eIDAS 2.0: Vier neue Vertrauensdienste und ihre Bedeutung

In November 2023, the Council of the European Union and European Parliament formalized a provisional agreement on how to update and modify the Electronic Identification, Authentication, and Trust Services (eIDAS) Regulation. Known colloquially as eIDAS 2.0, the new agreement paves the way for a comprehensive framework for European digital identity (eID).

Once approved and enacted, these changes will extensively affect all EU citizens, residents, and businesses. Continue reading to learn more and find out how eIDAS 2.0 will affect individuals and businesses alike.

Background: What is an eIDAS?

The proposed legislation amends the eIDAS regulation on the EU’s internal market, which was approved in 2014 and put in place incrementally between 2016 and 2018. This comprehensive regulation seeks to ensure safety in accessing public services and carrying out online transactions across EU borders.

Until now, eIDAS has effectively overseen not only electronic archives and digital vaults, but also how trust service providers deliver electronic identification, electronic signatures, electronic seals, electronic time stamps, electronic registered delivery services (ERDS), electronic documents, and website authentication certificates. These foundational instruments are essential for smoothly conducting secure electronic transactions.

Im Juni 2021 beschloss die EU-Kommission jedoch, sich den neuen technologischen Herausforderungen im Bereich der Online-Sicherheit zu stellen, und der Rat nahm ernsthafte Beratungen darüber auf, wie diesen Herausforderungen begegnet werden kann, um die bestehenden EU-Vorschriften zu modernisieren und dadurch das Vertrauen, die Sicherheit und den Komfort bei Online-Transaktionen für alle EU-Bürger zu verbessern. 

Änderungen

Although the original eIDAS regulation applied to e-signatures, electronic seals, and electronic timestamps, as well as digital vaults and electronic archives, the updated eIDAS 2.0 will include e-registered delivery services, e-certificates for authentication, and electronic seals for electronic documents. In essence, it will oversee cross-border digital services such as authenticating and identifying individuals and websites. 

Additionally, it will reinforce security and privacy for electronic identities and trusted services by establishing a framework that will facilitate the creation of digital identities by means of European digital identity wallets. These identity wallets will enable individuals and businesses to create and use digital identities without any need for mandatory government verification.

What is more, both digital identities and trust services will be enhanced by streamlining the interoperability structure of the member states’ national systems.

Aktuelle und auf dem neuesten Stand befindliche Vertrauensdienste, die Unternehmen benötigen

Einige der Vorschläge aus dem Jahr 2021 haben die Endauswahl geschafft, während andere der genauen Prüfung nicht standhielten. Die folgenden Vorschläge haben die tiefgreifendsten Auswirkungen auf Einzelpersonen und Organisationen in der EU.

Das europäische digitale Identitäts-Wallet

Die verabschiedete Vereinbarung verpflichtet die Mitgliedstaaten zur Einführung einer europäischen digitalen Identitätsbrieftasche (eID), die technisch gesehen das abdeckt, was in der Verordnung – etwas umständlich – als “elektronische Bescheinigungen von Merkmalen” bezeichnet wird. Einfach ausgedrückt wird die eID digitale Identitätsnachweise und biometrische Dokumente wie mobile Führerscheine, Diplome, berufliche Zertifizierungen sowie Dokumente für Reisen, das Gesundheitswesen und Bankgeschäfte speichern. 

Dienstleistungen im Bereich der elektronischen Archivierung

Digital vaults and the elektronische Archivierung of electronic documents will be modernized by introducing the concept of “qualified electronic archiving services”, which aim to ensure that all electronic data and documents are created or maintained by a qualified trust service provider.

Furthermore, the integrity and accuracy of their origin and legal features will be preserved throughout the conservation period. Finally, the new proposal mandates accurate recording of the date and time of the archiving process. 

Um sicherzustellen, dass die Sicherheit und Authentizität der elektronischen Archivierung angesichts der sich wandelnden digitalen Landschaft auf dem neuesten Stand bleibt, sieht der Vorschlag vor, die „Digital Identity Wallet“ zur Schaffung vertrauenswürdiger digitaler Identitäten zu nutzen, die auf gemeinsamen, in der gesamten Europäischen Union verabschiedeten technischen Standards basieren werden. 

Elektronische Signaturen und Siegel

To ensure consistent certification practices across the EU, the proposal recommends additional Commission guidelines on certifying and recertifying qualified creation devices for signatures and seals. Furthermore, the proposal calls for cross-border recognition of qualifizierte elektronische Signaturen und Siegel.

Currently, three types of eSignatures are included in eIDAS (Simple, Advanced, and Qualified). Qualified Electronic Signatures are as legally valid as handwritten signatures on paper and require certification by a Qualified Service Trust Provider (QSTP). QSTPs are subject to the most rigorous EU requirements and must undergo regular audits that guarantee their adherence to regulation standards. 

Schließlich führt eIDAS Bestimmungen zur Verwendung elektronischer Siegel ein, die elektronische Dokumente mit derselben Rechtskraft beglaubigen wie herkömmliche Siegel, welche die Herkunft und Integrität amtlicher Dokumente bestätigen.

Elektronische Zeitstempel

Die Verknüpfung elektronischer Daten mit anderen elektronischen Daten dient als Nachweis für den Zeitpunkt, zu dem die Daten existierten. Wie bei elektronischen Signaturen und Siegeln fordert eIDAS 2.0 die grenzüberschreitende Anerkennung der von den einzelnen Mitgliedstaaten ausgestellten Zeitstempel.

Elektronische Einschreibedienste

Dieser Vertrauensdienst liefert den Nachweis, dass elektronische Daten gesendet und empfangen wurden, und bietet somit eine ähnliche Sicherheit wie ein Einschreiben im herkömmlichen Postsystem. eIDAS 2.0 gewährleistet die grenzüberschreitende Interoperabilität zwischen qualifizierten elektronischen Einschreibdiensten.

Authentifizierungsdienste für Websites

Falling under the rubric of a “qualified trust service”, website authentication links a website to the natural or legal person holding the certificate, thus ensuring that users can trust the website identity they are interacting with. Currently, websites are authenticated by root certificates controlled by certificate authorities. 

Artikel 45 des neuen eIDAS-2.0-Vorschlags wird es den Mitgliedstaaten ermöglichen, nach eigenem Ermessen neue Stammzertifikate einzufügen. Dies wurde jedoch von Cybersicherheitsexperten heftig kritisiert, und es bleibt abzuwarten, ob diese Änderungen letztendlich in Gesetzeskraft treten werden oder nicht.

Understanding the Role of Electronic Ledgers in eIDAS Regulation

Utilizing blockchain technology is becoming an integral part of regulatory frameworks. The recent inclusion of electronic ledger mechanisms within the revised eIDAS (Electronic Identification, Authentication and Trust Services) regulation marks a significant step towards more robust, secure, and efficient digital transactions across Europe.

Staying abreast of these technological and regulatory changes is paramount for compliance officers. Let’s see how they can enhance trust services within the digital single market.

Distributed Ledger Technology

Distributed Ledger Technology (DLT) is a digital system for recording the transactions of assets where the transactions and their details are recorded in multiple places simultaneously. Unlike traditional databases, DLT has no central data store or administration functionality. Here’s why it’s groundbreaking in the context of compliance and regulation:

Transparency and Efficiency: Every participant within the DLT network has access to all transactions, ensuring unparalleled transparency. This open visibility promotes trust among users and can dramatically reduce the time required to trace and verify transactional histories, thus delivering efficiency gains.

Reducing Duplication: With DLT, the duplication of effort commonly seen in traditional business networks is negated. Each transaction is once recorded on a shared ledger that is accessible by all participants – thus minimizing the room for discrepancies and errors.

Immutable Records

One of the standout features of blockchain, an implementation of DLT, is the immutability of records. Once an entry has been made to the ledger, it cannot be altered or deleted by any single party:

Trust and Integrity: Compliance officers can appreciate that this characteristic guarantees the integrity of electronic records, which is critical for meeting stringent regulatory standards.

Error Handling: In the rare event of an error, the incorrect entry cannot be erased. Instead, a new transaction must be logged to counteract the mistake, and both transactions are transparently visible to all parties. This evidentiary trail maintains the ledger’s integrity and ensures compliance with audit trails.

Smart Contracts

Smart contracts are self-executing contracts where the terms of the agreement between the buyer and the seller are directly written into lines of code. These contracts are stored and replicated on the blockchain, and the execution of contract terms is supervised automatically.

Automation and Compliance: With smart contracts, compliance officers can leverage the technology to automate and enforce legal and regulatory obligations without intermediaries, thereby reducing costs and streamlining operations.

Versatility of Application: Whether it is the transfer of corporate bonds or defining the terms for an insurance payout, intelligent contracts can simplify complex transactions and their associated compliance requirements.

The Implication for eIDAS

With embedding electronic ledger principles within eIDAS and the other regulations regarding trust services and the digital identity wallet, compliance officers are now at the forefront of overseeing sensitive data such as customer information and contracts within digital trust services.

This reinforces a higher standard of transaction record integrity, improved compliance mechanisms, and automation potential—all conducive to a resilient and innovative digital market.