Sittings · Document
OPINION (COM(2021)0281 – C90200/2021 – 2021/0136(COD)) 2022-10-11
On the proposal for a regulation of the European Parliament and of the Council Amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity
Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Cristian Terheş
AMENDMENTS
The Committee on Civil Liberties, Justice and Home Affairs calls on the Committee on Industry, Research and Energy, as the committee responsible, to take into account the following amendments:
Amendment 1
Proposal for a regulation
Recital 6
| Text proposed by the Commission | Amendment |
| (6) Regulation (EU) No 2016/67919 applies to the processing of personal data in the implementation of this Regulation. Therefore, this Regulation should lay down specific safeguards to prevent providers of electronic identification means and electronic attestation of attributes from combining personal data from other services with the personal data relating to the services falling within the scope of this Regulation. | (6) Natural or legal persons who own person identification data should be considered to be Digital Identity subjects. Regulations (EU) 2016/67919, and (EU) 2018/172519a and Directive 2002/58/EC19b apply to the processing of personal data in the implementation of this Regulation. Therefore, this Regulation should lay down specific safeguards to prevent providers of electronic identification means and electronic attestation of attributes from combining personal data from other services with the personal data relating to the services falling within the scope of this Regulation. This Regulation further specifies the application of principles of purpose limitation, data minimisation, and data protection by design and by default to specific use-cases, without prejudice to Regulation (EU) No 2016/679. |
| __________________ | __________________ |
| 19 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1 | 19 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1 |
| 19a Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). | |
| 19b Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.7.2002, p. 37) |
Amendment 2
Proposal for a regulation
Recital 8
| Text proposed by the Commission | Amendment |
| (8) In order to ensure compliance within Union law or national law compliant with Union law, service providers should communicate their intent to rely on the European Digital Identity Wallets to Member States. That will allow Member States to protect users from fraud and prevent the unlawful use of identity data and electronic attestations of attributes as well as to ensure that the processing of sensitive data, like health data, can be verified by relying parties in accordance with Union law or national law. | (8) In order to ensure compliance with Union law or national law, service providers should register with the Member States before they are able to rely on the European Digital Identity Wallets. Natural or legal persons should be able to submit a complaint with regard to the use of the European Digital Identity Wallets by a relying party. That will allow Member States to protect users from fraud and prevent the unlawful use of identity data and electronic attestations of attributes, as well as to ensure that the processing of sensitive data, like health data, can be verified by relying parties in accordance with Union law or national law. Member States should prevent the unlawful use of identity data, and ensure that the relying parties only require data that is strictly necessary for the provision of the service. |
Amendment 3
Proposal for a regulation
Recital 9
| Text proposed by the Commission | Amendment |
| (9) All European Digital Identity Wallets should allow users to electronically identify and authenticate online and offline across borders for accessing a wide range of public and private services. Without prejudice to Member States’ prerogatives as regards the identification of their nationals and residents, Wallets can also serve the institutional needs of public administrations, international organisations and the Union’s institutions, bodies, offices and agencies. Offline use would be important in many sectors, including in the health sector where services are often provided through face-to-face interaction and ePrescriptions should be able to rely on QR-codes or similar technologies to verify authenticity. Relying on the level of assurance “high”, the European Digital Identity Wallets should benefit from the potential offered by tamper-proof solutions such as secure elements, to comply with the security requirements under this Regulation. The European Digital Identity Wallets should also allow users to create and use qualified electronic signatures and seals which are accepted across the EU. To achieve simplification and cost reduction benefits to persons and businesses across the EU, including by enabling powers of representation and e-mandates, Member States should issue European Digital Identity Wallets relying on common standards to ensure seamless interoperability and a high level of security. Only Member States’ competent authorities can provide a high degree of confidence in establishing the identity of a person and therefore provide assurance that the person claiming or asserting a particular identity is in fact the person he or she claims to be. It is therefore necessary that the European Digital Identity Wallets rely on the legal identity of citizens, other residents or legal entities. Trust in the European Digital Identity Wallets would be enhanced by the fact that issuing parties are required to implement appropriate technical and organisational measures to ensure a level of security commensurate to the risks raised for the rights and freedoms of the natural persons, in line with Regulation (EU) 2016/679. | (9) All European Digital Identity Wallets should allow users to electronically identify and authenticate online and offline across borders for accessing a wide range of public and private services. Without prejudice to Member States’ prerogatives as regards the identification of their nationals and residents, Wallets can also serve the institutional needs of public administrations, international organisations and the Union’s institutions, bodies, offices and agencies. Offline use would be important in many sectors, including in the health sector where services are often provided through face-to-face interaction and ePrescriptions should be able to rely on QR-codes or similar technologies to verify authenticity. The users should have access to a simple interface that would allow them to have an overview of their current and previous authorisations with regard to the sharing of personal data or electronic attestation of attributes. They should have the possibility to withdraw their consent. Relying on the level of assurance “high”, the European Digital Identity Wallets should benefit from the potential offered by tamper-proof technology such as secure elements, to comply with the security and integrity requirements under this Regulation. The European Digital Identity Wallets should also allow users to create and use qualified electronic signatures and seals which are accepted across the Union. To achieve simplification and cost reduction benefits to persons and businesses across the Union, including by enabling powers of representation and e-mandates, Member States should issue European Digital Identity Wallets relying on common standards to ensure seamless interoperability and a high level of security. Only Member States’ competent authorities can provide a high degree of confidence in establishing the identity of a person and therefore provide assurance that the person claiming or asserting a particular identity is in fact the person he or she claims to be. It is therefore necessary for certain use cases that the European Digital Identity Wallets rely on the legal identity of citizens, other residents or legal entities. Trust in the European Digital Identity Wallets would be enhanced by the fact that issuing parties are required to implement appropriate technical and organisational measures to ensure a level of security commensurate to the risks raised for the rights and freedoms of the natural persons, in line with Regulation (EU) 2016/679. |
Amendment 4
Proposal for a regulation
Recital 9 a (new)
| Text proposed by the Commission | Amendment |
| (9a) In order to ensure the successful uptake of the European Digital Identity Wallet, it is crucial to ensure trust in the technical framework behind, and digital ecosystem surrounding, the Wallet. A high degree of transparency can contribute to establishing trust by allowing users to make informed decisions about the security and privacy characteristics of the European Digital Identity Wallet, as well as allowing for public scrutiny of the activities and actors involved in the framework. For this reason, Member States should ensure that relevant information, such as privacy protective settings, technical architecture, security frameworks, and the location where the processing of personal data is carried out, is included in the set of minimum information about the European Digital Identity Wallet and is made publicly available. |
Amendment 5
Proposal for a regulation
Recital 9 b (new)
| Text proposed by the Commission | Amendment |
| (9b) One of the objectives of the European Digital Identity Wallet should be to improve the possibilities of citizens to make their own choices about what data they share, to minimise the amount of shared data for the service they want to use and to better manage and control the shared data. |
Amendment 6
Proposal for a regulation
Recital 10
| Text proposed by the Commission | Amendment |
| (10) In order to achieve a high level of security and trustworthiness, this Regulation establishes the requirements for European Digital Identity Wallets. The conformity of European Digital Identity Wallets with those requirements should be certified by accredited public or private sector bodies designated by Member States. Relying on a certification scheme based on the availability of commonly agreed standards with Member States should ensure a high level of trust and interoperability. Certification should in particular rely on the relevant European cybersecurity certifications schemes established pursuant to Regulation (EU) 2019/88120 . Such certification should be without prejudice to certification as regards personal data processing pursuant to Regulation (EC) 2016/679 | (10) In order to achieve a high level of security and trustworthiness, this Regulation establishes the requirements for European Digital Identity Wallets. The conformity of European Digital Identity Wallets with those requirements should be certified by accredited public or private sector bodies designated by Member States. Relying on a certification scheme based on state- of-the- art technology and commonly agreed standards with Member States should ensure a high level of trust, interoperability and data protection. Certification should in particular rely on the relevant European cybersecurity certifications schemes established pursuant to Regulation (EU) 2019/88120. Such certification should be without prejudice to certification as regards personal data processing pursuant to Regulation (EC) 2016/679. |
| __________________ | __________________ |
| 20 Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act), OJ L 151, 7.6.2019, p. 15 | 20 Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act), OJ L 151, 7.6.2019, p. 15 |
Amendment 7
Proposal for a regulation
Recital 11
| Text proposed by the Commission | Amendment |
| (11) European Digital Identity Wallets should ensure the highest level of security for the personal data used for authentication irrespective of whether such data is stored locally or on cloud-based solutions, taking into account the different levels of risk. Using biometrics to authenticate is one of the identifications methods providing a high level of confidence, in particular when used in combination with other elements of authentication. Since biometrics represents a unique characteristic of a person, the use of biometrics requires organisational and security measures, commensurate to the risk that such processing may entail to the rights and freedoms of natural persons and in accordance with Regulation 2016/679. | (11) European Digital Identity Wallets should ensure the highest level of security for the personal data used for authentication irrespective of whether such data is stored locally, on cloud-based solutions or on a combination of both, taking into account the different levels of risk. Using biometrics to authenticate should not be a precondition for using the European Digital Identity Wallet, notwithstanding the requirement for strong user authentication. Since biometrics represents a unique characteristic of a person, the use of biometric data is limited to specific scenarios pursuant to Regulation (EU) 2016/679, and requires technical and organisational security measures, commensurate to the risk that such processing may entail to the rights and freedoms of natural persons and in accordance with that Regulation. The ability to store information from the European Digital Identity Wallet in the cloud should only be active after the user has given explicit consent. Member States should allow the European Digital Identity Wallet to store cryptographic material and handle transactions on the user device without requiring cloud services, unless the user explicitly consents to such storage. Where the European Digital Identity Wallet is provided on the device of the user, its cryptographic material should be stored in the secure elements of the device. |
Amendment 8
Proposal for a regulation
Recital 12
| Text proposed by the Commission | Amendment |
| (12) To ensure that the European Digital Identity framework is open to innovation, technological development and future-proof, Member States should be encouraged to set-up jointly sandboxes to test innovative solutions in a controlled and secure environment in particular to improve the functionality, protection of personal data, security and interoperability of the solutions and to inform future updates of technical references and legal requirements. This environment should foster the inclusion of European Small and Medium Enterprises, start-ups and individual innovators and researchers. | (12) To ensure that the European Digital Identity framework is open to innovation, technological development and future-proof, Member States should be encouraged to set-up jointly sandboxes to test innovative solutions in a controlled and secure environment in particular to improve the functionality, protection of personal data, security and interoperability of the solutions and to inform future updates of technical references and legal requirements. This environment should foster the inclusion of European Small and Medium Enterprises, start-ups and individual innovators and researchers, while improving compliance and preventing the placing on the market of solutions which infringe Union law on data protection and IT security. |
Amendment 9
Proposal for a regulation
Recital 17
| Text proposed by the Commission | Amendment |
| (17) Service providers use the identity data provided by the set of person identification data available from electronic identification schemes pursuant to Regulation (EU) No 910/2014 in order to match users from another Member State with the legal identity of that user. However, despite the use of the eIDAS data set, in many cases ensuring an accurate match requires additional information about the user and specific unique identification procedures at national level. To further support the usability of electronic identification means, this Regulation should require Member States to take specific measures to ensure a correct identity match in the process of electronic identification. For the same purpose, this Regulation should also extend the mandatory minimum data set and require the use of a unique and persistent electronic identifier in conformity with Union law in those cases where it is necessary to legally identify the user upon his/her request in a unique and persistent way. | (17) Service providers use the identity data provided by the set of person identification data available from electronic identification schemes pursuant to Regulation (EU) No 910/2014 in order to match users from another Member State with the legal identity of that user. However, despite the use of the eIDAS data set, in many cases ensuring an accurate match requires additional information about the user and specific unique identification procedures at national level. To further support the usability of electronic identification means, this Regulation should require Member States to take specific measures to ensure a correct identity match in the process of electronic identification. The use of person identification data or a combination of person identification data, including the use of unique and persistent identifiers issued by Member States or generated by the European Digital Identity Wallet is essential to ensuring that the identity of the user, in particular in the public sector and, where required by Union or national law, can be verified. Member State law should be able to require the use of sector- or relying party specific unique and persistent identifiers. The European Digital Identity Wallet should be capable of storing those identifiers and disclosing them where requested by the user. |
Amendment 10
Proposal for a regulation
Recital 25
| Text proposed by the Commission | Amendment |
| (25) In most cases, citizens and other residents cannot digitally exchange, across borders, information related to their identity, such as addresses, age and professional qualifications, driving licenses and other permits and payment data, securely and with a high level of data protection. | (25) In the internal market, citizens need to have the opportunity to exchange information about their identity across borders. However, in most cases, citizens and other residents cannot digitally exchange, across borders, officially certified information related to their identity, such as addresses, age and professional qualifications, driving licenses and other permits and payment data, securely and with a high level of data protection. This could result in the transfer of that data in a less secure and less organised manner. |
Amendment 11
Proposal for a regulation
Recital 29
| Text proposed by the Commission | Amendment |
| (29) The European Digital Identity Wallet should technically enable the selective disclosure of attributes to relying parties. This feature should become a basic design feature thereby reinforcing convenience and personal data protection including minimisation of processing of personal data. | (29) The European Digital Identity Wallet should technically enable the selective disclosure of attributes to relying parties in a secure and user-friendly manner as one of its key features and advantages. It should also ensure that no attributes are disclosed to parties that are not registered to receive such attributes. This feature should become a basic design feature thereby reinforcing convenience and personal data protection including minimisation of processing of personal data in particular privacy by design and by default. Mechanisms for the validation of the European Digital Identity Wallet, the selective disclosure and authentication of users to access online services should be privacy-preserving thereby preventing the tracking of the user and respecting the principle of purpose limitation, which implies a right to pseudonymity to ensure the user cannot be linked across several relying parties. The technical architecture and implementation of the European Digital Identity Wallet should be in full compliance with Regulation (EU) 2016/679. In addition, the decentralised nature of the wallet should enable self-signing and revocability of attributes and identifiers. |
Amendment 12
Proposal for a regulation
Recital 29 a (new)
| Text proposed by the Commission | Amendment |
| (29a) Unless specific rules of Union or national law require users to identify themselves, the use of services under a pseudonym should be allowed and should not be restricted by Member States, for example by imposing a general obligation on service providers to limit the pseudonymous use of their services. |
Amendment 13
Proposal for a regulation
Recital 35
| Text proposed by the Commission | Amendment |
| (35) The certification as qualified trust service providers should provide legal certainty for use cases that build on electronic ledgers. This trust service for electronic ledgers and qualified electronic ledgers and the certification as qualified trust service provider for electronic ledgers should be notwithstanding the need for use cases to comply with Union law or national law in compliance with Union law. Use cases that involve the processing of personal data must comply with Regulation (EU) 2016/679. Use cases that involve crypto assets should be compatible with all applicable financial rules for example with the Markets in Financial Instruments Directive23 , the Payment Services Directive24 and the future Markets in Crypto Assets Regulation25 . | (35) The certification as qualified trust service providers should provide legal certainty for use cases that build on electronic ledgers. This trust service for electronic ledgers and qualified electronic ledgers and the certification as qualified trust service provider for electronic ledgers should be notwithstanding the need for use cases to comply with Union law or national law in compliance with Union law. Use cases that involve the processing of personal data must comply with Regulation (EU) 2016/679. Use cases that involve crypto assets should be compatible with all applicable financial rules for example with the Markets in Financial Instruments Directive23, the Payment Services Directive24 the future Markets in Crypto Assets Regulation25, Funds Transfer Regulation25a. |
| _________________ | _________________ |
| 23 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU Text with EEA relevance, OJ L 173, 12.6.2014, p. 349–496. | 23 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU Text with EEA relevance, OJ L 173, 12.6.2014, p. 349–496. |
| 24 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC, OJ L 337, 23.12.2015, p. 35–127. | 24 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC, OJ L 337, 23.12.2015, p. 35–127. |
| 25 Proposal for a Regulation of the European Parliament and of the Council on Markets in Crypto-assets, and amending Directive (EU) 2019/1937, COM/2020/593 final. | 25 Proposal for a Regulation of the European Parliament and of the Council on Markets in Crypto-assets, and amending Directive (EU) 2019/1937, COM/2020/593 final. |
| 25a Proposal for a Regulation of the European Parliament and of the Council on information accompanying transfers of funds and certain crypto-assets (recast), 2021/0241(COD). |
Amendment 14
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point i
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 42
| Text proposed by the Commission | Amendment |
| (42) ‘European Digital Identity Wallet’ is a product and service that allows the user to store identity data, credentials and attributes linked to her/his identity, to provide them to relying parties on request and to use them for authentication, online and offline, for a service in accordance with Article 6a; and to create qualified electronic signatures and seals; | (42) ‘European Digital Identity Wallet’ is an electronic identification means that allows the user, on a device under the user’s control to store and manage identity data, explicit confirmations of consent to share personal data, credentials and attributes linked to the user’s identity, to provide them selectively to duly registered relying parties on request and to use them for authentication, online and offline, for a service in accordance with Article 6a; and to create qualified electronic signatures and seals; |
Amendment 15
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point i
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 43
| Text proposed by the Commission | Amendment |
| (43) ‘attribute’ is a feature, characteristic or quality of a natural or legal person or of an entity, in electronic form; | (43) ‘attribute’ means an electronic representation of a feature, characteristic or quality of a natural or legal person or of an entity; |
Amendment 16
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point i
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 55
| Text proposed by the Commission | Amendment |
| (55) ‘unique identification’ means a process where person identification data or person identification means are matched with or linked to an existing account belonging to the same person.’; | (55) ‘identity matching’ means a process where person identification data or person identification means are matched with or linked to an existing account belonging to the same person.’ |
Amendment 17
Proposal for a regulation
Article 1 – paragraph 1 – point 4
Regulation (EU) No 910/2014
Article 5 – title
| Text proposed by the Commission | Amendment |
| Pseudonyms in electronic transaction | Protection of personal data, and pseudonyms in electronic transactions. |
Amendment 18
Proposal for a regulation
Article 1 – paragraph 1 – point 4
Regulations (EU) No 910/2014
Article 5 – paragraph 1
| Text proposed by the Commission | Amendment |
| Without prejudice to the legal effect given to pseudonyms under national law, the use of pseudonyms in electronic transactions shall not be prohibited.; | 1. Processing of personal data shall be carried out in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and, where relevant, Directive 2002/58/EC, by implementing the principles of data minimisation, purpose limitation, and data protection by design and by default, in particular with respect to the technical measures for the implementation of this Regulation and the interoperability framework in accordance with Article 12 thereof. |
| 2. Without prejudice to the legal effect given to pseudonyms under national law, the use of pseudonyms in electronic transactions shall be permitted. The use of pseudonyms freely chosen by the user shall always be an option to substitute a unique identifier where identification of the user is not required by Union or national law. | |
| 3. Relying parties shall make reasonable efforts to enable the use of their services without electronic identification or authentication. |
Amendment 19
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 3 – point b a (new)
| Text proposed by the Commission | Amendment |
| (ba) make an informed decision about the sharing of personal information with relying parties. This includes identification of the relying party, the possibility for complete or partial refusal of information requests from relying parties, a full transaction history. |
Amendment 20
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 2
| Text proposed by the Commission | Amendment |
| (2) for relying parties to request and validate person identification data and electronic attestations of attributes; | (2) for relying parties to request and validate person identification data and electronic attestations of attributes in accordance with Regulation (EU) 2016/679; |
Amendment 21
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 2 a (new)
| Text proposed by the Commission | Amendment |
| (2a) for relying parties to be duly registered on a publicly available list and for their information requests to be visible on that publicly available list; |
Amendment 22
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 3
| Text proposed by the Commission | Amendment |
| (3) for the presentation to relying parties of person identification data, electronic attestation of attributes or other data such as credentials, in local mode not requiring internet access for the wallet; | (3) for the presentation in accordance with Regulation (EU) 2016/679 to relying parties of person identification data such as credentials, electronic attestation of attributes or other data, in local mode not requiring internet access for the wallet and for the user to make an informed decision about the sharing of personal information with relying parties, while ensuring that selective disclosure is possible, such presentation including complete or partial refusal of information requests from relying parties, a full transaction history, the possibility to withdraw previously given consent to information requests and information about the exercise of rights as data subject; |
Amendment 23
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulations (EU) No 910/2014
Article 6a – paragraph 4 – point b
| Text proposed by the Commission | Amendment |
| (b) ensure that trust service providers of qualified attestations of attributes cannot receive any information about the use of these attributes; | (b) ensure that providers of qualified and non-qualified electronic attestations of attributes are technologically prevented from receiving any information about the use of these attributes; |
Amendment 24
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulations (EU) No 910/2014
Article 6a – paragraph 4 – point e
| Text proposed by the Commission | Amendment |
| (e) ensure that the person identification data referred to in Articles 12(4), point (d) uniquely and persistently represent the natural or legal person is associated with it. | (e) ensure that the person identification data referred to in Articles 12(4), point (d) uniquely represents the natural or legal person and that the reference to that data is different for the different relying parties, if legally required; |
Amendment 25
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point e a (new)
| Text proposed by the Commission | Amendment |
| (ea) enable the user to access, in a readable format, a list of actions, transactions or uses of electronic attestations of attributes or person identification data, that have been authorised by the user; |
Amendment 26
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point e b (new)
| Text proposed by the Commission | Amendment |
| (eb) enable the user to transfer the European Digital Identity Wallet's data, and to block the access to it in case of a security breach, allowing for the data suspension, revocation or withdrawal. |
Amendment 27
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4a (new)
| Text proposed by the Commission | Amendment |
| 4a. Where there is a chain of relying parties, intermediaries shall not obtain knowledge about the contents of the transaction. |
Amendment 28
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulations (EU) No 910/2014
Article 6a – paragraph 7
| Text proposed by the Commission | Amendment |
| 7. The user shall be in full control of the European Digital Identity Wallet. The issuer of the European Digital Identity Wallet shall not collect information about the use of the wallet which are not necessary for the provision of the wallet services, nor shall it combine person identification data and any other personal data stored or relating to the use of the European Digital Identity Wallet with personal data from any other services offered by this issuer or from third-party services which are not necessary for the provision of the wallet services, unless the user has expressly requested it. Personal data relating to the provision of European Digital Identity Wallets shall be kept physically and logically separate from any other data held. If the European Digital Identity Wallet is provided by private parties in accordance to paragraph 1 (b) and (c), the provisions of article 45f paragraph 4 shall apply mutatis mutandis. | 7. The technical framework for the European Digital Identity Wallet shall be subject to the following principles: |
| (a) The user shall be in full control of the European Digital Identity Wallet and the user’s data, including self-certification. | |
| (b) The European Digital Identity Wallet shall use decentralised elements for the identity architecture. | |
| (c) The set of electronic identification means, attributes and certificates contained in a European Digital Identity Wallet shall be stored securely and exclusively on devices controlled by the user, unless the user freely consents to storage on third-party devices or to a cloud based option. | |
| (d) The European Digital Identity Wallet shall provide cryptographically verifiable credentials. | |
| (e) The European Digital Identity Wallet shall allow secure connections between the user and the relying parties. | |
| (f) The technical architecture of the European Digital Identity Wallet shall prevent the issuer of the European Digital Identity Wallet, Member State or any other parties from collecting or obtaining electronic identification means, attributes, electronic documents contained in a European Digital Identity Wallet and information about the use of the wallet by the user, except where requested by the user using devices in the user’s control. The exchange of information via the European Digital Identity Wallet shall not allow providers of electronic attestations of attributes to track, link, correlate or otherwise obtain knowledge of transactions or user behaviour. | |
| (g) Unique and persistent identifiers shall not be accessible to relying parties in cases other than when identification of the user is required by Union or national law. | |
| (h) Member States shall ensure that relevant information on the European Digital Identity Wallet is publicly available. | |
| (i) Personal data relating to the provision of European Digital Identity Wallets shall be kept physically and logically separate from any other data held. | |
| (j) If the European Digital Identity Wallet is provided by private parties in accordance to paragraph 1 (b) and (c), the provisions of Article 45f (4) shall apply mutatis mutandis. | |
| (k) Where attestation of attributes does not require the identification of the user, zero knowledge attestation shall be performed. | |
| (l) The issuer of the European Digital Identity Wallet shall be the controller for the purposes of Regulation (EU) 2016/679 regarding the processing of personal data in the European Digital Identity Wallet. | |
| (m) The European Digital Identity Wallet shall provide a complaint mechanism to enable users to inform the supervisory body under this Regulation and the supervisory authorities established under Regulation (EU) 2016/679 directly where a relying party requests a disproportionate amount of data which is not in line with the registered intended use of that data. |
Amendment 29
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 7 a (new)
| Text proposed by the Commission | Amendment |
| 7a. Access to public and private services, to online platforms within the meaning of Regulation (EU) XXX/XXX [Digital Services Act] or to the labour market by natural persons shall not be made conditional on the use of the European Digital Identity Wallet. | |
| The use of the European Digital Identity Wallets shall be optional, provided free of charge and in no circumstance create grounds for any type of discrimination. | |
| Natural persons shall not suffer disadvantages for not using the European Digital Identity Wallet. |
Amendment 30
Proposal for a regulation
Article 1 – paragraph 1 – point 12
Regulations (EU) No 910/2014
Article 11a – title
| Text proposed by the Commission | Amendment |
| Unique Identification | Identity matching |
Amendment 31
Proposal for a regulation
Article 1 – paragraph 1 – point 12
Regulation (EU) No 910/2014
Article 11a – paragraph 1
| Text proposed by the Commission | Amendment |
| 1. When notified electronic identification means and the European Digital Identity Wallets are used for authentication, Member States shall ensure unique identification. | 1. When notified electronic identification means and the European Digital Identity Wallets are used for electronic identification, Member States shall ensure identity matching. |
Amendment 32
Proposal for a regulation
Article 1 – paragraph 1 – point 12
Regulation (EU) No 910/2014
Article 11a – paragraph 2
| Text proposed by the Commission | Amendment |
| 2. Member States shall, for the purposes of this Regulation, include in the minimum set of person identification data referred to in Article 12.4.(d), a unique and persistent identifier in conformity with Union law, to identify the user upon their request in those cases where identification of the user is required by law. | 2. In order to identify the user upon their request in those cases where identification of the user is required by law, unique and persistent identifiers issued by Member States or generated by the European Digital Identity Wallets shall be provided together with the minimum set of person identification data referred to in Article 12(4), point (d). Member States may require unique and persistent identifiers to be sector or relying party specific as long as they uniquely identify the user across the Union. |
Amendment 33
Proposal for a regulation
Article 1 – paragraph 1 – point 13 – point b
Regulation (EU) No 910/2014
Article 12 – paragraph 4 – point d
| Text proposed by the Commission | Amendment |
| (d) a reference to a minimum set of person identification data necessary to uniquely and persistently represent a natural or legal person;; | (d) a reference to a set of person identification data necessary to uniquely represent a natural or legal person, which is available from electronic identification schemes; |
Amendment 34
Proposal for a regulation
Article 1 – paragraph 1 – point 20 – point a – point 2
Regulations (EU) No 910/2014
Article 17 – paragraph 4 – point f
| Text proposed by the Commission | Amendment |
| (f) to cooperate with supervisory authorities established under Regulation (EU) 2016/679, in particular, by informing them without undue delay, about the results of audits of qualified trust service providers, where personal data protection rules have been breached and about security breaches which constitute personal data breaches;; | (f) to cooperate with supervisory authorities established under Regulation (EU) 2016/679, in particular, by informing them without undue delay, about the results of audits of qualified trust service providers, where there is evidence that personal data protection rules have been breached and about security breaches which are likely to constitute personal data breaches, or about suspicions of such breaches that it has become aware of in the performance of its tasks, without prejudice to Regulation (EU) 2016/679. |
Amendment 35
Proposal for a regulation
Article 1 – paragraph 1 – point 22 – point b
Regulation (EU) No 910/2014
Article 20 – paragraph 2
| Text proposed by the Commission | Amendment |
| Where personal data protection rules appear to have been breached, the supervisory body shall inform the supervisory authorities under Regulation (EU) 2016/679 of the results of its audits.; | Without prejudice to any further obligations on data controllers or processors arising from Regulation (EU) 2016/679, where there is any reason to believe that data protection rules could have been breached, the supervisory body shall inform the supervisory authorities under Regulation (EU) 2016/679, the issuer and the controller of the European Digital Identity Wallet without undue delay and shall provide the results of its audits as soon as they are available; |
ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT
The following list is drawn up on a purely voluntary basis under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the opinion, until the adoption thereof in committee:
| Entity and/or person |
1. European Commission DG CNECT
2. The European Data Protection Supervisor
3. Brussels Privacy Hub, THE EUROPEAN COMMISSION PROPOSAL AMENDING THE eIDAS REGULATION (EU) No 910/2014: A PERSONAL DATA PROTECTION PERSPECTIVE
4. Professor Ricardo Genghini, Chairman of the European Standardization Committee E-Signature and Infrastructures (ESI) within the European Telecommunications Standards Institute (ETSI) - Notes on the current draft of eIDAS Revision Proposal
5. epicenter.works & European Digital Rights (EDRI)
6. Luukas Ilves, Deputy Secretary General of the Estonian Ministry of Economic Affairs and Communications for Digital Development
7. European Consumer Organisation (BEUC) - Making European Digital Identity as Safe as It Is needed - BEUC Position Paper
8. Jaap-Henk Hoepman, Associate Professor of privacy enhancing protocols and privacy by design in the Digital Security group at the Institute for Computing and Information Sciences of the Radboud University Nijmegen, Civil liberties aspects of the commission proposal to amend the eIDAS regulation
9. Eric Verheul, professor in the Digital Security Group of the Radboud University Nijmegen - Issues and recommendations on the eIDAS wallet as proposed in the eIDAS update
10. Manuel Atug expert in IT Security and engineering Chaos Computer Club & Christian Kahlo eID expert - written input
11. Lukasz Olejnik, PhD, https://lukaszolejnik.com, written contribution
12. Carmela Troncoso - Professor on Security and Privacy at Swiss Federal Institute of Technology Lausanne - written input
13. Dr. F. S. Gürses, Associat Professor at the Faculty of Technology, Policy and Management, TU Delft - written input
14. Eurosmart - The Voice Of The Digital Security Industry - Feedback on the revision of eIDAS
15. Mozzila
16. Google
17. Apple
18. The International Association for Trusted Blockchain Applications (INATBA) - Establishing a Framework for a European Digital Identity (eIDAS) - Policy Position
19. TWG Trusted Information of the EU Observatory for ICT Standardisation - report on “Trust in the European digital space in the age of automated bots and fakes”
20. Rule of Law Defense Coalition, Bucharest Romania
21. American Chamber of Commerce to the European Union, Brussels - written input