eidas for e-justice Tallinn (EE), 19 October 2017

Transcription

1 eidas for e-justice Tallinn (EE), 19 October 2017 Andrea Servida DG CONNECT, European Commission Unit "egovernment & Trust"

2 eidas The Regulation in a nutshell 2 MAIN CHAPTERS SUBJECT TO DIFFERENT RULES AND REQUIREMENTS Chapter II Mutual recognition of e-identification means Chapter III Electronic trust services Electronic signatures Electronic seals Time stamping Electronic registered delivery service Website authentication Chapter IV Electronic Documents

3 eidas: boosting trust & supporting businesses! TRUST CONVENIENCE eidas CROSS-BORDER SEAMLESS

4 Timeline days left eid Entry into force of the eidas Regulation Voluntary cross-border recognition eid DSI v.1 eidas compliant Mandatory crossborder recognition Trust Services esignature Directive rules Date of application of eidas rules for trust services 4

5 Trust Services: key principles Non-discrimination principle and legal effect Qualified vs non-qualified services associated legal effects Transparency and liability Trust services Risk management approach Technological neutrality Voluntary technical standards providing presumption of compliance 5 * The Regulation does not impose the use of trust services

6 eidas - Electronic signature and seals 6 Non-discrimination as evidence in legal proceedings (art ) Legal effect (art ) e-signature: only for natural persons Assimilation to handwritten signature e-seal: only for legal persons Integrity of the data and correctness of the origin Recognition in all MS of a qualified electronic signature /seal based on a qualified certificate issued in one MS (art )

7 Definition of Trust Services & electronic documents art. 3(36) Electronic registered delivery service (art. 2(9) of Directive 97/67) Registered item 'electronic registered delivery service' means a service that makes it possible to transmit data between third parties by electronic means and provides evidence relating to the handling of the transmitted data, including proof of sending and receiving the data, and which protects transmitted data against the risk of loss, theft, damage or any unauthorised alterations 'registered item' means a service providing a flat-rate guarantee against risks of loss, theft or damage and supplying the sender, where appropriate upon request, with proof of the handing in of the postal item and/or of its delivery to the addressee

8 Qualified electronic registered delivery service Associated legal effect to the qualified e-registered delivery service Non-discrimination as evidence in court vis-à-vis paper equivalent Data sent and received enjoy the presumption of: the integrity of the data, the sending of that data by the identified sender, the receipt of the data by the identified addressee the accuracy of the date and time of sending and receipt of the data.

9 eidas - Electronic time stamp Non-discrimination as evidence in legal proceedings (art.41.1) Legal effect (art.41.2) Accuracy of the date and time it indicates Integrity of the data to which the date and time are bound Requirements for qualified e-time stamp (art.42) Binds the date and time to data in such a manner as to reasonably preclude undetectable changes to the data Based on accurate time source linked to UTC Signed with an AeS or sealed with an AeSeal of the QTSP or by some equivalent method 9

10 Trust services: where we stand Number of listed QTSPs per MS UK; 1 SK; 5 AT; 3 BE; 3 BG; 4 SE; 1 CZ; 4 RO; 5 SI; 7 PT; 4 PL; 6 DE; 14 EE; 1 DK; 9 EL; 5 NL; 8 MT; 2 ES; 22 LV; 1 LU; 1 LT; 4 LIE; 2 IT; 24 FR; 13 FI; 1 HR; 3 10 IS; 1 IE; 2 HU; 3 Total: 200 QTSPs active in 29 Countries (Sept.2017

11 eidas: Key principles for eid Cooperation between Member States Principle of reciprocity relying on defined levels of assurance Mandatory cross-border recognition only to access public services eid Sovereignty of MS to use or introduce means for eid Full autonomy for private sector Interoperability framework 11 *The Regulation does not impose the use of eid

12 Countries with eid schemes Countries with eid schemes: AT, BE, CZ, DE, DK, EE, ES, FI, HR, HU, IT, IS, LT, LU, LV, MT, NL, NO, PT, RO, SE, SK, TR, UK Countries setting-up national eid schemes: BG, CY, EL, FR, SI Countries to be confirmed: IE, PL Information provided by MSs (as of 1 January 2016): eid cards in 15 MSs (6 planned), other eid means in 24 MSs 25 MSs having either an eid card or other eid means 12

13 Where does eidas have an impact? UMM&DS Uniform User Management and Digital Signatures ehgi ehealth Governance Initiative ECI European Citizens' Initiative ESSN European Social Security Number SUP Directive on single-member private limited liability companies PSD2 Revised Directive on Payment Services AML5 5th Anti-Money Laundering Directive 13

14 Levels of Assurance - (EU) 2015/1502 Elements of Levels of Assurance Enrolment eid means management Authentication Management, organisation application registration identity proofing design issuance suspension renewal and replacement requirements for confirming an identity to a relying party Information Security Management (ISM), record keeping facilities and staff, controls, Compliance and audit An example of differences between LoA: identity proofing Level high: substantial plus Level substantial: low plus Level low Physical appearance at registration (including remote or at earlier stage) Required Not required Not required 14 Verification of identity evidence Verified possession of valid identity evidence (like photo/bio) Based on recognised evidence checked to be genuine. No direct verification of identity evidence assumed to be genuine No direct verification of identity evidence assumed to be genuine

15 KYC Digital on-boarding Customer initiates enrolment procedure How cross-border eid/authentication works Customer accesses bank website website authentication ensures that website belongs to bank Notified eid under eidas 1. Identity verification Customer Due Diligence/Business Relationship Check against fraud risk Minimum data set: current family name current first name date of birth unique identifier Depend on bank/national applicable rules on CDD/KYC Additional attributes: first and family name at birth place of birth current address gender

16 Countries in process of implementing an eidas compliant Node Countries setting-up an eidas compliant Node: AT*, BE*, DE, DK*, EE*, EL*, ES*, FR, HR*, HU, IS, IT*, LU*, MT*, NL*, NO*, PL*, PT, SK, SE, UK* Countries planning national eidas Node implementation: BG, CY, CZ*, FI, LT, LV*, RO, SI, TR Countries to be confirmed: IE, PT * countries that expressed intent to use CEF eid sample implementation Some countries have already communicated their timeline for their node implementation: Belgium Estonia Luxembourg Malta

17 eid schemes notified Germany National ID card registered users On 23 August 2017, DE eid formally notified - Publication to OJEU today! A milestone towards establishing eid and trust services in Europe achieved! NEW!. and 5 more countries are intending to pre-notify their schemes by the end of 2017! 17

18 Reuse of building blocks by CEF's sectorial projects Sector Specific DSIs Building Block DSIs CEF edelivery Building Blocks esignature eid etranslation einvoicing Europeana * Safer internet * Public open data ODR ehealth eprocurement EESSI EU e-justice portal BRIS (ECP) Cybersecurity etranslation DG CONNECT DG CONNECT DG CONNECT DG JUST DG SANTE DG GROW DG EMPL DG JUST DG JUST DG CONNECT DGT Decided not to reuse Commitment to analyse Commitment to reuse Reusing * Projects run together with Member States through grants provided by CEF.

19 Reuse by Policy DGs (without CEF funding) Building Block DSIs CEF edelivery Building Blocks esignature eid etranslation einvoicing Policy projects * FLUX CISE eparticipation EU-CEG TRACES LRI EUGO UUMDS ECRIS PNR Tachonet DG MARE DG MARE DG CONNECT DG SANTE DG SANTE DG JUST DG GROW DG TAXUD DG JUST DG HOME DG MOVE * The list of over 20 systems reusing only etranslation is available on the CEF Dashboard, Decided not to reuse Commitment to analyse Commitment to reuse Reusing

20 For further information and feedback Web page on eidas eidas Observatory s-observatory Text of eidas Regulation in all languages Connecting Europe Facility Catalogue of Building Blocks eidas twitter Andrea Servida DG CONNECT, European Commission Unit "egovernment & Trust" 20