Changes from report parliamentary committee draft to plenary report

Added(b) the European Digital Identity Wallet shall use decentralised elements for the identity architecture;

RemovedArticle 1 – paragraph 1 – point 21 – point b, Article 18: deleted / (deleted)

Added(c) the set of electronic identification means, attributes and certificates contained in a European Digital Identity Wallet shall be stored securely and exclusively on devices controlled by the user, unless the user freely consents to storage on third-party devices or to a cloud based option;

RemovedRegulation (EU) No 910/2014

Added(e) the European Digital Identity Wallet shall allow secure connections between the user and the relying parties;

RemovedArticle 1 – paragraph 1 – point 21 – point c, Article 18: deleted / (deleted) / (deleted)

Added(f) the technical architecture of the European Digital Identity Wallet shall prevent the issuer of ▌European Digital Identity Wallets, Member State or any other parties from collecting or obtaining electronic identification means, attributes, electronic documents contained in a European Digital Identity Wallet and information about the use of the European Digital Identity Wallet by the user, except where requested by the user using devices in the user’s control and he exchange of information via the European Digital Identity Wallet shall not allow providers of electronic attestations of attributes to track, link, correlate or otherwise obtain knowledge of transactions or user behaviour;

RemovedRegulation (EU) 910/2014

Added(g) unique and persistent identifiers shall not be accessible to relying parties in cases other than when identification of the user is required by Union or national law;

RemovedArticle 1 – paragraph 1 – point 25 – point a, Article 24 – paragraph 1 – point c: (c) by using other identification methods which ensure the identification of the natural person with a high level of confidence and security, the conformity of which shall be confirmed by a conformity assessment body and which shall comply with the up-to-date standards on ID proofing with a view of ensuring a high level of security and interoperability of electronic identification and trust services in the Union;

Added(h) Member States shall ensure that relevant information on the European Digital Identity Wallet is publicly available;

RemovedRegulation (EU) 910/2014

Added(i) personal data relating to the provision of European Digital Identity Wallets shall be kept physically and logically separate from any other data held;

RemovedArticle 1 – paragraph 1 – point 25 – point c – point 4, Article 24 – paragraph 2 – point j: (4) point (j) is replaced by the following: / '(j) ensure lawful processing of personal data in accordance with Regulation (EU) 2016/679;

Added(j) if the European Digital Identity Wallet is provided by private parties in accordance to paragraph 1 (b) and (c), the provisions of Article 45f(4) shall apply mutatis mutandis;

RemovedRegulation (EU) 910/2014

Added(k) where attestation of attributes does not require the identification of the user, zero knowledge proof shall be performed;

RemovedArticle 1 – paragraph 1 – point 25 – point f, Article 24 – paragraph 6: 6. The Commission shall be empowered to adopt delegated acts regarding the additional measures referred to in paragraph 2(fa). Those delegated acts shall start to apply from 24 months after they have entered into force, unless duly justified by a major security risk.

Added(l) the issuer of the European Digital Identity Wallet shall be the controller for the purposes of Regulation (EU) 2016/679 regarding the processing of personal data in the European Digital Identity Wallet;

RemovedRegulation (EU) 910/2014

Added(m) the European Digital Identity Wallet shall provide a complaint mechanism to enable users to inform the supervisory body under this Regulation and the supervisory authorities established under Regulation (EU) 2016/679 directly where a relying party requests a disproportionate amount of data which is not in line with the registered intended use of that data.

RemovedArticle 1 – paragraph 1 – point 35, Article 39a – title: Requirements for generating, managing and duplicating electronic seal creation data and for a qualified service for the management of remote electronic seal creation devices

Added7a. The use of the European Digital Identity Wallet shall be voluntary. Access to public and private services, access to labour market and freedom to conduct business shall not in any way be restricted or made disadvantageous for natural or legal persons not using European Digital Identity Wallets. It shall remain possible to access public and private services by other existing identification and authentication means.

RemovedRegulation (EU) 910/2014

Added▌

RemovedArticle 1 – paragraph 1 – point 35, Article 39a – paragraph 1: Article 29(1a) and 29a shall apply mutatis mutandis to a qualified service for the management of remote electronic seal creation devices.;

Added9. Article 24(2), points (b), (d), (e), (f), (fa), (fb), (g), and (h) shall apply mutatis mutandis to Member States directly issuing and managing the European Digital Identity Wallets.

RemovedRegulation (EU) 910/2014

Added10. The European Digital Identity Wallet shall be made accessible for persons with disabilities in accordance with the accessibility requirements of Annex I to Directive (EU) 2019/882 and the United Nations Convention on the Rights of Persons with Disabilities, as well as to persons with special needs, including older people and persons with limited access to digital technologies or with insufficient digital literacy.

RemovedArticle 1 – paragraph 1 – point 38, Article 45: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Added11. By … [6 months after the date of entry into force of this amending Regulation], the Commission shall ▌ reference standards for the requirements referred to in this Article by means of an implementing act on the implementation of the European Digital Identity Wallet. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 48(2).

RemovedRegulation (EU) 910/2014

Added11a. By ... [6 months after the date of entry into force of this amending Regulation], the Commission shall adopt a delegated act in accordance with Article 47 supplementing this Regulation by establishing technical and operational specifications for the requirements referred to in this Article.

RemovedArticle 1 – paragraph 1 – point 39, Article 45a – paragraph 3 a (new): 3a. Lawfully issued attestations presented to the relying parties in the paper form instead of electronic attestations of attributes shall not be denied by relying parties.

AddedEuropean Digital Identity Wallets Relying Parties

RemovedRegulation (EU) 910/2014

Added1. Where a relying party intends to rely upon European Digital Identity Wallets for the provision of public or private services it shall register in to the Member State where the relying party is established. The relying party’s registration shall include information about the data that it intends to request with regard to each different service provided, the intended use of the data requested and the reasons for the request. The relying party shall notify the Member State about any change to the information notified with undue delay.

RemovedArticle 1 – paragraph 1 – point 39, Article 45c – title: Requirements for qualified electronic attestation of attributes

Added1a. Relying parties that intend to process special categories of personal data, such as health or biometric data as referred to in Article 9 of the Regulation (EU) 2016/679 shall require prior approval from the competent authorities in the Member State in which they intend to provide their services. Relying parties that are granted the approval shall ensure that processing of personal information is carried out in accordance with Article 6(1) of the Regulation (EU) 2016/679.

RemovedRegulation (EU) No 910/2014

Added1b. Paragraphs 1 and 1a shall be without prejudice to ex-ante approval requirements set out in Union law or national law for the provision of specific services.

RemovedArticle 1 – paragraph 1 – point 39, Article 45c – paragraph 4: 4. By … [6 months of the entering into force of this amending Regulation], the Commission shall establish reference numbers of standards for qualified electronic attestations of attributes by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11).

Added1c. Member States shall make the information referred to in paragraph 1 publicly available online, together with the identity of each relying party and their contact details.

RemovedRegulation (EU) No 910/2014

Added1d. Member States shall establish ex-post controls to verify that data requests are proportionate and commensurate with the declared intent and that the principle of data minimisation is respected.

RemovedArticle 1 – paragraph 1 – point 39, Article 45d – paragraph 1 a (new): 1a. Authentic sources may issue non-qualified electronic attestation of attributes at the request of the user.

Added1e. The European Digital Identity Framework Board established pursuant to Article 46c or any Member State shall revoke the authorisation of relying parties in the case of illegal or fraudulent use of the European Digital Identity Wallet, or suspend such authorisation until identified irregularities have been remedied.

RemovedRegulation (EU) No 910/2014

Added2. Member States shall implement a common mechanism for the identification and authentication of relying parties and the verification of the notified data sets referred in Article 6a(4), points (ca) and (cb).

RemovedArticle 1 – paragraph 1 – point 39, Article 45d – paragraph 2: 2. By … [6 months of the entering into force of this amending Regulation], taking into account relevant international standards, the Commission shall set out the minimum technical specifications, standards and procedures with reference to the catalogue of attributes and schemes for the attestation of attributes and verification procedures for qualified electronic attestations of attributes by means of an implementing act on the implementation of the European Digital Identity Wallets as referred to in Article 6a(11).

Added2a. Where relying parties intend to rely upon European Digital Identity Wallets issued in accordance with this Regulation, they shall authenticate and identify themselves to the user of the European Digital Identity Wallet, before any other form of transaction can take place.

RemovedRegulation (EU) No 910/2014

Added3. Relying parties shall be responsible for carrying out the procedure for authenticating and validating person identification data and electronic attestation of attributes originating from European Digital Identity Wallets. Relying parties shall accept the use of pseudonyms, unless the identification of the user is required by Union or national law.

RemovedArticle 1 – paragraph 1 – point 39, Article 45e – paragraph 1 a (new): 1a. Public registers shall issue its qualified electronic attestation of attributes to the user of an European Digital Identity Wallet at his or her request.

Added3a. Intermediaries acting on behalf of relying parties are to be considered relying parties and shall not obtain data about the content of the transaction.

RemovedRegulation (EU) No 910/2014

Added4. By ...[6 months after the date of entry into force of this amending Regulation], the Commission shall adopt delegated acts in accordance with Article 47, supplementing this Regulation by establishing technical and operational specifications for the requirements referred to in this Article, in accordance with Article 6a(11a).

RemovedArticle 1 – paragraph 1 – point 39, Article 45e – paragraph 1 b (new): 1b. Non-qualified attestation of attributes can be issued by any trust service provider or directly through a European Digital Identity Wallet.

AddedCertification of the European Digital Identity Wallets

RemovedRegulation (EU) No 910/2014