Commission Implementing Decision (EU) 2015/1984 of 3 November 2015 defining the circumstances, formats and procedures of notification pursuant to Article 9(5) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market (notified under document C(2015) 7369) (Text with EEA relevance)

• CELEX: Implementing Decision (EU) 2015/1984
• Articles: 5

Article 1 Objective

Pursuant to Article 9(5) of Regulation (EU) No 910/2014, this Decision lays down the circumstances, formats and procedures of notifications of electronic identification schemes to the Commission.

Article 2 Language of notification

1.   The language of notification shall be English. The notification form referred to in Article 3(1) shall be completed in English.

2.   Without prejudice to paragraph 1, Member States shall not be obliged to translate supporting documents referred to in point 4.4 of the Annex where this would create an unreasonable burden.

Article 3 Notification procedure and formats

1.   Notification shall be made electronically in the format compliant with the form set out in the Annex.

2.   Where a scheme involves multiple responsible parties issuing the electronic identification means and/or covers multiple levels of assurance, points 3.2 and/or where appropriate 4.2 of the notification form set out in the Annex shall be completed separately for each party issuing the electronic identification means and/or for each level of assurance.

3.   Where the authorities, parties, entities or bodies to be notified in the form set out in the Annex, in particular the parties managing the registration process of the unique person identification data or the parties issuing the electronic identification means, are acting under the same set of rules and using the exact same procedures, in particular where they are regional or local authorities, the following specific rules shall apply:

(a)

the notification form may be filled in once in respect of all such parties;

(b)

the notification form may be filled with information necessary to identify the respective functional or territorial organisation level.

4.   The Commission shall confirm receipt of the notification by electronic means.

5.   The Commission may request additional information or clarification in the following circumstances:

(a)

the notification form is not properly filled in;

(b)

there is a manifest error in the form or in the supporting documents;

(c)

a description of the electronic identification scheme prior to notification was not provided to other Member States pursuant to Article 7(g) of Regulation (EU) No 910/2014.

6.   Where additional information or clarification referred to in paragraph 5 is requested, the notification shall only be considered complete when such additional information or clarification is submitted to the Commission.

Article 4 Addressees

This Decision is addressed to the Member States.

Schedules & Appendices

ANNEX

ANNEX

NOTIFICATION FORM FOR ELECTRONIC IDENTITY SCHEME UNDER ARTICLE 9(5) OF REGULATION (EU) No 910/2014

( Insert the name of the Member State ) hereby notifies the European Commission of an electronic identification scheme to be published in the list referred to in Article 9(3) of Regulation (EU) No 910/2014 and confirms the following:

—

the information communicated in this notification is consistent with the information which has been communicated to the Cooperation Network in accordance with Article 7(g) of Regulation (EU) No 910/2014, and

—

the electronic identification scheme can be used to access at least one service provided by a public sector body in ( insert the name of the Member State ).

Date

[signed electronically]

1.    General information

Title of scheme (if any)

Level(s) of assurance (low, substantial or high)

2.    Authority(ies) responsible for the scheme

Name(s) of authority(ies)

Postal address(es)

E-mail address(es)

Telephone No

3.    Information on relevant parties, entities and bodies (where there are multiple parties, entities or bodies, please list them all, in accordance with Article 3(2) and (3)

3.1.    Entity which manages the registration process of the unique person identification data

Name of entity which manages the registration process of the unique person identification data

3.2.    Party issuing the electronic identification means

Name of the party issuing the electronic identity means and indication of whether the party is referred to in Article 7(a)(i), (ii) or (iii) of Regulation (EU) No 910/2014

Article 7(a)(i) ☐

Article 7(a)(ii) ☐

Article 7(a)(iii) ☐

3.3.    Party operating the authentication procedure

Name of party operating the authentication procedure

3.4.    Supervisory body

Name of the supervisory body

(provide the name(s) where applicable)

4.    Description of the electronic identification scheme

Document(s) may be enclosed for each of the following descriptions.

(a)

Briefly describe the scheme including the context within which it operates and its scope

(b)

Where applicable, list the additional attributes which may be provided for natural persons under the scheme if requested by a relying party

(c)

Where applicable, list the additional attributes which may be provided for legal persons under the scheme if requested by a relying party

4.1.    Applicable supervisory, liability and management regime

4.1.1.    Applicable supervisory regime

Describe the supervisory regime of the scheme with respect to the following:

(where applicable, information shall include the roles, responsibilities and powers of the supervising body referred to in point 3.4, and the entity to which it reports. If the supervising body does not report to the authority responsible for the scheme, full details of the entity to which it reports shall be provided)

(a)

supervisory regime applicable to the party issuing the electronic identification means

(b)

supervisory regime applicable to the party operating the authentication procedure

4.1.2.    Applicable liability regime

Describe briefly the applicable national liability regime for the following scenarios:

(a)

liability of the Member State under Article 11(1) of Regulation (EU) No 910/2014

(b)

liability of the party issuing the electronic identification means under Article 11(2) of Regulation (EU) No 910/2014

(c)

liability of the party operating the authentication procedure under Article 11(3) of Regulation (EU) No 910/2014

4.1.3.    Applicable management arrangements

Describe the arrangements for suspending or revoking of either the entire identification scheme or authentication, or their compromised parts

4.2.    Description of the scheme components

Describe how the following elements of Commission Implementing Regulation (EU) 2015/1502  ( 1 ) have been met in order to reach a level of assurance of an electronic identification means under the scheme the Commission is being notified of:

(include any standards adopted)

4.2.1.    Enrolment

(a)

Application and registration

(b)

Identity proofing and verification (natural person)

(c)

Identity proofing and verification (legal person)

(d)

Binding between the electronic identification means of natural and legal persons

4.2.2.    Electronic identification means management

(a)

Electronic identification means characteristics and design (including, where appropriate, information on security certification)

(b)

Issuance, delivery and activation

(c)

Suspension, revocation and reactivation

(d)

Renewal and replacement

4.2.3.    Authentication

Describe the authentication mechanism including terms of access to authentication by relying parties other than public sector bodies

4.2.4.    Management and organisation

Describe the management and organisation of the following aspects:

(a)

General provisions on management and organisation

(b)

Published notices and user information

(c)

Information security management

(d)

Record keeping

(e)

Facilities and staff

(f)

Technical controls

(g)

Compliance and audit

4.3.    Interoperability requirements

Describe how the interoperability and minimum technical and operational security requirements under Commission Implementing Regulation (EU) 2015/1501  ( 2 ) are met. List and attach any document that may give further information on compliance, such as the opinion of the Cooperation Network, external audits, etc.

4.4.    Supporting documents

List here all supporting documentation submitted and state to which of the elements above they relate. Include any domestic legislation which relates to the electronic identification provision relevant to this notification. Submit an English version or English translation whenever available.

( 1 )   Commission Implementing Regulation (EU) 2015/1502 of 8 September 2015 on setting out minimum technical specifications and procedures for assurance levels for electronic identification means pursuant to Article 8(3) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market ( OJ L 235, 9.9.2015, p. 7 ).

( 2 )   Commission Implementing Regulation (EU) 2015/1501 of 8 September 2015 on the interoperability framework pursuant to Article 12(8) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market ( OJ L 235, 9.9.2015, p. 1 ).