Preamble 61 to 70
(61) Attributes provided by the qualified trust service providers as part of the qualified attestation of attributes should be verified against authentic sources either directly by the qualified trust service provider or by means of designated intermediaries recognised at national level in accordance with Union or national law for the purpose of secure exchange of attested attributes between identity or attestation of attributes’ service providers and relying parties.
Member States should establish appropriate mechanisms at national level to ensure that qualified trust service providers issuing qualified electronic attestation of attributes are able, on the basis of the consent of the person to whom the attestation is issued, to verify the authenticity of the attributes relying on authentic sources. It should be possible for appropriate mechanisms to include the use of specific intermediaries or technical solutions in accordance with national law allowing access to authentic sources.
Ensuring the availability of a mechanism that allows the verification of attributes against authentic sources is intended to facilitate the compliance of the qualified trust service providers of qualified electronic attestation of attributes with their obligations under Regulation (EU) No 910/2014. A new annex to that Regulation should contain a list of categories of attributes with regard to which Member States are to ensure that measures are taken to allow qualified providers of electronic attestations of attributes to verify by electronic means, at the request of the user, their authenticity against the relevant authentic source.
(62) Secure electronic identification and the provision of attestation of attributes should offer additional flexibility and solutions for the financial services sector to allow the identification of customers and the exchange of specific attributes necessary to comply with, for example, customer due diligence requirements under a future Regulation establishing the Anti Money Laundering Authority, with suitability requirements stemming from investor protection law, or to support the fulfilment of strong customer authentication requirements for online identification for the purposes of account login and of initiation of transactions in the field of payment services.
(63) The legal effect of an electronic signature is not to be challenged on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic signature. However, it is for national law to establish the legal effect of electronic signatures, except for the requirements provided for in this Regulation according to which the legal effect of a qualified electronic signature is to be considered to be equivalent to that of a handwritten signature.
In determining the legal effects of electronic signatures, Member States should take into account the principle of proportionality between the legal value of a document to be signed and the level of security and cost that an electronic signature requires. To increase the accessibility and use of electronic signatures, Member States are encouraged to consider the use of advanced electronic signatures in the day-to-day transactions for which they provide a sufficient level of security and confidence.
(64) In order to ensure the consistency of certification practices across the Union, the Commission should issue guidelines on the certification and recertification of qualified electronic signature creation devices and of qualified electronic seal creation devices, including their validity and limitations in time.
This Regulation does not prevent the public or private bodies that have certified qualified electronic signature creation devices from temporarily re-certifying such devices for a short certification period on the basis of the results of the previous certification process, where such re-certification cannot be performed within the legally set time frame for a reason other than a breach or security incident, without prejudice to the obligation to conduct a vulnerability assessment and without prejudice to the applicable certification practice.
(65) The issuance of certificates for website authentication is intended to provide users with assurance with a high level of confidence in the identity of the entity standing behind the website, irrespective of the platform used to display that identity. Those certificates should contribute to the building of trust in conducting business online, as users would have confidence in a website that has been authenticated.
The use of such certificates by websites should be voluntary. In order for website authentication to become a means by which to increase trust, to provide a better experience for the user and to foster growth in the internal market, this Regulation lays down a trust framework including minimal security and liability obligations for the providers of qualified certificates for website authentication and requirements for the issuance of those certificates.
National trusted lists should confirm the qualified status of website authentication services and of their trust service providers, including their full compliance with the requirements of this Regulation with regard to the issuance of qualified certificates for website authentication. The recognition of qualified certificates for website authentication means that the providers of web-browsers should not deny the authenticity of qualified certificates for website authentication for the sole purpose of attesting the link between the website domain name and the natural or legal person to whom the certificate is issued or confirming the identity of that person.
Providers of web-browsers should display the certified identity data and the other attested attributes to the end-user in a user-friendly manner in the browser environment, by technical means of their choice. To that end, providers of web-browsers should ensure support and interoperability with qualified certificates for website authentication issued in full compliance with this Regulation.
The obligation of recognition and interoperability of and support for qualified certificates for website authentication does not affect the freedom of providers of web-browsers to ensure web security, domain authentication and the encryption of web traffic in a manner and by means of technology that they consider to be the most appropriate. In order to contribute to the online security of end-users, providers of web-browsers should, in exceptional circumstances, be able to take precautionary measures that are both necessary and proportionate in reaction to substantiated concerns regarding security breaches or the loss of integrity of an identified certificate or set of certificates.
Where they take such precautionary measures, providers of web-browsers should notify, without undue delay, the Commission, the national supervisory body, the entity to which the certificate was issued and the qualified trust service provider that issued that certificate or set of certificates, of any concern with regard to such a security breach or loss of integrity as well as the measures taken relating to the single certificate or set of certificates.
Those measures should be without prejudice to the obligation of the providers of web-browsers to recognise qualified website authentication certificates in accordance with the national trusted lists. To further protect Union citizens and residents in the Union and promote the use of qualified certificates for website authentication, public authorities in Member States should consider incorporating qualified certificates for website authentication in their websites.
The measures provided for by this Regulation that aim to bring increased coherence between Member States’ divergent approaches and practices relating to supervisory procedures are intended to contribute to improved trust and confidence in the security, quality and availability of qualified certificates for website authentication.
(66) Many Member States have introduced national requirements for services providing secure and trustworthy electronic archiving in order to allow for the long-term preservation of electronic data and electronic documents, and associated trust services. To ensure legal certainty, trust and harmonisation across Member States, a legal framework for qualified electronic archiving services should be established, inspired by the framework of the other trust services set out in this Regulation.
The legal framework for qualified electronic archiving services should offer trust service providers and users an efficient toolbox that includes functional requirements for the electronic archiving service, as well as clear legal effects when a qualified electronic archiving service is used.
Those provisions should apply to electronic data and electronic documents created in electronic form as well as paper documents that have been scanned and digitised. When required, those provisions should permit the preserved electronic data and electronic documents to be ported on different media or formats for the purpose of extending their durability and legibility beyond the technological validity period, while preventing loss and alteration to the extent possible.
When electronic data and electronic documents submitted to the electronic archiving service contain one or more qualified electronic signatures or qualified electronic seals, the service should use procedures and technologies capable of extending their trustworthiness for the preservation period of such data, possibly relying on the use of other qualified trust services established by this Regulation.
In order to create preservation evidence where electronic signatures, electronic seals or electronic timestamps are used, qualified trust services should be used. To the extent that electronic archiving services are not harmonised by this Regulation, it should be possible for Member States to maintain or introduce national provisions, in accordance with Union law, relating to those services, such as specific provisions for services integrated in an organisation and only used for the internal archives of that organisation. This Regulation should not distinguish between electronic data and electronic documents created in electronic form and physical documents that have been digitised.
(67) The activities of national archives and memory institutions, in their capacity as organisations dedicated to preserving the documentary heritage in the public interest, are usually regulated in national law and they do not necessarily provide trust services within the meaning of this Regulation. In so far such institutions do not provide such trust services, this Regulation is without prejudice to their operation.
(68) Electronic ledgers are a sequence of electronic data records which should ensure their integrity and the accuracy of their chronological ordering. Electronic ledgers should establish a chronological sequence of data records.
In conjunction with other technologies, they should contribute to solutions for more efficient and transformative public services such as e-voting, cross-border cooperation of customs authorities, cross-border cooperation of academic institutions and the recording of ownership for real estate in decentralised land registries. Qualified electronic ledgers should establish a legal presumption for the unique and accurate sequential chronological ordering and integrity of the data records in the ledger.
Due to their specificities, such as the sequential chronological ordering of data records, electronic ledgers should be distinguished from other trust services such as electronic time stamps and electronic registered delivery services. To ensure legal certainty and promote innovation, a Union-wide legal framework that provides for the cross-border recognition of trust services for the recording of data in electronic ledgers should be established.
This should sufficiently prevent the same digital asset from being copied and sold more than once to different parties. The process of creating and updating an electronic ledger depends on the type of ledger used, namely whether it is centralised or distributed.
This Regulation should ensure technological neutrality, namely neither favouring, nor discriminating against, any technology used to implement the new trust service for electronic ledgers. In addition, sustainability indicators with regard to any adverse impacts on the climate or other environment-related adverse impacts should be taken into account by the Commission, using adequate methodologies, when preparing the implementing acts specifying the requirements for qualified electronic ledgers.
(69) The role of trust service providers for electronic ledgers should be to ascertain the sequential recording of data into the ledger. This Regulation is without prejudice to any legal obligations of users of electronic ledgers under Union or national law. For instance, use cases that involve the processing of personal data should comply with Regulation (EU) 2016/679 and use cases that relate to financial services should comply with the relevant Union financial services law.
(70) In order to avoid the fragmentation of and barriers in the internal market, due to diverging standards and technical restrictions, and to ensure a coordinated process to avoid affecting the implementation of the European Digital Identity Framework, a process for close and structured cooperation between the Commission, Member States, civil society, academia and the private sector is needed. To achieve that objective, Member States and the Commission should cooperate within the framework set out in the Commission Recommendation (EU) 2021/946 (16) to identify a common Union toolbox for the European Digital Identity Framework.
In that context, Member States should agree on a comprehensive technical architecture and reference framework, a set of common standards and technical references including recognised existing standards and a set of guidelines and descriptions of best practices covering at least all functionalities and interoperability of European Digital Identity Wallets, including eSignatures and of the qualified trust service providers for electronic attestation of attributes as laid out in this Regulation.
In that context, Member States should also agree on common elements with regard to a business model and fee structure for European Digital Identity Wallets, in order to facilitate take up, in particular by SMEs, in a cross-border context. The content of the toolbox should evolve in parallel with and reflect the outcome of the discussion and the process of adoption of the European Digital Identity Framework.
Note: This is the final text of Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024, establishing the European Digital Identity Framework.