THE CROATIAN PARLIAMENT1430
Pursuant to Article 89 of the Constitution of the Republic of Croatia, I hereby issue theDECISION
PROMULGATING THE ACT ON THE IMPLEMENTATION OF REGULATION(EU) NO 910/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
OF 23 JULY 2014 ON ELECTRONIC IDENTIFICATION AND TRUST SERVICES
FOR ELECTRONIC TRANSACTIONS IN THE INTERNAL MARKET AND
REPEALING DIRECTIVE 1999/93/EC
I hereby promulgate the Act on the Implementation of Regulation (EU) No 910/2014 of theEuropean Parliament and of the Council of 23 July 2014 on electronic identification and trustservices for electronic transactions in the internal market and repealing Directive 1999/93/EC,
passed by the Croatian Parliament at its session on 19 June 2017.
Class: 011-01/17-01/25
Reg. No.: 71-06-01/1-17-2
Zagreb, 21 June 2017
The President ofthe Republic of Croatia
Kolinda Grabar-Kitarović, m. p.

ACTON THE IMPLEMENTATION OF REGULATION (EU) NO 910/2014 OF THE
EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 23 JULY 2014 ON
ELECTRONIC IDENTIFICATION AND TRUST SERVICES FOR ELECTRONIC
TRANSACTIONS IN THE INTERNAL MARKET AND REPEALING DIRECTIVE
1999/93/EC
I. GENERAL PROVISIONS
Purpose of the ActArticle 1
This Act:
1. lays down the competent authorities and tasks of competent authorities for theimplementation of Regulation (EU) No 910/2014 of the European Parliament and of theCouncil of 23 July 2014 on electronic identification and trust services for electronictransactions in the internal market and repealing Directive 1999/93/EC (SL L 257/73
28.8.2014 – hereinafter: Regulation (EU) No 910/2014)
2. lays down the bodies for the supervision of the implementation of Regulation (EU) No910/2014
3. determines the body competent for accreditation of conformity assessment bodies
4. lays down the rights, obligations and responsibilities of the signatories and trust service
providers
5. determines misdemeanour provisions for acting contrary to Regulation (EU) No 910/2014.
Terms
Article 2(1) For the purposes of this Act, the terms shall have the same meaning as terms used inRegulation (EU) No 910/2014.
(2) The term of legal person from Article 3, paragraphs 24, 29 and 38 of Regulation (EU) No
910/2014 shall mean legal persons governed by public law and legal persons governed byprivate law.
II. COMPETENT AUTHORITIES
Competent authority for the area of identification
Article 3(1) The competent authority for the implementation of Regulation (EU) No 910/2014 and thisAct with respect to provisions governing electronic identification from Article 6 to Article 12of Regulation (EU) No 910/2014 shall be the central state administration body competent for
e-Croatia.
(2) The central state administration body referred to in paragraph 1 of this Article shallperform the following tasks:
1. notifying national electronic identification systems to the European Commission for theirpublication in the Official Journal of the European Union and removing them therefrom
2. cooperating with personal data protection bodies.
Competent authority for trust services
Article 4(1) The competent authority for the implementation of Regulation (EU) No 910/2014 and thisAct with respect to provisions governing trust services from Article 13 to Article 45 ofRegulation (EU) No 910/2014 shall be the central state administration body competent for theeconomy.
(2) The central state administration body referred to in paragraph 1 of this Article shallperform the following tasks:
1. supervising trust service providers, granting and withdrawing qualified status, analysing
conformity assessment reports, auditing, requiring trust service providers to remove all
failures to comply with the provisions of Regulation (EU) No 910/2014
2. establishing, maintaining and publishing trusted lists of trust service providers and qualified
trust service providers
3. cooperating with supervisory bodies in other Member States of the European Union(providing mutual assistance, exchanging good practice)
4. notifying other authorities and the public about security breaches
5. periodical annual reporting to the European Commission on its principal activities (by 31March for the previous calendar year).
(3) The head of the central state administration body competent for the economy shall lay
down by way of an ordinance other identification methods which provide equivalentassurance in terms of reliability to physical presence, by which trust service provider verifies
the identity and, if applicable, any specific attributes of the natural or legal person to whom
the qualified certificate is issued.
National accreditation body
Article 5
The body competent for accreditation of conformity assessment bodies of qualified trust
service providers and qualified trust services that they provide, in accordance with provisionsof Article 3, point 18 and Article 20 of Regulation (EU) No 910/2014, shall be the national
accreditation body.
Cooperation
Article 6(1) The bodies referred to in Articles 3 and 4 of this Act shall cooperate with each other andwith other competent authorities in the Republic of Croatia, as well as with other European
Union Member States’ bodies competent for the supervision of the implementation ofRegulation (EU) No 910/2014 and, where appropriate, with other relevant competentauthorities in accordance with the legislation of the European Union and national legislationsof the European Union Member States.
(2) Within the framework of the cooperation referred to in paragraph 1 of this Article, thebodies referred to in Articles 3 and 4 of this Act shall exchange information among
themselves, and also:

1. with other European Union Member States’ bodies competent for the supervision of theimplementation of Regulation (EU) No 910/2014
2. with the European Commission and, where appropriate, with other public bodies
3. with other bodies competent in accordance with laws governing personal data protection.
(3) Submission of information referred to in paragraph 2 of this Article shall not be
considered a breach of the obligation to keep confidentiality of data.
(4) The body that receives information referred to in paragraph 2 of this Article shall keep its
confidentiality and may use it only for the purpose for which it was submitted, and may makeit available to third persons only in accordance with special regulations.
III. SUPERVISION
Article 7(1) Supervision of the implementation of Regulation (EU) No 910/2014 and this Act withrespect to provisions laying down electronic identification from Articles 6 through 12 ofRegulation (EU) No 910/2014 shall be carried out by civil servants of the central stateadministration body competent for e-Croatia authorised for the implementation ofsupervision.
(2) Supervision of the implementation of Regulation (EU) No 910/2014 and this Act withrespect to provisions laying down trust services from Articles 13 through 45 of Regulation(EU) No 910/2014 shall be carried out by inspectors and other civil servants of the central
state administration body competent for the economy authorised for the implementation
supervision.
(3) Supervision of the work of trust service providers and qualified trust service providers andnational electronic identification systems in the field of collection, use and protection of
personal data of signatories shall be carried out by inspectors and other civil servantsauthorised for the implementation of supervision determined by the law and other regulations
governing personal data protection, in accordance with their prescribed scope of activities.
(4) Within the framework of the supervision of trust service providers and qualified trust
service providers:– it shall be established whether the conditions laid down by Regulation (EU) No 910/2014
and implementing regulations adopted pursuant to Regulation (EU) No 910/2014 have beenmet– correctness of application of prescribed procedures and organisational and technicalmeasures and the implementation of internal rules related to the conditions laid down byRegulation (EU) No 910/2014 and implementing regulations adopted pursuant to Regulation(EU) No 910/2014 shall be supervised.
(5) The trust service provider and the qualified trust service provider shall, for the purpose of
implementation of supervision, enable unrestricted inspection of data on business operations,inspection of business documentation, access to the signatory’s register and the accompanyingcomputer equipment and devices.
IV. RIGHTS, OBLIGATIONS AND RESPONSIBILITIES OF SIGNATORIES, TRUSTSERVICE PROVIDERS AND HOLDERS OF ELECTRONIC IDENTIFICATION MEANS
Article 8
Each signatory shall undertake all necessary measures for protection from loss and damage
they may cause to other signatories, providers of trust services or third persons.
Article 9
The signatory shall, with due diligence, use and keep the devices and data for the creation ofthe electronic signature, use the devices and data for the creation of the electronic signature inaccordance with the provisions of this Act, and protect and keep the devices and data for thecreation of the electronic signature from unauthorised access and use.
Article 10(1) The signatory shall submit to the trust service provider all the necessary data andinformation on changes that affect or may affect the accuracy of the electronic signature
within seven days from the occurrence of changes.
(2) The signatory shall request revocation of their certificate immediately after gaining
knowledge in all cases of loss or damage of devices or data for the creation of their electronicsignature.
Article 11(1) The holder of the electronic identification means shall undertake all necessary measures tohave the electronic identification means under their exclusive supervision, in order to prevent
theft, loss or unauthorised cession of their electronic identification means and shall,
immediately, with the issuer of the electronic identification means, revoke their electronicidentification if they establish that it has been lost, stolen or ceded to others withoutauthorisation.
(2) If electronic identification means are revoked or their validity expires, the holder of theelectronic identification means must not use them consciously, or employ them.
Article 12(1) The signatory shall be responsible for the damage that arises due to their failure to comply
with their obligations laid down by this Act.
(2) The signatory may, exceptionally, be released from responsibility in cases when they can
prove that the injured party did not undertake or incorrectly undertook actions related to thevalidation of the electronic signature.
Article 13

The trust service provider shall have, in addition to obligations stated in Regulation (EU) No
910/2014, also the following obligations:
1. to enable all interested parties to inspect identification data of trust service providers
2. to keep all data and documentation on issued certificates for at least ten years from the dayof their issuance, where data and accompanying documentation may be also in electronicform
3. to use the provisions of acts and other regulations governing personal data protection.
Article 14(1) The trust service provider shall discontinue their certification service or revoke thecertificate from those signatories:
1. who have expressly requested it
2. for whom inaccurate or incomplete data were found in the Records of Certificates
3. for whom official notification of death was received
4. for whom official notification of loss of legal capacity was received
5. for whom it was established that they use the data for the creation of the electronic
signature contrary to legal regulations of the Republic of Croatia.
(2) The trust service provider shall keep updated records of all revoked certificates.
(3) The trust service provider shall notify the signatory of the revocation of the certificate
within 24 hours from receiving the notification or from the occurrence of the circumstances
due to which the certificate is being revoked.
(4) The head of the central state administration body competent for the economy shall lay
down by way of an ordinance the rules on temporary suspension of certificates for electronic
signatures and certificates for electronic seals in cases where the certificate temporarily loses
its validity; these cases shall be different from revocation of the certificate.
Article 15
The trust service provider issuing qualified certificates shall keep all documentation on issued
and revoked certificates as a means for providing evidence and verification in court,
administrative and other proceedings, for the period of at least ten years from the expiry of thevalidity of certificates to which that documentation refers.
Cessation of provision of trust services
Article 16

(1) The trust service provider shall inform about possible cessation of providing services allusers of trust services, as well as the state administration body competent for the economy or
the supervisory body at least three months before the expiry of trust services entrusted to themby a contract.
(2) The trust service provider, which ceases providing these services, shall ensure withanother trust service provider the continuation of performance of trust services for signatories
to whom they issued certificates, and if this is not possible, they shall revoke all issued
certificates and inform thereon immediately and without delay the state administration bodycompetent for the economy or the supervisory body.
(3) The trust service provider, which ceases providing trust services, shall deliver all
documentation related to trust services carried out to another trust service provider to whomthey transfer obligations related to provision of trust services.
Article 17Provisions of Title IV of this Act shall apply mutatis mutandis to services of issuingelectronic seals, time stamps and electronic registered delivery service.
V. MISDEMEANOUR PROVISIONS
Natural persons
Article 18(1) The natural person shall be fined for a misdemeanour in the amount of HRK 2,000.00 toHRK 10,000.00 if they:–access and use data and devices for the creation of electronic signature, advanced electronicsignature, qualified signature, electronic seal, advanced electronic seal, or qualified electronicseal, without authorisation.
(2) The signatory or a natural person or a responsible person in a legal person who represents
the signatory shall be fined for a misdemeanour in the amount of HRK 2,000.00 to HRK
10,000.00 if they:
1. do not use devices and data for the creation of electronic signature, advanced electronic
signature, qualified signature, electronic seal, advanced electronic seal, or qualified electronicseal (Article 9 of this Act) with due diligence
2. do not deliver to a certification service provider, within seven day from the changes
occurred, necessary data and information on any change that affects or may affect theaccuracy of the electronic signature, advanced electronic signature, qualified signature,electronic seal, advanced electronic seal, or qualified electronic seal (Article 10 of this Act)
3. do not deliver to a certification service provider the request for revoking the certificate in atimely manner, or if, immediately after gaining knowledge, do not request revoking of theircertificate in cases of loss or damage of devices/data for the creation of their electronicsignature (Article 10 of this Act).

Legal persons
Article 19
The qualified trust service provider shall be fined for a misdemeanour in the amount of HRK
5,000.00 to HRK 100,000.00 if they:
1. do not verify validly the identity of the natural or legal person to whom the qualified
certificate is issued (Article 24, paragraph 1 of Regulation (EU) No 910/2014)
2. do not inform the supervisory body of any change in the provision of their qualified trust
services and an intention to cease those activities at least 3 (three) months before the expiry oftrust services entrusted to them by a contract (Article 24, paragraph 2, subparagraph (a) ofRegulation (EU) No 910/2014)
3. do not employ staff and/or subcontractors who possess the necessary expertise, reliability,experience, and qualifications and who have received appropriate training regarding security
and personal data protection rules and apply administrative and management procedures
which correspond to European or international standards (Article 24, paragraph 2,subparagraph (b) of Regulation (EU) No 910/2014)
4. do not maintain sufficient financial resources and/or obtain appropriate liability insurance,in connection with Article 13 of Regulation (EU) No 910/2014 (Article 24, paragraph 2,subparagraph (c) of Regulation (EU) No 910/2014)
5. before entering into a contractual relationship, do not inform, in a clear and comprehensive
manner, any person seeking to use a qualified trust service of the precise terms and conditions
regarding the use of that service, including any limitations on its use (Article 24, paragraph 2,subparagraph (d) of Regulation (EU) No 910/2014)
6. do not use trustworthy systems and products that are protected against modification andensure the technical security and reliability of the processes supported by them (Article 24,paragraph 2, subparagraph (e) of Regulation (EU) No 910/2014)
7. do not use trustworthy systems to store data provided to them, in a verifiable form (Article
24, paragraph 2, subparagraph (f) of Regulation (EU) No 910/2014)
8. do not take appropriate measures against forgery and theft of data (Article 24, paragraph 2,subparagraph (g) of Regulation (EU) No 910/2014)
9. do not record and keep accessible for an appropriate period of time, including after theactivities of the qualified trust service provider have ceased, all relevant information
concerning data issued and received by the qualified trust service provider, in particular, forthe purpose of providing evidence in legal proceedings and for the purpose of ensuringcontinuity of the service (Article 24, paragraph 2, subparagraph (h) of Regulation (EU) No910/2014)
10. do not have an up-to-date termination plan to ensure continuity of service in accordancewith provisions verified by the supervisory body under Article 17, paragraph 4, point (i) of

Regulation (EU) No 910/2014 (Article 24, paragraph 2, subparagraph (i) of Regulation (EU)No 910/2014)
11. do not ensure lawful processing of personal data in accordance with Directive 95/46/EC(Article 24, paragraph 2, subparagraph (j) of Regulation (EU) No 910/2014)
12. in case of qualified trust service providers issuing qualified certificates, do not establish
and keep updated a certificate database (Article 24, paragraph 2, subparagraph (k) ofRegulation (EU) No 910/2014).
VI. TRANSITIONAL AND FINAL PROVISIONS
Article 20(1) The head of the central state administration body competent for the economy shall issue
ordinances referred to in Article 4, paragraph 3 and Article 14, paragraph 4 of this Act within
one year from the day of entry into force of this Act.
(2) Upon entry into force of this Act, the Electronic Signature Act (Official Gazette 10/02,80/08 and 30/14) shall cease to have effect.
Article 21
This Act shall enter into force on the eighth day of its publication in the Official Gazette.
Class: 022-03/17-01/33
Zagreb, 19 June 2017
THE CROATIAN PARLIAMENT
The Presidentof the Croatian Parliament
Gordan Jandroković, m. p.