Sittings · Document
On the proposal for a regulation of the European Parliament and of the Council Amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity
Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Cristian Terheş
SHORT JUSTIFICATION
With this draft opinion, several concerns with regard to the Commission proposal are raised, particularly for addressing the data protection and privacy aspects, which fall in the remit of the Committee on Civil Liberties, Justice and Home Affairs (LIBE). Some of these concerns were already shared by the European Data Protection Supervisor, as well as by the stakeholders consulted during the preparation of the draft opinion. The rapporteur for opinion would like to highlight them, based on the written inputs received from different experts in the field.
The current proposal is of very technical nature and it touches upon critical aspects of fundamental rights, such as data protection and privacy. If the Parliament fails to come up with a coherent framework and a technically proof piece of legislation, the citizens will lose any control over their private data, which will become a commodity. Unfortunately, the technical options for the implementation of the proposal are to be adopted by the Commission via subsequent, non-legislative acts. This is a dangerous approach, as one technical option might be more intrusive than another, at the expense of the fundamental rights of the citizens.
More specific concerns could be raised regarding the unclear relation between eIDAS and GDPR; the respect of core data protection elements, such as data minimisation and selective disclosure; privacy by design and the use of unique identifiers; the lack of openness and transparency in developing the eIDAS Wallet security specifications and of the involvement of civil society or academics; dependence on big tech companies; the weakening of browser security.
Through the proposed amendments, the LIBE rapporteur for opinion aims at correcting the issues mentioned above, which fall under the competence of LIBE. To protect the privacy of individuals and not deter the privacy standard for users of the European Digital Identity Wallet, the rapporteur of opinion takes into consideration the fact that the use of pseudonyms has to be an option in all cases where full identification is not legally mandated. Moreover, references to the relationship between eIDAS and the European Data Protection Legislation back to the existing 2014 level of protections are reinserted.
The need for unlinkability and non-traceability has been broadly acknowledged by experts in the field. User transactions reveal large amounts of data, including data of highly personal nature, such as information of the individuals’ economic situation or information about the medical situation, travel history, consumption patterns and social interactions of citizens. Therefore, the architecture that is being considered should protect this data about a wide-range of online and offline user behaviour from centralised surveillance.
Last but not least, a unique, persistent identifier for natural persons would in some Member States be illegal or even unconstitutional (e.g. in Germany, the use of unique persistent identifiers is prohibited under the Census Act Ruling of 1983). The risk of a unique, life-long identifier cannot be deemed the least intrusive method for the purpose of uniquely identifying an individual. Article 11a is also not needed, as the existing interoperability framework of identification schemes according to the original Article 12 (4) (d) already entails a unique representation of an individual for cross-border cases and therefore it was proposed for deletion.
Nevertheless, the proposal has many loopholes outside of LIBE committee remit, which is why, in order to safeguard the Europeans’ fundamental rights, the entire proposal should be sent back to the Commission for a complete redesign. As this proposal is envisioned, it would lead to the Chinafication of Europe, allowing for the creation of a like social-credit system that would determine the mass surveillance and control of all Europeans, which must not be accepted. EU was envisioned as an “area of freedom” and efforts must be continued to keep it as such.
AMENDMENTS
The Committee on Civil Liberties, Justice and Home Affairs calls on the Committee on Industry, Research and Energy, as the committee responsible, to take into account the following amendments:
Amendment 1
Proposal for a regulation
Recital 6
| Text proposed by the Commission | Amendment |
| (6) Regulation (EU) 2016/67919 applies to the processing of personal data in the implementation of this Regulation. Therefore, this Regulation should lay down specific safeguards to prevent providers of electronic identification means and electronic attestation of attributes from combining personal data from other services with the personal data relating to the services falling within the scope of this Regulation. | (6) The Digital Identity subject is the natural or legal person to whom the person identification data belong. Regulation (EU) 2016/67919 applies to the processing of personal data in the implementation of this Regulation. Therefore, this Regulation should lay down specific safeguards to prevent providers of electronic identification means and electronic attestation of attributes from combining personal data from other services with the personal data relating to the services falling within the scope of this Regulation. |
| _________________ | _________________ |
| 19 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1 | 19 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1 |
Or. en
Amendment 2
Proposal for a regulation
Recital 11
| Text proposed by the Commission | Amendment |
| (11) European Digital Identity Wallets should ensure the highest level of security for the personal data used for authentication irrespective of whether such data is stored locally or on cloud-based solutions, taking into account the different levels of risk. Using biometrics to authenticate is one of the identifications methods providing a high level of confidence, in particular when used in combination with other elements of authentication. Since biometrics represents a unique characteristic of a person, the use of biometrics requires organisational and security measures, commensurate to the risk that such processing may entail to the rights and freedoms of natural persons and in accordance with Regulation 2016/679. | (11) European Digital Identity Wallets should ensure the highest level of security for the personal data used for authentication irrespective of whether such data is stored locally or on cloud-based solutions, taking into account the different levels of risk. Using biometrics to authenticate should not be a precondition for using the European Digital Identity Wallet, notwithstanding the requirement for strong user authentication. Biometric data for the purpose of uniquely identifying a natural person in the context of this Regulation should not be stored in the cloud. Since biometrics represents a unique characteristic of a person, the use of biometrics requires organisational and security measures, commensurate to the risk that such processing may entail to the rights and freedoms of natural persons and in accordance with Regulation (EU) 2016/679. |
Or. en
Justification
In order to ensure that users are in control of their data in the European Digital Identity Wallets, the envisaged system should not depend on a cloud-based infrastructure.
Amendment 3
Proposal for a regulation
Recital 29
| Text proposed by the Commission | Amendment |
| (29) The European Digital Identity Wallet should technically enable the selective disclosure of attributes to relying parties. This feature should become a basic design feature thereby reinforcing convenience and personal data protection including minimisation of processing of personal data. | (29) The European Digital Identity Wallet should technically enable the selective disclosure of attributes to relying parties. This feature should become a basic design feature thereby reinforcing convenience and personal data protection including minimisation of processing of personal data. Mechanisms for the validation of the European Digital Identity Wallet, selective disclosures and authentication of users to access online services should be privacy-preserving, thereby preventing the tracking of the user and respecting the right to anonymity and pseudonymity. |
Or. en
Justification
Essential functions of the Wallet have to be implemented in a privacy-preserving manner as to limit the potential for automated tracking of the user in cases where they are choosing to cancel an already initiated information sharing request from a relying party, only choosing to selectively disclose individual attributes about them (e.g. age verification in a liquor store) or using the Wallet to log into a service without being subsequently tracked by them. The last feature is offered by Apple’s “Sign in with Apple” functionality, which the wallet seeks to replace.
Amendment 4
Proposal for a regulation
Article 1 – paragraph 1 – point 3 – point i
Regulation (EU) No 910/2014
Article 3 – paragraph 1 – point 47
| Text proposed by the Commission | Amendment |
| (47) ‘electronic archiving’ means a service ensuring the receipt, storage, deletion and transmission of electronic data or documents in order to guarantee their integrity, the accuracy of their origin and legal features throughout the conservation period; | (47) ‘electronic archiving’ means a service ensuring the reception, storage, deletion and transmission of electronic data or documents in order to provide proof of authenticity and integrity, throughout the storage period; |
Or. en
Amendment 5
Proposal for a regulation
Article 1 – paragraph 1 – point 4
Regulation (EU) No 910/2014
Article 5 – paragraph 1
| Text proposed by the Commission | Amendment |
| Without prejudice to the legal effect given to pseudonyms under national law, the use of pseudonyms in electronic transactions shall not be prohibited.; | Without prejudice to the legal effect given to pseudonyms under national law, the use of pseudonyms and Self Sovereign Identities in electronic transactions shall not be prohibited; the use of pseudonyms shall always be an option to substitute a unique identifier or when authenticating with private relying parties; |
| The processing of personal data shall be carried out in accordance with Regulation (EU) 2016/679, in particular by implementing the principle of data protection by design and by default; |
Or. en
Justification
To protect the privacy of individuals and not deter the privacy standard for users of the European Digital Identity Wallet, the use of pseudonyms has to be an option in all cases where full identification is not legally mandated. Restore references to the relationship between eIDAS and the European Data Protection Legislation back to the existing 2014 level of protections. The original eIDAS Regulation offered a higher standard of data protection than afforded by Directive 95/46/EC by mandating the facilitation of privacy by design in Article 12(3)(c).
Amendment 6
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 2 a (new)
| Text proposed by the Commission | Amendment |
| (2a) for relying parties to be uniquely identified and for their information requests to be limited on the basis of a Member State’s approval in accordance with Article 6b(1); |
Or. en
Justification
The Common Interface should include this safeguard to prevent unapproved or unidentified relying parties to request information exceeding their use case. The eIDAS expert group organised by the European Commission acknowledged the need of “sharing policies” that restrict what information a relying party can ask from the user and prevent excessive information requests (See chapter 4.6.1 and footnote 22 of the final Outline from February 17th 2022).
Amendment 7
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 2 b (new)
| Text proposed by the Commission | Amendment |
| (2b) to ensure that proxies that act as intermediaries between relying parties and European Digital Identity Wallets do not obtain knowledge about the contents of the transaction; |
Or. en
Justification
The Common Interface should ensure that proxies acting as intermediaries between relying parties and users of the European Digital Identity Wallet cannot have access to the content of the transaction they convey. Such technical protections are commonplace and don’t limit the functioning of the system. The existence of such proxies has been acknowledged in the eIDAS Expert Group (See chapter 4.8.3 of the final Outline from February 17th 2022).
Amendment 8
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point a – point 3
| Text proposed by the Commission | Amendment |
| (3) for the presentation to relying parties of person identification data, electronic attestation of attributes or other data such as credentials, in local mode not requiring internet access for the wallet; | (3) for the presentation to relying parties of person identification data such as credentials, electronic attestation of attributes or other data, in local mode not requiring internet access for the wallet and for the user to make an informed decision about the sharing of personal information with relying parties. This includes identification of the relying party, complete or partial refusal of information requests from relying parties, a full transaction history and information about the exercise of rights as data subject. |
Or. en
Justification
The success of the European Digital Identity Wallet depends on citizens making informed decisions on the information they share with relying parties. Similar guidance about mandatory information on the purpose of the processing by the relying party, as well as the possibility of the use to refuse information requests has been given by the eIDAS Expert Group that is currently developing the Toolbox. (see chapter 4.6.1 of the final Outline from February 17th 2022).
Amendment 9
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point b
| Text proposed by the Commission | Amendment |
| (b) ensure that trust service providers of qualified attestations of attributes cannot receive any information about the use of these attributes; | (b) ensure that trust service providers of qualified and non-qualified attestations of attributes cannot receive any information about the use of these attributes; |
Or. en
Justification
This amendment extends the safeguards to protect user behaviour from being tacked. Examples of providers of non-qualified attribute attestation are private companies, membership clubs or universities. With this change in the text an existing technical safeguard of the European Digital Identity Wallet is simply extended to more stakeholders.
Amendment 10
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 4 – point e
| Text proposed by the Commission | Amendment |
| (e) ensure that the person identification data referred to in Articles 12(4), point (d) uniquely and persistently represent the natural or legal person is associated with it. | (e) ensure that the person identification data referred to in Articles 12(4), point (d) uniquely and persistently representing the natural or legal person is only shared pseudonymously so that it is different for the different relying parties in order to prevent the association or tracking of the user across relying parties and to make it impossible for the issuer of the European Digital Identity Wallet, third-party services connected to them or the Member State to receive any information about the use of the European Digital Identity Wallet; |
Or. en
Justification
The need for unlinkability and non-traceability was acknowledged by the eIDAS Expert Group (see page 26 in chapter 5 of the final Outline from February 17th 2022. User transactions will reveal large amounts of data, including data of highly personal nature, such as information of the individuals' economic situation or information about the medical situation, travel history, consumption patterns and social interactions of citizens.
Amendment 11
Proposal for a regulation
Article 1 – paragraph 1 – point 7
Regulation (EU) No 910/2014
Article 6a – paragraph 7
| Text proposed by the Commission | Amendment |
| 7. The user shall be in full control of the European Digital Identity Wallet. The issuer of the European Digital Identity Wallet shall not collect information about the use of the wallet which are not necessary for the provision of the wallet services, nor shall it combine person identification data and any other personal data stored or relating to the use of the European Digital Identity Wallet with personal data from any other services offered by this issuer or from third-party services which are not necessary for the provision of the wallet services, unless the user has expressly requested it. Personal data relating to the provision of European Digital Identity Wallets shall be kept physically and logically separate from any other data held. If the European Digital Identity Wallet is provided by private parties in accordance to paragraph 1 (b) and (c), the provisions of article 45f paragraph 4 shall apply mutatis mutandis. | 7. The user shall be in full control of the European Digital Identity Wallet and their data. The technical architecture shall make it impossible for the issuer of the European Digital Identity Wallet or third-party services connected to them or the Member State to collect or obtain information about the use of the wallet by the user. The exchange of information via the European Digital Identity Wallet shall not lead to other relying parties or providers of electronic attestation of attributes being able to track, link, correlate or otherwise obtain knowledge of transactions or user behaviour. Personal data relating to the provision of European Digital Identity Wallets shall be kept physically and logically separate from any other data held. If the European Digital Identity Wallet is provided by private parties in accordance to paragraph 1 (b) and (c), the provisions of article 45f paragraph 4 shall apply mutatis mutandis. The issuer of the European Digital Identity Wallet is the controller according to Regulation (EU) 2016/679 regarding the processing of personal data in the European Digital Identity Wallet. |
Or. en
Justification
Only an architecture that protects data like the medical situation, travel history, consumption patterns and social interactions of citizens which goes about a wide-range of online and offline user behaviour from centralised surveillance is an electronic identity system deserving citizens' trust. The issuer is the controller as it determines the means of processing of personal data by determining the concrete system, i.e. the means of processing, irrespective whether that system is executed or not on a device under their control (see C-40/17 and C-25/17).
Amendment 12
Proposal for a regulation
Article 1 – paragraph 1 – point 12
Regulation (EU) No 910/2014
Article 11a
| Text proposed by the Commission | Amendment |
| (12) the following Article 11a is inserted: | deleted |
| ‘Article 11a | |
| Unique Identification | |
| 1. When notified electronic identification means and the European Digital Identity Wallets are used for authentication, Member States shall ensure unique identification. | |
| 2. Member States shall, for the purposes of this Regulation, include in the minimum set of person identification data referred to in Article 12.4.(d), a unique and persistent identifier in conformity with Union law, to identify the user upon their request in those cases where identification of the user is required by law. | |
| 3. Within 6 months of the entering into force of this Regulation, the Commission shall further specify the measures referred to in paragraph 1 and 2 by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(10).’ |
Or. en
Justification
A unique, persistent identifier for natural persons would in some Member States be illegal or even unconstitutional (In Germany, the use of unique persistent identifiers is prohibited under the Census Act Ruling of 1983. The risk of a unique, life-long identifier cannot be deemed the least intrusive method for the purpose of uniquely identifying an individual. Article 11a is also not needed as the existing interoperability framework of identification schemes according to the original Article 12 (4) (d) already entails a unique representation of an individual for cross-border cases.
Amendment 13
Proposal for a regulation
Article 1 – paragraph 1 – point 13 – point b
Regulation (EU) No 910/2014
Article 12 – paragraph 4 – point d
| Text proposed by the Commission | Amendment |
| (d) a reference to a minimum set of person identification data necessary to uniquely and persistently represent a natural or legal person;; | (d) a reference to a minimum set of person identification data uniquely representing a natural or legal person, which is available from electronic identification schemes; |
Or. en
Justification
The Commission proposal would require a unique and persistent identification independent from a particular electronic identification scheme. In effect, this seemingly technical change of the interoperability framework would have the same effect as Article 11a.
Amendment 14
Proposal for a regulation
Article 1 – paragraph 1 – point 22 – point b
Regulation (EU) No 910/2014
Article 20 – paragraph 2
| Text proposed by the Commission | Amendment |
| Where personal data protection rules appear to have been breached, the supervisory body shall inform the supervisory authorities under Regulation (EU) 2016/679 of the results of its audits.; | Where personal data protection rules appear to have been breached, the supervisory body shall inform the supervisory authorities under Regulation (EU) 2016/679 and the Controller of the European Digital Identity Wallet of the results of its audits.; |
Or. en
Justification
According to Article 33 and 34 of the GDPR the controller has certain duties in case of a data breach. To fulfill these duties, they should be informed about a potential data breach in their system.
Amendment 15
Proposal for a regulation
Article 1 – paragraph 1 – point 22 – point b
Regulation (EU) No 910/2014
Article 20 – paragraph 2 – subparagraph 1 a (new)
| Text proposed by the Commission | Amendment |
| A stakeholder usingqualified trust services, such as qualified certificates or qualified electronic attestation of attributes, in an undertaking, may submit to the supervisory authority a complaint about the security or reliability of the qualified trust service. |
Or. en
Amendment 16
Proposal for a regulation
Article 1 – paragraph 1 – point 25 – point c – point 2
Regulation (EU) No 910/2014
Article 24 – paragraph 2 – point fb a (new)
| Text proposed by the Commission | Amendment |
| (fba) ensure the lawful processing of personal data in accordance with Regulation (EU) 2016/679; |
Or. en
ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT
The following list is drawn up on a purely voluntary basis under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the draft opinion:
| Entity and/or person |
1. European Commission DG CNECT
2. The European Data Protection Supervisor
3. Brussels Privacy Hub, THE EUROPEAN COMMISSION PROPOSAL AMENDING THE eIDAS REGULATION (EU) No 910/2014: A PERSONAL DATA PROTECTION PERSPECTIVE
4. Professor Ricardo Genghini, Chairman of the European Standardization Committee E-Signature and Infrastructures (ESI) within the European Telecommunications Standards Institute (ETSI) - Notes on the current draft of eIDAS Revision Proposal
5. epicenter.works & European Digital Rights (EDRI)
6. Luukas Ilves, Deputy Secretary General of the Estonian Ministry of Economic Affairs and Communications for Digital Development
7. European Consumer Organisation (BEUC) - Making European Digital Identity as Safe as It Is needed - BEUC Position Paper
8. Jaap-Henk Hoepman, Associate Professor of privacy enhancing protocols and privacy by design in the Digital Security group at the Institute for Computing and Information Sciences of the Radboud University Nijmegen, Civil liberties aspects of the commission proposal to amend the eIDAS regulation
9. Eric Verheul, professor in the Digital Security Group of the Radboud University Nijmegen - Issues and recommendations on the eIDAS wallet as proposed in the eIDAS update
10. Manuel Atug expert in IT Security and engineering Chaos Computer Club & Christian Kahlo eID expert - written input
11. Lukasz Olejnik, PhD, https://lukaszolejnik.com, written contribution
12. Carmela Troncoso - Professor on Security and Privacy at Swiss Federal Institute of Technology Lausanne - written input
13. Dr. F. S. Gürses, Associat Professor at the Faculty of Technology, Policy and Management, TU Delft - written input
14. Eurosmart - The Voice Of The Digital Security Industry - Feedback on the revision of eIDAS
15. Mozzila
16. Google
17. Apple
18. The International Association for Trusted Blockchain Applications (INATBA) - Establishing a Framework for a European Digital Identity (eIDAS) - Policy Position
19. TWG Trusted Information of the EU Observatory for ICT Standardisation - report on “Trust in the European digital space in the age of automated bots and fakes”
20. Rule of Law Defense Coalition, Bucharest Romania
21. American Chamber of Commerce to the European Union, Brussels - written input