EUROPEAN COMMISSION Brussels, 3.6.2021 SWD(2021) 124 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) n° 910/2014 as regards establishing a framework for a European Digital Identity {COM(2021) 281 final} - {SEC(2021) 228 final} - {SWD(2021) 125 final}



Table of contents Table of contents Table of figures Glossary 1 Introduction 1.1 Political and legal context 1.2 Key conclusions of the eIDAS evaluation 1.3 The digital identity market context 2 Problem definition 2.1 What are the problems? 2.2 What are the problem drivers? 2.3 How will the problems evolve? 3 Why should the EU act? 3.1 Subsidiarity: Necessity of EU action 3.2 Subsidiarity: Added value of EU action 4 Objectives: What is to be achieved? 4.1 Overarching objective 4.2 Objectives 5 What are the available policy options?

5.1 Policy option 1- LOW level ambition intervention: Improve the current legal framework for cross-border recognition of national eIDs and trust services 5.2 Policy option 2 - MEDIUM level ambition intervention: Creating a market for the secure exchange of Data linked to Identity 5.3 Policy option 3 - HIGH level ambition intervention: Personal digital identity wallet (EUeID) supported by measures under policy options 1 & 2 5.4 Options Discarded at an Early Stage 6 What are the impacts of the policy options? 6.1 Economic impacts 6.2 Wider economic impacts 6.3 Social impacts 6.4 Technological impacts 6.5 Impacts on social inclusion and fundamental rights 6.6 Environmental impacts 6.7 Impacts on SMEs 7 How do the options compare? 7.1 Effectiveness 7.2 Efficiency 7.3 Proportionality 7.4 Coherence 8 Preferred option 9 How will the actual impacts be monitored and evaluated?





Table of figures Figure 1 - Key conclusions of the eIDAS evaluation Figure 2 - Problems, drivers and causes Figure 3 - eIDAS node sending and receiving capacity across EU Figure 4 - Evolution of the number of yearly cross-border authentications in Austria, Czechia, Estonia, Netherlands, Luxembourg, and Sweden Figure 5 - Problems, drivers and objectives Figure 6 - Overview of policy options Figure 7 - Visual representation of a possible use case for the European digital identity Wallet App Figure 8 - Baseline scenario - summary of main costs and benefits Figure 9 - Policy option 1: overall costs Figure 10 - Policy option 1: overall benefits Figure 11 - Policy option 2: overall costs Figure 12 - Policy option 2: overall benefits Figure 13 - Policy option 3: overall costs Figure 14 - Policy option 3: overall benefits Figure 15 - overview of main costs / benefits and their categories and highlights the link between measures and options Figure 16 - Option 2: Estimated economic impacts in 5 to 10 years according to different levels of adoption Figure 17- Option 3: Estimated economic impacts in 5 to 10 years according to different levels of adoption Figure 18 - Option 2: estimated employment impacts in 5 to 10 years according to different levels of adoption

Figure 19 - Option 3: estimated employment impacts in 5 to 10 years according to different levels of adoption Figure 20 - Comparison of the options overview Figure 21 - Comparison of the options, scoring (legend) Figure 22 – Wider impacts summary table Figure 23 - European Digital Identity Ecosystem Figure 24 - REFIT Cost Savings – Preferred Option (*)



Glossary Term or acronym Meaning or definition AI Artificial intelligence AML Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing – “anti-money laundering directive” Attributes Pieces of information about one person or organisation. This could include details from the government – such as your legal name, date of birth, social security number— as well as details from other organisations, such as your professional qualifications, employment history, licenses etc. Authentication Electronic process that enables the electronic identification of a natural or legal person, or the origin and integrity of data in electronic form to be confirmed CAB Conformity Assessment Body CDD Customer due diligence”. Term used in financial services to require professionals to verify the identity, suitability and risks involved in engaging in their financial dealings. CEF Connecting Europe Facility. EU Funding programme supporting the development of interconnected trans-European networks in the fields of transport, energy and digital services. CEF Building blocks Open and reusable digital solutions: a framework, a standard, a software, or a software as a service (SaaS), or any combination thereof endorsed by the European Commission and supporting eDelivery, eSignatures and other digital trust service funded by the Connecting Europe Facility programme Credential Is a set of claims that prove qualification, achievement, quality or aspect of a person’s background. The term credential might be used as a basic identity attribute or attestation based on digital identity. eID Government electronic identification. It means the process of using person identification data in electronic form uniquely representing either a natural or legal person, or a natural person representing a legal person. Digital identity means material and/or immaterial unit containing person identification data and which is used for authentication for an online service Digital identity solutions Digital identification of various kind provided by the private or public sector which may include the provision of attributes and credentials eID scheme A system for electronic identification under which electronic identification means are issued to natural or legal persons, or natural persons representing legal persons eIDAS Regulation (EU) N°910/2014 on electronic identification and trust services for electronic transactions in the internal market eIDAS node An eIDAS Node is an application component that can assume two different roles depending on the origin of a received request, as a connector when located in the Member States of the Service Providers or as a Proxy Service when located in the Member State of the citizen ERDS Electronic Registered Delivery Service Gatekeepers Provider of core platform services with significant impact on the internal market, providing gateways for a large number of business users, to reach end users, everywhere in the Union and on different markets (see: COM(2020)842 final – Recital 6 and Art.2) SE Secure Element. Tamper resistant platform capable of securely hosting applications and storing confidential and cryptographic data. There are different forms of SE: embedded and integrated (eSE), smart cards, etc. ETSI European Telecommunications Standards Institute EUCC scheme Common Criteria based European candidate cybersecurity certification scheme FESA Forum of European Supervisory Authorities for trust service providers GDPR General Data Protection Regulation GSMA Global System for Mobile Communications Identity provider An entity that creates, maintains and manages identity information and provides authentication services IoT Internet of Things Level of assurance (LoA) According to ISO/IEC 29115, a LoA describes “the degree of confidence in the processes leading up to and including the authentication process itself, thus providing assurance that the entity claiming a particular identity (i.e., the entity) is in fact the entity to which that identity was assigned”. Under eIDAS, a notified eID scheme shall specify assurance levels low, substantial and/or high LOTL European List of Trusted Lists Notified eID scheme National eID notified by Member States for mutual recognition under eIDAS. The notification process ensures mutual recognition of the eID scheme across the EU. OOP Once-only principle, seeking to allow citizens and businesses to provide their data only once to public administrations OPC Open Public Consultation PSD2 Directive (EU) 2015/2366 on payment services in the internal market Qualified certificate ‘qualified certificate for website authentication’ means a certificate for website authentication, which is issued by a qualified trust service provider and meets the requirements laid down in Annex IV QTS / NQTS Qualified Trust Service / Non-Qualified Trust Service QTSP / NQTSP Qualified Trust Service Provider / Non-Qualified Trust Service Provider QWAC Qualified Website Authentication Service – digital certificate created by the eIDAS regulation (art.45) and issued by qualified trust service providers attesting to the identity of the entity responsible for a specific website SB (National) Supervisory Body SDGR Single Digital Gateway Regulation SOG-IS MRA Senior Officials Group Information Systems Security - Mutual Recognition Arrangement TSP Trust service provider 1Introduction Political and legal context In her State of the Union address of 16 September 2020, the President of the European Commission announced the Commission’s ambition to deliver a secure and trusted digital identity to all EU citizens: “We want a set of rules that puts people at the centre. (...) This includes control over our personal data, which we still have far too rarely today. Every time an app or website asks us to create a new digital identity or to easily log on via a big platform, we have no idea what happens to our data in reality. That is why the Commission will soon propose a secure European e-identity. One that we trust and that any citizen can use anywhere in Europe to do anything from paying your taxes to renting a bicycle. A technology where we can control ourselves what data and how data is used”. The European Council seconded the Commission’s ambition and, in the Council Conclusions of 1-2 October 2020 , called on the Commission to come forward with a proposal for a European digital identity framework initiative by mid-2021: The European Council Conclusions call for “The development of an EU-wide framework for secure public electronic identification (eID), including interoperable digital signatures, to provide people with control over their online identity and data as well as to enable access to public, private and cross-border digital services”. The Council invites the Commission to come forward with a proposal for a European digital identity framework initiative by mid-2021.” Electronic identification allows citizens and businesses to prove who they are when accessing services online. Trust services, such as electronic signatures , make online transactions more secure, convenient and efficient. The eIDAS Regulation (eIDAS) is the only cross-border framework for trusted electronic identification (eID) of natural and legal persons, and trust services. eIDAS enables the cross-border recognition of government eIDs for access to public services, under the condition the eID has been notified under eIDAS. eIDAS also establishes an EU market for trust services recognised across borders with the same legal status as their traditional equivalent paper-based processes. How eIDAS works: The eIDAS Regulation does not harmonise national eIDs but enables their mutual recognition through a notification process. Once a Member State has notified a national eID scheme to the Commission, Member States’ experts will do a peer-review of the scheme, assessing its compliance with the criteria set out in the eIDAS Regulation , implementing acts and guidelines . Only Member States can notify eID schemes and this is done on a voluntary basis. Moreover, there is currently no obligation for Member States to provide their citizens and businesses with eID enabling secure access to public services. eIDAS establishes three levels of assurance (low, substantial and high ), and each level has certain minimum criteria and functional requirements. Following the notification and the completion of the peer-review process, the scheme will be mutually recognised in all Member States. For the mutual recognition to work in practice, national eID schemes need to be interoperable. As the regulation does not harmonise technical standards, an interoperability framework with technical nodes (“eIDAS nodes”) to which services need to connect has been established to ensure the cross-border identification of users. In addition to eID, the eIDAS regulation provides a legal framework for trust services, such as electronic signatures, electronic seals, time stamps, electronic delivery services and website authentication certificates. Unlike for eIDs, trust services do not need to go through any peer review or evaluation by other Member States to be recognised cross-border. eIDAS establishes the legal framework and market rules to ensure that trust services are provided and recognised across borders with the same legal effect in all Member States as their traditional equivalent paper-based processes. eIDAS provides the highest probative value and legal certainty only to qualified trust services (which are equivalent to the physical / paper-based ones). Qualified trust services and qualified trust service providers (as opposed to non-qualified) are subject to a strict supervision by Member States’ dedicated authorities that verify whether they comply with the requirements laid down in eIDAS. Member States maintain national lists of qualified providers of trust services and of the qualified services they provide, which are communicated to and published by the Commission. The eIDAS regulation allows natural and legal persons to safely access services and carry out transactions online across borders, and has thus become a fundamental element to facilitate the single market in a number of sectors. For example, financial services have to comply with requirements on secure customer identification. eIDs under eIDAS are able to supply some of the required identity data to facilitate compliance with Anti-Money Laundering rules (AML). The Payment Services Directive (PSD2) builds on eIDAS trust services, such as eSeals and Qualified Website Authentication Certificates (QWACs) to identify the authenticity of websites by third-party payment providers. Secure online identification, based on eIDAS, is a requirement for the exchange of administrative certificates across borders, and is essential for the successful implementation and functioning of the Once-only principle (OOP) that will come into effect in 2023 . eIDAS is referenced in the Company law Directive as regards the use of digital tools and processes. The eIDAS trust services framework is recognised internationally, and forms the basis for a draft provision, expected to become a UN model law on trust services in electronic commerce in 2021, as well as for the ongoing electronic trade negotiations within the WTO.

While eIDAS plays an undisputed role in the internal market, a lot has changed since its adoption. eIDAS, adopted in 2014, is based on national eID systems following diverse standards and focuses on a relatively small segment of the electronic identifications needs of citizens and businesses: secure cross-border access to public services. The services targeted mainly concern the 3% of EU’s population residing in a Member State different from the one they were born in. Since then, digitalisation of all functions of society has increased dramatically. Not least has the COVID-19 pandemic had a very strong effect on the speed of digitalisation. A McKinsey survey suggests that COVID-19 has accelerated digitalisation by 7 years globally. As a result, the provision of both public and private services is increasingly becoming digital. Citizens and businesses’ expectations are to achieve high security and convenience for any online activity such as submitting tax declarations, enrolling in a foreign university, remotely opening a bank account or asking for a loan, renting a car, setting up a business in another Member State, authenticating for internet payments, bidding to an online call for tender, and more. As a consequence, the demand for means to identify and authenticate online, as well as to digitally exchange information related to our identity, attributes or qualifications (identity, addresses, age, but also professional qualifications, driving licences and other permits and payment systems), securely and with a high level of data protection, has increased radically. This has triggered a paradigm shift, moving towards advanced and convenient solutions that are able to integrate different verifiable data and certificates of the user. Users expect a self-determined environment where a variety of different credentials and attributes can be carried and shared such as for example your national eID, professional certificates, public transport passes or, in certain cases, even digital concert tickets. These are so-called self-sovereign app-based wallets managed through the mobile device of the user allowing for a secure and easy access to different services, both public and private, under his or her full control. Today, this demand cannot be fulfilled by the eID means and trust services as regulated by eIDAS, given its current limitations. As regards identification or authentication means, developed by the private sector outside the eIDAS framework they only partly answer to this challenge. While they offer user-friendly third-party authentication services (e.g. using a Facebook or Google account to log in to different services), they are common to access unregulated private online services that do not require a high level of security. They cannot offer the same level of legal certainty, data protection and privacy, mainly because they are self-asserted and cannot offer a link to trusted and secure government eID. As regards the digital exchange of attributes or qualifications, public and private offer is scattered and lacks cross-border legal effects. Article 49 of eIDAS requires the Commission to review the application of the regulation no later than July 2020, particularly to evaluate whether it is appropriate to modify its scope or its specific provisions taking into account technological, market and legal developments . This impact assessment bases itself on the evaluation report coming out of such review. In February 2020, the Commission committed itself in its Strategy on Shaping Europe’s Digital Future to revise the eIDAS Regulation aiming to improve its effectiveness, extend its application to the private sector and promote trusted digital identities for all EU citizens and businesses. The urgency of this revision became clear with the outbreak of the COVID-19 pandemic. The disruptions to offline public and private services, and the sudden need for accessing and using all types of public and private services online, revealed the failure of eIDAS in delivering the expected benefits to citizens, businesses and governments six years from its adoption. As a consequence, a majority of respondents to an Open Public Consultation agreed that eIDAS should be strengthened . A revised and strengthened eIDAS Regulation would be able to answer to new market and societal demands by addressing the needs for trusted government eIDs linked solutions, but also for attributes and credentials provided by the public and private sector, all being fully managed by the user and recognised across the EU to access both public and private services. This would support a large number of existing or proposed regulatory frameworks strengthening the EU’s Single Market such as the ongoing strengthening of the EU anti-money laundering framework, a future European digital driving license, a future European Social Security Passport, the Digital Euro , a European Maritime Single Window environment, the Regulation on Electronic Freight Transport Information or the initiative for developing an EU Single Window environment for customs. The COVID-19 pandemic also highlighted the potential of digital identity to support the recovery and resilience of the European economy. Smart investments in digital technologies, among them eID and trust services, are one of the pillars for the EU Recovery Plan . A stronger and wider European framework for the provision of trusted electronic identity solutions underpinned by legal identities provided by Member States can boost global trade and support competitive advantage of the EU-based enterprises. This can foster the competitive advantage of European businesses globally, through greater digitalisation (and thus, efficiency and effectiveness) of their service offering. Moreover, it can also trigger the development of new cross-borders markets related to identity, such as the one for the provision and exchange of attributes related to identity, (e.g. name, address and age, medical certificates or other types of information linked to a person such as a professional qualifications or a digital driver’s licence). Building on the evaluation of the eIDAS regulation, this impact assessment explores the challenges and the problem drivers preventing citizens and businesses to make full use of eID and trust services and outlines the options available to reach the objectives set by the political mandate from the President of the Commission and the European Council. Key conclusions of the eIDAS evaluation An evaluation on the functioning of eIDAS was conducted as part of the review process required by Article 49 of eIDAS. The conclusions of the evaluation are summarised in the table below. These findings are further elaborated in the problem definition and linked to the problem drivers (see section 2) Electronic identification Effectiveness 1.Only a limited number of eIDs have been notified, limiting the coverage of notified eID scheme to about 59% of EU population 2.The acceptance of notified eIDs both at the level of Member States and service providers is limited - not all eIDAS nodes are up and running and a limited number of public services offer eIDAS authentication 3.The interoperability of a number of eID schemes has been achieved at EU level 4.Limited incentives for Member States and service providers to connect to the eIDAS infrastructure 5.Lack of monitoring and reporting obligations limiting the access to reliable data on active connections and usage of notified eIDs 6.The actual cross border use of eIDs is very limited but the evolution of the number of transactions in certain Member States confirms increasing trend in the usage of notified eID schemes since September 2018 7.Lack of awareness of eIDAS among citizens and the use of notified eIDs by private service providers 8.eIDAS based eIDs has not been able to expand sufficiently into the private sector 9.The governance model of eIDs is complex – lacks harmonisation of certification, review of the notification and peer review procedures, clarification on the security requirements, the tools and procedure to manage eID related incidents Efficiency 10.The key stakeholder groups for which the eIDAS generated costs and benefits are national authorities, eIDAS node operators, eID providers and service providers. In charge of managing the system, national authorities and eIDAS node operators and eID providers bear significantly higher costs than service providers 11.The baseline assessment indicates that the quantifiable costs are higher than benefits due to a low uptake where benefits did not materialise. 12.For individual stakeholders, a considerable part are ‘expected’ benefits (discounted as future benefits) and therefore hardly quantifiable 13.Reducing uncertainty for the private sector, the centralization of the updates to eIDAS nodes and outreach activity for final users would lead to possible net cost reductions Relevance 14.The current scope and focus on notified eID schemes Member States to enable access to online public services is too limited and inadequate 15.The vast majority of the needs of eID and remote authentication remain with the private sector 16.eIDAS does not address the needs of specific sectors (e.g. education, banking, travel, aviation) - one of the limitation factor is the lack of specific attributes by domains Coherence 17.Lack of common understanding of the requirements in the level of assurance framework 18.The limitations of the eIDAS minimum dataset are an important shortcoming for the implementation of eIDAS solutions in a number of EU sectoral legislations 19.Lack of provisions for the mutual recognition of non EU-based eIDs EU added value 20.The eIDAS Regulation has created incentives for Member States to deploy an eID solution but the added value with regard to eID is limited due to its low coverage, uptake and usage 21.The needs originally identified for the adoption of the eIDAS Regulation still remain relevant; repealing the Regulation would lead to fragmentation and negative consequences to other legislative areas that rely on eIDAS Trust services Effectiveness 22.The eIDAS successfully established legal certainty on liability, burden of proof, legal effect and international aspects of trust services, but some issues remain 23.Availability and take-up of trust services in the EU have increased since the introduction of the eIDAS Regulation, there are differences among Member States and among different trust services 24.There is a diversity of interpretation of the requirements between Member States, which could be addressed by adopting non-mandatory implementing acts foreseen by eIDAS 25.eIDAS has set-up a strong framework that can be complemented with the necessary standards and requirements to reduce the current fragmentation of the market and divergences of interpretation by supervisory bodies and conformity assessment bodies 26.Formalisation of the cooperation between supervisory bodies to improve implementation of the eIDAS Efficiency 27.The key stakeholder groups in the area of trust services for which the eIDAS has generated costs and benefits are accreditation, conformity assessment, and supervisory bodies and qualified and non-qualified trust service providers 28.Recurring costs for governance are limited and mainly linked to ensuring compliance; QTSPs spent an average of EUR 800.000 to obtain and maintain the qualified status 29.The baseline assessment indicates that quantifiable costs are higher than benefits; for individual stakeholders, a considerable part of the benefits is only hypothetical at this stage (discounted as future benefits) - TSPs register benefits in an extension of market base, reputational increase and better access to finance due to compliance with the high eIDAS standards Relevance 30.The objectives of the eIDAS framework remain adequate to address the identified issues - the need to ensure the reduction of market fragmentation by ensuring cross-border and cross sector interoperability of trust services via the adoption of common standards 31.Need to define new trust services for eArchiving, requirements for the digitisation of paper documents and supporting portable identity credentials Coherence 32.The provisions on the role of conformity assessment bodies lack sufficient details on their obligations, liability or level of competence 33.The quality of conformity assessment reports varies across the national supervisory regimes - more reliance on standards could deliver more harmonisation and prevent a regulatory race to the bottom 34.In some areas divergent approaches at national level have impacts on trust and a level playing field, e.g. Article 24(1)(d) which allows Member States to recognise certain identification methods (such as biometric verification) EU added value 35.The Regulation has provided a common legal framework for the use of trust services, reducing fragmentation of the market and fostering the uptake of trust services. The digital identity market context A digital identity is a digital representation of a natural or legal person. It lets you prove who you are during interactions and transactions. Attributes contain information about a subject. This can include details such as your legal name or date of birth, as well as details from other organisations, such as your professional qualifications, bank balance or medical history. Today, it is considered that digital identities are also comprised of such characteristics or attributes related to an individual, an organisation or an electronic device. The information contained in a digital identity allows for the authentication of a user or the presentation of his/her digital attributes, giving him/her access to public or private services online or offline. The overall objective is to enable citizens and businesses to prove who they are or to prove their attributes/characteristics, without needing physical documents. What is emerging in the market today is a new environment where the focus has shifted from the provision and use of rigid digital identities to the provision and reliance on specific attributes related to those identities. For example, access to services may rely on the verification of qualifications or age (for example to buy alcohol online or enter a nightclub), or whether a person has been vetted. While the issuance and acceptance of such attributes require that the person has been identified, it is the attribute and the fulfilment of its requirements that provides access to specific services and therefore takes centre stage over the provision of digital identity. A digital identity system that does not allow a seamless link with attributes and credentials is therefore no longer addressing current societal demands due to digitisation. Example 1 – authenticating to an online service proving who you are: Kurt has moved to a country where a large number of public services can be accessed online. To access the online service required for the submission of the annual tax return, Kurt needs to identify and prove that he is who he claims to be using a digital identity solution. Using the eID issued by his home country, he is able to access the service thanks to eIDAS. Due to the Single Digital Gateway Regulation, from December 2023 on, Kurt will also able to request from his home country the tax returns required to prove his income status from previous years, using the same eID. Example 2-use of an attribute offline: Sarah is in the queue for a nightclub and the door security guard asks for her ID. Instead of showing her physical ID card, which contains lots of personal information, she instead uses her digital identity. She signs in on her phone using secure biometric authentication and shows the QR code to the security guard. The security guard can then scan this code, see it is a valid identity, and receive confirmation that Sarah is over 18 years old, without seeing any more details such as her date of birth or address. Example 3-use of an attribute online: Carmen needs to travel to another country for work. She must provide a medical certificate before taking the job. Carmen will get the medical certificate that confirms she complies with the rules set by the employer. Whoever gave Carmen the certificate can add the information from this certificate as attributes to Carmen’s personal data store app (sometimes known as a ‘digital wallet’). This attribute (the medical certificate in this case) can be shared online with the employer before Carmen arrives in the country.

The demand for digital identity solutions Digital identification solutions, including the provision of digital certificates for attributes, have seen an increasing demand by business and users. One of the main benefits of using digital identity solutions is the potential for efficiency gains as it allows service providers to communicate with their customers online and cut costs . The difference in cost of the online and physical channels can be threefold. Given the increase in the pace of digitalisation of the economy and society, as shown by the COVID pandemic, online identification and the sharing of attributes is becoming more important as the number of identity-sensitive and personalised services increase. The ability to identify digitally is also of increasing importance for social inclusion. Access to public services and to certain sectors (health, financial etc.) require identification or exchanging attributes with a high level of security and trustworthiness, including in terms of data protection. Secure identification systems are thus sometimes required by law in those sectors. In this context, users also demand convenience and user-friendliness, including mobile-based solutions . This has led to the emergence of new digital identity solutions that are self-managed or managed by a third party, external to the service provider . However, these solutions provide convenient access to some private online services, and often offer a lower level of security and data protection. Yet, users are increasingly concerned about their security, data protection and privacy beyond access to public services and regulated sectors. Consumers have thus a limited choice of solutions that both protect personal data and are easy to use, as using identification services provided by online platforms requires the user to consent to data disclosure. Choices for businesses are equally limited as identification solutions offered by platforms are not commercially impartial while there are often no better alternatives for online service providers given the large customer-base and market power of platforms. Secure identification means are offered by some private providers such as banks (mainly in the Nordic countries) but are limited to national use. The rapid digitalisation of services has also increased the demand for the provision of credentials digitally proving attributes such as medical certificates or professional qualifications. This is particularly the case in the education, banking, health or travel sectors. Recent technological solutions offering security and user-friendliness are digital wallets. Commercial versions are typically linked to payment solutions (ApplePay, GooglePay etc.) and allow to store and link different data sets or credentials (such as payment data, transport tickets, student IDs etc.) in a single seamless environment on the mobile phone. The first public sector wallets are now available and typically combine identification credentials with other public services and documents. Given the versatility and user convenience of digital wallets, many developers and providers of wallets focusing on identification and authentication have emerged. Many solutions focus on delivering very specific services and some solutions combine public and private sector attributes seamlessly. Example 4 – Digital Identity Wallet: Peter has installed a Digital Identity Wallet on his mobile phone. It has been provided by his home country, ensuring that the wallet has been issued to him and no one else pretending to be him. Based on the use of highly secure components for the storing of data, Peter fully trusts that the Digital Identity Wallet is safe and can be used trusted. Peter has a driving licence, a university diploma, a vaccination certificate and a residences card he used to carry around as physical cards in the more traditional wallet. Now available as digital attestations, he stores them in his digital identity wallet. Using the wallet, Peter no longer needs to rely on third parties to ensure the security of his identity data, reducing the risk of fraud from large scale cyber security attacks targeting big firms holding identity data about millions of users. Using the Digital Identity Wallet Peter also stores his boarding cards and the digital passport recently issued by his home country. Providers of digital identity solutions Organisations including Grand View Research, Fortune Business Insights and Global Market Insights predict that the identity and access management market will grow globally to at least €17 billion by 2026. Meanwhile, Gartner predicts that by 2023, identity solutions will be a multi-billion-euro industry . The market of digital identity solutions in the EU is large and diverse. It includes public sector providers providing national eIDs under national law and sometimes under the voluntary interoperability framework provided by eIDAS. Identity providers in the private sector include in the first place social media, which occupy the largest market share for digital identification and provide third-party identification services for a large part of service providers on the internet. Other private providers include banks and other financial service providers, telecom companies and mobile operators and dedicated networks and providers of digital identification . While public providers largely focus on highly secure identity solutions for online access to public services, these solutions are not always mobile and user-friendly. Private providers typically focus on less secure solutions, except in areas where regulatory requirements apply (e.g. in the financial sector) but focus on convenience and a seamless user-journey. Government eIDs (eIDs) are backed up by identity proofing according to strict rules and processes defined by governments, and therefore provide a high level of assurance on the link with the real identity of a person, making them currently more relevant for use cases that require a high level of trust. As these identities require a longer and more complex process to be issued, their usage tends to be more limited , including for cross-border use. Only those government eIDs that have been notified under eIDAS produce legal effects across borders. Despite increasing demand for secure and reliable digital identity means also to access private services, these types of identities are currently mostly offered for accessing public services. A quick and easy way to create a digital identity is through a social media account, where identity is self-asserted and does not require further authentication processes. Many private online service providers rely on social media login to simplify authentication for the user, and to gain access to user data, if permission is given by the user. A recent Eurostat survey estimated that in 2020, 34% of EU citizens used social login to access online services. The social login market features several market players such as Facebook (including Instagram), Google Sign-In, LinkedIn, Twitter and Amazon. These five have an aggregated market share of 87% of social logins in Europe . The drawback is that being self-asserted, these identity solutions cannot be used to access services that require a higher level of assurance in the identity of the person, such as public services or banking, nor do they satisfy citizens’ data protection expectations. Most recently, platforms and social media also seek to provide digital identity with higher levels of assurance, but mainly in connection with payment services, e.g. Apple Pay, Google-Pay or Libra / Facebook. Banks are acting as service providers for digital identity proofing and are usually regarded as trustworthy organisations. Bank digital identity solutions have gained popularity especially in the Nordic countries, where they can be used not only for bank transactions but also for public digital services and for accessing private services in a wide range of sectors . However, most bank digital identity services remain closed off to external service providers and digital services in the private sector . Mobile network operators provide users with a SIM card that allows them to be identified within their specific mobile network. GSMA Mobile Connect offers a solution that enables people to identify and authenticate using their mobile phone without a username and password, providing a globally interoperable solution made available by mobile network operators . Finally, dedicated digital identity companies offer users the opportunity of creating a digital identity by following a registration process backed up by already existing ID documents (e.g. driving license, passport), social media identity, or other certificates, and at the same time increasing the security of these identities with biometric tools such as facial recognition. These solutions offer portability and employ advanced technologies such as biometrics to protect the identity. These service providers are sometimes recognised by Governments and their solutions notified under eIDAS. A market for the provision of credentials and attributes has emerged in a number of sectors. Some Member States have developed proprietary systems or trust frameworks that allow e.g. for the expression of ePrescriptions or digital driving licenses. Europass develops a technical infrastructure to express credentials in the area of learning e.g. to create diplomas and certificates for students. The European Commission has proposed a Regulation for the provision of digital green certificates. In the private sector, digital credentials have reached users in particular in the area of finance. Private platforms offering personal credentials are only emerging but several wallet solutions linked to identification are in preparation. See further details in Annex 5, chapter 1 on how eIDAS works, on the demand for digital identity solutions and on providers of digital identity solutions. 2Problem definition What are the problems? State of play of implementation of eIDAS As regards eID: Since the entering into force of the eID part of the Regulation in September 2018, only 14 Member States have notified at least one eID scheme. As a result, 59 % of EU citizens have the possibility to use trusted and secure eID scheme across borders although only 7 schemes are entirely mobile responding to current user expectations. As not all technical nodes to ensure the connection through eIDAS are operational, cross-border access is limited. In addition, on average only half of public services accessible online domestically can be reached cross-border via the eIDAS network. For example, using a notified eID to access an online public service of the tax authorities in another Member State may be denied because the back bone services of the tax authority have not been connected to the eIDAS Interoperability framework. As regards trust services, there are currently 202 active qualified trust service providers operating in 28 of the 31 EU and EEA/EFTA countries. Qualified eSignatures are the service provided most on the market (158), followed by qualified time stamps (114) and qualified eSeals (107). Out of the five core trust services (Qualified certificate for electronic signature, Qualified certificate for electronic seal, Qualified time stamp, Qualified certificate for website authentication, Qualified electronic registered delivery service), the latter service is the most limited one, featuring only 20 active services in seven Member States at present.

Please refer to Annex 5, chapter 2 for more detailed information. More than 5 years after the adoption of the eIDAS Regulation, mixed conclusions must be drawn on its success. For trust services, the eIDAS Regulation has created a European market with common rules for the supervision of Qualified Trust Service Providers and the creation of legal effect of e-signatures, e-seals, etc., across borders. Although there are some weaknesses in the harmonisation of supervisory procedures and in the implementation of Qualified Website Authentication certificates (QWACs), trust service providers confirmed to more than 70% that the Regulation had overall improved trust and confidence in the security, quality and availability of trust services. For eID, a more critical conclusion must be drawn based on a number of factors, partly related to the regulatory shortcomings of the Regulation and its implementation. More importantly, there have been fundamental changes in what users come to expect, in technological developments, and in changes to the market given the sharp increase in number of services online and a shift away from the reliance on digital identify alone to the provision of digital attributes. Moreover, there is also a shift towards more user centric electronic identify solutions and solutions allowing users to control all aspects of their digital identity and protect personal data. Increased demand by public and private services for trusted identification and exchange of digital attributes not met The eIDAS Regulation focuses on access to cross-border public sector services, and has been able to offer this access only for a limited number of them (see below). However, since its adoption in 2014, the demand for secure and trusted identification and exchange of attributes has increased fundamentally both for access to public and private services. As regards the private sector, market demand for trusted and secure identification has substantially increased in sectors such as finance, transport or health. This is due to the general evolution of digital transformation and the fact that simplification of processes and considerable cost savings are possible thanks to a link of private sector use-cases with secure and trusted eID. This includes for instance facilitating a fully online customer on-boarding process in banking and insurance with a high level of security and data protection. However, cross-border private sector use cases using government eIDs notified under eIDAS are currently very limited. Even if the Regulation encourages Member States to allow private online service providers to offer the possibility to authenticate using a notified eID, not all notified eIDs are allowed to be used by the private sector even at national level. In 2018, eID schemes of 12 Member States could be used by the private sector at national level . For example, in the Czech Republic , holders of the national eID can use it to access health insurance companies , online gaming and betting websites , and a law firm on top of eGovernment services. The Danish NemID can be used to authenticate to online banking . In Germany, the list of authorised relying parties is also published and includes banks, notaries, pension insurances and system providers for accountants and attorneys . Overall, the eIDAS evaluation shows that cross-border use of notified eIDs by the private sector is practically inexistent due to questions of liability and the lack of viable commercial models, complexity of connecting to the nodes and limitations of the person dataset (See below in the drivers section). eIDAS indeed cannot address these new market demands given its inherent limitation to the public sector, the complexity for online private providers to connect to the system, its insufficient availability in all Member States and its lack of flexibility to support a variety of use cases (see section on drivers). Furthermore, identity solutions provided outside eIDAS cannot seamlessly respond to the new market needs. As mentioned in section 1, social media providers cannot offer a direct link to trusted and secure eID today, which is essential for legal certainty and to address e.g. liability issues. Their offers are therefore limited to certain private sectors such as e-commerce. While certain private providers, such as Banks, are able to offer digital identification and authentication with higher levels of assurance, their services remain closed to their own customers or, in those cases where they are also offered to external users, such identification means do not benefit from cross-border legal recognition which limits use cases and prevents scaling-up. In addition, the inability to offer secure and trusted eID for the private sector and to link them to attributes and credentials limits the competitiveness of EU digital industry developing independent e-commerce platforms and online services linked to trusted eID, such as in banking health or other areas where identification is sensitive. In the absence of a rules-based framework, online platforms equipped with large market power are likely to occupy this part of the market. As regards access to public services, demand has also evolved due to digitisation. An increase in mobility (about 30% of EU population travel yearly to another Member State) and changes in user needs and preferences point to an increase in the demand to access public services online across borders. However, eIDAS focuses mainly in the needs of those EU citizens of working age residing in another EU Member State, which represents in number only around 3% of EU population. Moreover, the core purpose of eIDAS, to enable the cross-border access to those public online services could also not be entirely fulfilled. Even in those Member States which notified a national eID under eIDAS, substantial barriers to access public online services persist. The number of services connected to the national nodes is considerably smaller than the number of services declared as being accessible via the domestic eID scheme. On the basis of available data it seems that only about half of the services accessible through domestic eID are connected to the national eIDAS node. Only 14% of providers of seven key public services across all Member States allowed cross-border authentication with a notified eID. The overall number of services connected to the national nodes is considerably smaller than the number of services available for access via the domestic eID schemes. Data provided by Member States on the number of public service providers connected to eIDAS nodes is very different: While Belgium reports for 2018 over 1000 public service providers, Germany reports 95 service providers for 2020 (additional data in Annex 5). The number of cross-border authentications and especially the number of receiving transactions provides an estimate on the current usage of notified eID schemes, as it is related to the number of use cases where citizens request access to an online service across borders. eIDAS cannot fulfil the current demand due to implementation weaknesses in the deployment of the eIDAS interoperability framework, difficulties in identity matching, but also due to failure of granting access to a large number of public online services by Member States to users identifying from abroad with an eID notified under eIDAS.

As regards the market demand for credentials digitally proving attributes, such as medical certificates or professional qualifications, they are currently not covered by eIDAS. Member States and service providers have therefore been forced to develop proprietary trust and interoperability frameworks to ensure the security of these services and/or their recognition across borders. This includes health (ePrescriptions or medical certificates), travel (facilitating travel and border control through information in electronic machine readable documents) and education (Europass Digital Credentials). A specific EU student eCard support structure within the CEF programme has been created to demonstrate in practice the ability for academic and non-academic services to exchange student identity data and the Horizon 2020 project Future Trust has also piloted the possibility to combine academic ID and national ID in order to issue trustworthy certificates for creating an EU Student eCard . A recent example is the Digital Green Pass Regulation, which foresees the development of an independent interoperability and trust framework for cross-border travel certificates by mid-2021. Example 5 – Attributes / Credentials: Digital Identity can provide trust and security to attributes and credentials in various areas. An EU-wide trust framework for attributes and credentials linked to strong identity verification would for example be able to protect sensitive health data and facilitate its exchange across borders upon user consent. In the absence of an existing EU framework for the attestation of digital attributes and credentials linking them to trusted eID, a specific regulatory framework for the swift provision of certificates to prove medical test results (“Digital Green Certificate”) has been necessary in March 2021. Current user expectations for seamless and trusted solutions to identify and share attributes across borders not met Users today expect seamless online journeys, mobile applications and single-sign-on solutions that can be used for online services in the public and private sector, covering all use cases for identification ranging from pseudonymous log-on to an online platform to secure identification for e-health or e-banking. Secure online identification and the exchange of attribute credentials is becoming more important as the number of identity-sensitive and personalised services increases. The ability to identify digitally will become an important factor of social inclusion and the provision of digital identity a strategic asset. New technological solutions are adopted by the public and private sectors that aim to address the evolving needs of citizens and businesses. Self-sovereign identity (SSI) solutions offer a user-determined environment that facilitates data protection and control. Digital wallets are a practical way of implementing SSI as they offer convenient possibilities for the user to manage and exchange their own identity-related information, attributes and credentials. Some Member States are moving into this direction, which, unless regulated at EU level, will further increase the disparity between national systems. However, today many citizens do not even have access to trusted and secure government eID means allowing them to access services across border. Six years after the adoption of eIDAS, the eIDAS framework covers only about half of the EU population, leaving 41% of EU citizens without the possibility to use any trusted and secure eID scheme across borders. Some Member States have involved the private sector in the provision of eID means and their services are recognised and used for access to online public and private services. However, their cross-border recognition relies on a decision by Member States to notify them under eIDAS. So far, only few have recognised private schemes, notably Belgium (ItsMe), Italy (SPID) or Sweden (BankID). Alternative digital identification solutions by private providers, not recognised by governments, do exist (see section 1.3). However, as mentioned above they only address some private use cases not requiring high level of security. Other more secure solutions offered by private providers lack common frameworks or standards as regards for example, the levels of assurance that they provide. They can therefore not scale up and be recognised across borders for access to public or private services which require a certain level of trust. Without access to seamless and trusted identity solutions recognised cross border, citizens and businesses will have to rely on solutions that are not linked to their legal identities issued by Member States and are therefore less secure. This contradicts the increasing user demand for a secure digital identity to access all online services in the EU that gives users control over the use of their personal data and allows for the exchange of personal data attributes and credentials. Data control and security concerns insufficiently addressed by available digital identity solutions There are security risks involved in providing personal data online or in information systems for authentication purposes. A data breach occurs when a cybercriminal infiltrates a data source and extracts confidential/private information, and many security incidents mainly affect personal data. For example, in April 2021 it was reported that data including phone numbers, Facebook IDs, names, birthdates and in some cases, e-mail addresses from 500 million Facebook users had been leaked online. An average person has more than 90 user accounts (digital identities) online. Having many accounts leads to reusing passwords, which increases the risk of identity theft and the leaking of personal data. In 2019, over 4.1 billion personal data records were exposed due to data breaches. Email addresses were exposed in 70% of reported data breaches and passwords were exposed in 65% of reported data breaches. A recent Eurostat survey showed that 75% of EU citizens use low-level security identity tools provided by the private sector (e.g. password and username or email address) with potential risks to the integrity of personal data or even identity theft. According to a Gigya survey, more than 80% of consumers admit to having quit an online registration form because they were uncomfortable with the amount or type of information requested. A recent Eurobarometer survey shows that 88% of consumers wish for more control over their data. However, neither public nor private offers fully respond to this demand. Existing eID under eIDAS is not sufficiently widely usable for identification in the private sector to represent a viable alternative and has inherent limitations to discretional data disclosure for the user. In addition, identification provided by large online platforms often does not allow for the effective protection of personal data, as evidenced by major data breaches and enforcement actions over the last decade, but is used by service providers given the large market power and customer base of platforms: Platforms and social media allow users to authenticate to third-party applications using their social network profile. They frequently require that users sign up to/register with the platform’s own service in order to use another of its products (e.g. an operating system, social network, etc.). Although the GDPR applies, data management, including activity data management, is not transparent in these situations and often the user has no other option than to consent to the disclosure of data in return for using the platform’s identification service. As mentioned by the European Data Protection Supervisor: “[t]he concern of using data from profiles for different purposes through algorithms is that the data loses its original context. Repurposing of data is likely to affect a person’s informational self-determination, further reduce the control of data subjects’ over their data, thus affecting the trust in digital environments and services”. While eIDAS notified eIDs offer a high level of security, it has limitations as regards the principle of data minimisation. For authentication to online public services cross-border, it is compulsory to exchange the full minimum eIDAS data set and there is no possibility for the user to limit the transmitted personal data to the minimum required for a specific transaction. For example, eIDAS does not support so called “zero-knowledge claims”, which allow a user to certify that he or she is above 18 years of age, without having to disclose her/his date of birth. Currently, even national eIDs offering a high level of security do not allow users to store data securely in the same place and apply full control on data release. Overall, eIDAS today cannot respond to user expectations for full control of personal data, and also private alternatives do not offer this possibility. The general shift towards a more comprehensive identity ecosystem that integrates attributes and credentials, some of them carrying sensitive data such as in the health sector, makes it necessary to develop eID ecosystems that are able to effectively protect personal data and offer full user control. Unequal Conditions for the Provision of Trust Services and insufficient Scope of the Regulation Although the evaluation of the eIDAS Regulation concludes that the regulatory framework has successfully established legal certainty on liability, burden of proof, legal effect and international aspects of trust services, it also shows that there is room for improvement regarding a harmonised application of supervisory procedures and processes for identity proofing, in particular when these processes are carried out remotely. Trust service providers (TSPs) must verify, in accordance with national law, the identity of the natural or legal person to whom a qualified certificate is issued. Since identity-proofing methods are defined in different ways at national level, some trust service providers face market-entry barriers. For example, remote identification using video identification is allowed in some Member States and not in others. This creates an uneven playing field benefitting trust services providers established in those Member States where the use of video identification is allowed. In addition, there are national differences in the way the conformity assessment of qualified trust services providers is carried out, which requirements apply and which standards are used. As the eIDAS Regulation does not regulate these aspects, differences in the application of the rules for national supervision between Member States raise challenges regarding a comparable level of trust and security of the services provided and of a common level playing field. For example, the evaluation shows that less than 50% of the Qualified Trust Service Providers reference specific standards (such as ETSI EN 319401) to prove compliance with the Regulation. Furthermore, only 15 Member States have introduced specific national procedures for the qualification of trust service providers. In other Member States, the lack of procedures creates uncertainty as to the criteria against which the trust service provider has been evaluated to ensure conformity with the Regulation. As regards the different practices in conformity assessment, the lack of a more harmonised approach to auditing with regards to the form and content of the conformity assessment reports has caused, according to ENISA, some “incongruences in the qualifications of TSPs in different countries as well as their qualified trust services, undermining trust and confidence”. The problems described for the provision of trust services are also linked to the absence of a common governance structure at EU level similar to that of the Cooperation Network for elDs allowing Member States to jointly address them. In the evaluation, some supervisory authorities noted that the role of FESA should be formalised to address the need of consistent application of eIDAS chapter on trust services in all Member States. Currently, FESA is an unofficial body and its activities depend on the initiatives of the representatives of the national bodies.

Risks of market barriers have also been identified for eArchiving services. The eIDAS Regulation requires archiving the signatures of electronic documents but does not specify requirements and which standards to use. This has led several Member States to develop competing national rules. As part of the consultation process, a number of Member States and the majority of trust service providers consulted suggested expanding the eIDAS Regulation to a new trust service for eArchiving. There is also need for improvement concerning the efficiency of a particular trust service, the provision of Qualified Website Authentication Certificates (QWACs). QWACS have been created by the eIDAS Regulation to enforce EU rules on a ‘right to know’ regarding the identity of websites. They offer traders and consumers a trusted and secure way of identifying the entity responsible for a specific website in a transparent way. Outside the browser environment, QWACs are used in the EU to secure payment services where full assurance on the identity of the entity behind a website is required by law. Despite the introduction of these certificates by the eIDAS Regulation, web browsers refuse to include them in their root stores and to display them clearly, which makes these certificates unusable for traders and consumers. Although the Commission initiated a dialogue in 2018 to promote implementation of QWACs in the browser environment, web-browsers continue to refuse supporting QWACs and have been unable to present alternatives with the same degree of legal assurance. Supporting a higher level of security, transparency and trustworthiness as offered by QWACs is not considered necessary by web-browsers and not foreseen by US legislation where most browsers are located. Web browsers are primarily concerned about ensuring the secure and trustworthy link to a domain and less about ensuring the identity of the entity behind the website with a high level of assurance as provided by QWACs. Alternative solutions to QWACs, such as TLS certificates applied by web browsers, do not offer the same legal protection as they do not enable the consumer to trace a website back to the identity of the person or to the legal entity behind it. In addition, they do not assure that this person or legal entity is genuine and legitimate, which is important to prevent identity fraud. TSL certificates only inform about interaction with an identified entity. However, they cannot distinguish the identity of the actual owner of the site from the identity of an intermediary. In particular for websites run by intermediaries or trading companies only QWACs can guarantee identity of the entity behind a website with a high level of assurance. The lack of recognition of QWACs by web-browsers may also conflict with the protection of fundamental rights of consumers as enshrined in articles 12, 101, 102, 114 and 169 of the Treaty on the Functioning of the European Union and with EU Consumer protection legislation, in particular Directive 2005/29/EC. What are the problem drivers? The following problem drivers are linked to three dimensions, which intersect and reinforce each-other: regulatory shortcomings, implementation weaknesses and changes in context. These links are indicated as appropriate below. Market, societal and technological developments triggering new user and market needs (change of context) The context for the eIDAS Regulation in 2021 is fundamentally different to 2014, the year of its adoption. Various developments have created new demands that cannot be answered effectively by the eIDAS Regulation in its current form. The following elements summarise these developments, which are also referenced in other parts of the impact assessment as strong and overarching factors of change: ·With the ubiquity of smartphones, the overall progress in digital transformation and the emergence of new user determined technologies such as self-sovereign identity, users expect to identify online and mobile with a single log-in solution using the same eID for public and private use-cases as confirmed by Eurobarometer data (see above). ·The push for further digitalisation in public administration and the economy accelerated by the ongoing pandemic has created emerging offers for a variety of digital credentials and attributes to affirm personal and professional situations, claims and entitlements in a digital form. Today, these offers cannot relate to an overall technical and legal interoperability framework that inspires trust and security through the link to public eID and a focus on the protection of personal data. For this reason, the public sector pursues the development of various proprietary and insular solutions, for example in eHealth. ·In the private sector, large online platforms are preparing to offer digital identities at higher levels of trust and assurance, such as personal digital wallets, typically connecting identity attributes with payment credentials. These developments of the market, technological and societal change and a shift in user behaviour and expectation described in the second problem (Current user expectations for seamless and trusted solutions to identify and share attributes across borders not met) are factors that reinforce each other and create a strong pull-effect for a personal, seamless, user-determined digital identity platform that allows to share different forms of identity data under full user-control. Built on trusted and secure national eID, the eIDAS Regulation is in a privileged place to respond to these developments with a user-controlled personal digital tool that allows for the linkage of national eID and private and public credentials in a seamless way. Notification by Member States of eID schemes under eIDAS is voluntary and the process is complex (regulatory weakness) The absence of a regulatory obligation for Member States to notify a national eID scheme and submit it to the mutual recognition process is identified in the evaluation as a decisive factor for the problem that not all EU citizens and businesses can have secure identity means to access online services securely in a cross-border context. The introduction of a mandatory requirement, in the Single Digital Gateway Regulation, to use notified eIDs from December 2023, seems to have triggered the recent increase in the number of notifications. Member States mostly agree on the outcome of the evaluation of the eIDAS Regulation showing that a strong push is needed to accelerate the pace of notifications. Moreover, the notification process is long, complex and suffers from inconsistent interpretation and application of the mutual recognition requirements. Multiple stakeholders consider the peer review processes as cumbersome and inefficient. A key aspect of inconsistent interpretation among Member States concerns the requirements for levels of assurance. To support mutual recognition of national eID schemes under eIDAS, Implementing Regulation 2015/1502 defines three levels of assurance - low, substantial and high – and establishes minimum technology-neutral requirements and procedures to achieve compliance. However, there has been disagreement among Member States how these requirements should be interpreted in practice, and there is no commonly agreed methodology for demonstrating compliance. The lack of references to relevant standards in the implementing act negatively affects the effectiveness and efficiency of the process to achieve mutual recognition and therefore the availability of trusted and secure eID solutions. These weaknesses particularly affect mobile schemes, which benefit from high convenience and user uptake. Currently it takes on average 9 months from the pre-notification of an eID scheme until its publication in the Official Journal of the EU. In addition, there is a 12-month delay for the application of mutual recognition following such publication. Hence, it takes almost 2 years for citizens and businesses to take advantage of cross-border authentication. Not all Member States notified national eID and opened them to the private sector for domestic reasons or for lack of incentives (implementation weakness)

In March 2021, the intention to notify national eID under eIDAS remained unclear for ten Member States. This diverse group includes countries with eIDs at different stages of development at national level. The reasons for not notifying existing schemes are diverse and cannot be determined clearly in all cases given the lack of structured information and the fact that notification is voluntary and a political decision by each Member State. It is likely that for some Member States, existing eID schemes are not considered sufficiently technically mature to ensure interoperability with other national schemes within eIDAS. For some other Member States, the system of mutual recognition, which is technologically neutral and based on functional security requirements, leaves a relatively wide margin of interpretation in relation to security levels that can be reached by certain technologies (e.g. mobile eID schemes). In addition to the absence of strict rules and requirements for the peer review process, outcomes are to a certain degree unpredictable which may act as a disincentive for notification. For other Member States, the necessary national regulatory frameworks may be absent or under review. In addition, the low overall number of accessible public online services abroad act as addition disincentive. Ultimately, investments into infrastructure are required to upgrade existing eID, which also raises questions of technological choice considering existing legacy systems and given the absence of accepted standards at European level. As a result, the current system of eIDAS, based on ensuring interoperability through nodes is still not entirely operational, although all Member States are required to accept incoming identification requests from eIDAS (see summary above). Even if all Member States would notify swiftly, the existing framework based on mutual recognition of eIDs is not fit for purpose considering the current shift towards the reliance on verified digital attributes and credentials. For the provision of attributes and credentials, a federated system of IT nodes based on technological neutrality and mutual recognition is not practical. It is unlikely that the diversity of use cases and high number of attributes and credentials in different areas can be bound efficiently into the exiting interoperability system, even if this is upgraded. Technical shortcomings associated with such a solution, like response delays or denials of service would act as a strong disincentive to private providers using the system and could not offer the same seamless user-journeys than the standards-based systems the private sector is developing. One of the limiting factors affecting Member States incentives to notify eID schemes stems from the limited scope of the eID framework, which focused on very limited public sector use cases, mainly those to address the needs of EU citizens residing in another Member States than their country of origin. Although a rapid increase of digitalisation has triggered an increase of demand to access cross border online public and private services where user authentication is needed, the current shift to attributes and credentials which cannot be expressed by the existing eIDAS system may act as a disincentive for notification. Although Member States can also notify or recognise private identity solutions only few have done so. Entrusting a private provider with operating a national eID is a sensitive political choice and issues of costs and liabilities, competition, interoperability with eGovernment services, trust and reasons of national sovereignty may be engaged. When Member States have functioning eID schemes provided by the private sector (e.g. banks or telecom companies), they might hesitate to notify those schemes since it would imply accepting the liability for the functioning of a scheme they do not control, in the cross-border context. In cases where Member States have no control on the provision of a private sector scheme, they may be reluctant to take such liability without firstly clarifying the liabilities and responsibilities in the national regulatory framework that governs the notified eID provided by the private sector provider. In addition, eID schemes notified by some Member States do not always cover all levels of assurance with the result that not all online public services abroad will be accessible for users of this Member State. Several Member States have notified only smart-card based eID schemes. These systems are not fully mobile and their take-up at national level is limited. Notified national eID schemes are not by default open to the private sector and the eIDAS Regulation does not include a requirement for this purpose. Even if the Regulation encourages Member States to allow private online service providers to offer the possibility to authenticate using a notified eID, few notified eIDs are allowed to be used by the private sector on national level and none on cross-border level for questions of costs and liabilities and technical issues of connecting private service providers to eIDAS nodes. Private providers of digital identity attributes are not subject to a harmonised regulatory framework ensuring trust and security cross-border (regulatory weakness) Currently, eIDAS exclusively regulates government eID solutions or solutions by private eID providers that are notified and guaranteed by a Member State. Other digital identity solutions do not provide official identities of a person and in most cases are not recognised by governments, banks or telcos. Identification attributes issued by the private sector (e.g. banks) are not covered by the eIDAS regulation and operate without legal effects across borders and without legal certainty about liability or transparency over security levels. Services have arisen both in the public and private sector to enable citizens to prove who they are or to prove their attributes/characteristics, without the need to provide physical documents. However, their cross border legal effect and the level of security is not ensured as a legal framework for this purpose is missing. The identification of objects and devices follows international standards, which are out of scope of eIDAS. However, scenarios where things and IoT devices need to be linked in a trusted way to owners are increasingly frequent and can be achieved by linking attributes and credentials to secure and trusted eID. The absence of a regulatory framework at EU level for the provision of trusted and secure attributes and credentials also affects the possibilities to link IoT devices to trusted and secure eID of physical or legal persons. The number of connected devices installed globally could more than triple from 23 billion in 2018 to over 75 billion in 2025. Traditional identity solutions focus exclusively on people and are not built for linking people and devices. Consultations with Member States and industry representatives stressed the need for a trusted and secure link between the identification of devices and the identities of physical and legal persons in order to protect against cybersecurity attacks of novel technologies, such as IoT, autonomous driving, 5G or smart devices. For example, there are emerging use cases linking devices to their owners. Electronic certificates linked to a car can be stored on a mobile device and by means of encryption allow the user to open it and drive. The portability of such certificates would also allow him to pass it on for use by others. Relying on international standards establishing the identity of things, once linked to a person using attribute certificates, the digital identify wallet environment will allow the user to securely store multiple keys from numerous providers. Example 6 - IoT: Marta just purchased a new car allowing her to open and start it using an App provided by the car manufacturer. She has also a boat, a scooter and a mobile home, the producers of which have issued Apps allowing her to operate them. However, the various producers use different procedures to link the devices to Marta and to the device she controls, some of which are not entirely trustworthy risking theft. Moreover, the many proprietary solutions prevent her from keeping the device identity attribute certificates in the same wallet, ensuring the same level of trust and security provided to other type of digital identity attributes (diplomas, driving licences etc.). Diverse and ineffective conditions for private online service providers cannot rely on trusted and secure eIDs cross-border (regulatory and implementation weakness) The limited reliance on notified eIDs by private online service providers is mainly due to two reasons. First, each Member State remains free to set the conditions for the use of its national eIDAS infrastructure by private online service providers, leading to diverging national approaches. In addition, there is no guidance at national or EU level on pricing (including revenue-sharing mechanisms), liability and support structure, responsibility for billing and payments and dispute resolution mechanisms related to private sector use of notified eIDs. The impact assessment supporting the original proposal for the eIDAS Regulation already noted that, for example, pricing and liability rules for use by private services are set by the notifying Member State and differ considerably, with the result that only very few private services are connected to the eIDAS network. Second, limited use by the private sector is due to lack of common standards of notified eID means which requires a connection via nodes and cannot offer a swift and seamless user-journey. Even if all notifying Member States potentially opened their eIDAS nodes to the private sector services providers across the Union, the diversity of national conditions for the use of the national eID infrastructures will still make it very difficult for the service providers to build a sustainable business plan or to accurately estimate the potential of this openness to expand their business cross-border. Overall, the lack of harmonised rules prevents the cross-border and cross-sector use of eIDs by the private sector, limiting the usability of notified eIDs. “…key factors for the private-sector take up of formal eIDs therefore depend on: a) the availability of open technical systems b) the establishment of clear rules for use of eIDs and for eAuthentication processes c) the establishment of clear liability rules.” The set of identity data provided by eIDAS is too limited and rigid (regulatory weakness) For each identification, eID under eIDAS transmit a minimum data set, which includes first name(s) and family name(s); date of birth and a unique identifier (as persistent as possible in time). This minimum data set is compulsory for cross-border authentication to access online public services. Given the focus of eIDAS for public service identification, there is no possibility for the user to add additional data that is necessary in order to access certain private sector services or to facilitate compliance with specific sectorial regulatory requirements. The number of cases for which notified eIDs can be used are therefore in practice limited. In contrast, there is also no possibility for the user to limit the transmitted data to the minimum necessary for the authentication to a specific service. Access to certain services requires less data (for example to purchase alcohol one only needs to prove age). The GDPR introduced the concept of ‘privacy by design’, making explicit reference to data minimization. On top of this, it introduces the obligation of privacy by default, going a step further into stipulating the protection of personal data as a default property of systems and services. The current eIDAS system does not allow the user to actively enforce these provisions in the GDPR and to control which data to share and with whom. In addition, the rigid data set for notified eIDs makes it also difficult to match identity records as the current minimum dataset is often not sufficient to uniquely identify a person. Such difficulties typically occur when a person owns different notified eIDs which makes matching the identity to a record difficult using automated means. Problems of identity matching limit the usability of notified eID and is predominantly linked to the cross border use of eIDs since at national level citizens can more easily be identified relying on national identifiers and unique national data sets.

Some service providers require a national registry number to grant access to online public services in order to avoid identity matching problems. However, not all Member states issue such a number and include it in the data set. Obtaining it may require physical presence which is an obstacle for users from abroad even in case they are eligible to obtain a national registry number and to access a service. Several Member States have identified identity matching as a key challenge for the revision of the eIDAS Regulation. Full assurance on record matching / identity matching is a precondition for a seamless cross-border functioning of a European Digital Identity for persons, companies and devices. Without full assurance on identity matching, Member States will be reluctant to open services and agree to an extension of eID / eIDAS to the private sector. Inconsistent Interpretation, divergent application and lack of acceptance of the eIDAS Regulation in relation to QWACs (regulatory and Implementation weakness) Although the evaluation concluded that eIDAS has been successful in establishing an EU market for trust services, significant barriers remain for trust service providers, which hinder competition. It is currently left to the discretion of supervisory bodies in each Member State how qualified trust service providers should be supervised. Furthermore, national conformity assessment bodies do not apply common standards in the conformity assessment of the qualified trust services and their providers. Nor is there a common approach on the scope and content of the conformity assessment reports issued as part of the assessment process. According to the evaluation report about 50% of Member States have implemented procedures at national level for the qualification of Trust Service Providers (TSPs) however half of those procedures do not reference applicable standards. For the remaining Member States there is no public information or guidance to the criteria applied to a TSP, the required scope of the conformity assessment, and how and by whom it should be performed, whether there exists a review process by the national supervisory body, nor its content or duration. Different national rules, non-harmonised applications, differences in fees and certification periods create risks of forum-shopping. Choosing Member States where supervisory authorities and conformity assessment bodies may be more lenient in assessing the functional requirements of the regulation, negatively affects trust and confidence in qualified trust service providers. A specific problem is connected to diverging national practices relates to remote identity verification. Remote identity verification is the process of validating a person's attributes and verifying if they really are who they say they are without a physical face-to-face interaction. Such verification can instead be made through biometric identification or by verifying identity documents remote via video conference or video assisted automatic identification. Despite a common legal basis in the eIDAS Regulation which defines the circumstances for remote identification, there is a significant lack of harmonisation in applying these requirements across Member States: Remote identification methods are currently left to the discretion of each Member State supervisory body, without any clear equivalence requirements applying to the physical presence mentioned in Article 24(1)(b). Consequently, the same remote identification methods can be accepted in some Member States and rejected in others. As mentioned on page 16, the provision and use of website authentication services are entirely voluntary for web site owners. However, when web site owners choose to use QWACS, the browser must display information about its content to the user. Since the adoption of the eIDAS Regulation in 2014, web-browsers have not accepted the use of these certificates in the bowser environment, calling for additional regulatory intervention to ensure consumer choice. As mentioned under problem 4 on page 16, the provision and use of website authentication services are entirely voluntary for web site owners. However, when web site owners choose to use QWACS, the browser must display information about its content to the user. Since the adoption of the eIDAS Regulation in 2014, web-browsers have not accepted the use of these certificates in the bowser environment, calling for additional regulatory intervention to ensure consumer choice. How will the problems evolve? The evolution of the problems described should be seen in the light of expected trends on the identity market. Globally, an increase in demand for digital identity solutions is expected, with a predicted annual market growth ranging from 13% to 20%. In addition, it is likely that user expectations with regard to control of personal identity data and effective technologies for fraud and identity theft prevention will continue to increase. Continued growth in mobile penetration strengthens the demand for convenient and secure mobile platforms and solutions. Large private providers and online platforms are investing into providing secure identification, in particular for payment services. The combination of convenient technological solutions and market power will in the medium term allow online platforms to offer secure identification for all use-cases, including public online services. This will increase the dependency of the larger players and continue to put political pressure on Member states to avoid the replacing of public eID and fear a de facto privatization of identification of physical persons in the digital world. Without promoting the use of legal identities requiring a high level of assurance linked to identity and identity attributes, the increased privatisation of digital identity and dependency on providers of social log-in Solutions are likely to continue with the inherent risk this poses to the security and privacy of identity data. The prominence of large players in an unregulated sector is also likely to challenge the competitiveness of European industry in this space. In the light of these expected trends, a no change scenario for the eIDAS Regulation may have the following impacts on the problems and drivers: Not all EU citizens and businesses will have access to seamless user-centric trusted and secure digital identity solutions that can be conveniently used to authenticate to cross-border and cross-sector online services. In the absence of clear rules and incentives for private sector adoption of notified eIDs their usability will remain limited and users will not have the possibility to fully rely on the use of highly trustworthy solutions at the EU level empowering them. Only a few national eID solutions that are able to integrate private services and align with user preferences are likely to see continued growth in adoption at national level. Their cross-border use is unlikely to improve in the absence of regulatory change at EU level putting the functioning of the digital single market at risk. With regards to IoT devices, consumers will have to rely on a multitude of solutions, not relying on common rules for linking devices to a person in a reliable consumer controlled and secure digital environment. In the absence of a common solution for identity matching, cross-border usability of eIDs will remain limited and this would also pose a risk to the functioning of other EU legislation, such as the Once-Only Principle under the Single Digital Gateway Regulation. Market fragmentation for private digital identity solutions is likely to grow in the absence of a unitary regulatory framework at EU level. It is likely that a few powerful players (e.g. online platforms), able to capitalise on technology and customer base, will take a large share of the digital identification market while smaller independent providers will see their market share reduced. This is likely to create dependencies for online service providers, user lock-in and a decrease in value creation as well as presenting a challenge to the EU’s digital autonomy. Users will not be able to control the use of their identity data in the absence of clear, uniform data protection and privacy safeguards for identity providers including online platforms. Online payment fraud is anticipated to grow. Stakeholder trust, interoperability of trust services and further unequal market access are likely to suffer from a continuous inconsistent application of the regulation by supervisory authorities. Market fragmentation, growth below potential and limitations to international reach are other possible effects. A continuing refusal of web-browsers to support QWACs would leave the enforcement of consumer and privacy rights exclusively with supervisory bodies and transparency for citizen could not be ensured. On the contrary, a support of QWACs by web-browsers could create a competitive advantage for the security and transparency of online transactions in the EU. On this background, the President and the European Council have called for a secure and trusted digital identity for all that protects data and can be used for public and private online services. This offer can only be attractive to the user if it includes the widest range of use-cases in one application – from highly sensitive eGovernment and eHealth applications to pseudonymous log-on options to online platforms. In addition, the offer must be as user-friendly as current platform solutions offering seamless user-journeys and short response times. 3Why should the EU act? This initiative aims to support Europe’s digital transformation towards a Digital Single Market. With the growing digitization of public and private services accessible cross border relying on the use of digital identity solutions, there is a risk that citizens will continue to face obstacles and not make full use of online services easily and throughout the EU while preserving their privacy if left to Member States in accordance with the current legal framework. There is also the risk that the shortcomings of the current legal framework for trust services would increase fragmentation and reduce trust if left to Member States alone. Thus, Article 114 TFEU is identified as the relevant legal basis for this initiative. Subsidiarity: Necessity of EU action Citizens and businesses should be able to benefit from the availability of highly secure and trustworthy digital identity solutions that can be used across the EU and the portability of electronic attestations of attributes linked to identity. Due to the current limitations of the eIDAS Regulation, in particular in view of recent technological developments, market and user demand, requiring the availability of more user friendly and true cross border solutions allowing access to online services EU wide. Users have also grown increasingly accustomed to globally available solutions, for example when accepting the use of Single Sign-On solutions provided by the larger social media platforms to access online services. Member States cannot alone address the challenges this creates in terms of privacy and market power of the large providers, which requires interoperability and trusted eIDs at the EU level In addition, electronic attestations of attributes issued and accepted in one Member State, like an electronic health certificate, is often not legally recognised and accepted in other Member States. This creates the risk that Member States continue to develop national solutions.

For the provision of Trust Services, although largely regulated and functioning in accordance with the current legal work, national practices also creates the risk of increased fragmentation. For example, video identification is recognised in some Member States while not in others and additional means of remote identification is made available on the market requiring a harmonised approach to avoid barriers. Furthermore, ensuring the use and acceptance of existing trust services cannot be done by Member States alone. For example, in the browser environment, ensuring the EU wide acceptance of Qualified Web Authentication Certificates has to be addressed at the EU level. EU-level intervention is ultimately best suited to provide citizens and businesses the means to identify cross border and exchange personal identity attributes and credentials using highly secure and trustworthy digital identity solutions ensuring privacy. No single Member State can offer alternatives to solutions offered by large market players. This requires trusted and secure eID and a regulatory framework linking them to attributes and credentials at EU level. Only EU-level intervention can lay down the conditions that ensure user control and access to cross border online digital services and a interoperability framework making it easy for online services to rely on the use of digital identity solutions irrespective of where in the EU it has been issued or where a citizen resides. It is unlikely, as shown by the review of the eIDAS Regulation, that national intervention would be equally efficient and effective. Subsidiarity: Added value of EU action Considering the growing demand from citizens, businesses and providers of online services for user friendly, secure and privacy friendly digital identity solutions that can be used cross border, further action at the EU level can bring greater value than action by individual Member States, as shown by the evaluation of the eIDAS Regulation. A more harmonised approach at the EU level based on the fundamental shift from the reliance on digital identity solutions alone to the provision of electronic attestations of attributes would ensure that citizens and businesses can have access to public and private services anywhere in the EU relying on verified proofs of identity and attributes. Online service providers would be able to accept digital identity solutions independently of where they have been issued, relying on a common European approach to trust, security and interoperability. Users and service providers alike can also benefit from the same legal value provided to electronic attestations of attributes across the EU, which is particularly important when coordinated action is necessary, like when it comes to digital health certificates. Trust services providing electronic attestations of attributes would also benefit from the availability of a European market for their services. For example, recuperating the costs to ensure a highly trustworthy and secure environment for the provision of Qualified Trust Service is more easily off-set at EU level due to economies of scale. Only an EU framework can ensure full cross-border portability of legal identities and electronic attestation of attributes linked to it making it possible to trust identity assertions made by other Member States. Building on the current eIDAS framework for the provision of trust services, additional measures to further harmonise it would improve market conditions and ensure trust at the EU level. Moreover, the eIDAS regulation is setting the standards for trust services globally. To support the international competitiveness of European businesses it is necessary to ensure the regulatory framework for trust services remains relevant and effective. A more harmonised approach would also benefit Member States, ensuring compliance with obligations under EU and national law requiring that users identify to access services. For example, notified electronic identity solutions based on a common approach to identity matching will allow Member States to fulfil their obligations in accordance with the Single Digital Gateway Regulation. EU action would also provide users increased choice, not having to rely fully on the solutions provided by a handful of large online providers. From the evaluation of the eIDAS Regulation, stakeholders largely agreed that the eIDAS Regulation has created added-value and is by many considered the most advanced framework in its field globally. The revised eIDAS Regulation will add further value addressing technological developments, user and market demands and make it unnecessary for businesses to develop own and sector-specific solutions. The Conclusions of the European Council in October 2020 underpin the above and demonstrate Member States’ agreement that national action alone would not suffice to reach the set objectives. Thus, the European Council stresses the need for ac