# EUR-Lex - 52012PC0238 - EN

*|*

# 52012PC0238

**Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on electronic identification and trust services for electronic transactions in the internal market /* COM/2012/0238 final - 2012/0146 (COD) */**

			*

			*

EXPLANATORY MEMORANDUM

1.           CONTEXT OF THE PROPOSAL

This memorandum explains
a proposed legal framework designed to enhance trust in electronic transactions
in the internal market.

Building trust in
the online environment is key to economic development. Lack of trust makes
consumers, businesses and administrations hesitate to carry out transactions
electronically and to adopt new services.

The Digital Agenda for Europe[1] identifies existing barriers to
Europe’s digital development and proposes legislation on e-signatures (Key
Action 3) and the mutual recognition of e-identification and authentication
(Key Action 16), establishing a clear legal framework so as to eliminate
fragmentation and the lack of interoperability, enhance digital citizenship and
prevent cybercrime. Legislation ensuring the mutual recognition of electronic
identification and authentication across the EU and review the Directive on
Electronic Signatures is also a key action in the Single Market Act[2], for the realisation of the
digital single market. The Roadmap for Stability and Growth[3] underlines the key role for the
development of the digital economy of the future common legal framework for the
mutual recognition and acceptance of electronic identification and
authentication across borders.

The proposed legal
framework, consisting of a ‘Regulation of the European Parliament and of the
Council on electronic identification and trust services for electronic
transactions in the internal market’, seeks to enable secure and seamless
electronic interactions between businesses, citizens and public authorities,
thereby increasing the effectiveness of public and private online services,
e-business and electronic commerce in the EU.

The existing EU
legislation, namely Directive 1999/93/EC on a ‘Community framework for
electronic signatures’[4],
essentially covers electronic signatures only. There is no comprehensive EU
cross-border and cross-sector framework for secure, trustworthy and easy-to-use
electronic transactions that encompasses electronic identification,
authentication and signatures.

The aim is to
enhance existing legislation and to expand it to cover the mutual recognition
and acceptance at EU level of notified electronic identification schemes and
other essential related electronic trust services.

2.           RESULTS OF CONSULTATIONS WITH INTERESTED
PARTIES AND IMPACT ASSESSMENTS

This initiative is
the result of extensive consultations on a review of the current legal
framework on electronic signatures in the course of which the Commission
gathered feedback from Member States, the European Parliament and other
stakeholders[5].
An online public consultation was complemented by an ‘SME Test Panel’ to
identify the specific views and needs of SMEs; and other targeted consultations
with stakeholders[6],[7]. The Commission also
launched a number of studies in relation to electronic identification,
authentication, signature and related trust services (eIAS).

The consultations
made clear that a large majority of stakeholders agreed on the need to review
the current framework to fill the gaps left by the electronic signature Directive.
It was felt that this would better respond to challenges posed by the rapid
development of new technologies (particularly online and mobile access) and by increased
globalisation, while maintaining the technological neutrality of the legal
framework.

In line with its ‘Better
Regulation’ policy, the Commission conducted an impact assessment of policy
alternatives. Three sets of policy options were assessed, dealing respectively
with (1) the scope of the new framework, (2) the legal instrument and (3) the
level of supervision required[8].
The preferred policy option proved to be enhancing legal certainty, boosting
coordination of national supervision, ensuring mutual recognition and
acceptance of electronic identification schemes and incorporating essential
related trust services. The impact assessment concluded that doing this would
lead to considerable improvements to legal certainty, security and trust in
terms of cross-border electronic transactions, resulting in less fragmentation
of the market.

3.           LEGAL ELEMENTS OF THE PROPOSAL

3.1 Legal Basis

This proposal is based on Article 114 TFEU,
which concerns the adoption of rules to remove existing barriers to the
functioning of the internal market. Citizens, businesses and administrations will
be able to benefit from the mutual recognition and acceptance of electronic
identification, authentication, signatures and other trust services across borders
when needed for the access and completion of electronic procedures or
transactions.

A Regulation is
considered to be the most appropriate legal instrument. The direct
applicability of a Regulation pursuant to Article 288 TFEU will reduce legal
fragmentation and provide greater legal certainty by introducing a harmonised
set of core rules contributing to the functioning of the internal market.

3.2 Subsidiarity and proportionality

In
order for EU action to be justified, the subsidiarity principle must be
respected:

a) Transnational nature of the problem (necessity test)

The transnational
nature of eIAS requires EU action. Domestic (i.e. national) action alone would
not suffice to meet the objectives, nor achieve the targets set out in the Europe
2020 Strategy[9]. Conversely, experience has shown that national
measures have de facto created barriers to the
EU-wide interoperability of electronic signatures, and that they are currently
having the same effect on electronic identification, electronic authentication
and related trust services. It is therefore necessary
for the EU to create an enabling framework to address cross-border
interoperability and to improve the coordination of national supervision
schemes. However, electronic identification cannot be addressed in the
proposed Regulation in the same generic manner as the other trust electronic
services because issuing means of identification is a national prerogative. The
proposal therefore focuses strictly on cross-border aspects of electronic
identification.

The proposed Regulation creates a level
playing field for businesses providing trust services where the currently
existing differences in national legislation often lead to legal uncertainty
and additional burden. Legal certainty is significantly increased through clear
acceptance obligations by Member States of qualified trust services which will
create additional incentive for businesses to go abroad. For example a company
will be able to participate electronically to a public call for tenders
launched by the administration of a different Member State without its
electronic signature being blocked due to specific national requirements and
interoperability problems. Similarly, a company will have the opportunity to
sign contracts electronically with a counterpart based in a different Member
State without fearing different legal requirements for trust services such as
electronic seals, electronic documents or time stamping. Finally, a notice of
default will be delivered from one Member State to another with the certainty
of its legal validity in both Member States. Finally, online commerce will be more
trustworthy when shoppers will have the means to verify that they indeed access
the website of the merchant of their choice instead of a possibly fake website.

Mutually recognised electronic
identification means and widely accepted electronic signatures will facilitate
cross-border provision of numerous services in the internal market and enable
businesses to go cross-border without facing obstacles in interactions with
public authorities. In practice this will mean significant efficiency
improvements both for businesses and citizens when complying with the
administrative formalities. For example, giving the opportunity to a student to
enrol electronically in a university abroad, to a citizen to submit tax declaration
online to another Member State or to a patient to access his or her health data
online. If there is no such mutually recognised electronic identification
means, a doctor will not be able to access the patient medical data needed to
treat him or her and the medical and laboratory tests that the patient has
already undertaken will have to be repeated.

b) Added value (effectiveness test)

The
objectives outlined above are currently not being achieved by voluntary
coordination among Member States, nor is this reasonably likely to happen in
the future. This leads to duplication of efforts, setting different standards,
transnational characteristics of the spill-overs generated by ICT, and
administrative complexity of establishing such coordination by way of bilateral
and multilateral agreements.

In
addition, the need to overcome such problems, as (a) an absence of legal
certainty due to heterogeneous national provisions stemming from divergent
interpretations of the electronic signature Directive and (b) a lack of
interoperability of the electronic signature systems set up at national level
due to the non-uniformly application of technical standards, requires the kind
of coordination across EU Member States which can be done more effectively at
the EU level.

3.3 Detailed explanation of the
proposal

3.3.1      CHAPTER I – GENERAL
PROVISIONS

Article 1 defines the subject matter of the
Regulation.

Article 2 defines the material scope of the
Regulation.

Article 3 contains definitions of the terms
used in the Regulation. While some definitions are taken over from Directive
1999/93/EC, others are clarified, complemented with additional elements, or
newly introduced.

Article 4 determines the internal market
principles with regard to the territorial application of the Regulation. Explicit
mention is made of the imposition of no restrictions on the freedom to provide
services and the free circulation of products.

3.3.2      CHAPTER II – ELECTRONIC
IDENTIFICATION

Article 5 provides for the mutual
recognition and acceptance of electronic identification means falling under a
scheme which will be notified to the Commission on the conditions laid down in
the Regulation. Most EU Member States have introduced some form of electronic
identification system. However, they differ in many aspects. The lack of a
common legal basis requiring each Member State to recognise and accept
electronic identification means issued in other Member States to access online
services, along with the inadequate cross-border interoperability of national
electronic identifications, creates barriers which prevent citizens and
businesses from benefiting fully from the digital single market. The mutual
recognition and acceptance of any electronic identification means falling under
a notified scheme under this Regulation removes these legal barriers.

The Regulation does not oblige Member
States to introduce or notify electronic identification schemes, but to
recognise and accept notified electronic identifications for those online
services where electronic identification is required to get access at national
level. The potential increase of economies of scale
created through the cross-border use of notified electronic identification
means and authentication systems may stimulate Member States to notify to their
electronic identification schemes.Article 6 sets out
the five conditions for the notification of electronic identification schemes:

Member States can notify the electronic
identification schemes that they accept under their jurisdiction where
electronic identification is required for public services. A further
requirement is that the respective electronic identification means must be
issued by, on behalf of or at least under the responsibility of the Member
State notifying a scheme.

Member States must ensure an unambiguous
link between the electronic identification data and the person concerned. This
obligation does not mean that a person cannot have multiple electronic
identification means, but they must all link to the same person.

The reliability of an electronic
identification depends on the availability of means of authentication (i.e. the
possibility to check the validity of the electronic identification data). The
Regulation obliges the notifying Member States to provide online authentication
free of charge vis-à-vis third parties. The authentication possibility must be
available without interruption. No specific technical requirements, such as
hardware or software can be imposed on the parties relying on such
authentication. This provision does not apply to any requirements vis-à-vis the
users (holders) of the electronic identification means that are technically
necessary for the use of the electronic identification means, such as card
readers.

Member States must accept liability for the
unambiguity of the link (i.e. that the identification data attributed to the
person are not linked to any other person) and the authentication possibility (i.e.
the possibility to check the validity of the electronic identification data).
The liability of Member States does not cover other aspects of the
identification process or any transaction that requires identification.

Article 7 contains rules on notifying the
Commission of electronic identification schemes.

Article 8 aims to ensure the technical
interoperability of the notified identification schemes through a coordination approach,
including delegated acts.

3.3.3      CHAPTER III – TRUST
SERVICES

3.3.3.1 Section 1 – General provisions

Article 9 sets out the principles relating
to the liability of both non-qualified and qualified trust service providers.
It builds on Article 6 of Directive 1999/93/EC and extends entitlement to
compensation of damage caused by any negligent trust service provider for
failure to comply with security good practices which result in a security breach
which has a significant impact on the service.

Article 10 describes the mechanism for the
recognition and acceptance of qualified trust services provided by a provider
established in a third country. It builds on Article 7 of Directive 1999/93/EC
but retains only the sole practically feasible option which is to allow such
recognition under an international agreement between the European Union and
third countries or international organisations.

Article 11 sets out the principles of data
protection and minimisation. It builds on Article 8 of Directive 1999/93/EC.

Article 12 makes trust services accessible
to disabled people.

3.3.3.2 Section 2 – Supervision

Article 13 obliges Member States to
establish supervisory bodies, based on Article 3(3) of Directive 1999/93/EC,
clarifying and enlarging their remit with regard to both trust service
providers and qualified trust service providers.

Article 14 introduces an explicit mechanism
of mutual assistance between supervisory bodies in Member States to facilitate
the cross-border supervision of trust service providers. It introduces rules on
joint operations and supervisory authorities’ right to participate in such
operations.

Article 15 introduces an obligation for
both qualified and non-qualified trust service providers to implement
appropriate technical and organisational measures for the security of their
activities. Furthermore, the competent supervisory bodies and other relevant
authorities must be informed of any security breaches. If appropriate, they
will in turn inform other Member States’ supervisory bodies and will, directly
or via the trust service provider concerned, inform the public.

Article 16 sets out the conditions for the supervision
of qualified trust service providers and qualified trust services provided by
them. It obliges qualified trust service providers to be audited on a yearly
basis by a recognised independent body to confirm to the supervisory body that
they fulfil the obligations laid down in the Regulation. Moreover, Article 16(2)
gives the supervisory body the right to carry out on-the-spot audits of the
qualified trust service providers at any time. The supervisory body is also
empowered to issue binding instructions to qualified trust service providers to
remedy, in a proportionate manner, any failure to meet an obligation revealed
by a security audit.

Article 17 concerns the activity carried
out by the supervisory body at the request of a trust service provider wishing
to initiate a qualified trust service.

Article 18 provides for the establishment
of trusted lists[10]
containing information on qualified trust service providers who are subject to
supervision and to the qualified services they offer. This information must be
made publicly available through a common template in order to facilitate its
automated use and ensure an appropriate level of detail.

Article 19 sets out the requirements the
qualified trust service providers must meet in order to be recognised as such.
It draws on Annex II of Directive 1999/93/EC.

3.3.3.3 Section 3 – Electronic
signature

Article 20 enshrines the rules related to the
legal effect of natural persons’ electronic signatures. It clarifies and
expands Article 5 of Directive 1999/93/EC introducing an explicit obligation to
give to qualified electronic signatures the same legal effect as handwritten
signatures. Moreover, Member States must ensure the cross-border acceptance of
qualified electronic signatures, in the context of the provision of public
services, and they must not introduce any additional requirements which might
result in barriers to the use of such signatures.

Article 21 sets out the requirements for
qualified signature certificates. It clarifies Annex I of Directive 1999/93/EC
and removes provisions which did not work in practice (e.g. limitations on
transactions value).

Article 22 sets out the requirements for
qualified electronic signature creation devices. It clarifies the requirements
for secure signature creation devices laid down in Article 3(5) of Directive
1999/93/EC, which now have to be considered as qualified signature creation
devices under this Regulation. It also makes it clear that the scope of a
signature creation device can be much wider than just something containing
signature creation data. The Commission may also establish a list of reference
numbers of standards for security requirements on devices.

Article 23, building on Article 3(4) of
Directive 1999/93/EC, introduces the concept of certification of qualified
electronic signature devices to determine their conformity with the security
requirements laid down in Annex II. These devices must be recognised by all
Member States as matching the requirements when a certification procedure is
conducted by a certification body designated by a Member State. The Commission
will publish a positive list of such certified devices according to Article 24.
The Commission may also establish a list of reference numbers of standards for
the security assessment of information technology products referenced in
Article 23(1).

Article 24 concerns publication of a list
of qualified electronic signature creation devices by the Commission after
notification of conformity by the Member States.

Article 25 builds on the recommendations of
Annex IV of Directive 1999/93/EC to lay down binding requirements for the
validation of qualified electronic signatures with a view to increasing the
legal certainty of such a validation.

Article 26 sets out the conditions for
qualified validation services.

Article 27 sets out the condition for the
long-term preservation of qualified electronic signatures. This is possible due
to the use of procedures and technologies capable of extending the
trustworthiness of the qualified electronic signature validation data beyond
the time of their technological validity when forgery may become easy to do for
cyber criminals.

3.3.3.4 Section 4 – Electronic seals

Article 28 concerns the legal effect of
electronic seals of legal persons. A specific legal presumption is bestowed on
a qualified electronic seal which guarantees the origin and integrity of
electronic documents to which it is linked.

Article 29 sets out the requirements for
qualified certificates for electronic seals.

Article 30 sets out the requirements for
and certification and publication of list for the qualified electronic seal
creation devices.

Article 31 sets out the condition of
validation and preservation of qualified electronic seals.

3.3.3.5 Section 5 – Electronic time
stamp

Article 32 concerns the legal effect of
electronic time stamps. A specific legal presumption is bestowed on qualified
electronic time stamps with regard to the certainty of the time.

Article 33 sets out the requirements for
qualified electronic time stamps.

3.3.3.6 Section 6 – Electronic
documents

Article 34 is related to the legal effects
and the conditions of acceptance of electronic documents. There is a specific
legal presumption of the authenticity and integrity of any electronic document
signed with a qualified electronic signature or bearing a qualified electronic
seal. With regard to the acceptance of electronic documents, when an original
document or a certified copy is required for the provision of a public service,
at least electronic documents issued by the persons who are competent to issue
the relevant documents and that are considered to be originals or certified
copies in accordance with national law of the Member State of origin, shall be
accepted in other Member States without additional requirements.

3.3.3.7 Section 7 – Electronic delivery
services

Article 35 concerns the legal effect of
data sent or received using an electronic delivery service. A specific legal
presumption regarding the integrity of data which are sent or received and the accuracy
of the time on which the data are sent or received is guaranteed for qualified
electronic delivery services. It also ensures the mutual recognition of
qualified electronic delivery services at EU level.

Article 36 sets out the requirements for
qualified electronic delivery services.

3.3.3.8 Section 8 – Website
authentication

This section is intended to ensure that the
authenticity of a website with respect to the owner of the site will be
guaranteed.

Article 37 sets out the requirements for
qualified certificates for website authentication, which can be used to
guarantee the authenticity of a website. A qualified certificate for website
authentication will provide a minimal set of trustworthy information on the
website and on the legal existence of its owner.

3.3.4      CHAPTER IV – DELEGATED
ACTS

Article 38 contains the standard provisions
for exercising the delegations in line with Article 290 TFEU (delegated acts).
This allows the legislator to delegate to the Commission the power to adopt
non-legislative acts of general application to supplement or amend certain
non-essential elements of a legislative act.

3.3.5      CHAPTER V – IMPLEMENTING
ACTS

Article 39 contains the provision covering
the Committee procedure needed to confer implementing powers on the Commission
wherever, in accordance with Article 291 TFEU, uniform conditions for
implementing legally binding acts of the Union are needed. The examination
procedure applies.

3.3.6      CHAPTER VI – FINAL
PROVISIONS

Article 40 obliges the Commission to
evaluate the Regulation and report on its findings.

Article 41 repeals Directive 1999/93/EC and
provides for the smooth transition of the existing electronic signature
infrastructure to the new requirements of the Regulation.

Article 42 sets out the date of the entry
into force of the Regulation.

4.           BUDGETARY IMPLICATIONS

The specific budgetary implications of the
proposal relate to the tasks allocated to the European Commission as specified
in the legislative financial statements accompanying this proposal.

The proposal has no implications on
operational expenditure.

The legislative financial statement accompanying
this proposal for a Regulation covers the budgetary impacts for the Regulation
itself.

2012/0146 (COD)

Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT
AND OF THE COUNCIL

on electronic identification and trust
services for electronic transactions in the internal market

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE
COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the
Functioning of the European Union, and in particular Article 114 thereof,

Having regard to the proposal from the
European Commission,

After transmission of the draft legislative
act to the national Parliaments,

Having regard to the opinion of the
European Economic and Social Committee[11],

After consulting the European Data
Protection Supervisor[12],

Acting in accordance with the ordinary
legislative procedure,

Whereas:

(1)       Building trust in the
online environment is key to economic development. Lack of trust makes
consumers, businesses and administrations hesitate to carry out transactions
electronically and to adopt new services.

(2)       This Regulation seeks to
enhance trust in electronic transactions in the internal market by enabling
secure and seamless electronic interactions to take place between businesses,
citizens and public authorities, thereby increasing the effectiveness of public
and private online services, electronic business and electronic commerce in the
Union.

(3)       Directive 1999/93/EC of
the European Parliament and of the Council of 13 December 1999 on a Community
framework for electronic signatures[13],
essentially covered electronic signatures without delivering a comprehensive
cross-border and cross-sector framework for secure, trustworthy and easy-to-use
electronic transactions. This Regulation enhances and expands the acquis
of the Directive.

(4)       The Commission’s Digital
Agenda for Europe[14]
identified the fragmentation of the digital market, the lack of
interoperability and the rise in cybercrime as major obstacles to the virtuous
cycle of the digital economy. In its Citizenship Report 2010 the Commission
further highlighted the need to solve the main problems which prevent European
citizens from enjoying the benefits of a digital single market and cross-border
digital services[15].

(5)       The European Council
invited the Commission to create a digital single market by 2015[16] to make rapid progress in key
areas of the digital economy and to promote a fully integrated digital single market[17] by facilitating the
cross-border use of online services, with particular attention to facilitating secure
electronic identification and authentication.

(6)       The Council invited the
Commission to contribute to the digital single market by creating appropriate
conditions for the mutual recognition of key enablers across borders, such as
electronic identification, electronic documents, electronic signatures and
electronic delivery services, and for interoperable eGovernment services across
the European Union[18].

(7)       The European Parliament
stressed the importance of the security of electronic services, especially of
electronic signatures, and of the need to create a public key infrastructure at
pan-European level, and called on the Commission to set up a European
validation authorities gateway to ensure the cross-border interoperability of
electronic signatures and to increase the security of transactions carried out
using the internet[19].

(8)       Directive 2006/123/EC of
the European Parliament and of the Council of 12 December 2006 on services in
the internal market[20]
requests Member States to establish ‘points of single contact’ (PSC) to ensure
that all procedures and formalities relating to access to a service activity
and to the exercise thereof can be easily completed, at a distance and by
electronic means, through the appropriate point of single contact and with the appropriate
authorities. Many online services accessible through PSCs require electronic
identification, authentication and signature.

(9)       In most cases service
providers from another Member State cannot use their electronic identification
to access these services because the national electronic identification schemes
in their country are not recognised and accepted in other Member States. This
electronic barrier excludes service providers from enjoying the full benefits
of the internal market. Mutually recognized and accepted electronic
identification means will facilitate cross-border provision of numerous
services in the Internal Market and enable businesses to go cross-border
without facing many obstacles in interactions with public authorities

(10)     Directive
2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the
application of patients’ rights
in cross-border healthcare[21]
sets up a network of national authorities responsible for eHealth. To enhance
safety and the continuity of cross-border healthcare, the network is required
to produce guidelines on cross-border access to electronic health data and
services, including by supporting ‘common identification and authentication measures to facilitate
transferability of data in cross-border healthcare’. Mutual
recognition and acceptance of electronic identification and authentication is
key to make cross border healthcare for European citizens a reality. When
people travel for treatment, their medical data needs to be accessible in the
country of treatment. This requires a solid, safe and trusted electronic
identification framework.

(11)     One of the objectives of
this Regulation is to remove existing barriers to the cross-border use of
electronic identification means used in the Member States to access at least
public services. This Regulation does not aim at intervening on electronic
identity management systems and related infrastructures established in the
Member States. The aim of this Regulation is to ensure that for the access to
cross-border online services offered by the Member States, secure electronic
identification and authentication is possible.

(12)     Member States should remain
free to use or introduce means, for electronic identification purposes, for accessing
online services. They should also be able to decide whether to involve the
private sector in the provision of these means. Member States should not be obliged
to notify their electronic identification schemes. The choice to either notify
all, some or none of the electronic identification schemes used at national
level to access at least public online services or specific services is up to the
Member States.

(13)     Some conditions need to be
set in the Regulation with regard to which electronic identification means have
to be accepted and how the schemes should be notified. These should help Member
States to build the necessary trust in each other's electronic identification
schemes and to mutually recognise and accept electronic identification means falling
under their notified schemes. The principle of mutual recognition and
acceptance should apply if the notifying Member State meets the conditions of
notification and the notification was published in the Official Journal of the
European Union. However, the access to these online services and their final delivery
to the applicant should be closely linked to the right to receive such services
under the conditions set by national legislation.

(14)     Member States should be
able to decide to involve the private sector in the issuance of electronic identification
means and to allow the private sector the use of electronic identification
means under a notified scheme for identification purposes when needed for
online services or electronic transactions. The possibility to use such
electronic identification means would enable the private sector to rely on
electronic identification and authentication already largely used in many
Member States at least for public services and to make it easier for businesses
and citizens to access their online services across borders. In order to
facilitate the use of such electronic identification means across borders by
the private sector, the authentication possibility provided by the Member
States should be available to relying parties without discriminating between
public or private sector.

(15)     The cross border use of
electronic identification means under a notified scheme requires Member States to
cooperate in providing technical interoperability. This rules out any specific
national technical rules requiring non-national parties for instance to obtain
specific hardware or software to verify and validate the notified electronic
identification. Technical requirements on users, on the other hand, stemming
from the inherent specifications of whatever token is used (e.g. smartcards)
are inevitable.

(16)     Cooperation of Member
States should serve the technical interoperability of the notified electronic
identification schemes with a view to foster a high level of trust and security
appropriate to the degree of risk. The exchange of information and the sharing
of best practices between Member States with a view to their mutual recognition
should help such cooperation.

(17)     This Regulation should also
establish a general legal framework for the use of electronic trust services.
However, it should not create a general obligation to use them. In particular,
it should not cover the provision of services based on voluntary agreements
under private law. Neither should it cover aspects related to the conclusion
and validity of contracts or other legal obligations where there are
requirements as regards form prescribed by national or Union law.

(18)     In order to contribute to
the general cross-border use of electronic trust services, it should be
possible to use them as evidence in legal proceedings in all Member States.

(19)     Member States should remain
free to define other types of trust services in addition to those making part
of the closed list of trust services provided for in this Regulation, for the
purpose of recognition at national level as qualified trust services.

(20)     Because of the pace of technological
change, this Regulation should adopt an approach which is open to innovations.

(21)     This Regulation should be
technology-neutral. The legal effects it grants should be achievable by any
technical means provided that the requirements of this Regulation are met.

(22)     To enhance people’s trust
in the internal market and to promote the use of trust services and products,
the notions of qualified trust services and qualified trust service provider should
be introduced with a view to indicating requirements and obligations to ensure
high-level security of whatever qualified trust services and products are used
or provided.

(23)     In line with the
obligations under the UN Convention on the Rights of Persons with Disabilities
that has entered into force in the EU, persons with disabilities should be able
to use trust services and end user products used in the provision of those
services on equal bases with other consumers.

(24)     A trust service provider is
a controller of personal data and therefore has to comply with the obligations
set out in Directive 95/46/EC of the European Parliament and of the Council of
24 October 1995 on the protection of individuals with regard to the processing
of personal data and on the free movement of such data[22]. In particular the collection
of data should be minimised as much as possible taking into account the purpose
of the service provided.

(25)     Supervisory bodies should
cooperate and exchange information with data protection authorities to ensure
proper implementation of data protection legislation by service providers. The
exchange of information should in particular cover security incidents and
personal data breaches.

(26)     It should be incumbent on
all trust service providers to apply good security practice appropriate to the
risks related to their activities so as to boost users’ trust in the single
market.

(27)     Provisions on the use of
pseudonyms in certificates should not prevent Member States from requiring
identification of persons pursuant to Union or national law.

(28)     All Member States should
follow common essential supervision requirements to ensure a comparable
security level of qualified trust services. To ease the consistent application
of these requirements across the Union, Member States should adopt comparable
procedures and should exchange information on their supervision activities and
best practices in the field.

(29)     Notification of security
breaches and security risk assessments is essential with a view to providing
adequate information to concerned parties in the event of a breach of security
or loss of integrity.

(30)     To enable the Commission
and the Member States to assess the effectiveness of the breach notification
mechanism introduced by this Regulation, supervisory bodies should be requested
to provide summary information to the Commission and to European Network and
Information Security Agency (ENISA).

(31)     To enable the Commission
and the Member States to assess the impact of this Regulation, supervisory
bodies should be requested to provide statistics on and the use of qualified
trust services.

(32)     To enable the Commission
and the Member States to assess the effectiveness of the enhanced supervision
mechanism introduced by this Regulation, supervisory bodies should be requested
to report on their activities. This would be instrumental in facilitating the
exchange of good practices between supervisory bodies and would ensure the
verification that essential supervision requirements are implemented consistently
and efficiently in all Member States.

(33)     To ensure sustainability
and durability of qualified trust services and to boost users’ confidence in
the continuity of qualified trust services, supervisory bodies should ensure
that the data of qualified trust service providers are preserved and kept accessible
for an appropriate period of time even if a qualified trust service provider
ceases to exist.

(34)     To facilitate the
supervision of qualified trust services providers, for example when a provider
is providing its services in the territory of another Member State and is not
subject to supervision there, or when the computers of a provider are located
in the territory of another Member State than the one where it is established,
a mutual assistance system between supervisory bodies in the Member States should
be set up.

(35)     It is the responsibility of
trust service providers to meet the requirements set out in this Regulation for
the provisioning of trust services, in particular for qualified trust services.
Supervisory bodies have the responsibility to supervise how trust service
providers meet these requirements.

(36)     In order to allow an
efficient initiation process, which should lead to the inclusion of qualified
trust service providers and the qualified trust services they provide into trusted
lists, preliminary interactions between prospective qualified trust service
providers and the competent supervisory body should be encouraged with the view
of facilitating the due diligence leading to the provisioning of qualified
trust services.

(37)     Trusted lists are essential
elements to build trust among market operators as they indicate the qualified
status of the service provider at the time of supervision, on the other hand
they are not a prerequisite for achieving the qualified status and providing
qualified trust services which results from respecting the requirements of this
Regulation.

(38)     Once it has been subject to
a notification, a qualified trust service cannot be refused for the fulfilment
of an administrative procedure or formality by the concerned public sector
body, for not being included in the trusted lists established by the Member
States. For the present purpose a public sector body refers to any public
authority or other entity entrusted with the provision of eGovernment services
such as online tax declaration, request for birth certificates, participation
to electronic public procurement procedures, etc.

(39)     While a high level of
security is needed to ensure mutual recognition of electronic signatures, in
specific cases, such as in the context of Commission Decision 2009/767/EC of 16
October 2009 setting out measures facilitating the use of procedures by
electronic means through the ‘points of single contact’ under Directive
2006/123/EC of the European Parliament and of the Council on services in the
internal market[23], electronic
signatures with a lower security assurance should also be accepted.

(40)     It should be possible to
entrust qualified electronic signature creation devices to the care of a third
party by the signatory, provided that appropriate mechanisms and procedures are
implemented to ensure that the signatory has sole control over the use of his
electronic signature creation data, and the qualified signature requirements
are met by the use of the device.

(41)     To ensure legal certainty
on the validity of the signature it is essential to detail which components of
a qualified electronic signature must be assessed by the relying party carrying
out the validation. Moreover, defining the requirements of qualified trust
service providers that can provide a qualified validation service to relying
parties not willing or unable to carry out themselves the validation of
qualified electronic signatures, should stimulate the private or public sector
to invest in such services. Both elements should make qualified electronic
signature validation easy and convenient for all parties at Union level.

(42)     When a transaction requires
a qualified electronic seal from a legal person, a qualified electronic
signature from the authorised representative of the legal person should be equally
acceptable.

(43)     Electronic seals should serve
as evidence that an electronic document was issued by a legal person, ensuring
certainty of the document’s origin and integrity.

(44)     This Regulation should ensure
the long-term preservation of information, i.e. the legal validity of
electronic signature and electronic seals over extended periods of time, guaranteeing
that they can be validated irrespective of future technological change.

(45)     In order to enhance the
cross-border use of electronic documents this Regulation should provide for the
legal effect of electronic documents which should be considered as equal to
paper documents dependent on the risk assessment and provided the authenticity
and integrity of the documents are ensured. It also important for further
development of cross-border electronic transactions in the internal market that
original electronic documents or certified copies issued by relevant competent
bodies in a Member State under their national law are accepted as such also in
other Member States. This Regulation should not affect Member States’ right to
determine what constitutes an original or a copy at a national level but ensures
that these can be used as such also across borders.

(46)     As competent authorities in
the Member States currently use different formats of advanced electronic
signatures to sign their documents electronically, it is necessary to ensure
that at least a number of advanced electronic signature formats can be
technically supported by Member States when they receive documents signed
electronically. Similarly, when competent authorities in the Member States use
advanced electronic seals, it would be necessary to ensure that they support at
least a number of advanced electronic seal formats.

(47)     In addition to
authenticating the document issued by the legal person, electronic seals can be
used to authenticate any digital asset of the legal person, e.g. software code,
servers.

(48)     Making it possible to authenticate
websites and the person owning them would make it harder to falsify websites
and thus reduce fraud.

(49)     In
order to complement certain detailed technical aspects of this Regulation in a
flexible and rapid manner, the power to adopt acts in accordance with Article
290 of the Treaty on the Functioning of the European Union should be delegated
to the Commission in respect of interoperability of electronic identification; security
measures required of trust service providers; recognised independent bodies
responsible for auditing the service providers; trusted lists; requirements
related to the security levels of electronic signatures; requirements of
qualified certificates for electronic signatures their validation and their
preservation; the bodies responsible for the certification of qualified
electronic signature creation devices; and the requirements related to the
security levels of electronic seals and to qualified certificates for
electronic seals; the interoperability between delivery services. It is of
particular importance that the Commission carry out appropriate consultations
during its preparatory work, including at expert level.

(50)     The
Commission, when preparing and drawing up delegated acts, should ensure a
simultaneous, timely and appropriate transmission of relevant documents to the
European Parliament and to the Council.

(51)     In
order to ensure uniform conditions for the implementation of this Regulation,
implementing powers should be conferred on the Commission, in particular for
specifying reference numbers of standards which use would give a presumption of
compliance with certain requirements laid down in this Regulation or defined in
delegated acts. Those powers should be exercised in accordance with Regulation
(EU) No 182/2011 of the European Parliament and of the Council of 16 February
2011 laying down the rules and general principles concerning mechanisms for
control by the Member States of the Commission's exercise of implementing
powers[24].

(52)     For reasons of legal
certainty and clarity, Directive 1999/93/EC should be repealed.

(53)     To ensure legal certainty
to the market operators already using qualified certificates issued in
compliance with Directive 1999/93/EC, it is necessary to provide for a
sufficient period of time for transitional purposes. It is also necessary to
provide the Commission with the means to adopt the implementing acts and
delegated acts before that date.

(54)     Since the objectives of
this Regulation cannot be sufficiently achieved by the Member States and can
therefore, by reason of the scale of the action, be better achieved at Union
level, the Union may adopt measures, in accordance with the principle of
subsidiarity as set out in Article 5 of the Treaty on European Union. In
accordance with the principle of proportionality, as set out in that Article,
this Regulation does not go beyond what is necessary in order to achieve that
objective, especially regarding the Commission's role as coordinator of national
activities,

HAVE ADOPTED THIS REGULATION:

CHAPTER
I

GENERAL
PROVISIONS

Article 1

Subject
matter

1.
This Regulation lays down rules for electronic identification and electronic
trust services for electronic transactions with a view to ensuring the proper
functioning of the internal market.

2. This Regulation lays down the conditions
under which Member States shall recognise and accept electronic identification means
of natural and legal persons falling under a notified electronic identification
scheme of another Member State.

3. This Regulation establishes a legal
framework for electronic signatures, electronic seals, electronic time stamps,
electronic documents, electronic delivery services and website authentication.

4. This Regulation ensures that trust
services and products which comply with this Regulation are permitted to
circulate freely in the internal market.

Article 2

Scope

1. This Regulation applies to electronic
identification provided by, on behalf or under the responsibility of Member
States and to trust service providers established in the Union.

2. This Regulation does not apply to the
provision of electronic trust services based on voluntary agreements under
private law.

3. This Regulation does not apply to
aspects related to the conclusion and validity of contracts or other legal
obligations where there are requirements as regards form prescribed by national
or Union law.

Article 3

Definitions

For the purposes of this Regulation,
the following definitions shall apply:

(1) ‘electronic identification’ means
the process of using person identification data in electronic form unambiguously
representing a natural or legal person;

(2) ‘electronic identification means’
means a material or immaterial unit containing data as referred to in point 1
of this Article, and which is used to access services online as referred to in
Article 5;

(3) ‘electronic identification scheme’
means a system for electronic identification under which electronic
identification means are issued to persons as referred to in point 1 of this
Article;

(4) ‘authentication’ means an electronic
process that allows the validation of the electronic identification of a
natural or legal person; or of the origin and integrity of an electronic data;

(5) ‘signatory’ means a natural person
who creates an electronic signature;

(6) ‘electronic signature’ means data
in electronic form which are attached to or logically associated with other
electronic data and which are used by the signatory to sign;

(7) ‘advanced electronic signature’
means an electronic signature which meets the following requirements:

(a)
it is uniquely linked to the signatory;

(b)
it is capable of identifying the signatory;

(c)
it is created using electronic signature
creation data that the signatory can, with high level of confidence, use under
his sole control; and

(d)
it is linked to the data to which it relates in
such a way that any subsequent change in the data is detectable;

(8) ‘qualified electronic signature’ means
an advanced electronic signature which is created by a qualified electronic
signature creation device, and which is based on a qualified certificate for
electronic signatures;

(9) ‘electronic signature creation data’
means unique data which are used by the signatory to create an electronic
signature;

(10) ‘certificate’ means an electronic
attestation which links electronic signature or seal validation data of a
natural or a legal person respectively to the certificate and confirms those
data of that person;

(11) ‘qualified certificate for
electronic signature’ means an attestation which is used to support electronic
signatures, is issued by a qualified trust service provider and meet the
requirements laid down in Annex I;

(12) ‘trust service’ means any
electronic service consisting in the creation, verification, validation, handling
and preservation of electronic signatures, electronic seals, electronic time
stamps, electronic documents, electronic delivery services, website
authentication, and electronic certificates, including certificates for
electronic signature and for electronic seals;

(13) ‘qualified trust service’ means a
trust service that meets the applicable requirements provided for in this
Regulation;

(14) ‘trust service provider’ means a
natural or a legal person who provides one or more trust services;

(15) ‘qualified trust service provider’
means a trust service provider who meets the requirements laid down in this
Regulation;

(16) ‘product’ means hardware or
software, or relevant components thereof, which are intended to be used for the
provision of trust services;

(17) ‘electronic signature creation
device’ means configured software or hardware used to create an electronic signature;

(18) ‘qualified electronic signature
creation device’ means an electronic signature creation device which meets the
requirements laid down in Annex II;

(19) ‘creator of a seal’ means a legal
person who creates an electronic seal;

(20) ‘electronic seal’ means data in
electronic form which are attached to or logically associated with other
electronic data to ensure the origin and the integrity of the associated data;

(21) ‘advanced electronic seal’ means
an electronic seal which meets the following requirements:

(a)
it is uniquely linked to the creator of the
seal;

(b)
it is capable of identifying the creator of the
seal;

(c)
it is created using electronic seal creation
data that the creator of the seal can, with a high level of confidence under
its control, use for electronic seal creation; and

(d)
it is linked to the data to which it relates in
such a way that any subsequent change in the data is detectable;

(22) ‘qualified electronic seal’ means
an advanced electronic seal which is created by a qualified electronic seal
creation device, and which is based on a qualified certificate for electronic
seal;

(23) ‘electronic seal creation data’
means unique data which are used by the creator of the electronic seal to
create an electronic seal;

(24) ‘qualified certificate for electronic seal’ means an
attestation which is used to support an electronic seal, is issued by a
qualified trust service provider and meet the requirements laid down in Annex
III;

(25) ‘electronic time stamp’ means data in electronic
form which binds other electronic data to a particular time establishing
evidence that these data existed at that time;

(26) ‘qualified electronic time stamp’ means an
electronic time stamp which meets the requirements laid down in Article 33;

(27) ‘electronic document’ means a
document in any electronic format;

(28) ‘electronic delivery service’ means
a service that makes it possible to transmit data by electronic means and
provides evidence relating to the handling of the transmitted data, including
proof of sending or receiving the data, and which protects transmitted data
against the risk of loss, theft, damage or any unauthorised alterations;

(29) ‘qualified electronic delivery
service’ means an electronic delivery service which meets the requirements laid
down in Article 36;

(30) ‘qualified certificate for website
authentication’ means an attestation which makes it possible to authenticate a
website and links the website to the person to whom the certificate is issued, which
is issued by a qualified trust service provider and meets the requirements laid
down in Annex IV;

(31) ‘validation data’ means data which are
used to validate an electronic signature or an electronic seal.

Article 4

Internal
market principle

1. There shall be no restriction on the
provision of trust services in the territory of a Member State by a trust
service provider established in another Member States for reasons which fall
within the fields covered by this Regulation.

2. Products which comply with this
Regulation shall be permitted to circulate freely in the internal market.

CHAPTER
II

ELECTRONIC
IDENTIFICATION

Article 5

Mutual
recognition and acceptance

When an electronic identification using an
electronic identification means and authentication is required under national
legislation or administrative practice to access a service online, any
electronic identification means issued in another Member State falling under a
scheme included in the list published by the Commission pursuant to the
procedure referred to in Article 7 shall be recognised and accepted for the
purposes of accessing this service.

Article 6

Conditions
of notification of electronic identification schemes

1. Electronic identification schemes shall
be eligible for notification pursuant to Article 7 if all the following
conditions are met:

(a)
the electronic identification means are issued
by, on behalf of or under the responsibility of the notifying Member State;

(b)
the electronic identification means can be used
to access at least public services requiring electronic identification in the
notifying Member State;

(c)
the notifying Member State ensures that the
person identification data are attributed unambiguously to the natural or legal
person referred to in Article 3 point1;

(d)
the notifying Member State ensures the
availability of an authentication possibility online, at any time and free of
charge so that any relying party can validate the person identification data
received in electronic form. Member States shall not impose any specific
technical requirements on relying parties established outside of their
territory intending to carry out such authentication. When either the notified
identification scheme or authentication possibility is breached or partly
compromised, Member States shall suspend or revoke without delay the notified
identification scheme or authentication possibility or the compromised parts
concerned and inform the other Member States and the Commission pursuant to
Article 7;

(e)
the notifying Member State takes liability for:

–
(i) the unambiguous attribution of the person
identification data referred to in point (c), and

–
(ii) the authentication possibility specified in
point (d).

2. Point (e) of paragraph 1 is without prejudice
to the liability of parties to a transaction in which electronic identification
means falling under the notified scheme are used.

Article
7

Notification

1. Member States which notify an electronic
identification scheme shall forward to the Commission the following information
and without undue delay, any subsequent changes thereof:

(a)
a description of the notified electronic
identification scheme;

(b)
the authorities responsible for the notified
electronic identification scheme;

(c)
information on by whom the registration of the
unambiguous person identifiers is managed;

(d)
a description of the authentication possibility;

(e)
arrangements for suspension or revocation of
either the notified identification scheme or authentication possibility or the
compromised parts concerned.

2. Six months after the entry into force of
the Regulation, the Commission shall publish in the Official Journal of the
European Union the list of the electronic identification schemes which were
notified pursuant to paragraph 1 and the basic information thereon.

3. If the Commission receives a
notification after the period referred to in paragraph 2 expired, it shall amend
the list within three months.

4. The Commission may, by means of
implementing acts, define the circumstances, formats and procedures of the
notification referred to in paragraphs 1 and 3. Those implementing acts shall
be adopted in accordance with the examination procedure referred to in Article
39(2).

Article 8

Coordination

1. Member States shall cooperate in order
to ensure the interoperability of electronic identification means falling under
a notified scheme and to enhance their security.

2. The Commission shall, by means of
implementing acts, establish the necessary modalities to facilitate the
cooperation between the Member States referred to in paragraph 1 with a view to
fostering a high level of trust and security appropriate to the degree of risk.
Those implementing acts shall concern, in particular, the exchange of
information, experiences and good practice on electronic identification
schemes, the peer review of notified electronic identification schemes and the
examination of relevant developments arising in the electronic identification
sector by the competent authorities of the Member States. Those implementing
acts shall be adopted in accordance with the examination procedure referred to
in Article 39(2).

3. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the facilitation
of cross border interoperability of electronic identification means by setting
of minimum technical requirements.

CHAPTER
III

TRUST
SERVICES

Section
1

General provisions

Article 9

Liability

1. A trust service provider shall be liable
for any direct damage caused to any natural or legal person due to failure to
comply with the obligations laid down in Article 15(1), unless the
trust service provider can prove that he has not acted negligently.

2. A qualified trust service provider shall be liable for any direct damage caused
to any natural or legal person due to failure to meet the requirements laid
down in this Regulation, in particular in Article 19, unless the qualified trust service provider can prove
that he has not acted negligently.

Article 10

Trust
services providers from third countries

1. Qualified trust services and qualified
certificates provided by qualified trust service providers established in a third
country shall be accepted as qualified trust services and qualified
certificates provided by a qualified trust service providers established in the
territory of the Union if the qualified trust services or qualified
certificates originating from the third country are recognised under an
agreement between the Union and third countries or international organisations in
accordance with Article 218 TFUE.

2. With reference to paragraph 1, such
agreements shall ensure that the requirements applicable to qualified trust
services and qualified certificates provided by qualified trust service
providers established in the territory of the Union are met by the trust
service providers in the third countries or international organisations,
especially with regard to the protection of personal data, security and
supervision.

Article 11

Data
processing and protection

1. Trust service providers and supervisory bodies
shall ensure fair and lawful processing in accordance with Directive 95/46/EC when
processing personal data.

2. Trust service providers shall process
personal data according to Directive 95/46/EC. Such processing shall be
strictly limited to the minimum data needed to issue and maintain a certificate
or to provide a trust service.

3. Trust service providers shall guarantee the
confidentiality and integrity of data related to a person to whom the trust
service is provided.

4. Without prejudice to the legal effect
given to pseudonyms under national law, Member States shall not prevent trust
service providers indicating in electronic signature certificates a pseudonym
instead of the signatory’s name.

Article 12

Accessibility for persons with disabilities

Trust services
provided and end user products used in the provision of those services shall be
made accessible for persons with disabilities whenever possible.

Section
2

Supervision

Article 13

Supervisory
body

1. Member States shall designate an
appropriate body established in their territory or, upon mutual agreement, in
another Member State under the responsibility of the designating Member State. Supervisory
bodies shall be given all supervisory and investigatory powers that are
necessary for the exercise of their tasks.

2. The supervisory body shall be
responsible for the performance of the following tasks:

(a)
monitoring trust service providers established
in the territory of the designating Member State to ensure that they fulfil the
requirements laid down in Article 15;

(b)
undertaking supervision
of qualified trust service providers established in the
territory of the designating Member State and of the qualified trust services
they provide in order to ensure that they and the qualified trust services
provided by them meet the applicable requirements laid down in this Regulation;

(c)
ensuring that relevant information and data referred
to in point (g) of Article 19(2), and recorded by qualified trust service
providers are preserved and kept accessible after the activities of a qualified
trust service provider have ceased, for an appropriate time with a view to
guaranteeing continuity of the service.

3. Each supervisory body shall submit a
yearly report on the last calendar year’s supervisory activities to the
Commission and Member States by the end of the first quarter of the following
year. It shall include at least:

(a)
information on its supervisory activities;

(b)
a summary of breach notifications received from
trust service providers in accordance with Article 15(2);

(c)
statistics on the market and usage of qualified
trust services, including information on qualified trust service providers
themselves, the qualified trust services they provide, the products they use
and the general description of their customers.

4. Member States shall notify to the
Commission and other Member States the names and the addresses of their
respective designated supervisory bodies.

5. The Commission shall be empowered to
adopt delegated acts, in accordance with Article 38, concerning the definition
of procedures applicable to the tasks referred to in paragraph 2.

6. The Commission may, by means of
implementing acts, define the circumstances, formats and procedures for the
report referred to in paragraph 3. Those implementing acts shall be adopted in
accordance with the examination procedure referred to in Article 39(2).

Article 14

Mutual
assistance

1. Supervisory bodies shall cooperate with
a view to exchange good practice and provide each other, within the shortest
possible time, with relevant information and mutual assistance so that
activities can be carried out in a consistent manner. Mutual assistance shall
cover, in particular, information requests and supervisory measures, such as
requests to carry out inspections related to the security audits as referred to
in Articles 15, 16 and 17.

2. A supervisory body to which a request
for assistance is addressed may not refuse to comply with it unless:

(a)
it is not competent to deal with the request; or

(b)
compliance with the request would be
incompatible with this Regulation.

3. Where appropriate, supervisory bodies
may carry out joint investigations in which staff from other Member States’
supervisory bodies is involved.

The supervisory body of the Member State
where the investigation is to take place, in compliance with its own national
law, may devolve investigative tasks to the assisted supervisory body’s staff.
Such powers may be exercised only under the guidance and in the presence of
staff from the host supervisory body. The assisted supervisory body’s staff
shall be subject to the host supervisory body’s national law. The host
supervisory body shall assume responsibility for the assisted supervisory body
staff’s actions.

4. The Commission may, by means of
implementing acts, specify the formats and procedures for the mutual assistance
provided for in this Article. Those implementing acts shall be adopted in
accordance with the examination procedure referred to in Article 39(2).

Article 15

Security
requirements applicable to trust service providers

1. Trust service providers who are
established in the territory of the Union shall take appropriate technical and
organisational measures to manage the risks posed to the security of the trust
services they provide. Having regard to state of the
art, these measures shall ensure that the level of
security is appropriate to the degree of risk. In particular, measures shall be
taken to prevent and minimise the impact of security incidents and inform
stakeholders of adverse effects of any incidents.

Without prejudice to Article 16(1), any
trust service provider may submit the report of a security audit carried out by
a recognised independent body to the supervisory body to confirm that
appropriate security measures have been taken.

2. Trust service providers shall, without
undue delay and where feasible not later than 24 hours after having become
aware of it, notify the competent supervisory body, the competent national body
for information security and other relevant third parties such as data protection
authorities of any breach of security or loss of integrity that has a
significant impact on the trust service provided and on the personal data
maintained therein.

Where appropriate, in particular if a
breach of security or loss of integrity concerns two or more Member States, the
supervisory body concerned shall inform supervisory bodies in other Member
States and the European Network and Information Security Agency (ENISA).

The supervisory body concerned may also
inform the public or require the trust service provider to do so, where it
determines that disclosure of the breach is in the public interest.

3. The supervisory body shall provide to ENISA
and to the Commission once a year with a summary of breach notifications
received from trust service providers.

4. In order to implement paragraphs 1 and
2, the competent supervisory body shall have the power to issue binding
instructions to trust service providers.

5. The Commission shall be empowered to
adopt delegated acts, in accordance with Article 38, concerning the further
specification of the measures referred to in paragraph 1.

6. The Commission may, by means of
implementing acts, define the circumstances, formats and procedures, including
deadlines, applicable for the purpose of paragraphs 1 to 3. Those implementing
acts shall be adopted in accordance with the examination procedure referred to
in Article 39(2).

Article 16

Supervision of qualified trust service providers

1. Qualified trust service providers shall
be audited by a recognised independent body once a year to confirm that they
and the qualified trust services provided by them fulfil the requirements set
out in this Regulation, and shall submit the resulting security audit report to
the supervisory body.

2. Without prejudice to paragraph 1, the
supervisory body may at any time audit the qualified trust service providers to
confirm that they and the qualified trust services provided by them still meet
the conditions set out in this Regulation, either on its own initiative or in
response to a request from the Commission. The supervisory body shall inform
the data protection authorities of the results of its audits, in case personal
data protection rules appear to have been breached.

3. The supervisory body shall have the
power to issue binding instructions to qualified trust service providers to
remedy any failure to fulfil the requirements indicated in the security audit
report.

4. With reference to paragraph 3, if the
qualified trust service provider does not remedy any such failure within a time
limit set by the supervisory body, it shall lose its qualified status and be
informed by the supervisory body that its status will be changed accordingly in
the trusted lists referred to in Article 18.

5. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the specification
of the conditions under which the independent body carrying out the audit
referred to in paragraph 1 of this Article and in Article 15(1) and in Article
17(1) shall be recognised.

6. The Commission may, by means of
implementing acts, define the circumstances, procedures and formats applicable
for the purpose of paragraphs 1, 2 and 4. Those implementing acts shall be
adopted in accordance with the examination procedure referred to in Article 39(2).

Article 17

Initiation
of a qualified trust service

1. Qualified trust service providers shall
notify the supervisory body of their intention to start providing a qualified
trust service and shall submit to the supervisory body a security audit report
carried out by a recognised independent body, as provided for in Article 16(1).
Qualified trust service providers may start to provide the qualified trust
service after they have submitted the notification and security audit report to
the supervisory body.

2. Once the relevant documents are
submitted to the supervisory body according to paragraph 1, the qualified
service providers shall be included in the trusted lists referred to in Article
18 indicating that the notification has been submitted.

3. The supervisory body shall verify the
compliance of the qualified trust service provider and of the qualified trust services
provided by it with the requirements of the Regulation.

The supervisory body shall indicate the
qualified status of the qualified service providers and the qualified trust
services they provide in the trusted lists after the positive conclusion of the
verification, not later than one month after the notification has been done in
accordance with paragraph 1.

If the verification is not concluded within
one month, the supervisory body shall inform the qualified trust service
provider specifying the reasons of the delay and the period by which the
verification shall be concluded.

4. A qualified trust service which has been
subject to the notification referred to in paragraph 1 cannot be refused for
the fulfilment of an administrative procedure or formality by the concerned
public sector body for not being included in the lists referred to in paragraph
3.

5. The Commission may, by means of
implementing acts, define the circumstances, formats and procedures for the
purpose of paragraphs 1, 2 and.3 Those implementing acts shall be adopted in
accordance with the examination procedure referred to in Article 39(2).

Article 18

Trusted
lists

1. Each Member State shall establish,
maintain and publish trusted lists with information related to the qualified
trust service providers for which it is competent together with information
related to the qualified trust services provided by them.

2. Member States shall establish, maintain
and publish, in a secure manner, electronically signed or sealed trusted lists provided
for in paragraph 1 in a form suitable for automated processing.

3. Member States shall notify to the
Commission, without undue delay, information on the body responsible for
establishing, maintaining and publishing national trusted lists, and details of
where such lists are published, the certificate used to sign or seal the trusted
lists and any changes thereto.

4. The Commission shall make available to the public, through
a secure channel, the information, referred to in paragraph 3 in electronically
signed or sealed form suitable for automated processing.

5. The Commission shall be empowered to adopt delegated acts in
accordance with Article 38 concerning the definition of the information
referred to in paragraph 1.

6. The Commission may, by means of
implementing acts, define the technical
specifications and formats for trusted lists applicable for the purposes of paragraphs 1 to 4. Those implementing acts shall be adopted in
accordance with the examination procedure referred to in Article 39(2).

Article 19

Requirements
for qualified trust
service providers

1. When issuing a qualified certificate, a qualified trust service provider shall verify, by appropriate means
and in accordance with national law, the identity and, if applicable, any
specific attributes of the natural or legal person to whom a qualified
certificate is issued.

Such information shall be verified by the qualified service
provider or by an authorised third party acting under the responsibility of the
qualified service provider:

(a)
by a physical appearance of the natural person
or of an authorised representative of the legal person, or

(b)
remotely, using electronic identification means under
a notified scheme issued in compliance with point (a).

2. Qualified trust service providers providing qualified
trust services shall:

(a)
employ staff who possess the necessary
expertise, experience, and qualifications and apply administrative and
management procedures which correspond to European or international standards and
have received appropriate training regarding security and personal data
protection rules;

(b)
bear the risk of liability for damages by
maintaining sufficient financial resources or by an appropriate liability
insurance scheme;

(c)
before entering into a contractual relationship,
inform any person seeking to use a qualified trust service of the precise terms
and conditions regarding the use of that service;

(d)
use trustworthy systems and products which are
protected against modification and guarantee the technical security and
reliability of the process supported by them;

(e)
use trustworthy systems to store data provided
to them, in a verifiable form so that:

–
they are publicly available for retrieval only where
the consent of the person to whom the data has been issued has been obtained,

–
only authorised persons can make entries and
changes,

–
information can be checked for authenticity;

(f)
take measures against forgery and theft of data;

(g)
record for an appropriate period of time all
relevant information concerning data issued and received by the qualified trust
service provider, in particular for the purpose of providing evidence in legal
proceedings. Such recording may be done electronically;

(h)
have an up-to-date termination plan to ensure
continuity of service in accordance with arrangements issued by the supervisory
body under point (c) of Article 13(2);

(i)
ensure lawful processing of personal data in
accordance with Article 11.

3. Qualified trust service providers issuing qualified certificates shall register
in their certificate database the revocation of the certificate within ten
minutes after such revocation has taken effect.

4. With regard to paragraph 3, qualified trust service providers issuing qualified certificates shall
provide to any relying party information on the validity or revocation status
of qualified certificates issued by them. This information shall be made
available at any time at least on a certificate basis in an automated manner
which is reliable, free of charge and efficient.

5. The Commission may, by means of
implementing acts, establish reference numbers of standards for trustworthy
systems and products. Compliance with the requirements laid down in Article 19 shall
be presumed where trustworthy systems and products meet those standards. Those
implementing acts shall be adopted in accordance with the examination procedure
referred to in Article 39(2). The Commission shall publish those acts in the Official
Journal of the European Union.

Section
3

Electronic signature

Article 20

Legal
effects and acceptance of electronic signatures

1. An electronic signature shall not be
denied legal effect and admissibility as evidence in legal proceedings solely
on the grounds that it is in an electronic form.

2. A qualified electronic signature shall
have the equivalent legal effect of a handwritten signature.

3. Qualified electronic signatures shall be
recognised and accepted in all Member States.

4. If an electronic signature with a security
assurance level below qualified electronic signature is required, in particular
by a Member State for accessing a service online offered by a public sector
body on the basis of an appropriate assessment of the risks involved in such a
service, all electronic signatures matching at least the same security assurance
level shall be recognised and accepted.

5. Member States shall not request for cross-border
access to a service online offered by a public sector body an electronic
signature at a higher security assurance level than qualified electronic
signature.

6. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the definition of
the different security levels of electronic signature referred to in paragraph 4.

7. The Commission may, by means of
implementing acts, establish reference numbers of standards for the security
levels of electronic signature. Compliance with the security level defined in a
delegated act adopted pursuant to paragraph 6 shall be presumed when an
electronic signature meets those standards. Those implementing acts shall be
adopted in accordance with the examination procedure referred to in Article
39(2). The Commission shall publish those acts in the Official Journal of
the European Union.

Article 21

Qualified
certificates for electronic signature

1. Qualified certificates for electronic signature
shall meet the requirements laid down in Annex I.

2. Qualified certificates for electronic
signature shall not be subject to any mandatory requirement exceeding the requirements
laid down in Annex I.

3. If a qualified certificate for
electronic signature has been revoked after initial activation, it shall lose
its validity, and its status shall not in any circumstances be reverted by
renewing its validity.

4. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the further
specification of the requirements laid down in Annex I.

5. The Commission may, by means of
implementing acts, establish reference numbers of standards for qualified
certificates for electronic signature. Compliance with the requirements laid
down in Annex I shall be presumed where a qualified certificate for electronic signature
meets those standards. Those implementing acts shall be adopted in accordance
with the examination procedure referred to in Article 39(2). The Commission
shall publish those acts in the Official Journal of the European Union.

Article 22

Requirements
for qualified electronic signature creation devices

1. Qualified electronic signature creation
devices shall meet the requirements laid down in Annex II.

2. The Commission may, by means of
implementing acts, establish reference numbers of standards for qualified electronic
signature creation devices. Compliance with the requirements laid down in Annex
II shall be presumed where a qualified electronic signature creation device
meets those standards. Those implementing acts shall be adopted in accordance
with the examination procedure referred to in Article 39(2). The Commission
shall publish those acts in the Official Journal of the European Union.

Article 23

Certification
of qualified electronic signature creation devices

1. Qualified electronic signature creation
devices may be certified by appropriate public or private bodies designated by
Member States provided that they have been submitted to a security evaluation
process carried out in accordance with one of the standards for the security
assessment of information technology products included
in a list that shall be established by the Commission by means of implementing
acts. Those implementing acts shall be adopted in
accordance with the examination procedure referred to in Article 39(2). The
Commission shall publish those acts in the Official Journal of the European
Union.

2. Member States shall notify to the
Commission and other Member States the names and addresses of the public or
private body designated by them as referred to in paragraph 1.

3. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the establishment
of specific criteria to be met by the designated bodies referred to in paragraph
1.

Article 24

Publication
of a list of certified qualified electronic signature creation devices

1. Member States shall notify to the
Commission without undue delay, information on qualified electronic signature
creation devices which have been certified by the bodies referred to in Article
23. They shall also notify to the Commission, without undue delay, information
on electronic signature creation devices that would no longer be certified.

2. On the basis of the information
received, the Commission shall establish, publish and maintain a list of certified
qualified electronic signature creation devices.

3. The Commission may, by means of
implementing acts, define circumstances, formats and procedures applicable for
the purpose of paragraph 1. Those implementing acts shall be adopted in
accordance with the examination procedure referred to in Article 39(2).

Article 25

Requirements
for the validation of qualified electronic signatures

1. A qualified electronic signature shall
be considered as valid provided that it can be established with a high level of
certainty, that at the time of signing:

(a)
the certificate, that supports the signature, is
a qualified electronic signature certificate complying with the provisions laid
down in Annex I;

(b)
the qualified certificate required is authentic
and valid;

(c)
the signature validation data correspond to the
data provided to the relying party;

(d)
the set of data unambiguously representing the
signatory is correctly provided to the relying party;

(e)
the use of any pseudonym is clearly indicated to
the relying party if a pseudonym is used;

(f)
the electronic signature was created by a qualified
electronic signature creation device;

(g)
the integrity of the signed data has not been compromised;

(h)
the requirements provided for in Article 3 point7
are met;

(i)
the system used for validating the signature provides
to the relying party the correct result of the validation process and allows
the relying party to detect any security relevant issues.

2. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the further
specification of the requirements laid in down in paragraph 1.

3. The Commission may, by means of
implementing acts, establish reference numbers of standards for the validation
of qualified electronic signatures. Compliance with the requirements laid down
in paragraph 1 shall be presumed where the validation of qualified electronic
signatures meets those standards. Those implementing acts shall be adopted in
accordance with the examination procedure referred to in Article 39(2). The
Commission shall publish those acts in the Official Journal of the European
Union.

Article 26

Qualified
validation service for qualified electronic signatures

1. A qualified validation service for
qualified electronic signatures shall be provided by a qualified trust service
provider who:

(a)
provides validation in compliance with Article
25(1), and

(b)
allows relying parties to receive the result of
the validation process in an automated manner which is reliable, efficient and
bearing the advanced electronic signature or advanced electronic seal of the provider
of the qualified validation service.

2. The Commission may, by means of
implementing acts, establish reference numbers of standards for qualified
validation service referred to in paragraph 1. Compliance with the requirements
laid down in point (b) of paragraph 1 shall be presumed where the validation
service for qualified electronic signature meets those standards. Those
implementing acts shall be adopted in accordance with the examination procedure
referred to in Article 39(2). The Commission shall publish those acts in the Official
Journal of the European Union.

Article 27

Preservation
of qualified electronic signatures

1. A qualified electronic signature
preservation service shall be provided by a qualified trust service provider
who uses procedures and technologies capable of extending the trustworthiness
of the qualified electronic signature validation data beyond the technological
validity period.

2. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the further
specification of the requirements laid down in paragraph 1.

3. The Commission may, by means of
implementing acts, establish reference numbers of standards for the
preservation of qualified electronic signatures. Compliance with the
requirements laid down in paragraph 1 shall be presumed where the arrangements
for the preservation of qualified electronic signatures meet those standards.
Those implementing acts shall be adopted in accordance with the examination
procedure referred to in Article 39(2). The Commission shall publish those acts
in the Official Journal of the European Union.

Section
4

Electronic seals

Article 28

Legal
effects of electronic seal

1. An electronic seal shall not be denied
legal effect and admissibility as evidence in legal proceedings solely on the
grounds that it is in electronic form.

2. A qualified electronic seal shall enjoy
the legal presumption of ensuring the origin and integrity of the data to which
it is linked.

3. A qualified electronic seal shall be
recognised and accepted in all Member States.

4. If an electronic seal security assurance
level below the qualified electronic seal is required, in particular by a
Member State for accessing a service online offered by a public sector body on
the basis of an appropriate assessment of the risks involved in such a service,
all electronic seals matching at a minimum the same security assurance level
shall be accepted.

5. Member States shall not request for accessing
a service online offered by a public sector body an electronic seal with higher
security assurance level than qualified electronic seals.

6. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the definition of
different security assurance levels of electronic seals referred to in paragraph
4.

7. The Commission may, by means of
implementing acts, establish reference numbers of standards for the security
assurance levels of electronic seals. Compliance with the security assurance level
defined in a delegated act adopted pursuant to paragraph 6 shall be presumed
when an electronic seal meets those standards. Those implementing acts shall be
adopted in accordance with the examination procedure referred to in Article
39(2). The Commission shall publish those acts in the Official Journal of
the European Union.

Article 29

Requirements
for qualified certificates for electronic seal

1. Qualified certificates for electronic
seal shall meet the requirements laid down in Annex III.

2. Qualified certificates for electronic
seal shall not be subject to any mandatory requirements exceeding the
requirements laid down in Annex III.

3. If a qualified certificate for an electronic
seal has been revoked after initial activation, it shall lose its validity, and
its status shall not in any circumstances be reverted by renewing its validity.

4. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the further
specification of the requirements laid down in Annex III.

5. The Commission may, by means of
implementing acts, establish reference numbers of standards for qualified
certificates for electronic seal. Compliance with the requirements laid down in
Annex III shall be presumed where a qualified certificate for electronic seal
meet those standards. Those implementing acts shall be adopted in accordance
with the examination procedure referred to in Article 39(2). The Commission
shall publish those acts in the Official Journal of the European Union.

Article 30

Qualified
electronic seal creation devices

1. Article 22 shall apply mutatis mutandis
to requirements for qualified electronic seal creation devices.

2. Article 23 shall apply mutatis
mutandis to the certification of qualified electronic seal creation
devices.

3. Article 24 shall apply mutatis
mutandis to the publication of a list of certified qualified electronic
seal creation devices.

Article 31

Validation
and preservation of qualified electronic seals

Articles 25, 26 and 27 shall apply mutatis
mutandis to the validation and preservation of qualified electronic seals.

Section
5

Electronic time stamp

Article 32

Legal
effect of electronic time stamps

1. An electronic time stamp shall not be denied legal
effect and admissibility as evidence in legal proceedings solely on the grounds
that it is in electronic form.

2. Qualified electronic time stamp shall enjoy a legal
presumption of ensuring the time it indicates and the integrity of the data to
which the time is bound.

3. A qualified electronic time stamp shall be recognised
and accepted in all Member States.

Article 33

Requirements
for qualified electronic time stamps

1. A qualified electronic time stamp shall meet the
following requirements:

(a)
it is accurately linked to Coordinated Universal
Time (UTC) in such a manner as to preclude any possibility of the data being
changed undetectably;

(b)
it is based on an accurate time source;

(c)
it is issued by a qualified trust service
provider;

(d)
it is signed using an advanced electronic
signature or an advanced electronic seal of the qualified trust service
provider, or by some equivalent method.

2. The Commission may, by means of implementing acts, establish
reference numbers of standards for the accurate linkage of time to data and an accurate
time source. Compliance with the requirements laid down in paragraph 1 shall be
presumed where an accurate linkage of time to data and an accurate time source
meets those standards. Those implementing acts shall be adopted in accordance
with the examination procedure referred to in Article 39(2). The Commission
shall publish those acts in the Official Journal of the European Union.

Section
6

Electronic documents

Article 34

Legal
effects and acceptance of the electronic documents

1. An electronic document shall be
considered as equivalent to a paper document and admissible as evidence in
legal proceedings, having regard to its assurance level of authenticity and
integrity.

2. A document bearing a qualified
electronic signature or a qualified electronic seal of the person who is
competent to issue the relevant document, shall enjoy legal presumption of its
authenticity and integrity provided the document does not contain any dynamic
features capable of automatically changing the document.

3. When an original document or a
certified copy is required for the provision of a service online offered by a
public sector body, at least electronic documents issued by the persons who are
competent to issue the relevant documents and that are considered to be
originals or certified copies in accordance with national law of the Member
State of origin, shall be accepted in other Member States without additional
requirements.

4. The Commission may, by means of
implementing acts, define formats of electronic signatures and seals that shall
be accepted whenever a signed or sealed document is requested by a Member State
for the provision of a service online offered by a public sector body referred
to in paragraph 2. Those implementing acts shall be adopted in accordance with
the examination procedure referred to in Article 39(2).

Section
7

Qualified electronic delivery service

Article 35

Legal
effect of an electronic delivery service

1. Data sent or received using an electronic
delivery service shall be admissible as evidence in legal proceedings with
regard to the integrity of the data and the certainty of the date and time at
which the data were sent to or received by a specified addressee.

2. Data sent or received using a qualified
electronic delivery service shall enjoy legal presumption of the integrity of
the data and the accuracy of the date and time of sending or receiving the data
indicated by the qualified electronic delivery system.

3. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the specification
of mechanisms for sending or receiving data using electronic delivery services,
which shall be used with a view to fostering interoperability between
electronic delivery services.

Article 36

Requirements
for qualified electronic delivery services

1. Qualified electronic delivery services
shall meet the following requirements:

(a)
they must be provided by one or more qualified
trust service provider(s);

(b)
they must allow the unambiguous identification
of the sender and if appropriate, the addressee;

(c)
the process of sending or receiving of data must
be secured by an advanced electronic signature or an advanced electronic seal
of qualified trust service provider in such a manner as to preclude the
possibility of the data being changed undetectably;

(d)
any change of the data needed for the purpose of
sending or receiving the data must be clearly indicated to the sender and addressee
of the data;

(e)
the date of sending, receipt and any change of
data must be indicated by a qualified electronic time stamp;

(f)
in the event of the data being transferred
between two or more qualified trust service providers, the requirements in
points (a) to (e) shall apply to all the qualified trust service providers.

2. The Commission may, by means of
implementing acts, establish reference numbers of standards for processes for
sending and receiving data. Compliance with the requirements laid down in
paragraph 1 shall be presumed where the process for sending and receiving data
meets those standards. Those implementing acts shall be adopted in accordance
with the examination procedure referred to in Article 39(2). The Commission shall
publish those acts in the Official Journal of the European Union.

Section
8

Website authentication

Article 37

Requirements
for qualified certificates for website authentication

1. Qualified certificates for website
authentication shall meet the requirements laid down in Annex IV.

2. Qualified certificates for website
authentication shall be recognised and accepted in all Member States.

3. The Commission shall be empowered to
adopt delegated acts in accordance with Article 38 concerning the further specification
of the requirements laid down in Annex IV.

4. The Commission may, by means of
implementing acts, establish reference numbers of standards for qualified
certificates for website authentication. Compliance with the requirements laid
down in Annex IV shall be presumed where a qualified certificate for website
authentication meets those standards. Those implementing acts shall be adopted
in accordance with the examination procedure referred to in Article 39(2). The
Commission shall publish those acts in the Official Journal of the European
Union.

CHAPTER
IV

DELEGATED
ACTS

Article 38

Exercise
of the delegation

1. The power to adopt delegated acts is
conferred on the Commission subject to the conditions laid down in this
Article.

2. The power to
adopt delegated acts referred to in Articles 8(3), 13(5), 15(5), 16(5), 18(5),
20(6), 21(4), 23(3), 25(2), 27(2), 28(6), 29(4), 30(2), 31, 35(3) and 37(3)
shall be conferred on the Commission for an indeterminate period of time from the
entry into force of this Regulation.

3. The delegation of power referred to in
Articles 8(3), 13(5), 15(5), 16(5), 18(5), 20(6), 21(4), 23(3), 25(2), 27(2),
28(6), 29(4), 30(2), 31, 35(3) and 37(3) may be revoked at any time by the
European Parliament or by the Council. A decision to revoke shall put an end to
the delegation of the power specified in that decision. It shall take effect
the day following the publication of the decision in the Official Journal of
the European Union or at a later date specified therein. It shall not affect
the validity of any delegated acts already in force.

4. As soon as it adopts a delegated act,
the Commission shall notify it simultaneously to the European Parliament and to
the Council.

5. A delegated act adopted pursuant to
Articles 8(3), 13(5), 15(5), 16(5), 18(5), 20(6), 21(4), 23(3), 25(2), 27(2),
28(6), 29(4), 30(2), 31, 35(3) and 37(3) shall enter into force only if no
objection has been expressed either by the European Parliament or the Council
within a period of two months of notification of that act to the European
Parliament and the Council or if, before the expiry of that period, the
European Parliament and the Council have both informed the Commission that they
will not object. That period shall be extended by two months at the initiative
of the European Parliament or of the Council.

CHAPTER
V

IMPLEMENTING
ACTS

Article 39

Committee
procedure

1. The Commission shall be assisted by a committee.
That committee shall be a committee within the meaning of Regulation (EU) No
182/2011.

2. Where reference is made to this
paragraph, Article 5 of Regulation 182/2011 shall apply.

CHAPTER
VI

FINAL
PROVISIONS

Article 40

Report

The Commission shall report to the European
Parliament and to the Council on the application of this Regulation. The first
report shall be submitted no later than four years after the entry into force
of this Regulation. Subsequent reports shall be submitted every four years
thereafter.

Article 41

Repeal

1. Directive 1999/93/EC is repealed.

2. References to the repealed Directive
shall be construed as references to this Regulation.

3. Secure signature creation devices of
which the conformity has been determined in accordance with Article 3(4) of
Directive 1999/93/EC shall be considered as qualified signature creation
devices under this Regulation.

4. Qualified certificates issued under
Directive 1999/93/EC shall be considered as qualified certificates for
electronic signatures under this Regulation until they expire, but for no more
than five years from the entry into force of this Regulation.

Article 42

Entry
into force

This Regulation shall enter into force on
the twentieth day following that of its publication in the Official Journal
of the European Union.

This Regulation shall be binding in its
entirety and directly applicable in all Member States.

Done at Brussels,

For the European Parliament                       For
the Council

The President                                                 The
President

ANNEX I

Requirements
for qualified certificates for electronic signatures

Qualified certificates for electronic
signatures shall contain:

(a)
an indication, at least in a form suitable for
automated processing, that the certificate has been issued as a qualified
certificate for electronic signature;

(b)
a set of data unambiguously representing the
qualified trust service provider issuing the qualified certificates including
at least, the Member State in which that provider is established and

–
for a legal person: the name and registration
number as stated in the official records,

–
for a natural person: the person’s name;

(c)
a set of data unambiguously representing the
signatory to whom the certificate is issued including at least the name of the
signatory or a pseudonym, which shall be identified as such;

(d)
electronic signature validation data which
correspond to the electronic signature creation data;

(e)
details of the beginning and end of the
certificate’s period of validity;

(f)
the certificate identity code which must be
unique for the qualified trust service provider;

(g)
the advanced electronic signature or advanced
electronic seal of the issuing qualified trust service provider;

(h)
the location where the certificate supporting the
advanced electronic signature or advanced electronic seal referred to in point
(g) is available free of charge;

(i)
the location of the certificate validity status
services that can be used to enquire about the validity status of the qualified
certificate;

(j)
where the electronic signature creation data
related to the electronic signature validation data are located in a qualified
electronic signature creation device, an appropriate indication of this, at least
in a form suitable for automated processing.

ANNEX II

Requirements
for qualified signature creation devices

1. Qualified electronic signature
creation devices shall ensure, by appropriate technical and procedural means,
that at least:

(a)
the secrecy of the electronic signature creation
data used for electronic signature generation is assured;

(b)
the electronic signature creation data used for electronic
signature generation can occur only once;

(c)
the electronic signature creation data used for electronic
signature generation cannot, with reasonable assurance, be derived and the electronic
signature is protected against forgery using currently available technology;

(d)
the electronic signature creation data used for electronic
signature generation can be reliably protected by the legitimate signatory
against use by others.

2. Qualified electronic signature creation
devices shall not alter the data to be signed or prevent such data from being
presented to the signatory prior to signing.

3. Generating or managing electronic
signature creation data on behalf of the signatory shall be done by a qualified
trust service provider.

4. Qualified trust service providers
managing electronic signature creation data on behalf of the signatory may
duplicate the electronic signature creation data for back-up purposes provided
the following requirements are met:

(a)
the security of the duplicated datasets must be at
the same level as for the original datasets;

(b)
the number of duplicated datasets shall not
exceed the minimum needed to ensure continuity of the service.

ANNEX III

Requirements
for qualified certificates for electronic seals

Qualified certificates for electronic seals
shall contain:

(a)
an indication, at least in a form suitable for
automated processing, that the certificate has been issued as a qualified
certificate for electronic seal;

(b)
a set of data unambiguously representing the
qualified trust service provider issuing the qualified certificates including
at least the Member State in which that provider is established and

–
for a legal person: the name and registration
number as stated in the official records,

–
for a natural person: person’s name;

(c)
a set of data unambiguously representing the
legal person to whom the certificate is issued, including at least name and
registration number as stated in the official records;

(d)
electronic seal validation data which correspond
to the electronic seal creation data;

(e)
details of the beginning and end of the
certificate’s period of validity;

(f)
the certificate identity code which must be
unique for the qualified trust service provider;

(g)
the advanced electronic signature or advanced
electronic seal of the issuing qualified trust service provider;

(h)
the location where the certificate supporting the
advanced electronic signature or advanced electronic seal referred to in point (g)
is available free of charge;

(i)
the location of the certificate validity status
services that can be used to enquire the validity status of the qualified
certificate;

(j)
where the electronic seal creation data related
to the electronic seal validation data are located in a qualified electronic
seal creation device, an appropriate indication of this, at least in a form
suitable for automated processing.

ANNEX IV

Requirements
for qualified certificates for website authentication

Qualified certificates for website
authentication shall contain:

(a)
an indication, at least in a form suitable for
automated processing, that the certificate has been issued as a qualified
certificate for website authentication;

(b)
a set of data unambiguously representing the
qualified trust service provider issuing the qualified certificates including
at least the Member State in which that provider is established and

–
for a legal person: the name and registration
number as stated in the official records,

–
for a natural person: person’s name;

(c)
a set of data unambiguously representing the
legal person to whom the certificate is issued, including at least name and
registration number as stated in the official records;

(d)
elements of the address, including at least city
and Member State, of the legal person to whom the certificate is issued as
stated in the official records;

(e)
the domain name(s) operated by the legal person
to whom the certificate is issued;

(f)
details of the beginning and end of the
certificate’s period of validity;

(g)
the certificate identity code which must be
unique for the qualified trust service provider;

(h)
the advanced electronic signature or advanced
electronic seal of the issuing qualified trust service provider;

(i)
the location where the certificate supporting the
advanced electronic signature or advanced electronic seal referred to in point
(h) is available free of charge;

(j)
the location of the certificate validity status
services that can be used to enquire the validity status of the qualified
certificate.

LEGISLATIVE FINANCIAL STATEMENT

1.           FRAMEWORK OF THE PROPOSAL/INITIATIVE

This financial statement details the
requirements in terms of administrative expenditure in order to implement the
proposed Regulation on electronic identification and trust services for
electronic transactions in the internal market.

Following the legislative procedure and
discussion for the adoption by the EP and the Council of the proposed
Regulation, twelve FTE will be required by the Commission to devise the related
delegated and implementing acts, to ensure the availability of organisational
and technical standards, to handle the information notified by Member States,
in particular to maintain the information related to trusted lists, to ensure
the awareness of stakeholders – in particular citizens and SMEs - of the
advantages of using electronic identification, authentication, signature and
related trust services (eIAS) and to engage discussions with third countries in
view of achieving eIAS interoperability at global level.

1.1.        Title of the proposal/initiative

Commission proposal for a Regulation on electronic identification
and trust services for electronic transactions in the internal market

1.2.        Policy area(s) concerned
in the ABM/ABB structure[25]

09 INFORMATION SOCIETY

1.3.        Nature of the proposal/initiative

 ̈ The
proposal/initiative relates to a new action

 ̈ The
proposal/initiative relates to a new action following a pilot
project/preparatory action[26]

 ̈ The proposal/initiative relates to the
extension of an existing action

þ The proposal/initiative
relates to an action redirected towards a new action

1.4.        Objectives

1.4.1.     The Commission's
multiannual strategic objective(s) targeted by the proposal/initiative

The general objectives of the proposal are those of general EU
policies in which the proposal situates, such as the EU 2020 Strategy. It aims
to ensure that Europe would ‘be turned into a smart, sustainable and inclusive
economy delivering high levels of employment, productivity and social
cohesion.’

1.4.2.     Specific objective(s) and
ABM/ABB activity(ies) concerned

To enhance trust in pan-European electronic transactions and to
ensure cross-border legal recognition of electronic identification,
authentication, signature and related trust services as well as a high level of
data protection and user empowerment in the single market (see Digital Agenda
for Europe, key actions 3 and 16).

ABM/ABB activity(ies) concerned

09 02 - Regulatory framework for the Digital Agenda for Europe

1.4.3.     Expected result(s) and
impact

Specify the effects
which the proposal/initiative should have on the beneficiaries/groups targeted.

Establish a clear
regulatory environment for eIAS services that would boost user convenience,
trust and confidence in the digital world.

1.4.4.     Indicators of results and
impact

Specify the
indicators for monitoring implementation of the proposal/initiative.

1. Existence of eIAS
suppliers that have activities in multiple EU Member States:

2. Degree to which
devices become inter-operational (e.g. smartcard readers) between sectors and countries;

3. Usage of eIAS by
all categories of population;

4. Extent to which
eIAS are used by end-users for national transactions and international
(cross-border) transactions;

5. Degree of
harmonization across Members States of eIAS legislation;

6. Electronic
identification schemes notified to the Commission;

7. Services
accessible with notified electronic identification means in the public sector (e.g.
eGovernment, eHealth, eJustice, eProcurement);

8. Services accessible with notified electronic identification
means in the private sector (e.g. online banking, eCommerce, eGambling, login
to websites, safer internet services).

1.5.        Grounds for the
proposal/initiative

1.5.1.     Requirement(s) to be met in
the short or long term

The divergent national implementations of the electronic signature
Directive due its to different interpretations by Member States lead to
cross-border interoperability problems and thus to a segmented EU landscape and
distortions in the internal market. This is accompanied by a lack of trust and
confidence in electronic systems which impede European citizens to benefit from
the same kind of services in the digital world as in the physical world.

1.5.2.     Added value of EU involvement

Action at EU level would produce clear benefits compared with action
at the level of Member States. Experience has shown indeed that national
measures are not only insufficient to make electronic transactions possible
across borders, but they have on the contrary created barriers to the EU-wide
interoperability of electronic signatures, and that they are currently having
the same effect for electronic identification, authentication and related trust
services.

1.5.3.     Lessons learned from
similar experiences in the past

The proposal builds on the experience with e-signature Directive and
the problems encountered due to fragmented transposition and implementation of
that Directive, which have blocked it from achieving its objectives.

1.5.4.     Coherence and possible
synergy with other relevant instruments

The electronic signature Directive is referenced through several
other EU initiatives which have been set up to eliminate interoperability
challenges and cross border recognition and acceptance issues related to
certain types of electronic interactions, e.g., the Services Directive, the
Public Procurement Directives, the revised VAT (e-invoicing) Directive or the
European Citizen Initiative Regulation.

Moreover, the proposed Regulation will provide a legal framework
beneficial for the wide take-up of the Large Scale Pilots (LSPs) have been put
in place at the EU level to support the development of interoperable and
trustworthy means of electronic communication (including SPOCS, supporting the
implementation of the Services Directive; STORK, supporting the development and
use of interoperable eIDs; PEPPOL, supporting the development and use of
interoperable eProcurement solutions; epSOS, supporting the development and use
of interoperable eHealth solutions; eCodex, supporting the development and use
of interoperable eJustice solutions).

1.6.        Duration and financial
impact

 ̈ Proposal/initiative of limited
duration

–
 ̈  Proposal/initiative in effect from [DD/MM]YYYY to [DD/MM]YYYY

–
 ̈  Financial impact from YYYY to YYYY

þ Proposal/initiative of unlimited
duration

1.7.        Management mode(s) envisaged[27]

þ Centralised direct management by the Commission

 ̈ Centralised indirect management with the delegation of implementation tasks to:

–
 ̈  executive agencies

–
 ̈  bodies set up by the Communities[28]

–
 ̈  national public-sector bodies/bodies with public-service mission

–
 ̈  persons entrusted with the implementation of specific actions
pursuant to Title V of the Treaty on European Union and identified in the
relevant basic act within the meaning of Article 49 of the Financial Regulation

 ̈ Shared management with the Member States

 ̈ Decentralised management with third countries

 ̈ Joint management with international organisations (to be specified)

If more than one
management mode is indicated, please provide details in the
"Comments" section.

Comments

[//]

2.           MANAGEMENT MEASURES

2.1.        Monitoring and reporting
rules

Specify frequency
and conditions.

The first evaluation will take place 4 years after the entry into
force of the Regulation. An explicit clause on report, by which the Commission
will report to the European Parliament and the Council on its application, is
included in the regulation. Subsequent reports will be submitted every 4 years
thereafter. The Commission methodology on evaluation will be applied. These
evaluations will be conducted with the help of targeted studies on the
implementation of the legal instruments, questionnaires to national
authorities, expert discussions, workshops, Eurobarometer surveys, and so
forth.

2.2.        Management and control
system

2.2.1.     Risk(s) identified

An Impact Assessment has been carried to accompany the proposal for
the Regulation. The new legal instrument will provide for mutual recognition
and acceptance of electronic identification across borders, improve the current
electronic signature framework, strengthening national supervision of trust
service providers and give legal effect and recognition to related trust
services. It also introduces the use of delegated and implementing acts as a
mechanism to ensure flexibility vis-à-vis technological developments.

2.2.2.     Control method(s) envisaged

Existing control methods applied by the Commission will cover the
additional appropriations.

2.3.        Measures to prevent fraud
and irregularities

Specify existing or
envisaged prevention and protection measures.

Existing fraud prevention measures applied by the Commission will
cover the additional appropriations.

3.           ESTIMATED FINANCIAL IMPACT OF THE
PROPOSAL/INITIATIVE

3.1.        Heading(s) of the
multiannual financial framework and expenditure budget line(s) affected

· Existing expenditure budget lines

In order of
multiannual financial framework headings and budget lines.

Heading of multiannual financial framework || Budget line || Type of expenditure || Contribution

Number [Description........................................] || Diff./non-diff. ([29]) || from EFTA[30] countries || from candidate countries[31] || from third countries || within the meaning of Article 18(1)(aa) of the Financial Regulation

5 || 09. 01 01 01 Expenditure related to staff in active employment in the DG Information Society and Media || Non-diff. || NO || NO || NO || NO

5 || 09. 01 02 01 External staff || Non-diff. || NO || NO || NO || NO

3.2.        Estimated impact on
expenditure

3.2.1.     Summary of estimated impact
on expenditure

Heading of multiannual financial framework: || Number || [Heading 1. Smart and Inclusive Growth ...........................................................................................]

DG: INFSO || || || Year 2014 || Year  2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL

Ÿ Operational appropriations || || || || || || || ||

Number of budget line- N.A. || Commitments || (1) || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000

Payments || (2) || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000

Number of budget line -N.A. || Commitments || (1a) || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000

Payments || (2a) || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000

Appropriations of an administrative nature financed  from the envelope for specific programmes[32] || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000

Number of budget line || || (3) || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000

TOTAL appropriations for DG INFSO || Commitments || =1+1a +3 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000

Payments || =2+2a +3 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000 || 0.000

Heading of multiannual financial framework: || 5 || " Administrative expenditure "

EUR million (to 3 decimal places)

|| || || Year 2014 || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL

DG: INFSO

Ÿ Human resources || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 9,408

Ÿ Other administrative expenditure || || || || || || || ||

TOTAL DG INFSO || Appropriations || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 9,408

TOTAL appropriations under HEADING 5 of the multiannual financial framework || (Total commitments = Total payments) || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 9,408

EUR million (to 3 decimal places)

|| || || Year 2014 || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL

TOTAL appropriations under HEADINGS 1 to 5 of the multiannual financial framework || Commitments || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 9,408

Payments || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 9,408

3.2.2.     Estimated impact on
operational appropriations

–
þ  The proposal/initiative does not require the use of operational
appropriations

–
 ̈  The proposal/initiative requires the use of operational
appropriations, as explained below:

3.2.3.     Estimated impact on
appropriations of an administrative nature

3.2.3.1.  Summary

–
 ̈  The proposal/initiative does not require the use of administrative
appropriations

–
þ  The proposal/initiative requires the use of administrative
appropriations, as explained below:

EUR million (to 3
decimal places)

|| Year N 2014 || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL

HEADING 5 of the multiannual financial framework || || || || || || || ||

Human resources || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 9,408

Other administrative expenditure || || || || || || || ||

Subtotal HEADING 5 of the multiannual financial framework || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 9,408

Outside HEADING 5[33] of the multiannual financial framework || || || || || || || ||

Human resources || || || || || || || ||

Other expenditure of an administrative nature || || || || || || || ||

Subtotal outside HEADING 5 of the multiannual financial framework || || || || || || || ||

TOTAL || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 1,344 || 9,408

3.2.3.2.  Estimated requirements of
human resources

–  ̈  The
proposal/initiative does not require the use of human resources

– þ  The
proposal/initiative requires the use of human resources, as explained below:

Estimate to be expressed in full amounts
(or at most to one decimal place)

|| Year 2014 || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020

Ÿ Establishment plan posts (officials and temporary agents)

09 01 01 01 (Headquarters and Commission’s Representation Offices) || 9 || 9 || 9 || 9 || 9 || 9 || 9

XX 01 01 02 (Delegations) || || || || || || ||

XX 01 05 01 (Indirect research) || || || || || || ||

10 01 05 01 (Direct research) || || || || || || ||

Ÿ External personnel (in Full Time Equivalent unit: FTE)[34]

09 01 02 01 (CA, INT, SNE from the "global envelope") || 3 || 3 || 3 || 3 || 3 || 3 || 3

XX 01 02 02 (CA, INT, JED, LA and SNE in the delegations) || || || || || || ||

XX 01 04 yy [35] || - at Headquarters[36] || || || || || || ||

- in delegations || || || || || || ||

XX 01 05 02 (CA, INT, SNE - Indirect research) || || || || || || ||

10 01 05 02 (CA, INT, SNE - Direct research) || || || || || || ||

Other budget lines (specify) || || || || || || ||

TOTAL || 12 || 12 || 12 || 12 || 12 || 12 || 12

The human resources required
will be met by staff from the DG who are already assigned to management of the action
and/or have been redeployed within the DG, together if necessary with any
additional allocation which may be granted to the managing DG under the annual
allocation procedure and in the light of budgetary constraints.

Description of
tasks to be carried out:

Officials and temporary agents || Manage the legislative procedures for the adoption by the EP and the Council of the planned Regulation and related delegated / implementing acts. Priority Areas: 1.    Establishment of a new legislative framework on electronic trust services 2.    Fostering take-up of electronic trust services by raising SME and citizens awareness on their potential 3.    Follow-up of Directive 1999/93/EC including international aspects 4.    Leveraging the large scale pilots to accelerate the concrete realisation of the objective of the new legislative framework.

External personnel || Idem as above

3.2.4.     Compatibility with the
current multiannual financial framework

–
þ  Proposal/initiative is compatible the current multiannual
financial framework.

–
 ̈  Proposal/initiative will entail reprogramming of the relevant
heading in the multiannual financial framework.

Explain what reprogramming is required,
specifying the budget lines concerned and the corresponding amounts.

–
 ̈  Proposal/initiative requires application of the flexibility
instrument or revision of the multiannual financial framework[37].

Explain what is required, specifying the
headings and budget lines concerned and the corresponding amounts.

3.2.5.     Third-party contributions

–
þ The proposal/initiative does not provide for co-financing by third
parties

–
 ̈ The proposal/initiative provides for the co-financing estimated
below:

3.3.      Estimated impact on revenue

–
þ  Proposal/initiative has no financial impact on revenue.

–
 ̈  Proposal/initiative has the following financial impact:

·
 ̈            on own resources

·
 ̈            on miscellaneous revenue

[1]               COM(2010) 245 of 19.5.2010

[2]               COM(2011) 206 final of
13.4.2011

[3]               COM(2011) 669, 12.10.2011

[4]               OJ L 13, 19.1.2000, p. 12

[5]               For details on the
consultations, see http://ec.europa.eu/information_society/policy/esignature/eu_legislation/revision

[6]               A stakeholder workshop was
organised on 10.3.2011 with representatives from the public and private sectors
and academia to discuss what legislative measures were needed to address the
challenges ahead. This was an interactive forum to exchange views and to point
up the different positions on the questions raised in the public consultation. Several
organisations spontaneously sent position papers.

[7]               In particular, the Polish EU
Presidency organised a meeting with Member States on electronic signature in
Warsaw on 9.11.2011 and on electronic identification in Poznan on 17.11.2011.
On 25.1.2012, the Commission convened a workshop with Member States to discuss remaining
issues on electronic identification, authentication and signature.

[8]               Under
the first set, four options were examined: repealing the e-signature Directive;
no policy change; enhancing legal certainty, boosting coordination of national
supervision and ensuring mutual recognition and acceptance of electronic
identification throughout the EU; and fourthly, expansion to incorporate
certain related trust services. The second set consisted of assessing the relative
merits of the opportunities of regulating via one or two instruments, and via a
directive versus a regulation. The third set examined the possibilities offered
by implementing national supervision schemes based on common essential
supervision requirements versus an EU-based supervision system. Each policy
option was assessed, with the help of a group which brought together all interested
Directorates General of the Commission, in terms of its effectiveness in achieving
the policy objectives, its economic impact on stakeholders (including on the EU
Institutions’ budget), its social and environmental impact, and its effect on
administrative burden.

[9]               Communication from the Commission: Europe 2020. A
strategy for smart, sustainable and inclusive growth, COM(2010) 2020, 3.3.2010.

[10]             The
trusted list as established by the Commission Decision 2009/767/EC as amended
by the Commission Decision 2010/425/EU shall be the basis for a new Commission
Decision on trusted lists under this Regulation.

[11]             OJ C , , p. .

[12]             OJ C, , p. .

[13]             OJ L 13, 19.1.2000, p. 12

[14]             COM(2010) 245 final/2

[15]             EU
Citizenship Report 2010: Dismantling obstacles to EU citizens' rights,
COM(2010) 603 final, point 2.2.2, page 13.

[16]             4/2/2011: EUCO 2/1/11

[17]             23/10/2011: EUCO 52/1/11

[18]             Council Conclusions on the
European eGovernment Action Plan 2011-2015, 3093rd Transport,
Telecommunications and Energy Council meeting, Brussels, 27 May 2011.

[19]             European Parliament resolution
of 21.9.2010 on completing the internal market for e-commerce, 21.9.10,
P7_TA(2010)0320, and European Parliament resolution of 15.6.2010 on internet
governance: the next steps, P7_TA(2010)0208.

[20]             OJ L 376, 27.12.2006, p. 36

[21]             OJ L 88, 4.4.2011, p. 45

[22]             OJ L 281,
23.11.1995, p. 31

[23]             OJ L 274,
20.10.2009, p. 36

[24]             OJ L 55,
28.2.2011, p. 13

[25]             ABM:
Activity-Based Management – ABB: Activity-Based Budgeting.

[26]             As referred to in Article
49(6)(a) or (b) of the Financial Regulation.

[27]             Details
of management modes and references to the Financial Regulation may be found on
the BudgWeb site: http://www.cc.cec/budg/man/budgmanag/budgmanag_en.html

[28]             As referred to in Article 185
of the Financial Regulation.

[29]             Diff. =
Differentiated appropriations / Non-diff. = Non-Differentiated Appropriations

[30]             EFTA: European Free Trade
Association.

[31]             Candidate countries and, where
applicable, potential candidate countries from the Western Balkans.

[32]             Technical and/or administrative assistance and
expenditure in support of the implementation of EU programmes and/or actions
(former "BA" lines), indirect research, direct research.

[33]             Technical
and/or administrative assistance and expenditure in support of the
implementation of EU programmes and/or actions (former "BA" lines),
indirect research, direct research.

[34]             CA=
Contract Agent; INT= agency staff ("Intérimaire"); JED= "Jeune
Expert en Délégation" (Young Experts in Delegations); LA= Local Agent;
SNE= Seconded National Expert;

[35]             Under the ceiling for external
personnel from operational appropriations (former "BA" lines).

[36]             Essentially for Structural
Funds, European Agricultural Fund for Rural Development (EAFRD) and European
Fisheries Fund (EFF).

[37]             See
points 19 and 24 of the Interinstitutional Agreement.