Trust services/eID in Japan and EU
eIDAS 2.0 legal perspective
Wednesday 15 November 2023

eIDAS in a nutshell: Trust as the key driving force
Why eIDAS 1?
• Building trust in online environment• Legal certainty for trust building blocks• eID means (for online identification/authentication)• (Qualified) trust services• Less legal fragmentation in EU• More interoperability• More convenience• … as a common foundation for secure& seamless cross-border eTransactions
Source:2

Why eIDAS 2• eID means

EUID Wallet• eID means LoA high• User centric & control• Common set of standards• Designed for X-border use• Online authentication• Creation of QESig• Attestations of attributes• Bridge to onboard on & useof (Q)TS• Not available to all EU citizens, at least @LoA high• Heterogeneous means (as many as MS oreven more) requiring heavy interoperability
framework (eIDAS nodes)• No real cross-border use• (Qualified) trust services• Legal certainty but no implementation certainty• no IAs have been adopted so far on QTS• Lack of harmonisation / guidances @ supervision• Missing types of services (eArchiving, remotemanagement of QSCD, Electronic attestations)Improved framework•••

More implementation certainty via
mandatory adoption of Implementing
acts (40+)
More guidance on supervision tasks
4 new types of QTS
 eArchiving, eLedger, management of remote
QSCD, qualified electronic attestations of attributes
3

From eIDAS 1 to eIDAS 2 … a long journey
eIDAS 1 revisionassessment
2020 - 2021

CouncilGeneral
Approach(14959/22)(COM (2021) 281 final

Council &Parliament
Provisional
Agreement

03 June 2021

8 Nov. 2023

eIDAS 2Commission
proposal

25 Nov. 2022

(adopted 6 Dec. 2022)

EuropeanParliament
reporton eIDAS 2Commission
proposal(A9-0038/2023)

02 February 2023

2 votes @ Committee levelend 2023
2 votes @ Plenary level

beginning 2024
eIDAS 2Adoption

Spring 2024

4

Bird’s eye overview – eIDAS 1 Regulation●electronic Identification and Authentication Services●

Published 28/08/2014 – Applicable as of 1/7/2016

Source: European Commission

5

Bird’s eye overview – eIDAS 2 Regulation●Regulation amending Reg. (EU) 910/2014 as regards establishinga framework for a European Digital Identity●Revision started in 2020 – EC proposal June 2021 – Adoption as of Spring 2024

eIDAS 2 establishing a framework for EUDI•••

EUDI WalleteID means LoA highCertifiedCommonstandards

Open source

QESig/QESeal

changing+ Fast
legal environment•••

Registered Relying Parties
Source: European Commission

GDPR
NIS2 Directive
Cybersecurity
Act (CSA)
Cyber Resilienceact (CRA)
DMA, DSA
Sectorial••••

PSD2mDL
AML…

6

EUDI Wallet•

Free use for all citizens• Provided by Member States• All EU citizens may use it for free on a voluntary basis•Accepted throughout the Union• Recognised by private & public service providers (relying parties)• For all transactions requiring authentication•

Secure and privacy oriented• Citizens can control and protect their identity, personal data and digital assets•

Wallet of functionalities
••
•
•

•
•
•
•

eID means LoA high (identification & authentication to services)
Creation of QESigStore & present attestations of attributes (e.g. mDL, diplomas, etc.)
Privacy dashboard

Many different Wallets but one common set of specifications & standards
Designed for X-border use and bridge to onboard on & use of (Q)TS
Commission reference implementation and minimum viable product
Open source

7Four Large Scale Pilots

23 countries:36 public and40+ private entities

8 countries: 6 public and15 private entities

20 countries : 56 publicand 80+ private entities

19 countries : 18 public and 40+
private entities#PAYMENTS# MOBILE DRIVING
LICENSE#PAYMENTS# EDUCATION# ACCESS GOV SERVICES# TRAVEL# SOCIAL SECURITY# OPEN BANKACCOUNT# ORGANISATIONID# HEALTH# CONTRACTS# SIM REGiSTRATION

Budget >90 Million (50% EU contribution), >250 Participants, 11 use
cases, co-funded under the Digital Europe Programme

Source: European Commission

What are the Pilots testing with the EU Digital Identity
Wallet?

ACCESS GOVSERVICESMOBILE DRIVING
LICENCES

Access digital public
services (nationally andacross borders) by using
your wallet to securely
identify and authenticate
yourself.

Request a digital version ofyour driving license. Then
always have it ready toshare in your wallet.

EDUCATIONHEALTH

Never lose theuniversity diploma you
worked so hard foragain. Easily store andshare your mostimportant education
credentials.

ORGANISATION ID

REGISTER SIM

Use your wallet toprove who you work forwhen meeting new andpotential clients.

Registering a new SIM
card just got easier.
Your wallet lets you
quickly identify
yourself.

Keep your health closeat hand. Identify
yourself at yourpharmacist’s and claim
your needed
prescriptions with justyour wallet.

OPEN A BANKACCOUNTNo need to track down
to a bank branch. Verify
your identity when
opening a new bankaccount with just yourwallet.

ACCESS SOCIALSECURITYTRAVELStore and share key
travel documents inyour wallet. Prove who
you are when booking
a hotel online, andthen easily check-in
once you get there.

Keep tabs on your social
security information anduse your wallet toaccess the social
security benefits you areentitled to.

PAYMENTSCONTRACTS

Make your onlinetransactions easier.
Use your wallet to
identify yourself andauthorise payments.

Your wallet makes
business flow. Sign
contracts with justyour wallet.

Source: European Commission

eIDAS Regulation – Key legal aspects on trust services●Regulation key elements●●●●●eIDAS 2

Art 114 TFEU on internal market as the legal basis
 Free movement of products and services
Directly applicable in all EU Member States
28 implementing acts and 1 delegated act to further
specify the technical aspects of the Regulation
Date of application for trust services: 01 July 2016●

unchanged●

unchanged
Mandatory adoption of 40+
implementing acts
Spring 2024●●

Trust services key principles

Leveraging on NIS2 Directive

Few cases of mandatory
specifications / standards

eIDAS 1 Pyramid of Trust (services)
EU trust mark for QTS
may only be used by QTSP
Constitutive list to state whois qualified TSP and for what
qualified trust service- Pre-authorisation for QTSP
- Life-cycle supervision- informal compiled list of eIDAS
accredited CABs (30+)(EA  NAB  “de facto” accreditation scheme
ISO/IEC 17065 + EN 319 403 + eIDAS)

Reg. (EU) No 910/2014+ few implementing acts on (Q)TS••••CIR (EU) 2015/806 on EU Trust Mark,CID (EU) 2015/1505 on trusted lists,
CID (EU) 2015/1506 on AdES formats,
CID (EU) 2016/650 on QSCD
assessment

ETSI, CEN/CENELEC, ISO/IEC, etc.

11eIDAS 2 Pyramid of Trust (services)
EU trust mark for QTS
may only be used by QTSP
Constitutive list to state who
is qualified TSP and for what
qualified trust service

Four new types of QTS- Management of rQSCD- Qualified eArchiving- Qualified eLedgers- Qualified electronic attestations of attributes- Pre-authorisation for QTSP
- Life-cycle supervision- informal compiled list of eIDAS
accredited CABs (30+)(EA  NAB  “de facto” accreditation scheme
ISO/IEC 17065 + EN 319 403 + eIDAS)

Reg. (EU) No 910/2014+ few implementing acts on (Q)TS••••

CIR (EU) 2015/806 on EU Trust Mark,CID (EU) 2015/1505 on trusted lists,CID (EU) 2015/1506 on AdES formats,
CID (EU) 2016/650 on QSCD
assessment

ETSI, CEN/CENELEC, ISO/IEC, etc.

More guidance via more
implementing acts
Mandatory adoption of
implementing acts

• 40+ within 12 months)• Empowerment not limited to point
to standards but to establish
specifications if necessary

Incl. mandatory specifications/ standards instead ofpresumption of compliance12Qualified trust services
Closed list of 9 types… 4 new types of QTS
Qualified electronicarchiving

Remote-managementof QSCDPresumption of their integrity
and of their origin for theduration of the preservation
period by the QTSP

Qualified electronicledgers

Presumption of unique andaccurate sequential
chronological ordering and ofintegrity of data records

Qualified electronic
attestationsof attributes(QEAAs)Same legal effect as lawfully
issued attestations in paperform.

 Introduction of non-qualified version will havesignificant impact on the market as every provider ofeArchiving, eLegder & any type of EAA shall be13
considered as a TSP (e.g. subject to NIS2)

Very few changes on Trust Services Supervision schemeso ImplementingoLOTL

EU MS TL

Reg. (EU) No 910/2014+ CID (EU) 2016/650 on
QSCD assessment standards
for local QSCDs+ Designated Certification Body
notified alternative processes forremote QSCDs (and local QSCDs
not covered by CID (EU) 2016/650)(CID (EU) 2015/1505
on trusted lists)

Implementing Act

Act updateMax. 5 years
validity certificate

Implementing
Act update

Implementing Act
harmonisingaccreditation andassessment rules

14International aspects• Art. 14 international (mutual recognition)• Implementation• eIDAS 1: International (Trade) agreement as only mechanism• eIDAS 2• International (Trade) agreement or Implementing Decision• Trusted List as a pre-requisite tool of the MRA execution

Source: ETS TR 103 684• EU List of the Lists as authentication tool towards 3rd countries
Trusted Lists of (mutually) recognised 3rd country TSP/TS• 3rd Country TSP/TS must meet eIDAS requirements• AdES LOTL to facilitate recognition of AdESig / AdESeal
including from 3rd Countries (e.g. UA)
15

Questions – Contact

Olivier DELOS (CISSP, CISA)
Mobile:Email:
Web:+32 477 78 79 74
olivier.delos@sealed.bewww.sealed.beSylvie LACROIX (CISA, CSXF)
Mobile:Email:
Web:+32 477 78 79 75
sylvie.lacroix@sealed.bewww.sealed.be