EUROPEAN COMMISSION Brussels, 3.6.2021 COM(2021) 290 final REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the evaluation of Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market (eIDAS) {SEC(2021) 229 final} - {SWD(2021) 130 final}



1.Introduction This report outlines the results of the evaluation of Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market (‘the eIDAS Regulation’). Article 49 of the Regulation requires the Commission to review the application of this Regulation and to evaluate in particular whether it is appropriate to modify its scope or its specific provisions taking into account the experience gained in its application, as well as technological, market and legal developments, and where appropriate, the report should be accompanied by legislative proposals. The accompanying staff working document contains more detailed evidence and analysis supporting these findings. 1.1.The eIDAS framework With the eIDAS Regulation adopted in 2014 the EU broke new ground by introducing a first cross-border framework for trusted digital identities and trust services, now recognised and respected globally. The aim of the eIDAS regulation was to allow all EU citizens access to public services across the EU using means of electronic identification (eID) issued in their home country. It sought to enhance trust in electronic transactions in the internal market by providing a common foundation for secure and seamless electronic interaction between citizens, businesses and public authorities, thereby increasing the effectiveness of public and private online services, electronic business and electronic commerce in the EU. It repealed Directive 1999/93/EC on a Community framework for electronic signatures that essentially covered electronic signatures only. As implied by the legal base of the Regulation, Article 114 TFEU, it intended to remove existing barriers to the functioning of the internal market by promoting approximation of Member States legislation, in particular mutual recognition and acceptance of eID, authentication, signatures and related trust services across borders when needed for the access and completion of electronic procedures or transactions. Before the Regulation entered into force there was no comprehensive EU cross-border and cross-sector framework for secure, trustworthy and easy-to-use electronic transactions that encompassed electronic identification, authentication and trust services. The Commission proposal (COM(2012) 238 final) of 4 June 2012 accompanied by the Impact Assessment (SWD(2012) 135 final) identified the following four general objectives: •ensuring the development of a digital single market; •promoting the development of key cross-border public services; •stimulating and strengthening competition in the single market; •enhancing user-friendliness (citizens and businesses). Despite the fact that the Regulation is delivering on many of its goals and has become a fundamental element to facilitate the single market in a number of sectors (e.g. for financial services and enabling access and reuse of data in administrative procedures), it carries a number of limitations: lack of obligation to notify national eID schemes, limited attributes (elements of personal information) that can be reliably disclosed to third parties, the act’s focus on the public sector and the absence of clear incentives for private parties to use national eIDs. In addition, the European electronic identity ecosystem is distributed across different national regulatory environments, levels of digital governance, culture, and varying levels of trust in public institutions. 1.2.Context Provision of digital identity is undergoing fundamental changes. Entities such as banks, providers of electronic communications services or utility companies, some of which are required by law to collect identity attributes, are leveraging their procedures to act as verified identity providers. Internet intermediaries, including major social media platforms and internet browsers, act as de facto digital identity gatekeepers and offer BYOI (bring your own identity) solutions that allow their users to authenticate on third-party websites and services by using their user profiles. This convenience comes at the cost of loss of control over disclosed personal data while these eID means are disconnected from a verified physical identity, which makes fraud and cybersecurity threats more difficult to mitigate. A large majority of EU citizens would like to have access to a secure digital identity that they could use to access online services. Finally, although there are many different views on the future of digital identity, the key role of the national governments in the development of any far-reaching digital ID eco-system needs to be duly considered. Users today expect seamless online journeys, mobile applications and single-sign-on solutions that can be used for online services in the public and private sector, covering all use cases for identification ranging from pseudonymous log-on to an online platform to secure identification for e-health or e-banking. Secure online identification and the exchange of attribute credentials is becoming more important as the number of identity-sensitive and personalised services increases. The ability to identify digitally will become an important factor of social inclusion and the provision of digital identity a strategic asset. In her State of the Union speech on 16 September 2020, the President of the European Commission announced the Commission’s ambition to deliver a secure and trusted digital identity to all EU citizens: “We want a set of rules that puts people at the centre. (...) This includes control over our personal data, which we still have far too rarely today. Every time an app or website asks us to create a new digital identity or to easily log on via a big platform, we have no idea what happens to our data in reality. That is why the Commission will soon propose a secure European e-identity. One that we trust and that any citizen can use anywhere in Europe to do anything from paying your taxes to renting a bicycle. A technology where we can control ourselves what data and how data is used”. The European Council seconded the Commission’s ambition and, in the Council Conclusions of 1-2 October 2020, called on the Commission to come forward with a proposal for a European digital identity framework initiative by mid-2021: The European Council Conclusions call for “The development of an EU-wide framework for secure public electronic identification (eID), including interoperable digital signatures, to provide people with control over their online identity and data as well as to enable access to public, private and cross-border digital services”. The Council invites the Commission to come forward with a proposal for a European digital identity framework initiative by mid-2021.” Electronic identification allows citizens and businesses to prove who they are when accessing services online. Trust services, such as electronic signatures, make online transactions more secure, convenient and efficient. The eIDAS Regulation is the only cross-border framework for trusted eID of natural and legal persons, and trust services. eIDAS enables the cross-border recognition of government eIDs for access to public services, under the condition the eID has been notified under eIDAS. eIDAS also establishes an EU market for trust services recognised across borders with the same legal status as their traditional equivalent paper-based processes.

2.Main findings of the evaluation The main findings of the evaluation, according to the evaluation criteria, can be summarised under the following headings. 2.1.Effectiveness The provisions on electronic identity have led to the creation of the eIDAS network, which seeks to enable holders of a notified eID scheme to access online public services across borders. The interoperability of only a limited number of eID schemes has been achieved at EU level. The eIDAS Regulation has successfully established legal certainty on liability, burden of proof, legal effect and international aspects of trust services, but some issues remain. Availability and take-up of trust services in the EU have increased since the introduction of the eIDAS Regulation, however, there are differences among Member States and among different trust services Despite some achievements, the regulation has not achieved its potential in terms of effectiveness. Only a limited amount of eIDs have been notified, limiting the coverage of EU citizens with a notified eID scheme (59% of the population). The acceptance of notified eIDs is limited, as not all eIDAS nodes are up and running, a limited number of public services offer the eIDAS notification or are connected to the infrastructure, and technical errors prevent users from effectively authenticating. On the trust services side, the objective of the Regulation to remain technology neutral has led to a diversity of interpretation of the requirements between Member States also due to the lack of adoption of additional implementing acts. It cannot be concluded that a level playing field has been fully achieved at EU level. However, the eIDAS Regulation has set-up a strong framework that can be complemented with the necessary standards and requirements to reduce the current fragmentation of the market and divergences of interpretation by supervisory bodies and conformity assessment bodies and strengthened cooperation between the supervisory bodies. 2.2.Efficiency The baseline assessment indicates that quantifiable costs have been so far higher than benefits. In the area of eID this is the result of a low uptake where benefits did not materialise. The key stakeholder groups for which the eID part of the eIDAS Regulation has generated costs and benefits are national authorities, eIDAS node operators, eID providers and service providers. For the trust services the key stakeholder groups, which faced the main costs and benefits are accreditation, conformity assessment, and supervisory bodies and qualified and non-qualified trust service providers. For individual stakeholders, a considerable part are expected benefits (discounted as future benefits) and therefore hardly quantifiable. Recurring costs for governance in the area of trust services are limited and mainly linked to ensuring compliance. For individual stakeholders, a considerable part of the benefits is only hypothetical at this stage (discounted as future benefits) and hardly quantifiable. Trust Service Providers register benefits in the form of revenue due to the provision of trust services in other EU countries and an extension of market base. 2.3.Relevance The eID ecosystem has profoundly changed since the introduction of the eIDAS Regulation with an increasing footprint of private identity providers. Taking into account the increase in digital transactions, all EU citizens should have access to a secure and interoperable digital identity, which is not the case today. The objectives of the eIDAS legal framework remain relevant to address the initially identified issues, notably the need to ensure the reduction of market fragmentation by ensuring cross-border and cross sector interoperability of trust services via the adoption of common standards. The current scope and focus of the eIDAS Regulation on eID schemes notified by EU Member States and on enabling access to online public services seems too limited. Some key barriers to uptake by users and private sector service providers have prevented the regulatory framework to reach its full potential. Despite introducing references to eIDAS solutions in a number of sectoral EU legislation, the eIDAS Regulation has not yet replied to the needs of specific sectors (e.g. education, banking, travel, aviation). One of the limitation factors of the current framework with respect to these sectoral needs is the lack of specific attributes by domains. The key tension is the ability of eIDAS to stay in line with the latest developments of technology in the domain of trust services. The extension of the trust services list, notably through the introduction of a trust service for eArchiving, a trust service supporting portable identity credentials and a trust service for electronic ledgers would address a number of use cases and provide citizens and businesses with the possibility to prove digitally who they are or to prove their attributes/characteristics, without needing physical documents. 2.4.Coherence The evaluation shows that the eID part of the Regulation is supported by a generally coherent system for mutual recognition of eIDs based on notification and peer review. The trust services framework provides for a coherent supervisory system for trust services. However, certain issues have been identified impacting the internal coherence of the Regulation. For eIDs, the notification and peer review system set out in the eIDAS framework intended to deliver a common understanding of the level of assurance (LoA) provided by an eID scheme but assessment of practical implementation shows that this is not always the case. Although it encourages flexibility and technological neutrality, a common understanding of what constitutes a substantial and high LoA is still missing. The focus on the public services contrasts with the possibility for the user to limit the transmitted data to the minimum necessary for the authentication to a specific service as the minimum data set is always transmitted to allow the identification of a person. The implementation of the current eIDAS system does not allow the user to facilitate the enforcement of the GDPR principles of data minimisation and privacy by default by controlling which data to share and with whom. The rules on the assessment of the trust service providers against the functional requirements of the Regulation to obtain the qualified status shows some weaknesses as the role of conformity assessment bodies lacks sufficient detail on their obligations, liability or level of competence. Some provisions leave it up to the Member States to recognise certain identification methods (such as biometric verification) at national level, which hamper regulatory level playing field and creates uncertainty. 2.5.EU added value