable list of authorised actions and to transfer Wallet data and block access after a security breach.¶¶
- Wallet use must be optional, free of charge and non-discriminatory; access to services, online platforms and the labour market must not depend on it.¶
Who is affected
- Users of the European Digital Identity Wallet, who gain control, transparency and refusal rights.¶¶¶
- Relying parties, which must register, appear on a public list and request only necessary data.¶¶
- Member States, which must register providers, ensure identity matching and publish information.¶¶
- Providers of electronic identification means and attestations of attributes, subject to data separation and security rules.¶¶
- Supervisory bodies and data protection authorities, which must be informed of breaches without undue delay.¶¶