The European Parliament adopted by 335 votes to 190, with 31 abstentions, a legislative resolution on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity.

This proposed Regulation establishes a European digital identity framework allowing Union citizens and residents in the Union to access public and private online and offline services throughout the Union.

The European Parliament's position adopted at first reading under the ordinary legislative procedure amends the Commission's proposal as follows:

European Digital Identity Wallets

European Digital Identity Wallets should enable the user, in a manner that is user-friendly, transparent, and traceable by the user, to:

- securely request, obtain, select, combine, store, delete, share and present, under the sole control of the user, person identification data and, where applicable, in combination with electronic attestations of attributes, to authenticate to relying parties online and, where appropriate, in offline mode, in order to access public and private services, while ensuring that selective disclosure of data is possible;

- generate pseudonyms and store them encrypted and locally within the European Digital Identity Wallet;

- securely authenticate another person’s European Digital Identity Wallet, and receive and share person identification data and electronic attestations of attributes in a secured way between the two European Digital Identity Wallets;

- access a log of all transactions carried out through the European Digital Identity Wallet via a common dashboard enabling the user to: (i) view an up-to-date list of relying parties with which the user has established a connection; (ii) easily request the erasure by a relying party of personal data; (iii) easily report a relying party to the competent national data protection authority, where an allegedly unlawful or suspicious request for data is received; (iv) sign by means of qualified electronic signatures or seal by means of qualified electronic seals.

The source code of the application software components of European Digital Identity Wallets should be open-source licensed to encourage transparency, innovation and to enhance security. The issuance, use and revocation of the European Digital Identity Wallets should be free of charge to all natural persons. Users should have full control of the use of and of the data in their European Digital Identity Wallet.

The use of European Digital Identity Wallets shall be voluntary . Access to public and private services, access to the labour market and freedom to conduct business should not in any way be restricted or made disadvantageous to natural or legal persons that do not use European Digital Identity Wallets. It shall remain possible to access public and private services by other existing identification and authentication means.

Any processing of personal data carried out by the Member States or on their behalf by bodies or parties responsible for the provision of European Digital Identity Wallets as electronic identification means shall be carried out in accordance with appropriate and effective data protection measures.

The conformity of European Digital Identity Wallets and the electronic identification scheme under which they are provided with the requirements laid down in the Regulation should be certified by conformity assessment bodies designated by Member States.

Registering and monitoring

Where a relying party intends to rely upon European Digital Identity Wallets for the provision of public or private services by means of digital interaction, the relying party should register in the Member State where it is established.

The registration process should be cost-effective and proportionate-to-risk. The relying party should provide at least: (i) the information necessary to authenticate to European Digital Identity Wallets, which as a minimum includes: (i) the contact details of the relying party; (ii) the intended use of European Digital Identity Wallets, including an indication of the data to be requested by the relying party from users.

Member States should designate one or more supervisory bodies established in their territory. These bodies should be given the necessary powers and adequate resources for the exercise of their tasks in an effective, efficient and independent manner. The role of the supervisory bodies designated should be to:

- supervise providers of European Digital Identity Wallets established in the designating Member State and to ensure, by means of ex ante and ex post supervisory activities, that those providers and European Digital Identity Wallets they provide meet the requirements laid down in this Regulation;

- take action, if necessary, in relation to providers of European Digital Identity Wallets established in the territory of the designating Member State, by means of ex post supervisory activities, when informed that providers or European Digital Identity Wallets that they provide infringe this Regulation.

Qualified electronic signatures

The Regulation provides for free qualified electronic signatures for EU wallet users, which are the most trusted, and have the same legal standing as a handwritten signature, as well as wallet-to-wallet interactions, to improve the fluidity of digital exchanges.

An attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source in one Member State should be recognised as an attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source in all Member States.

The Committee on Industry, Research and Energy adopted the report by Romana JERKOVIĆ (S&D, HR) on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity.

The new European Digital Identity would allow citizen to safely participate in the digital society and facilitate unrestricted access to online public services throughout the Union for any natural or legal person.

The committee responsible recommended that the European Parliament's position adopted at first reading under the ordinary legislative procedure should amend the proposal as follows:

European Digital Identity Wallet

Members clarified the definition of ‘European Digital Identity Wallet’ to mean an electronic identification means which securely stores, manages and validates identity data and electronic attestations of attributes, to provide them to relying parties and other users of European Digital Identity Wallets on request, and which enables the creation of qualified electronic signatures and seals.

To ensure that all natural and legal persons in the Union have secure, reliable, trusted and seamless access to cross-border public and private services, while having full control over their data, each Member State should issue at least one European Digital Identity Wallet by 18 months after the date of entry into force of this amending Regulation.

European Digital Identity Wallets should:

- be issued and managed in any of the following ways: (i) directly by a Member State; (ii) under a mandate from a Member State; (iii) independently from a Member State but recognised by that Member State;

- be voluntary ;

- provide common protocols and interfaces: (i) to establish unique, private and secure peer-to peer connections between two European Digital Identity Wallets or between an European Digital Identity Wallet and a relying party; (ii) for users of European Digital Identity Wallets and relying parties to request, receive, select, send, authenticate and validate electronic attestations of attributes, person identification data, the identification of relying parties, electronic signatures and electronic seals;

- provide the necessary state-of-the-art security functionalities, such us mechanisms to encrypt and store data in a way that is only accessible to and decryptable by the user and establish end-to-end encrypted exchanges with relying parties and other European Digital Identity Wallets;

- be free of charge to all natural and legal persons.

National competent authorities and single point of contact

The report stressed that each Member State should establish one or more new national competent authorities to carry out the tasks assigned to them. Member States should designate one national single point of contact on European digital identity framework (single point of contact). The national competent authorities should, inter alia : (i) monitor and enforce the application of this Regulation; (ii) supervise issuers of European Digital Identity Wallets; (iii) supervise allegedly unlawful or inappropriate behaviours; (iv) supervise qualified trust service providers.

The European Digital Identity Framework Board

Members also proposed the establishment of the European Digital Identity Framework Board (EDIFB) composed of representatives of national competent authorities and the Commission. The EDIFB should assist the Commission in: (i) the preparation of legislative proposals and policy initiatives in the field of digital wallets, electronic identification means and trust services; (ii) exchanging good practices and information regarding the application of the provisions of this Regulation; (iii) carrying out coordinated security risk assessments in cooperation with ENISA.

PURPOSE: to amend Regulation (EU) No 910/2014 as regards establishing a framework for a European digital identity.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.

BACKGROUND: the electronic identification and trust services for electronic transactions in the internal market Regulation ( Regulation 910/2014 ) (eIDAS) is the only cross-border framework for trusted electronic identification (eID) of natural and legal persons, and trust services. eIDAS, adopted in 2014, is based on national eID systems following diverse standards and focuses on a relatively small segment of the electronic identifications needs of citizens and businesses: secure cross-border access to public services. Since then, digitalisation of all functions of society has increased dramatically with the COVID-19 pandemic having a very strong effect on the speed of digitalisation. As a consequence, the demand for means to identify and authenticate online, as well as to digitally exchange information related to our identity, attributes or qualifications (identity, addresses, age, but also professional qualifications, driving licences and other permits and payment systems), securely and with a high level of data protection, has increased radically.

Currently, there is no requirement for Member States to develop a national digital ID and to make it interoperable with the ones of other Member States, which leads to high discrepancies between countries. The current proposal will address these shortcomings by improving the effectiveness of the framework and extending its benefits to the private sector and to mobile use.

CONTENT: the proposed framework for a European Digital Identity aims to achieve a shift from the reliance on national digital identity solutions only, to the provision of electronic attestations of attributes valid at European level. Providers of electronic attestations of attributes should benefit from a clear and uniform set of rules and public administrations should be able to rely on electronic documents in a given format.

More specifically, the proposed Regulation seeks to amend Regulation (EU) No 910/2014 to require Member States to issue a European Digital Identity Wallet under a notified eID scheme. It includes provisions to ensure that natural and legal persons will have the possibility to securely request and obtain, store, combine and use person identification data and electronic attestations of attributes to authenticate online and offline and to allow access to goods and online public and private services under the user’s control.

Main objectives

The general objective of this initiative is to ensure the proper functioning of the internal market, particularly in relation to the provision and use of cross-border and cross-sector public and private services relying on the availability and use of highly secure and trustworthy electronic identity solutions.

The specific objectives seek to:

- provide access to trusted and secure digital identity solutions that can be used across borders, meeting user expectations and market demand;

- ensure that public and private services can rely on trusted and secure digital identity solutions across borders;

- provide citizens full control of their personal data and assure their security when using digital identity solutions;

- ensure equal conditions for the provision of qualified trust services in the EU and their acceptance.

European Digital Identity Wallet

Under the new proposed Regulation, Member States will offer citizens and businesses digital wallets that will be able to link their national digital identities with proof of other personal attributes (e.g. driving licence, diplomas, bank account). These wallets may be provided by public authorities or by private entities, provided they are recognised by a Member State.

Trust service

In order to achieve a high level of security and trustworthiness, this Regulation establishes the requirements for European Digital Identity Wallets. The conformity of European Digital Identity Wallets with those requirements should be certified by accredited public or private sector bodies designated by Member States. Relying on a certification scheme based on the availability of commonly agreed standards with Member States should ensure a high level of trust and interoperability.

Moreover, in order to ensure that users can identify who is behind a website, the proposal makes an amendment which would require providers of web browsers to facilitate the use of qualified certificates for website authentication.

Personal data security

It is proposed that European Digital Identity Wallets should ensure the highest level of security for the personal data used for authentication irrespective of whether such data is stored locally or on cloud-based solutions, taking into account the different levels of risk. Any personal data would be shared online only if the citizen chooses to share that information .

Budgetary implications

The total financial resources necessary for the implementation of the proposal in the 2022-2027 period will be up to EUR 30.825 million , including EUR 8.825 million of administrative costs and up to EUR 22 million in operational spending covered by the Digital Europe Programme (pending agreement). The financing will support costs linked to maintaining, developing, hosting, operating and supporting the eID and trust services’ building blocks. It may also support grants for connecting services to the European Digital Identity Wallet ecosystem, the development of standards and technical specifications.