Changes from report parliamentary committee draft to plenary report

AddedELECTRONIC IDENTIFICATION;’

RemovedArticle 1 – paragraph 1 – point 7, Article 6c – paragraph 4: 4. By … [6 months of the entering into force of this amending Regulation], the Commission shall, by means of implementing acts, establish a list of standards for the certification of the European Digital Identity Wallets referred to in paragraph 3. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Added(6) Article 6 is deleted;

RemovedRegulation (EU) No 910/2014

Added(7) the following Articles ▌are inserted:

RemovedArticle 1 – paragraph 1 – point 7, Article 6d – paragraph 3: 3. By … [6 months of the entering into force of this amending Regulation], the Commission shall define formats and procedures applicable for the purposes of paragraph 1 by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11).

Added‘Article 6a

RemovedRegulation (EU) No 910/2014

AddedEuropean Digital Identity Wallets

RemovedArticle 1 – paragraph 1 – point 9, Article 7 – paragraph 1 – introductory part: Pursuant to Article 9(1) Member States shall notify, within 12 months after the entry into force of this Regulation at least one electronic identification scheme including at least one identification means that fulfil all the following criteria:

Added1. For the purpose of ensuring that all natural and legal persons in the Union have secure, reliable, trusted and seamless access to cross-border public and private services, while having full control over their data, each Member State shall issue at least one European Digital Identity Wallet by ... [18 months after the date of entry into force of this amending Regulation].

RemovedRegulation (EU) No 910/2014

Added2. European Digital Identity Wallets shall be issued and managed in any of the following ways:

RemovedArticle 1 – paragraph 1 – point 10 a (new), Article 10 – title: (10a) in Article 10, the titleis replaced by the following: / 'Security breach of electronic identification schemes for cross-border authentication'

Added(a) directly by a Member State;

RemovedRegulation (EU) No 910/2014

Added(b) under a mandate from a Member State;

RemovedArticle 1 – paragraph 1 – point 11, Article 10a – paragraph 1: 1. Where European Digital Identity Wallets issued pursuant to Article 6a or the validation mechanisms referred to in Article 6a(5) points (a), (b) and (c) are breached or partly compromised in a manner that affects their reliability and the confidentiality, integrity or availability of user data, or the reliability of other European Digital Identity Wallets, the issuer of the compromised European Digital Identity Wallet shall, without delay, suspend the issuance and revoke the validity of the European Digital Identity Wallet and inform single point of contact pursuant to Article 46a and the affected users.

Added(c) independently from a Member State but recognised by that Member State.

RemovedRegulation (EU) No 910/2014

Added2a. The source code used for providing European Digital Identity Wallets shall be open source and shall be published for auditing and review.

RemovedArticle 1 – paragraph 1 – point 11, Article 10a – paragraph 1 a (new): 1a. After notification of the security breach of the European Digital Identity Wallet, the single point of contact shall liaise with the relevant national competent authorities and, when necessary, with EDIB, EDPB, the Commission and ENISA.

Added3. European Digital Identity Wallets shall, in a user-friendly manner, enable the user to:

RemovedRegulation (EU) No 910/2014

Added(a) securely request and obtain, store, select, combine and share, in a manner that is transparent to, traceable by and under the sole control of the user, the necessary ▌ identification data to identify and authenticate the user online and offline in order to use online public and private services;

RemovedArticle 1 – paragraph 1 – point 11, Article 10a – paragraph 2: 2. Where the breach or compromise referred to in paragraph 1 is remedied, the issuer of the European Digital Identity Wallet shall re-establish the issuance and the use of the European Digital Identity Wallet and inform national competent authorities of other Member States, the affected users and the Commission without undue delay.

Added(aa) securely store, select, combine and share electronic attestation of attributes;

RemovedRegulation (EU) No 910/2014

Added(ab) securely issue and revoke electronic attestation of attributes issued directly by the user;

RemovedArticle 1 – paragraph 1 – point 11, Article 10a – paragraph 3: 3. If the breach or compromise referred to in paragraph 1 is not remedied within three months of the suspension or revocation, the Member State concerned shall withdraw the European Digital Identity Wallet concerned and inform the other Member States and the Commission on the withdrawal accordingly. Where it is justified by the severity of the breach, the European Digital Identity Wallet concerned shall be withdrawn without delay.

Added(ac) generate pseudonyms and store them encrypted and locally within it;

RemovedRegulation (EU) No 910/2014

Added(ad) securely authenticate a third person’s European Digital Identity Wallets or a connecting relying party, and receive and authenticate in a transparent and traceable manner the third party identity data and electronic attestation of attributes online and offline;

RemovedArticle 1 – paragraph 1 – point 11, Article 10a – paragraph 5: 5. By … [6 months of the entering into force of this amending Regulation], the Commission shall further specify the measures referred to in paragraphs 1 and 3 by means of a delegated act adopted in accordance with Article 47.

Added(ae) access a data base of all transactions carried out through the European Digital Identity Wallet via a common dashboard enabling the user to:

RemovedRegulation (EU) No 910/2014

Added(i) view an up to date list of relying parties with whom the user has established a connection and where applicable all data shared;

RemovedArticle 1 – paragraph 1 – point 12, Article 11a – title: Cross-border user Identification

Added(ii) easily request to a relying party the deletion of personal data pursuant to Article 17 of the Regulation (EU) 2016/679);

RemovedRegulation (EU) No 910/2014

Added(iii) easily report to the competent national authority where a relying party is established if an unlawful or inappropriate request of data is received without leaving the European Digital Identity Wallet;

RemovedArticle 1 – paragraph 1 – point 12, Article 11a – paragraph 1: 1. When notified electronic identification means and the European Digital Identity Wallets are used for cross-border authentication and identification, Member States shall ensure user identification.

Added(iv) revoke any electronic attestation of attribute issued by the user;

RemovedRegulation (EU) No 910/2014

Added(b) sign by means of qualified electronic signatures;

RemovedArticle 1 – paragraph 1 – point 12, Article 11a – paragraph 2: 2. In order to ensure interoperability of European Digital Identity Wallets, Member States shall provide a minimum set of person identification data, in conformity with national and Union law, which can unequivocally identify the user upon their request in those cases where identification of the user is required by law.

Added(ba) download all users’ data, electronic attestation of attributes and configurations;

RemovedRegulation (EU) No 910/2014

Added(bb) exercise users’ rights of data portability by switching to another European Digital Identity Wallet belonging to the same user.

RemovedArticle 1 – paragraph 1 – point 12, Article 11a – pargraph 3: 3. By … [6 months of the entering into force of this amending Regulation], the Commission shall lay down further technical specifications that are privacy enhancing and that will ensure trustworthy, secure and interoperable cross-border authentication and identification of users by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11).

Added4. European Digital Identity Wallets shall, in particular:

RemovedRegulation (EU) No 910/2014

Added(a) provide ▌ common protocols and interfaces:

RemovedArticle 1 – paragraph 1 – point 13 – point -a (new), Article 12 – title: (-a) in Article 12, the title is replaced by the following: / ‘Interoperability'

Added(i) to securely interact with the electronic identification means associated pursuant to Article 7(2), for the purpose of identifying and authenticating the user;

RemovedRegulation (EU) No 910/2014

Added(ii) for issuers of electronic attestation of attributes to issue electronic attestation of attributes into the user’s European Digital Identity Wallet;

RemovedArticle 1 – paragraph 1 – point 13 – point -a a (new), Article 12 – paragraph 3 – point (c): (-aa) in paragraph 3, point (c) is replaced by the following: / '(c) it ensures that personal data is processed in accordance with Regulation (EU) 2016/679.'

Added(iii) to establish unique, private and secure peer-to peer connections between two European Digital Identity Wallets or between an European Digital Identity Wallet and a relying party;

RemovedRegulation (EU) No 910/2014