Key takeaways on eIDAS 2.0
- Since 20 May 2024, the eIDAS 2.0 Regulation strengthens the European legal framework for electronic transactions by extending its scope and increasing the level of security applicable to trust services.
- Each Member State must make at least one European Digital Identity Wallet available by the end of 2026.
- The wallet will enable users to present identity data and electronic attestations of attributes, such as a qualification, driving licence or professional status.
- eIDAS 2.0 expands the list of trust services by incorporating qualified electronic ledgers and qualified electronic archiving, in addition to electronic signatures, electronic seals and timestamping.
- These new services ensure the integrity, origin, traceability and long-term preservation of electronic data, with legal recognition throughout the European Union.
- By harmonising identification and trust standards, eIDAS 2.0 facilitates cross-border exchanges, strengthens digital security and supports innovation within the European market.
What is the eIDAS 2.0 regulation?
The eIDAS regulation (Electronic Identification, Authentication and Trust Services) aims to establish a unified legal framework for electronic transactions within the European Union. Its second version represents a significant advancement, expanding its scope and strengthening its security measures. It also includes developments in trust services, reorganising the list of existing services and introducing two new ones: electronic archiving and electronic registers.
Creating a digital identity wallet
The creation of the digital identity wallet, or Wallet, aims to securely store personal data of European citizens, independent of the authentication technology used, ensuring the confidentiality of this data.
Expansion of Electronic Trust Services
The services of electronic signatures, electronic seals, and electronic timestamps are complemented by the new services of electronic registers and electronic archiving. These additional services ensure the integrity and accuracy of recorded data, with strict requirements for qualified trust service providers.
In its first version, eIDAS included only electronic signatures, electronic seals, and electronic timestamps.
The initial eIDAS regulation enumerates several levels of signatures:
Simple Signature
This form of electronic signature cannot be legally dismissed solely because of its electronic format. Examples include signing a name at the end of an email or a scanned signature.
Advanced Electronic Signature (AES)
Uniquely linked to the signatory, this signature allows the signatory to be identified and ensures the integrity of the document.
Qualified Electronic Signature (QES)
More stringent than AES, it holds the same legal value as a handwritten signature.
Signatories must use a digital identity certificate issued by a qualified and accredited EU trust service provider according to eIDAS standards. Signatories also use a Qualified Signature Creation Device (QSCD), such as a smart card or USB token, or a mobile application with a unique secret code.
An electronic seal, or digital seal, is defined as a set of electronic data attached to other electronic data to ensure their origin and integrity. Thus, the electronic seal is comparable to a company stamp or the signature of a legal entity.
An electronic timestamp certifies that data existed at a specific moment. For instance, it can validate promotional prices in e-commerce, ensure the traceability of supply chains, build infringement reports, guarantee regulatory compliance, etc.
Electronic register
eIDAS 2.0 now includes the electronic register, aimed at sequentially recording data to guarantee their integrity and the accuracy of their chronological order. A qualified register must be managed by one or more qualified trust service providers, establish the origin of the records, maintain a unique chronological order, and detect any subsequent modifications.
Electronic archiving service
eIDAS 2.0 also introduces the electronic archiving service, defined as a service that guarantees the receipt, storage, retrieval, and deletion of electronic data or documents, ensuring their longevity, readability, integrity, and confidentiality.
A qualified archiving service must:
- Be provided by a qualified trust service provider.
- Utilise processes and technologies ensuring data longevity and readability, even after technological obsolescence, at least for the legal retention period or as established in the contract, ensuring their integrity and origin.
- Ensure that data retention methods protect against any loss or modification, except in cases of modifications due to transfer of media or electronic format.
- Ensure that authorised parties automatically receive a report confirming that an electronic data retrieved from a qualified archiving service has maintained its integrity from entry into the archive to its exit.
Electronic archiving and registers are now included in the list of trust services established in the eIDAS regulation, benefiting from recognition and interoperability among Member States. An electronic data archived in a qualified service will benefit from a presumption of origin and integrity during its retention period.
Advantages of eIDAS 2.0 regulation
The eIDAS 2.0 regulation offers several advantages:
Facilitation of cross-border transactions
By harmonising identification and electronic signature standards, eIDAS 2.0 promotes transactions between Member States and encourages digital transactions within the EU.
Strengthening security
The use of qualified identifiers and electronic signatures enhances the security of digital transactions, protecting and reassuring citizens and businesses against cybercrime and fraud.
Simplification of administrative procedures
By promoting the use of electronic identifiers for access to public and private services, eIDAS V2 helps reduce costs and shorten administrative delays within the European Union.
Development of digital innovation
Through this new legal framework for online identification and authentication, eIDAS 2.0 aims to promote innovation in the digital services sector and encourage the development of new products and services.
Differences between eIDAS 1 and eIDAS 2.0
eIDAS 2.0 does not replace the mechanisms established by the 2014 Regulation. It builds on them by extending the European framework to digital identity, certified attributes and new trust services.
| Topic | eIDAS 1 | eIDAS 2.0 |
| Electronic identification | The 2014 eIDAS Regulation was primarily based on the mutual recognition of electronic identification means notified by Member States. Its application mainly concerned cross-border access to online public services. | eIDAS 2.0 introduces a European Digital Identity Wallet usable across the European Union. It is intended to enable individuals and businesses to identify themselves to public services, as well as to many private services. |
| Identity data management | The framework mainly aimed to enable user authentication using an identification means recognised by a Member State. It offered limited possibilities for restricting the information shared with a service. | The wallet must allow users to share only the information necessary for a given process. For example, they will be able to prove their age or professional status without disclosing their full identity data. |
| Electronic attribute attestations | Supporting documents such as diplomas, authorisations or professional qualifications were not covered by a structured European framework under trust services. | eIDAS 2.0 establishes a framework for electronic attribute attestations, which certify a characteristic relating to a natural or legal person, such as a diploma, a mandate or a professional authorisation. |
| Electronic archiving | Electronic archiving was not recognised as a standalone category of trust service at European level. Its evidential value therefore mainly depended on national legislation, applicable standards and the technical safeguards implemented. | The new regulation creates a harmonised framework for electronic archiving services, including qualified ones. The aim is to preserve the integrity, origin and readability of electronic data and documents throughout their retention period. |
| Electronic ledgers | Distributed ledger technologies or electronic ledgers did not benefit from a specific regime among the trust services defined by eIDAS. | eIDAS 2.0 recognises electronic ledgers as a new category of trust service. Qualified ledgers may benefit from legal presumptions regarding the chronological order, integrity and accuracy of the origin of recorded data. |
| Remote electronic signatures and seals | The regulation already covered electronic signatures and electronic seals, but the arrangements for remote management of signature creation devices were less developed in the original text. | eIDAS 2.0 strengthens the framework for solutions enabling the remote creation and management of qualified electronic signatures and qualified electronic seals, particularly through qualified trust service providers. |
| Role of private sector actors | Recognition obligations mainly concerned public administrations and certain cross-border uses. The acceptance of electronic identification means in the private sector remained largely optional. | Certain private companies will be required to accept the European wallet where strong user identification is needed. The regulation aims to extend the use of European digital identity to sectors such as banking, insurance, telecommunications and transport. |
| Scope of the European framework | eIDAS 1 mainly harmonised the recognition of electronic signatures, seals, timestamps and electronic identification means between Member States. | eIDAS 2.0 extends this framework to a broader range of services and digital credentials. It seeks to ensure more consistent cross-border use of identity, attributes and electronic evidence across the European Union. |
Conclusion
The eIDAS 2.0 regulation represents a crucial step towards creating a European digital identity. With these new shared standards within the EU for electronic identification, digital signatures, and qualified timestamps, eIDAS V2 facilitates cross-border transactions and strengthens trust in online transactions, building a secure and harmonised digital future for European citizens, businesses, and governments.
Disclaimer
The opinions, presentations, figures and estimates set forth on the website including in the blog are for informational purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.
The use of any content on this website, including in this blog, for any commercial purposes, including resale, is prohibited, unless permission is first obtained from Evidency. Request for permission should state the purpose and the extent of the reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.
