Changes from report parliamentary committee draft to plenary report

Added(iv) for users of European Digital Identity Wallets and relying parties to request, receive, select, send, authenticate and validate electronic attestations of attributes, person identification data, the identification of relying parties, electronic signatures and electronic seals;

RemovedArticle 1 – paragraph 1 – point 13 – point a, Article 12 – paragraph 3 – point d: (a) in paragraph 3, points (d) is deleted;

Added(v) for users of European Digital Identity Wallets and relying parties to authenticate and validate the European Digital Identity Wallet and approved relying parties;

RemovedRegulation (EU) No 910/2014

Added(vi) for users of European Digital Identity Wallets or relying parties, when available, to perform a zero knowledge proof inferred from person identification data or electronic attestation of attributes;

RemovedArticle 1 – paragraph 1 – point 13 – point b, Article 12 – paragraph 4 – point d: (d) a reference to a minimum set of person identification data necessary to uniquely and persistently represent a natural or legal person, available from electronic identification schemes. In general, insofar as personal data are concerned, the risks to the rights of individuals shall be assessed based on Article 25(1) of Regulation (EU) 2016/679;

Added(vii) for users of European Digital Identity Wallets to transfer and request reissuance of their own electronic attestation of attributes and configurations to another European Digital Identity Wallet belonging to the same user or a device controlled by the same user;

RemovedRegulation (EU) No 910/2014

Added(b) ensure that ▌providers of qualified and non-qualified electronic attestations of attributes are technologically prevented from receiving any information about the use of these attributes;

RemovedArticle 1 – paragraph 1 – point 13 – point b a (new), Article 12 – paragraphs 5, 6 and 7: (b a) paragraphs 5, 6 and 7 are deleted;

Added(c) meet the requirements set out in Article 8 with regards to assurance level “high”, in particular as applied to the requirements for identity proofing and verification, and electronic identification means management and authentication;

RemovedRegulation (EU) No 910/2014

Added(ca) in the case of electronic attestation of attributes with embedded disclosure policies, provide a mechanism to ensure that only the relying party or the user of European Digital Identity Wallets having the necessary electronic attestation of attribute has permission to access it;

RemovedArticle 1 – paragraph 1 – point 13 – point c a (new), Article 12 – paragraph 9: (ca) paragraph 9 is replaced by the following: / '9. The implementing acts referred to in paragraph 8 of this Article shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Added(cb) provide a mechanism to record digital requests received and digital transactions in a cryptographic manner that ensures that it is not possible to repudiate their authenticity;

RemovedRegulation (EU) No 910/2014

Added(cc) provide a mechanism to inform users, without delay, of any security breach that may have entirely or partially compromised their European Digital Identity Wallet or its content and in particular if their European Digital Identity Wallet has been suspended or revoked pursuant to Article 10a.

RemovedArticle 1 – paragraph 1 – point 14, Article 12a – paragraph 2: 2. The peer-review of electronic identification schemes referred to in Article 46(5), point (c), of this Regulation shall not apply to electronic identification schemes or part of such schemes certified in accordance with paragraph 1. Member States may use a certificate or a Union statement of conformity issued in accordance with a relevant European cybersecurity certification scheme established pursuant to Regulation (EU) 2019/881 to demonstrate compliance of such schemes with the requirements set out in Article 8(2) of this Regulation regarding the assurance levels of electronic identification schemes.

Added▌

RemovedRegulation (EU) No 910/2014

Added(e) ensure that the person identification data referred to in Article 12(4), point (d), representing the natural or legal person is associated with it.

RemovedArticle 1 – paragraph 1 – point 14, Article 12a – paragraph 2 a (new): 2a. The certification scheme used to demonstrate conformity pursuant to paragraph 1 shall include a two-year vulnerability assessment of the certified product and a continuous threat monitoring, unless such a certification scheme has been established pursuant to Regulation (EU) 2019/881.

Added(ea) provide a mechanism allowing the user of the European Digital Identity Wallet to act on behalf of another natural or legal person;

RemovedRegulation (EU) No 910/2014

Added(eb) display an "EU Digital Identity Wallet Trust Mark" for the recognition of qualified electronic attestation of attributes;

RemovedArticle 1 – paragraph 1 – point 16, Article 12b – paragraph 2: 2. Where private relying parties providing services are required by national or Union law, to use strong user authentication for online identification, or where strong user authentication is required by contractual obligation, including in the areas of transport, energy, banking and financial services, social security, health, drinking water, postal services, digital infrastructure, educational and professional qualifications, or telecommunications, private relying parties shall also accept the use of European Digital Identity Wallets issued in accordance with Article 6a.

Added(ec) offer qualified electronic signatures to all users by default and free of charge.’;

RemovedRegulation (EU) No 910/2014

Added5. Member States shall provide free of charge validation mechanisms to:

RemovedArticle 1 – paragraph 1 – point 16, Article 12b – paragraph 4: 4. The Commission shall in cooperation with the Member States, industry and the relevant stakeholders, including civil society, encourage and facilitate the development of self-regulatory codes of conduct at Union level (‘codes of conduct’), in order to contribute to wide availability and usability of European Digital Identity Wallets within the scope of this Regulation. These codes of conduct shall ensure acceptance of electronic identification means including European Digital Identity Wallets within the scope of this Regulation in particular by service providers relying on third party electronic identification services for user authentication. The Commission will facilitate the development of such codes of conduct in close cooperation with all relevant stakeholders and encourage service providers to complete the development of codes of conduct within 12 months of the adoption of this Regulation and effectively implement them within 18 months of the adoption of the Regulation.

Added(a) ▌ ensure that the authenticity and validity of European Digital Identity Wallets can be verified;

RemovedRegulation (EU) No 910/2014

Added(b) ▌ allow relying parties and users of European Digital Identity Wallets to verify that the electronic attestations of attributes are authentic and valid;

RemovedArticle 1 – paragraph 1 – point 19, Article 15 – paragraph 1: The provision of Trust services and end-user products used in the provision of those services shall be made accessible for persons with disabilities or with special needs, including older people, in accordance with the accessibility requirements of Annex I of Directive 2019/882 on the accessibility requirements for products and services.;

Added(c) ▌ allow relying parties, users of European Digital Identity Wallets and qualified trust service providers to verify the authenticity and validity of attributed person identification data;

RemovedRegulation (EU) No 910/2014

Added(ca) allow European Digital Identity Wallet users to verify the authenticity and validity of the identity of relying parties approved in accordance with Article 6b(1).

RemovedArticle 1 – paragraph 1 – point 20 – introductory part, Article 17: (20) Article 17 is deleted;

Added5a. Member States shall provide means to revoke the validity of the European Digital Identity Wallet:

RemovedRegulation (EU) No 910/2014

Added(a) upon the explicit request of the user;

RemovedArticle 1 – paragraph 1 – point 20 – point a, Article 17 – paragraph 4 – points c and f: deleted / (deleted) / (deleted) / (deleted) / (deleted)

Added(b) when its security has been compromised;

RemovedRegulation (EU) No 910/2014

Added(c) upon the death of the user or cease of activity of the legal person.

RemovedArticle 1 – paragraph 1 – point 20 – point b, Article 17 – paragraph 6: deleted / (deleted)

Added5b. Member States shall raise awareness about the benefits and risks of the European Digital Identity Wallet by means of communication campaigns. They shall ensure that their citizens are well-trained in its use.

RemovedRegulation (EU) No 910/2014

Added5c. Issuers of European Digital Identity Wallets shall ensure that users can easily request technical support and report technical problems or any other incidents having a negative impact on the provision of services of the European Digital Identity Wallet.

RemovedArticle 1 – paragraph 1 – point 20 – point c, Article 17 – paragraph 8: deleted / (deleted)

Added6. ▌ European Digital Identity Wallets shall be issued under a notified electronic identification scheme of level of assurance ‘high’. ▌

RemovedRegulation (EU) No 910/2014

Added6a. European Digital Identity Wallets shall ensure security-by-design. European Digital Identity Wallets shall provide the necessary state-of-the-art security functionalities, such us mechanisms to encrypt and store data in a way that is only accessible to and decryptable by the user and establish end-to-end encrypted exchanges with relying parties and other European Digital Identity Wallets. They shall offer resistance to skilled attackers, ensure the confidentiality, integrity and availability of their content, including person identification data and electronic attestation of attributes and request the secure, explicit and active user’s confirmation of its operation.

RemovedArticle 1 – paragraph 1 – point 21 – introductory part, Article 18: (21) Article 18 is deleted;

Added6b. The issuance and use of the European Digital Identity Wallets shall be free of charge to all natural and legal persons.

RemovedRegulation (EU) No 910/2014

Added7. The technical framework for the European Digital Identity Wallet shall be subject to the following principles:

RemovedArticle 1 – paragraph 1 – point 21 – point a, Article 18: deleted / (deleted)

Added(a) the user shall be in full control of the European Digital Identity Wallet and the user’s data, including self-certification;

RemovedRegulation (EU) No 910/2014