Changes from report parliamentary committee draft to plenary report

Added(23b) ‘remote qualified seal creation device’ means a qualified electronic seal creation device where a qualified trust service provider generates, manages or duplicates the electronic signature creation data on behalf of a seal creator;’;

RemovedRegulation (EU) No 910/2014

Added(g) point (29) is replaced by the following:

RemovedArticle 1 – paragraph 1 – point 7, Article 6a – paragraph 6 a (new): 6 a. The use of the European Digital Identity Wallets shall be on a voluntary basis. European Digital Identity Wallets issued or mandated by the Member States shall be free of charge to all natural and legal persons.

Added‘(29) ‘certificate for electronic seal’ means an electronic attestation or set of attestations that links electronic seal validation data to a legal person and confirms the name of that person;’;

RemovedRegulation (EU) No 910/2014

Added(ga) points (38) and (39) are replaced by the following:

RemovedArticle 1 – paragraph 1 – point 7, Article 6a – paragraph 7: 7. The user shall be in full control of the European Digital Identity Wallet and its own data. The issuer of the European Digital Identity Wallet shall ensure that it is built on privacy by design principle. In particular, the EDIW shall have the following features: / (a) for issuers of the European Digital Identity Wallet it shall be technologically impossible to receive any information on the use of the Wallet or its attributes. For the purpose of protecting user data against loss or corruption, encrypted synchronization and encrypted backup functions shall be permitted, with the previous explicit consent of the user. The issuer of the European Digital Identity Wallet shall not combine person identification data and any other personal data stored or relating to the use of the European Digital Identity Wallet with personal data from any other services offered by this issuer or from third-party services which are not necessary for the provision of the Wallet services. Personal data relating to the provision of European Digital Identity Wallets shall be kept physically and logically separate from any other data held. If the European Digital Identity Wallet is provided by private parties, the provisions of Article 45f, paragraph 4, shall apply mutatis mutandis; / (b) for issuers of the electronic attestation of attributes it shall be technologically impossible to receive any information about the use of these attributes and about the use of the European Digital Identity Wallet;…

Added‘(38) ‘certificate for website authentication’ means an electronic attestation that makes it possible to authenticate a website and links the website to the natural or legal person to whom the certificate is issued;

RemovedRegulation (EU) No 910/2014

Added(39) ‘qualified certificate for website authentication’ means a certificate for website authentication that links the website to the natural or legal person to whom the certificate is issued with a high level of assurance, which is issued by a qualified trust service provider and meets the requirements laid down in Annex IV;"

RemovedArticle 1 – paragraph 1 – point 7, Article 6a – paragraph 9: 9. Article 24(2), points (b), (e), (g), and (h) shall apply mutatis mutandis to issuers of European Digital Identity Wallets.

Added▌’

RemovedRegulation (EU) No 910/2014

Added(i) the following points ▌ are added:

RemovedArticle 1 – paragraph 1 – point 7, Article 6a –paragraph 10: 10. The European Digital Identity Wallet shall be made accessible for persons with disabilities or with special needs, including older people, in accordance with the accessibility requirements of Annex I to Directive 2019/882.

Added‘(42) ‘European Digital Identity Wallet’ means an electronic identification means which securely stores, manages and validates identity data and electronic attestations of attributes, to provide them to relying parties and other users of European Digital Identity Wallets on request, and which enables the creation of qualified electronic signatures and seals;

RemovedRegulation (EU) No 910/2014

Added(43) ‘attribute’ is a feature, characteristic or quality of a natural or legal person or of an entity ▌ ;

RemovedArticle 1 – paragraph 1 – point 7, Article 6a – paragraph 11: 11. By … [6 months of the entering into force of this amending Regulation], the Commission shall reference standards for the requirements referred to in this Article by means of an implementing act on the implementation of the European Digital Identity Wallet. This implementing act shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Added(44) ‘electronic attestation of attributes’ means an attestation in electronic form that allows the presentation and authentication of attributes;

RemovedRegulation (EU) No 910/2014

Added(45) ‘qualified electronic attestation of attributes’ means an electronic attestation of attributes, which is issued by a qualified trust service provider and meets the requirements laid down in Annex V;

RemovedArticle 1 – paragraph 1 – point 7, Article 6a – paragraph 11a (new): 11a. By ... [6 months after the date of entry into force of this amending Regulation], the Commission shall adopt a delegated act in accordance with Article 47 concerning the establishment of technical and operational specifications for the requirements referred to in this Article.'

Added(46) ‘authentic source’ is a repository or system, held under the responsibility of a public sector body or private entity, that contains attributes about a natural or legal person and is considered to be the primary source of that information or recognised as authentic in Union or national law;

RemovedRegulation (EU) No 910/2014

Added(47) ‘electronic archiving’ means a service ensuring preservation of electronic data or documents in order to guarantee their integrity, the accuracy of their origin and legal features throughout the conservation period;

RemovedArticle 1 – paragraph 1 – point 7, Article 6b – paragraph 1: 1. Where legal persons acting as a relying party intend to rely upon European Digital Identity Wallets issued in accordance with this Regulation, they shall communicate it to the Member State where the legal person is established to ensure compliance with requirements set out in Union law or national law for the provision of specific services. When communicating their intention to rely on European Digital Identity wallets, they shall also inform competent national authority about the intended use of the European Digital Identity Wallet with the justification of the data being requested. Member States shall scrutinize requested use cases of the European Digital Identity Wallet in regards to the potential privacy implications of the data exchanged and the purpose of the processing of personal data. In cases of privacy breaches, the cases shall be forwarded to competent national authorities for further assessment and enforcement.

Added(48) ‘qualified electronic archiving service’ means a service that meets the requirements laid down in Article 45g;

RemovedRegulation (EU) No 910/2014

Added(49) ‘EU Digital Identity Wallet Trust Mark’ means an indication in a simple, recognisable and clear manner that a Digital Identity Wallet has been issued in accordance with this Regulation;

RemovedArticle 1 – paragraph 1 – point 7, Article 6b – paragraph 1 a (new): 1 a. Where relying parties intend to rely upon European Digital Identity Wallets issued in accordance with this Regulation, they shall mutually authenticate themselves to the European Digital Identity Wallet of the user, before any form of transaction can take place.

Added(50) ‘strong user authentication’ means an authentication based on the use of at least two authentication factors categorised as user knowledge , possession and inherence that are independent, in such a way that the breach of one does not compromise the reliability of the others, and is designed in such a way to protect the confidentiality of the authentication data;

RemovedRegulation (EU) No 910/2014

Added(51) ‘user account’ means a mechanism that allows a user to access public or private services on the terms and conditions established by the service provider;

RemovedArticle 1 – paragraph 1 – point 7, Article 6b – paragraph 2: 2. Member States shall implement a common mechanism for the authentication of relying parties. Member States may revoke the authorisation of relying parties in the case of illegal or fraudulent use of the European Digital Identity Wallet in their country.

Added▌

RemovedRegulation (EU) No 910/2014

Added(54) ‘personal data’ means any information as defined in point 1 of Article 4 of Regulation (EU) 2016/679;

RemovedArticle 1 – paragraph 1 – point 7, Article 6b – paragraph 2 a (new): 2a. Relying parties shall specify to the user a clear and lawful purpose for each request to access electronic attribute attestation, including person identification data.

Added(55) ‘identity matching’ means a process where person identification data or person identification means are matched with or linked to an existing account belonging to the same person;

RemovedRegulation (EU) No 910/2014

Added(55a) 'offline service’ means the capability of a user to electronically identify and authenticate with a third party with close proximity technologies irrespective of whether the device is connected to the internet or not in order to access a wide range of public and private services.";

RemovedArticle 1 – paragraph 1 – point 7, Article 6b – paragraph 3: 3. Relying parties shall be responsible for carrying out the procedure for authenticating and validating electronic attestations of attributes, including person identification data, originating from European Digital Identity Wallets. European Digital Identity Wallets of the relying party may be used for that purpose.

Added(4) Article 5 is replaced by the following:

RemovedRegulation (EU) No 910/2014

Added‘Article 5

RemovedArticle 1 – paragraph 1 – point 7, Article 6b – paragraph 4: 4. By … [6 months of the entering into force of this amending Regulation], the Commission shall establish technical and operational specifications for the requirements referred to in this Article by means of a delegated act as referred to in Article 6a(11a).

AddedProtection of personal data, and use of pseudonyms in electronic transaction

RemovedRegulation (EU) No 910/2014

Added1. The processing of personal data shall be carried out in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and, where relevant, Directive 2002/58/EC, by implementing the principles of data minimisation, purpose limitation, and data protection by design and by default, in particular with respect to the technical measures for the implementation of this Regulation and the interoperability framework in accordance with Article 12 thereof.

RemovedArticle 1 – paragraph 1 – point 7, Article 6c – paragraph 1: 1. European Digital Identity Wallets that have been certified under a cybersecurity scheme pursuant to Regulation (EU) 2019/881 and the references of which have been published in the Official Journal of the European Union shall be presumed to be compliant with the cybersecurity relevant requirements set out in Article 6a of this Regulation, in so far as the cybersecurity certificate or parts thereof cover those requirements. If European cybersecurity certification schemes are available, certificates shall be issued by a national cybersecurity certification authority pursuant to that Regulation or on the basis of a general delegation of the task to a conformity assessment body by the national cybersecurity certification authority.

Added2. Without prejudice to the legal effect given to pseudonyms under national law and unless specific rules of the Union or national law require users to identify themselves for legal purposes, the use of pseudonyms in electronic transactions, freely chosen by the user, shall always be allowed and shall not be prohibited or restricted by means of a contract or the terms and conditions applicable to the use of the service.

RemovedStatements of conformity are issued when certification is performed at level "Basic" of the CSA, which is the lowest security level. Level "Basic" is not suitable for a European Digital Identity Wallet. Therefore, only "certificate" is relevant for Article 6c(1), "statement of conformity" is deleted.

Added3. Unless specific rules of the Union or national law require users to identify themselves for legal purposes, relying parties shall make reasonable efforts to enable the use of their services without electronic identification or authentication.’;

RemovedRegulation (EU) No 910/2014

Added(5) in Chapter II the heading is replaced by the following:

RemovedArticle 1 – paragraph 1 – point 7, Article 6c – paragraph 3: 3. The conformity of European Digital Identity Wallets with the requirements laid down in Article 6a shall be certified by accredited public or private bodies designated by Member States. The Commission shall adopt implementing acts to define a harmonised procedure for the accreditation of such bodies. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Added‘SECTION I

RemovedRegulation (EU) No 910/2014