Changes from plenary report to adopted text

Removed(6a) EDIWs should have the function of a privacy management dashboard embedded into the design, in order to ensure a higher degree of transparency and control of the users over their data. This function should provide an easy, user-friendly interface with an overview of all relying parties with whom the user has shared data, including attributes, and the type of data shared with each relying party. It should allow the user to track all transactions executed through EDIWs, with at least the following data: the time and date of the transaction, the counterpart identification, the data requested and the data shared. That information should be stored even if the transaction was not concluded. It should not be possible to repudiate the authenticity of the information contained in the transaction history . Such a function should be active by default. It should allow users to easily request to a relying party the immediate deletion of personal data pursuant Article 17 of Regulation (EU) 2016/679 and to easily report to the competent national authority where a relying party is established if an unlawful or inappropriate request of data is received without leaving the EDIW.

Removed(6b) Zero knowledge proof allows verification of a claim without revealing the data that proves it, based on cryptographic algorithms. The EDIW should allow for verification of claims inferred from personal data identification or attestation of attributes without having to provide the source data, to preserve the privacy of the user of the EDIW.

Removed(7) It is necessary to set out the harmonised conditions for the establishment of a framework for EDIWs to be issued directly by a Member State, under a mandate from a Member State or recognised by a Member State, which should empower all Union citizens and Union residents as defined by national law to securely request, receive, store, combine and selectively share data related to their identity and request deletion of their personal data in a user-friendly way and under the sole control of the user. All data should be stored by default on the user’s device unless the user explicitly choses otherwise. This Regulation should reflect shared values and uphold fundamental rights, strong ethical aspects, legal safeguards and liability, thus protecting democratic societies and citizens. Technologies used to achieve those objectives should be developed aiming towards the highest level of privacy and security, user convenience, accessibility, and wide usability and seamless interoperability. Member States should ensure equal access to and voluntary use of digital identification to all their nationals and residents. Member States should not, directly or indirectly, limit access to public services or public-funded services to natural or legal persons who decide not to use a EDIW and should develop and ensure free availability of alternative solutions for such individuals. Private relying parties using EDIWs to provide services should not deny those services or create disadvantageous conditions to consumers not using EDIWs to access their services.

Removed(7a) Where an EDIW is issued directly by a Member State, the competent authority concerned is directly responsible for the issuance and management of the EDIW, using its own resources. Where an EDIW is issued under a mandate from a Member State, the competent authority concerned has authorised a specific organisation to issue and manage the EDIW on its behalf on the basis of a public procurement procedure based on transparent, open and fair competition process in which all interested parties have the opportunity to participate and the best candidate is selected based on specific objective criteria and evaluation process. Where an EDIW is issued and managed independently but recognised by a Member State, the competent authority concerned has selected a specific organisation that has already developed an EDIW that complies with this Regulation. It is not necessary for the issuer and the manager of an EDIW to be the same entity.

Removed(8) In order to ensure compliance within Union law or national law compliant with Union law, relying parties should register their intent to rely on EDIWs in the Member State where they are established. That will allow Member States to protect users from fraud and prevent the unlawful use of identity data and electronic attestations of attributes as well as to ensure that the processing of sensitive data, like health data, can be verified by relying parties in accordance with Union ▌ or national law. The registration and approval processes should be cost-effective and proportional to the risk. The registration should include the data that the relying party intend to request, the intended use of and the reasons for the need of such data, per each different category of services provided by the relying party. Relying parties should provide reasons for their request complies with data minimisation principles.

Removed(9) All EDIWs should enable users to electronically identify and authenticate online and offline across borders for accessing a wide range of public and private services. Without prejudice to Member States’ prerogatives as regards the identification of their nationals and residents, EDIWs can also serve the institutional needs of public administrations, international organisations and the Union’s institutions, bodies, offices and agencies. Offline use would be important in many sectors, including in the health sector where services are often provided through face-to-face interaction and ePrescriptions should be able to rely on QR-codes or similar technologies to verify authenticity. Relying on the level of assurance "high" for identity proofing, EDIWs should benefit from the potential offered by tamper-proof solutions such as secure elements, to comply with the security requirements under this Regulation. When on-boarding into EDIWs, users should obtain the qualified electronic signature, free of charge and by default, without having to go through any additional administrative or technical procedures. ▌ To achieve simplification and cost reduction benefits to persons and businesses across the Union , including by enabling powers of representation and e-mandates, Member States should issue EDIWs relying on common standards and technical specifications to ensure seamless interoperability and to adequately increase the IT security, strengthen robustness against cyber-attacks and thus significantly reduce the potential risks of ongoing digitalisation for citizens and businesses. Only Member States’ competent authorities can provide a high degree of confidence in establishing the identity of a person and therefore provide assurance that the person claiming or asserting a particular identity is in fact the person he or she claims to be. It is therefore necessary for the issuing of EDIWs to rely on the legal identity of citizens, other residents or legal entities. Reliance on the legal identity should not hinder the possibility of EIDW users to access services through the use of pseudonyms, where there is no legal requirement for legal identity for authentication Trust in the EDIWs would be enhanced by the fact that issuing and managing parties are required to implement appropriate technical and organisational measures to ensure the highest level of security that is commensurate to the risks raised for the rights and freedoms of the natural persons, in line with Regulation (EU) 2016/679.

Removed(9a) EDIWs should include a functionality to generate freely chosen and user managed pseudonyms, as a form of authentication to access online services provided, including services provided by very large online platforms as defined in Regulation (EU) 2022/2065 of the European Parliament and of the Council.

Removed(9b) Member States should develop harmonised approaches to enable the technical possibility for persons with limited legal capacity, such as minors and for persons with no legal capacity, to use EDIWs, trust services and end-user products.

Removed(9c) Natural and legal persons should be able to authorise EDIWs of third-parties to perform certain actions on their behalf, such as by means of powers of attorney or delegations of authority for specific transactions to specific employees or subcontractors in the case of a company or to parents acting on behalf of minor children.

Removed(10) In order to achieve a high level of security and trustworthiness, this Regulation establishes the requirements for EDIWs. The conformity of EDIWs with those requirements should be certified by accredited public or private sector bodies designated by Member States. Relying on a certification scheme based on the availability of commonly agreed standards with Member States should ensure a high level of trust and interoperability. Certification should in particular rely on the relevant European cybersecurity certifications schemes established pursuant to Regulation (EU) 2019/8816. Such certification should be without prejudice to certification as regards personal data processing pursuant to Regulation (EC) 2016/679

Removed(10a) The transparency of EDIWs and the accountability of their issuers are key elements by which to create social trust in the framework. All issuers of EDIWs should make the source codes available to the public for its scrutiny, in particular for privacy and security. Issuers and managers of EDIWs should be subject to controls and liabilities similar to those of qualified trust services providers.

Removed(11) EDIWs should ensure the highest level of security for the personal data used for identification and authentication irrespective of whether such data is stored locally, in decentralised ledgers or on cloud-based solutions, and taking into account the different levels of risk. Using biometrics to identify and authenticate should not be a precondition for using EDIWs, notwithstanding the requirement for strong user authentication. Biometric data used for the purpose to authenticate a natural person in the context of this Regulation should not be stored in the cloud without the explicit consent of the user. Using biometrics is one of the identifications methods providing a high level of confidence, ▌ when used in combination with ‘what you know’ factor. Since biometrics represents a unique characteristic of a person, the use of biometrics should not be obligatory. Furthermore the use of biometric data should be limited to specific scenarios pursuant to Article 9 of Regulation (EU) 2016/679, and requires organisational and security measures, commensurate to the risk that such processing may entail to the rights and freedoms of natural persons and in accordance with Regulation 2016/679. Storing information from EDIWs in the cloud should be an optional feature only active after the user has given explicit consent. Where EDIWs are issued on a personal electronic device of the user, their cryptographic material should be, when technologically possible, stored in the secure elements of EDIWs.

Removed(11a) EDIWs should be secure-by-design. They should implement advanced security features to protect against identity theft, data theft, denial of service and any other cyber threat. This should include state-of-the-art encryption and storage methods that are only accessible to and decryptable by the user, and establishing end-to-end encrypted communication with other EDIWs and relying parties. Additionally, EDIWs should require secure explicit, and active use confirmation for operations.

Removed(11b) The use of EDIWs as well as the discontinuation of their use are rights and the choice of users. Member States should develop a simple, user-friendly, speedy and secure procedure for the users to request immediate revocation of validity of EDIWs. For the situations when users are in possession of the device, this functionality should be designed as an integrated feature of EDIWs. A user-friendly and speedy remote mechanism should be established for cases where users do not hold the device in their possession, such as in the case of theft or loss. Upon the death of the user or the cessation of activity by a legal person, a mechanism should be established to enable the authority responsible for settling the succession of the natural person or assets of the legal person to request the immediate termination of EDIWs.

Removed(11c) In order to promote uptake of EDIWs and the wider use of digital identities, Member States should not only show the benefits of the relevant services, but also, in cooperation with the private sector, researchers and academia, develop training programmes aiming to strengthen the digital skills of their citizens and residents, in particular for vulnerable groups, such as persons with disabilities, older persons and persons lacking digital skills.

Removed(12) To ensure that the European digital identity framework is open to innovation, technological development and future-proof, Member States should be encouraged to jointly set-up ▌ sandboxes to test innovative solutions in a controlled, time limited and secure environment in particular to improve the functionality, protection of personal data, security and interoperability of the solutions and to inform future updates of technical references and legal requirements. This environment should foster the inclusion of European Small and Medium Enterprises, start-ups and individual innovators and researchers as well as relevant industry stakeholders, while improving compliance and preventing the placing on the market of solutions which infringe Union law on data protection and IT security.

Removed(13) Regulation (EU) 2019/1157 of the European Parliament and of the Council7 strengthens the security of identity cards with enhanced security features by August 2021. Member States should consider the feasibility of notifying them under electronic identification schemes to extend the cross-border availability of electronic identification means.

Removed(14) The process of notification of electronic identification schemes should be improved and accelerated to promote the access to convenient, trusted, secure and innovative authentication and identification solutions and, where relevant, to encourage private identity providers to offer electronic identification schemes to Member State’s authorities for notification as national electronic identity card schemes under Regulation (EU) No 910/2014.

Removed(15) Streamlining of the current notification and peer-review procedures will prevent heterogeneous approaches to the assessment of various notified electronic identification schemes and facilitate trust-building between Member States. New, simplified, mechanisms should foster Member States’ cooperation on the security and interoperability of their notified electronic identification schemes.

Removed(16) Member States should benefit from new, flexible tools to ensure compliance with the requirements of this Regulation and of the relevant implementing acts. This Regulation should allow Member States to use reports and assessments performed by accredited conformity assessment bodies or voluntary ICT security certification schemes, such as certification schemes to be established at Union level under Regulation (EU) 2019/881, to support their claims on the alignment of the schemes or of parts thereof with the requirements of the Regulation on the interoperability and the security of the notified electronic identification schemes.

Removed(17) Service providers use the identity data provided by the set of person identification data available from electronic identification schemes pursuant to Regulation (EU) No 910/2014 in order to match users from another Member State with the legal identity of that user. However, despite the use of the eIDAS data set, in many cases ensuring an accurate match requires additional information about the user and specific unique identification procedures at national level. In order to ensure a high-level of trust and security of personal data of natural persons, different technical solutions should be considered, including the use or combination of various cryptographic techniques, such as cryptographically verifiable identifiers. To further support the usability of electronic identification means and implementation of ‘once-only’ principle, this Regulation should require Member States to take specific measures to ensure a correct identity match in the process of electronic identification exclusively for the cross-border access of public services that requires the identification of the user by law. In particular, this requirement should not be read as a call for a centralised identity register in the Union for natural persons and reliance would be placed on decentralised national registers. The use of person identification data or a combination of person identification data, including the use of unique and persistent identifiers issued by Member States or generated by EDIWs is important for ensuring that the identity of the user can be verified. National law should be able to require the use of unique and persistent identifiers that are specific to particular sectors or relying parties. EDIWs should be capable of storing those identifiers and disclosing them where requested by the user. For the same purpose, this Regulation should extend the mandatory minimum data set and require the use of a unique and persistent electronic identifier for legal persons in accordance with Union law.

Removed(17a) When accessing public and private services across borders, the authentication and identification of EDIW users should be possible. The receiving Member States should be able to unequivocally identify users, upon their request, in those cases where their identification is required by law and to proceed to identity matching. In order to ensure a high level of trust and security of personal data, different technical solutions should be considered, including the use or combination of various state-of-the-art cryptographic techniques and technologies, such as cryptographically verifiable identifiers, unique user-generated digital pseudonyms, self-sovereign identities, and domain-specific identifiers.

Removed(18) In accordance with Directive (EU) 2019/882 of the European Parliament and of the Council8, persons with disabilities should be able to use EDIWs, trust services and end-user products used in the provision of those services on an equal basis with other users.

Removed(19) This Regulation should not cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards form laid down by Union or national ▌law. In addition, it should not affect national form requirements pertaining to public registers, in particular commercial and land registers.

Removed(20) The provision and use of trust services are becoming increasingly important for international trade and cooperation. International partners of the EU are establishing trust frameworks inspired by Regulation (EU) No 910/2014. Therefore, in order to facilitate the recognition of such services and their providers, implementing legislation may set the conditions under which trust frameworks of third countries could be considered equivalent to the trust framework for qualified trust services and providers in this Regulation, as a complement to the possibility of the mutual recognition of trust services and providers established in the Union and in third countries in accordance with Article 218 of the Treaty.

Removed(21) Issuers of EDIWs may need access to specific hardware and software features of smartphones, such as parts of the operating system, secure hardware (secure element, SIM etc.), NFC, Bluetooth, Wi-Fi Aware and biometric sensors. Such features are under the control of operating system and equipment manufacturers. Therefore this Regulation should build on Union acts ensuring contestable and fair markets in the digital sector. In particular, it builds on Article 6(7) of the Regulation (EU) 2022/1925 of the European Parliament and of the Council, which requires the providers of core platform services designated as gatekeepers ▌ to allow business users and alternative providers of ▌ services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features , regardless of whether those features are part of the operating system or are available to or used by that gatekeeper when providing such services.

Removed(21a) This Regulation aims to facilitate the creation of, the choice between and the possibility of switching between EDIWs. In order to avoid lock-in effects, the issuers of EDIWs should, at the request of EDIW users, ensure the effective portability of data, including continuous and real-time access to services, and should not be allowed to use contractual, economic or technical barriers to prevent or to discourage effective switching between different EDIWs.

Removed(22) In order to streamline the cybersecurity obligations imposed on trust service providers, as well as to enable these providers and their respective competent authorities to benefit from the legal framework established by Directive XXXX/XXXX (NIS2 Directive), trust services are required to take appropriate technical and organisational measures pursuant to Directive XXXX/XXXX (NIS2 Directive), such as measures addressing system failures, human error, malicious actions or natural phenomena in order to manage the risks posed to the security of network and information systems which those providers use in the provision of their services as well as to notify significant incidents and cyber threats in accordance with Directive XXXX/XXXX (NIS2 Directive). With regard to the reporting of incidents, trust service providers should notify any incidents having a significant impact on the provision of their services, including such caused by theft or loss of devices, network cable damages or incidents occurred in the context of identification of persons. The cybersecurity risk management requirements and reporting obligations under Directive XXXXXX [NIS2] should be considered complementary to the requirements imposed on trust service providers under this Regulation. Where appropriate, established national practices or guidance in relation to the implementation of security and reporting requirements and supervision of compliance with such requirements under Regulation (EU) No 910/2014 should continue to be applied by the competent authorities designated under Directive XXXX/XXXX (NIS2 Directive). Any requirements pursuant to this Regulation do not affect the obligation to notify personal data breaches under Regulation (EU) 2016/679.

Removed(23) Due consideration should be given to ensure effective cooperation between the NIS and eIDAS authorities. In cases where the supervisory body under this Regulation is different from the competent authorities designated under Directive XXXX/XXXX [NIS2], those authorities should cooperate closely, in a timely manner by exchanging the relevant information in order to ensure effective supervision and compliance of trust service providers with the requirements set out in this Regulation and Directive XXXX/XXXX [NIS2]. In particular, the supervisory bodies under this Regulation should be entitled to request the competent authority under Directive XXXXX/XXXX [NIS2] to provide the relevant information needed to grant the qualified status and to carry out supervisory actions to verify compliance of the trust service providers with the relevant requirements under NIS 2 or require them to remedy non-compliance.

Removed(24) It is essential to provide for a legal framework to facilitate cross-border recognition between existing national legal systems related to electronic registered delivery services. That framework could also open new market opportunities for Union trust service providers to offer new pan-European electronic registered delivery services and ensure that the identification of the recipients is ensured with a higher level of confidence than the identification of the sender.

Removed▌

Removed(26) It should be possible to issue and handle trustworthy digital attributes and contribute to reducing administrative burden, empowering citizens and other residents to use them in their private and public transactions. Citizens and other residents should be able, for instance, to demonstrate ownership of a valid driving license issued by an authority in one Member State, which can be verified and relied upon by the relevant authorities in other Member States, to rely on their social security credentials or on future digital travel documents in a cross border context.

Removed(27) Any entity that collects, creates and issues attested attributes such as diplomas, licences, certificates of birth should be able to become a provider of electronic attestation of attributes and should be responsible for revoking the attestation in the event of falsification, identity theft, or any issuance based on an abusive request. Relying parties should use the electronic attestations of attributes as equivalent to attestations in paper format. Nevertheless, lawfully issued attestations of attributes in paper form should continue to be accepted by relying parties as an alternative to electronic attestations of attributes. An electronic attestation of attributes should not be denied legal effect solely on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic attestation of attributes. To that effect, general requirements should be laid down to ensure that a qualified electronic attestation of attributes has the equivalent legal effect of lawfully issued attestations in paper form. However, those requirements should apply without prejudice to Union or national law defining additional sector specific requirements as regards form with underlying legal effects and, in particular, the cross-border recognition of qualified electronic attestation of attributes, where appropriate. The Commission and the Member States should involve professional organisations in laying down the attributes that concern them.

Removed(28) The wide availability and usability of EDIWs require their acceptance and trust by both private individuals and private service providers. Private relying parties providing services such as in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, ▌telecommunications or education should accept the use of ▌EDIWs for the provision of services where strong user authentication for online identification is required by Union or national ▌law. Information requested from the user via the EDIW should be necessary and proportionate for the intended use case of the relying party and should be in line with the principle of data minimisation, ensuring transparency over which data is shared and for what purposes. Where very large online platforms as defined in Article 25.1. of Regulation (EU) 2022/2065 require users to authenticate to access online services, those platforms should be mandated to accept the use of EDIWs upon the voluntary request of the user. Users should be under no obligation to use EDIWs to access private services and should not be restricted or hindered on the grounds that they do not use an EDIW, but if users wish to do so, very large online platforms should accept EDIWs for this purpose while respecting the principle of data minimisation and the right of the users to use freely chosen pseudonyms. Given the importance of very large online platforms, due to their reach, in particular as expressed in number of recipients of the service and economic transactions this is necessary to increase the protection of users from fraud and secure a high level of data protection. Self-regulatory codes of conduct at Union level (‘codes of conduct’) should be developed in order to contribute to wide availability and usability of electronic identification means including EDIWs within the scope of this Regulation. The codes of conduct should facilitate wide acceptance of electronic identification means including EDIWs by those service providers which do not qualify as very large platforms and which rely on third party electronic identification services for user authentication. They should be developed within 12 months of the adoption of this Regulation. ▌

Removed(29) EDIWs should technically enable the selective disclosure of attributes to relying parties in a secure and user-friendly manner as one of its key features and advantages. They should also ensure that no attributes are disclosed to parties that are not registered to receive such attributes. This feature should become a basic design feature thereby reinforcing convenience and personal data protection including minimisation of processing of personal data in particular privacy by design and by default. Mechanisms for the validation of EDIWs, the selective disclosure and authentication of users to access online services should be privacy-preserving thereby preventing the tracking of the user and respecting the principle of purpose limitation, which implies a right to pseudonymity to ensure the user cannot be linked across several relying parties. The technical architecture and implementation of EDIWs should be in full compliance with Regulation (EU) 2016/679. In addition, the decentralised nature of EDIWs should enable self-signing and revocability of attributes and identifiers.

Removed(29a) Unless specific rules of Union or national law require users to identify themselves, the use of services under a pseudonym should be allowed and should not be restricted by Member States, for example by imposing a general obligation on service providers to limit the pseudonymous use of their services.

Removed(30) Attributes provided by the qualified trust service providers as part of the qualified attestation of attributes should be verified against the authentic sources either directly by the qualified trust service provider or via designated intermediaries recognised at national level in accordance with Union or national ▌law for the purpose of secure exchange of attested attributes between identity or attestation of attributes’ service providers and relying parties.

Removed(31) Secure electronic identification and the provision of attestation of attributes should offer additional flexibility and solutions for the financial services sector to allow identification of customers and the exchange of specific attributes necessary to comply with, for example, customer due diligence requirements under the Anti Money Laundering Regulation, [reference to be added after the adoption of the proposal], with suitability requirements stemming from investor protection legislation, or to support the fulfilment of strong customer authentication requirements for account login and for initiation of transactions in the field of payment services.

Removed(31a) This Regulation should establish the principle that the legal effect of an electronic signature cannot be challenged on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic signature. However, it is for national law to define the legal effect of electronic signatures, except for the requirements provided for in this Regulation according to which the legal effect of a qualified electronic signature is to be equivalent to that of a handwritten signature. In determining the legal effects of electronic signatures Member States should take into account the principle of proportionality between the judicial value of a document to be signed and level of security and cost that an electronic signature requires. To increase the accessibility and use of electronic signatures, Member States are encouraged to consider the use of advanced electronic signatures in the day-to-day transactions for which they provide a sufficient level of security and confidence. The use of qualified electronic signatures should be mandated only when the highest level of security and confidence is required.

Removed(32) Website authentication services provide users with a high level of assurance of the identity of the entity standing behind the website. Those services contribute to the building of trust and confidence in conducting business online, as users will have confidence in a website that has been authenticated. The use of website authentication services by websites is voluntary. However, in order for website authentication to become a means to increasing trust, providing a better experience for the user and furthering growth in the internal market, this Regulation lays down minimal security and liability obligations for the providers of website authentication services and their services. To that end, web-browsers should ensure support and interoperability with qualified certificates for website authentication pursuant to Regulation (EU) No 910/2014. They should recognise and display qualified certificates for website authentication to provide a high level of assurance, allowing website owners to assert their identity as owners of a website and users to identify the website owners with a high degree of certainty. To further promote their usage, public authorities in Member States should consider incorporating qualified certificates for website authentication in their websites. In the case of a security breach, web browsers should be able to take measures that are proportional to their risk. Web browsers should notify the Commission immediately of any security breach as well as the measures taken to remedy such breaches with regard to a single certificate or to a set of certificates.

Removed(33) Many Member States have introduced national requirements for services providing secure and trustworthy digital archiving in order to allow for the long term preservation of electronic documents and associated trust services. To ensure legal certainty and trust, it is essential to provide a legal framework to facilitate the cross border recognition of qualified electronic archiving services. That framework could also open new market opportunities for Union trust service providers.

Removed▌

Removed(36) In order to avoid fragmentation and barriers, due to diverging standards and technical restrictions, and to ensure a coordinated process to avoid endangering the implementation of the future European digital identity framework, a process for close and structured cooperation between the Commission, Member States, civil society, academics and the private sector is needed. To achieve this objective, Member States should cooperate. The Member States should agree on a comprehensive technical architecture and reference framework, a set of common standards and technical references including recognised existing standards, and a set of guidelines and descriptions of best practices covering at least all aspects of the functionalities and interoperability of the EDIWs including eSignatures and of the qualified trust service providers for attestation of attributes as laid out in this regulation. In this context, Member States should also reach agreement on common elements of a business model and fee structure of EDIWs, to facilitate take up, in particular by SMEs in a cross-border context. ▌

Removed(36a) In order to ensure wide usability and availability, additional financial support measures should be envisaged to support Member States in issuing and managing EDIWs. To that end, the Commission should asses the availability of additional Union funds to be made available for the Member States that would request support in the development, deployment and management of EDIWs.

Removed(36b) In order to ensure a wider use and applicability of EDIWs across the Union, the Commission should build on and leverage the framework of this Regulation when developing sectoral Union instruments, such as the European Social Security Pass and the common European data spaces. The coordination with the European Social Security Pass should enable the digital portability of citizens’ social security rights across borders and the verification of their entitlements and validity of documents. For the common European data space, EDIWs should enable a higher degree of transparency and control of the users over their data.

Removed(37) The European Data Protection Supervisor has been consulted pursuant to Article 42(1) of Regulation (EU) 2018/1525 of the European Parliament and of the Council12.

Removed(38) Regulation (EU) No 910/2014 should therefore be amended accordingly,

RemovedHAVE ADOPTED THIS REGULATION:

RemovedRegulation (EU) 910/2014 is amended as follows:

Removed(1) Article 1 is replaced by the following:

Removed‘This Regulation aims to contribute towards ensuring the proper functioning of the internal market ▌ providing an adequate level of security of electronic identification means and trust services used across the Union. For these purposes, this Regulation:

Removed(a) lays down the conditions under which Member States shall provide and recognise electronic identification means of natural and legal persons, falling under a notified electronic identification scheme of another Member State;

Removed(b) lays down rules for trust services, in particular for electronic transactions;

Removed(c) establishes a legal framework for electronic signatures, electronic seals, electronic time stamps, electronic documents, non-qualified electronic delivery services, qualified electronic registered delivery services, certificate services for website authentication, ▌ electronic attestation of attributes and the management of remote electronic signature and seal creation devices ▌ ;

Removed(d) lays down the conditions for the issuing, managing and recognition of European Digital Identity Wallets by Member States and for ensuring their interoperability and their cross-border use in the Union;

Removed(da) enables the exercise of the right to safely participate in the digital society and facilitates unrestricted access to online public services throughout the Union for any natural or legal person.’;

Removed(2) Article 2 is amended as follows:

Removed(a) paragraph 1 is replaced by the following:

Removed‘1. This Regulation applies to electronic identification schemes that have been notified by a Member State, European Digital Identity Wallets issued and managed by Member States and to trust service providers that are established in the Union.’;

Removed(b) paragraph 3 is replaced by the following: