Changes from plenary report to adopted text

RemovedDRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

AddedP9_TA(2024)0117

Removedon the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity

AddedEuropean Digital Identity Framework

Removed(COM(2021)0281 – C90200/2021 – 2021/0136(COD))

AddedCommittee on Industry, Research and Energy

AddedPE732.707

AddedEuropean Parliament legislative resolution of 29 February 2024 on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity (COM(2021)0281 – C9-0200/2021 – 2021/0136(COD))

▸7 unchanged paragraphs

(Ordinary legislative procedure: first reading)

The European Parliament,

– having regard to the Commission proposal to Parliament and the Council (COM(2021)0281),

– having regard to Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90200/2021),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to the opinion of the European Economic and Social Committee of 20 October 2021,

– having regard to the opinion of the Committee of the Regions of 13 October 2021,

Added– having regard to the provisional agreement approved by the responsible committee under Rule 74(4) of its Rules of Procedure and the undertaking given by the Council representative by letter of 6 December 2023 to approve Parliament’s position, in accordance with Article 294(4) of the Treaty on the Functioning of the European Union,

▸4 unchanged paragraphs

– having regard to Rule 59 of its Rules of Procedure,

– having regard to the opinions of the Committee on the Internal Market and Consumer Protection, the Committee on Legal Affairs and the Committee on Civil Liberties, Justice and Home Affairs,

– having regard to the report of the Committee on Industry, Research and Energy (A9-0038/2023),

1. Adopts its position at first reading hereinafter set out;

Change 1

Added2. Takes note of the statements by the Commission annexed to this resolution;

3. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

4. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Change 2

RemovedAMENDMENTS BY THE EUROPEAN PARLIAMENT*

AddedP9_TC1-COD(2021)0136

Removedto the Commission proposal

AddedPosition of the European Parliament adopted at first reading on 29 February 2024 with a view to the adoption of Regulation (EU) 2024/… of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework

Removed---------------------------------------------------------

Added(As an agreement was reached between Parliament and Council, Parliament's position corresponds to the final legislative act, Regulation (EU) 2024/1183.)

Removed2021/0136 (COD)

AddedANNEX TO THE LEGISLATIVE RESOLUTION

RemovedProposal for a

AddedStatement by the Commission on Article 45 on the occasion of the adoption of Regulation (EU) 2024/1183

RemovedREGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

AddedThe Commission welcomes the agreement reached, which, in its view, clarifies that web browsers are required to ensure support and interoperability for the qualified website authentication certificates (QWACs) for the sole purpose of displaying the identity data of the owner of the website in a user-friendly manner. The Commission understands this obligation as not prejudging the methods used to display such identity data.

Removedamending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity

AddedThe Commission welcomes the agreement reached, which, in its view, clarifies that the requirement for the web browsers to recognise QWACs does not restrict browsers own security policies and that Article 45, as proposed, leaves it up to the web browsers to preserve and apply their own procedures and criteria in order to maintain and preserve the privacy of online communications using encryption and other proven methods. The Commission understands draft Article 45 as not imposing obligations or restrictions on how web browsers establish encrypted connections with websites or authenticate the cryptographic keys used when establishing those connections.

RemovedTHE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

AddedThe Commission recalls that, in line with point 28 of the Interinstitutional Agreement between the European Parliament, the Council of the European Union and the European Commission on Better Law-Making of 13 April 2016, the Commission will make use of expert groups, consult targeted stakeholders and carry out public consultations, as appropriate.

RemovedHaving regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

AddedStatement by the Commission on unobservability on the occasion of the adoption of Regulation (EU) 2024/1183

RemovedHaving regard to the proposal from the European Commission,

AddedThe Commission welcomes the agreement reached, which in its view, confirms that this amending Regulation does not allow for the processing of personal data contained in or arising from the use of the European Digital Identity Wallet by the Wallet providers for other purposes than delivering wallet services.

RemovedAfter transmission of the draft legislative act to the national parliaments,

AddedThe Commission also welcomes the inclusion of the concept of unobservability in Recital (11c) of the draft amending Regulation, which should prevent wallet providers from collecting and seeing the details of user’s day-to-day transactions. The Commission is of the view that this concept means that there should not be correlation of data across different services for the purposes of user tracking or tracing or for determining, analysing and predicting personal behaviour, interests or habits.

RemovedHaving regard to the opinion of the European Economic and Social Committee1,

AddedAt the same time, the Commission acknowledges that, in full compliance with Regulation (EU) 2016/679, the providers of European Digital Identity Wallets may access certain categories of personal data with the user’s explicit consent, such as in order to ensure continuity in the provision of wallet services or to protect users from disruptions in their provision. That data should be limited to what is necessary for each specific purpose.

RemovedActing in accordance with the ordinary legislative procedure,

RemovedWhereas:

Removed(1) The Commission Communication of 19 February 2020, entitled “Shaping Europe’s Digital Future”2 announces a revision of Regulation (EU) No 910/2014 of the European Parliament and of the Council with the aim of improving its effectiveness, extend its benefits to the private sector and promote trusted digital identities for all Europeans.

Removed(2) In its conclusions of 1-2 October 20203, the European Council called on the Commission to propose the development of a Union-wide framework for secure public electronic identification, including interoperable digital signatures, to provide people with control over their online identity and data as well as to enable access to public, private and cross-border digital services.

Removed(2a) The Digital Decade Policy Programme 2030 sets the objective and digital target of a Union framework which, by 2030, leads to wide deployment of a trusted, voluntary, user-controlled digital identity, that will be recognised throughout the Union and allow each user to control their data and presence in online interactions.

Removed▌

Removed(3a) The Commission Declaration of 26 January 2022 entitled "European Declaration on Digital Rights and Principles for the Digital Decade" underlines every citizen’s right to access digital technologies, products and services that are safe, secure, and privacy-protective by design. This includes ensuring that all people living in the Union are offered an accessible, secure and trusted digital identity that enables access to a broad range of online and offline services, protected against all cyberthreats, including identity theft or manipulation. The Commission Declaration also states that everyone has the right to the protection of their personal data online. That right encompasses the control on how the data is used and with whom it is shared.

Removed(3b) Union citizens should have the right to a digital identity that is under their sole control and that enables them to exercise their rights as citizens in the digital environment and to participate in the digital economy. A European digital identity should be legally recognised throughout the Union.

Removed(4) A more harmonised approach to digital identification should reduce the risks and costs of the current fragmentation due to the use of divergent national solutions or, in some Member States, the absence of solutions, and will strengthen the Single Market by allowing citizens, other residents as defined by national law and legal entities to identify and authenticate online and offline in a safe, trustworthy, user friendly, convenient, accessible and harmonised way, across the Union. Everyone should be able to securely access public and private services relying on an improved ecosystem for trust services and on verified proofs of identity and electronic attestations of attributes, such as academic qualifications, university degrees or other educational or professional attainments legally recognised and accepted everywhere in the Union, or a license or a mandate to represent a company, while creating a uniform set of rules for providers of electronic attestations that ensures a level playing field. The framework for a European Digital Identity aims to achieve a shift from the reliance on national digital identity solutions only, to the provision of electronic attestations of attributes valid and legally recognised across the Union. Providers of electronic attestations of attributes should benefit from a clear and uniform set of rules and public administrations should be able to rely on electronic documents that are highly secured and accepted across the Union. With regard to electronic identification for public services with very high security identification requirements, it should be possible for Member States to enable notaries and other professionals entrusted with special powers in the public interest to rely on additional remote identity controls, set out in accordance with the principle of proportionality through national legislation.

Removed(5) To support the competitiveness of European businesses, online and offline service providers should be able to rely on digital identity solutions recognised across the Union, irrespective of the Member State in which they have been issued, thus benefiting from a harmonised European approach to trust, security and interoperability. Users and service providers alike should be able to benefit from the same legal value provided to electronic attestations of attributes across the Union. Harmonised digital identity framework has the potential to create economic value by providing easier access to goods and services, by significantly reducing operational costs linked to identification and authentication procedures, for example during the on-boarding of new customers, by reducing damages related to cybercrimes, such as identity theft, data theft and online fraud, and by promoting digital transformation of the Union’s micro, small and medium-sized enterprises (SMEs).

Removed(5a) A fully harmonised digital identity framework would contribute to the creation of a more digitally integrated Union, taking down the digital barriers between Member States and empower the Union citizens and Union residents to enjoy the benefits of digitalisation while increasing transparency and the protection of their rights.

Removed(5b) In order to encourage the digitalisation of the Member States’ public sector services and to ensure wide up-take of the European digital identity framework and the European Digital Identity Wallet (EDIW), this Regulation should support the use of the ‘once only’ principle in order to reduce administrative burden, to support cross-border mobility of citizens and businesses, and to foster development of interoperable e-government services across the Union. The cross-border application of the ‘once only’ principle should result in citizens and businesses not having to supply the same data to public authorities more than once, and that it should also be possible to use those data only at the request of the user for the purposes of completing cross-border online procedures. The implementation of this Regulation and of the ‘once-only’ principle should comply with all applicable data protection rules, including the principle of data minimisation, accuracy, storage limitation, integrity and confidentiality, necessity, proportionality and purpose limitation. The ‘once-only’ principle should be applied with the explicit consent of the user.

Removed(6) Natural and legal persons who own person identification data should be considered to be Digital Identity subjects. Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive 2002/58/EC or the European Parliament and of the Council apply to the processing of personal data in the implementation of this Regulation. Therefore, this Regulation should lay down specific safeguards to prevent providers of electronic identification means and electronic attestation of attributes from combining personal data from other services with the personal data relating to the services falling within the scope of this Regulation. This Regulation further specifies the application of principles of purpose limitation, data minimisation, and data protection by design and by default to specific-use cases, without prejudice to Regulation (EU) 2016/679.