Changes from report parliamentary committee draft to plenary report

Added1. An electronic attestation of attributes shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form or that it does not meet the requirements for qualified electronic attestations of attributes, or that it has been issued by a trust service provider established in a different Member State.

Added2. A qualified electronic attestation of attributes shall have the same legal effect as a lawfully issued attestation in paper form. Relying parties shall continue to accept such attestations in paper form as an alternative to electronic attestation of attributes.

Added3. A qualified electronic attestation of attributes issued in one Member State shall be recognised as a qualified electronic attestation of attributes in any other Member State.

AddedElectronic attestation of attributes in public services

AddedWhen an electronic identification using an electronic identification means and authentication is required under national law to access an online service provided by a public sector body, person identification data in the electronic attestation of attributes shall not substitute electronic identification using an electronic identification means and authentication for electronic identification unless specifically allowed by the Member State or the public sector body. In such a case, qualified electronic attestation of attributes from other Member States shall also be accepted.

AddedRequirements for qualified attestation of attributes

Added1. Qualified electronic attestation of attributes shall meet the requirements laid down in Annex V. A qualified electronic attestation of attributes shall be deemed to be compliant with the requirements laid down in Annex V, where it meets the standards referred to in paragraph 4.

Added2. Without prejudice to its content, qualified electronic attestations of attributes shall not be subject to any mandatory technical requirement in addition to the requirements laid down in Annex V.

Added3. Where a qualified electronic attestation of attributes has been revoked after initial issuance, it shall lose its validity from the moment of its revocation, and its status shall not in any circumstances be reverted. Only relying parties the user has shared this attribute with shall be able to link the revocation to those attributes.

Added4. By ... [6 months after the entry into force of this amending Regulation, the Commission shall establish reference numbers of standards for qualified electronic attestations of attributes by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11).

AddedVerification of attributes against authentic sources

Added1. Member States shall ensure that, at least for the attributes listed in Annex VI, wherever these attributes rely on authentic sources within the public sector, measures are taken to allow qualified providers of electronic attestations of attributes to verify free of charge by electronic means at the request of the user, the authenticity of the attribute directly against the relevant authentic source at national level or via designated intermediaries recognised at national level in accordance with Union or national ▌law.

Added1a. Authentic sources may issue non-qualified electronic attestation of attributes at the request of the user.

Added2. By … [6 months after the date of entry into force of this amending Regulation], taking into account relevant international standards, the Commission shall, by means of implementing acts, set out the minimum technical specifications, standards and procedures with reference to the catalogue of attributes and schemes for the attestation of attributes and verification procedures for qualified electronic attestations of attributes by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

AddedIssuing of electronic attestation of attributes to the European Digital Identity Wallets

Added1. Providers of qualified electronic attestations of attributes shall provide an interface with the European Digital Identity Wallets issued in accordance in Article 6a.

Added1a. Public registers shall provide qualified electronic attestation of attributes to the user of a European Digital Identity Wallet at the request of the user.

Added1b. Non-qualified attestation of attributes can be issued by any trust service provider, an authentic source or directly through a European Digital Identity Wallet.

Added1c. Providers of electronic attestations of attributes established in a Member State other than the Member State that issued user’s European Digital Identity Wallet, shall provide that user with the possibility to request, obtain, store and manage the electronic attestation of attributes in an easy manner, with no additional technical, administrative or procedural requirements for the European Digital Identity Wallet issued and managed by the Member State of origin.

AddedAdditional rules for the provision of electronic attestation of attributes services

Added1. Providers of qualified and non-qualified electronic attestation of attributes services shall not combine personal data relating to the provision of those services with personal data from any other services offered by them.

Added2. Personal data relating to the provision of electronic attestation of attributes services shall be kept logically separate from other data held.

Added3. Personal data relating to the provision of qualified electronic attestation of attributes services shall be kept physically and logically separate from any other data held.

Added4. Providers of qualified electronic attestation of attributes’ services shall provide such services under a separate legal entity.

AddedQUALIFIED ELECTRONIC ARCHIVING SERVICES

AddedLegal effects of an electronic archiving service

Added1. The legal effect and the admissibility of data and documents archived using an electronic archiving service as legal evidence shall not be refused on the sole grounds that this service is in an electronic form or does not fulfil the requirements of a qualified electronic archiving service.

Added2. The data and documents archived using a qualified electronic archiving service shall benefit from a presumption regarding the integrity of the archived data and documents, their availability, their traceability, their accuracy and their origin as well as the identification of users.

AddedQualified electronic archiving services

AddedA qualified electronic archiving service for electronic documents may only be provided by a qualified trust service provider which implements procedures and uses technologies that ensure that all the requirements for a qualified electronic archiving service are met.

AddedWithin 24 months after the entry into force of this Regulation, the Commission shall, by means of implementing acts, establish reference numbers of standards for electronic archiving services. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

AddedRequirements for qualified electronic archiving services

Added1. Qualified electronic archiving services shall meet the following requirements:

Added(a) they are created or maintained by a qualified trust service provider;

Added(b) they ensure the integrity and the accuracy of their origin and legal features throughout the conservation period;

Added(c) they ensure the accuracy of the date and time of the archiving process;

Added2. Compliance with the requirements laid down in paragraph 1 shall be presumed where an electronic archiving service meets the standards referred to in paragraph 3.

Added3. The Commission may, by means of implementing acts, establish reference numbers of standards for the processes of reception, storing, deletion and transmission of electronic data or documents. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Added▌

Added(39a) the following Articles are inserted:

Added"Article 46a

AddedNational competent authorities and single point of contact

Added1. Each Member State shall establish one or more new national competent authorities to carry out the tasks assigned to them under Article 46b or designate and existing body for that purpose.

Added2. Each Member State shall designate one national single point of contact on European digital identity framework (single point of contact). Where a Member State designates only one competent authority, that competent authority shall also be the single point of contact for that Member State.

Added3. Each single point of contact shall exercise a liaison function to ensure cross-border cooperation of its Member State’s competent authorities with the relevant authorities in other Member States, and, where appropriate, the Commission and ENISA, as well as to ensure cross-sectorial cooperation with other national competent authorities within its Member State.

Added4. Member States shall ensure that the competent authorities established or designated pursuant to paragraph 1 of this Article have the necessary powers and adequate resources to carry out, in an effective and efficient manner, the tasks assigned to them and thereby to fulfil the objectives of this Regulation. Member States shall ensure effective, efficient and secure cooperation of the designated representatives in the European Digital Identity Framework Board established pursuant to Article 46c.

Added5. Each Member State shall, without undue delay, notify the Commission of the establishment or designation of the competent authority pursuant to paragraph 1. They shall also make public and notify the Commission of the identity and tasks of single point of contact designated pursuant to paragraph 2 and any subsequent changes thereto. The Commission shall publish a list of those single points of contacts.

AddedTasks of the national competent authorities

Added1. The national competent authorities shall carry the following tasks:

Added(a) to monitor and enforce the application of this Regulation;

Added(b) to supervise issuers of European Digital Identity Wallets established in its territory through ex ante and ex post supervisory activities, ensuring they meet the requirements laid down in this Regulation and to take corrective actions when they fail to do so;

Added(c) to supervise allegedly unlawful or inappropriate behaviours of relying parties established in its territory, in particular when such behaviours have been reported through European Digital Identity Wallets and apply corrective actions if necessary;

Added(d) to supervise qualified trust service providers established in the territory of the designating Member State through ex ante and ex post supervisory activities, that those qualified trust service providers and the qualified trust services that they provide meet the requirements laid down in this Regulation;

Added(e) to take action if necessary, in relation to non-qualified trust service providers established in the territory of the designating Member State, through ex post supervisory activities, when informed that those non-qualified trust service providers or the trust services they provide allegedly do not meet the requirements laid down in this Regulation;

Added(f) to analyse the conformity assessment reports referred to in Articles 20(1) and 21(1);

Added(g) to inform the relevant national competent authorities of the Member States concerned, designated pursuant to Directive (EU) XXXX/XXXX [NIS2], of any significant breaches of security or loss of integrity they become aware of in the performance of their tasks and, in the case of a significant breach of security or loss of integrity which concerns other Member States, to inform the single point of contact of the Member State concerned designated pursuant to Directive (EU) XXXX/XXXX (NIS2);

Added(h) to report to the Commission about their main activities in accordance with paragraph 2;

Added(i) to carry out audits or request a conformity assessment body to perform a conformity assessment of the qualified trust service providers in accordance with Article 20(2);

Added(j) to cooperate with supervisory authorities established under Regulation (EU) 2016/679, in particular, by informing them without undue delay, about the results of audits of qualified trust service providers, where there is evidence that personal data protection rules have been breached and about security breaches which are likely to constitute personal data breaches, or about suspicions of such breaches that it has become aware of in the performance of its tasks, without prejudice to Regulation (EU) 2016/679;

Added(k) to grant qualified status to trust service providers and to the services they provide and to withdraw this status in accordance with Articles 20 and 21;