Changes from plenary report to adopted text

RemovedCross-border user identification

Removed1. When accessing cross-border public services that requires identification of the user by Union or national law, Member States shall ensure unequivocal identity matching for natural persons using notified electronic identification means or European Digital Identity Wallets. Member States shall provide for technical and organisational measures to ensure the protection of personal data and prevent profiling of users.

Removed2. In order to identify natural persons upon their request for accessing services as described in paragraph 1, Member States shall provide a minimum set of person identification data referred to in Article 12.4.(d). Member States that have at least one unique identifier shall, at the request of the user, issue unique and persistent identifiers for cross-border use. Those identifiers may be specific to particular sectors or relying parties, provided that they uniquely identify the user across the Union.

Removed2a. Member States shall provide a single unique and persistent identifier for legal persons using electronic identification means or European Digital Identity Wallets.

Removed3. By … [6 months after the date of entry into force of this amending Regulation], the Commission shall adopt an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11), laying down further technical specifications that are privacy enhancing and that will ensure trustworthy, secure and interoperable cross-border authentication and identification of users. That implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).’;

Removed(13) Article 12 is amended as follows:

Removed(-a) the title is replaced by the following:

Removed‘▌Interoperability’;

Removed(a) in paragraph 3, points (c) and (d) are replaced by the following:

Removed‘(c) it facilitates the implementation of data protection and security by design;

Removed(d) it ensures that personal data is processed in accordance with Regulation (EU) 2016/679.’;

Removed(b) in paragraph 4, point (d) is replaced by the following:

Removed‘(d) a reference to a minimum set of person identification data necessary to unequivocally represent a natural or legal person available from electronic identification schemes. In general, insofar as personal data are concerned, the risks to the rights of individuals shall be assessed based on Article 25(1) of Regulation (EU) 2016/679;’;

Removed(ba) paragraph 5 is deleted;

Removed(c) paragraph 6 is deleted;

Removed(ca) paragraph 7 is deleted;

Removed(cb) paragraph 9 is replaced by the following:

Removed‘9. The implementing acts referred to paragraph 8 of this Article shall be adopted in accordance with the examination procedure referred to in Article 48(2).’;

Removed(14) the following Article ▌ is inserted:

Removed‘Article 12a

RemovedCertification of electronic identification schemes

Removed1. Conformity of notified electronic identification schemes with the requirements laid down in Articles ▌ 8 and ▌ 10 may be certified by conformity bodies designated by Member States.

Removed2. The peer-review of electronic identification schemes referred to in Article46b(5), point (c) of this Regulation shall not apply to electronic identification schemes or part of such schemes certified in accordance with paragraph 1. Member States may use a certificate or a Union statement of conformity issued in accordance with a relevant European cybersecurity certification scheme established pursuant to Regulation (EU) 2019/881 to demonstrate full or partial compliance of such schemes or parts of such schemes with the requirements set out in Article 8(2) of this Regulation regarding the assurance levels of electronic identification schemes.

Removed2a. The certification scheme used to demonstrate conformity pursuant to paragraph 1 shall include a two-year vulnerability assessment of the certified product and a continuous threat monitoring, unless such a certification scheme has been established pursuant to Regulation (EU) 2019/881.

Removed3. Member States shall notify to the Commission with the names and addresses of the conformity assessment bodies referred to in paragraph 1. The Commission shall make that information available to all Member States.’;

Removed(15) the following heading is inserted after Article 12a:

Removed‘SECTION III

RemovedCROSS-BORDER RELIANCE ON ELECTRONIC IDENTIFICATION MEANS’;

Removed(16) the following Articles ▌are inserted:

Removed‘Article 12b

RemovedCross-border reliance on European Digital Identity Wallets

Removed1. Where Member States require an electronic identification using an electronic identification means and authentication under national law or by administrative practice to access an online service provided by a public sector body, they shall also accept European Digital Identity Wallets issued in accordance with this Regulation for the purpose of electronic identification and authentication and shall clearly communicate such acceptance to potential users of the service.

Removed2. Where private relying parties providing services are required, by Union or national ▌law, to use strong user authentication for online identification, ▌ , including in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, telecommunications or education in particular with regard to the recognition of educational and professional qualifications, private relying parties shall also offer and accept the use of European Digital Identity Wallets and notified electronic identification means with assurance level ‘high’ issued in accordance with this Regulation for identification and authentication.

Removed3. Where very large online platforms as defined in Article 25(1) Regulation (EU) 2022/2065. require users to authenticate to access online services, they shall also accept, though not exclusively, and facilitate the use of European Digital Identity Wallets issued in accordance with Article 6a strictly upon voluntary request of the user and in respect of the right to pseudonyms provided for in this Regulation. In this case, user generated pseudonyms shall be used in connection to a European Digital Identity Wallet. Very large online platforms shall clearly indicate this possibility to users of the service. The combination of person identification data and any other personal data and identifiers linked to the European Digital Identity Wallets with personal or non-personal data from any other services which are not necessary for the provision of the authentication or use of core services, is prohibited unless expressly requested by the user.

Removed4. The Commission shall, in cooperation with the Member States, industry and the relevant stakeholders, including civil society, encourage and facilitate the development of self-regulatory codes of conduct at Union level (‘codes of conduct’), in order to contribute to wide availability and usability of European Digital Identity Wallets within the scope of this Regulation. These codes of conduct shall ensure acceptance of electronic identification means including European Digital Identity Wallets within the scope of this Regulation in particular by service providers relying on third party electronic identification services for user authentication. The Commission will facilitate the development of such codes of conduct in close cooperation with all relevant stakeholders and encourage service providers to complete the development of codes of conduct within 12 months of the adoption of this Regulation and effectively implement them within 18 months of the adoption of the Regulation.

Removed▌

RemovedMutual recognition of other electronic identification means

Removed1. Where electronic identification using an electronic identification means and authentication is required under national law or by administrative practice to access an online service provided by a public sector body in a Member State, the electronic identification means, issued in another Member State shall be recognised in the first Member State for the purposes of cross-border authentication for that online service, and ensuring mutual recognition provided that the following conditions are met:

Removed(a) the electronic identification means is issued under an electronic identification scheme that is included in the list referred to in Article 9;

Removed(b) the assurance level of the electronic identification means corresponds to an assurance level equal to or higher than the assurance level required by the relevant public sector body to access that online service in the Member State concerned, and in any case not lower than an assurance level ‘substantial’;

Removed(c) the relevant public sector body in the Member State concerned uses the assurance level ‘substantial’ or ‘high’ in relation to accessing that online service.

RemovedSuch recognition shall take place no later than 6 months after the Commission publishes the list referred to in point (a) of the first subparagraph.

Removed2. An electronic identification means which is issued within the scope of an electronic identification scheme included in the list referred to in Article 9 and which corresponds to the assurance level ‘low’ may be recognised by public sector bodies for the purposes of cross-border authentication for the online service provided by those bodies.’;

Removed(17) In Article 13, paragraph 1 is replaced by the following:

Removed‘1. Notwithstanding paragraph 2 of this Article, trust service providers shall be liable for damage caused intentionally or negligently to any natural or legal person due to a failure to comply with the obligations under this Regulation and with the cybersecurity risk management obligations under Article 18 of the Directive XXXX/XXXX [NIS2].’;

Removed(18) Article 14 is replaced by the following:

Removed‘Article 14

RemovedInternational aspects

Removed1. The Commission may adopt delegated acts, in accordance with Article 47, supplementing this Regulation by setting out the conditions under which the requirements of a third country applicable to the trust service providers established in its territory and to the trust services they provide can be considered equivalent to the requirements applicable to qualified trust service providers established in the Union and to the qualified trust services they provide.

Removed2. Where the Commission has adopted a delegated act pursuant to paragraph 1 or concluded an international agreement on the mutual recognition of trust services in accordance with Article 218 of the Treaty, trust services provided by providers established in the third country concerned shall be considered equivalent to qualified trust services provided by qualified trust service providers established in the Union.’;

Removed(19) Article 15 is replaced by the following:

Removed‘Article 15

RemovedAccessibility to persons with disabilities and special needs

RemovedThe provision of trust services and end-user products used in the provision of those services shall be made available in plain and intelligible language and accessible for persons with disabilities or to persons who experience functional limitations, such as older people, and persons with limited access to digital technologies, in accordance with the accessibility requirements of Annex I of Directive (EU) 2019/882 on the accessibility requirements for products and services and the United Nations Convention on the Rights of Persons with Disabilities.’;

Removed(19a) Article 16 is replaced by the following:

Removed"Article 16

RemovedPenalties

Removed1. Without prejudice to Article 31 of the Directive (EU) XXXX/XXXX [NIS2], Member States shall lay down the rules on penalties applicable to infringements of this Regulation. The penalties provided for shall be effective, proportionate and dissuasive, in particular where the infringing party is an SME.

Removed2. Member States shall ensure that infringements by qualified trust service providers of the obligations laid down in this Regulation be subject to administrative fines of a maximum of at least EUR 10 000 000 or 2 % of the total worldwide annual turnover of the undertaking to which the qualified trust service provider belonged in the preceding financial year, whichever is higher.

Removed3. Member States shall ensure that infringement by non-qualified trust service providers of the obligations laid down in this Regulation be subject to administrative fines of a maximum of at least EUR 7 000 000 or 1,4 % of the total worldwide annual turnover of the undertaking to which the non-qualified trust service provider belongs in the preceding financial year, whichever is higher.";