Adoption of eIDAS 2: paradigm shift for digital identity in Europe

What happened?

On 30 April 2024, the eIDAS 2 Regulation introducing a European Digital Identity Framework¹ (also known as “EUDI”) was published in the Official Journal of the European Union. This regulation amends the eIDAS Regulation², in particular by establishing a mandatory European Digital Identity Wallet that can be linked to the national digital identities of users and by expanding the list of trust services by introducing new qualified trust services. 

With the eIDAS 2 Regulation, the European Commission wanted to harmonize and secure digital identification across the European Union with the aim of increasing security on the Internet and protecting users’ data, and meet certain interoperability requirements to address the shortcomings of the eIDAS Regulation.

Key takeaways

The ID Wallet 

The most significant change of the eIDAS 2 Regulation is the introduction of a fully mobile, secure and user-friendly European Digital Identity Wallet (the “ID Wallet”). This ID Wallet is defined as “an electronic identification means which allows the user to securely store, manage and validate person identification data and electronic attestations of attributes for the purpose of providing them to relying parties and other users of European Digital Identity Wallets, and to sign by means of qualified electronic signatures or to seal by means of qualified electronic seals.”

This is hence a means of electronic identification, for public or private services, characterised by citizens’ full control over their own data and interoperability between EU Member States. The ID Wallet has the structure of a digital ‘wallet’ in which verifiable data and official documents – so-called ‘attributes’ – can be collected (including, for example, driving licenses, diplomas and bank accounts).

General requirements for the ID Wallet are laid down to ensure that qualified electronic attestations of attributes by public authorities have the equivalent legal effect of lawfully issued attestations in paper form. The conformity of the ID Wallet with those requirements would be certified by accredited conformity assessment bodies or certified private entities designated by EU Member States. Hence, public authorities or accredited private entities will be able to issue wallets.

New trust services

Another novelty introduced by the eIDAS 2 Regulation is the designation of new trust services such as the electronic attestation of attributes, the management of remote electronic signature and seal creation devices, the electronic archiving (i.e. a service that enables the receipt, storage, retrieval and deletion of electronic data and documents in order to ensure their durability and readability as well as to preserve their integrity, confidentiality and proof of origin throughout the storage period), or the recording of electronic data in an electronic ledgers (i.e. a sequence of electronic data records that guarantees the integrity of these records and the accuracy of their chronological order).

Various requirements for qualified or non-qualified trust service providers

Qualified trust service providers will be, inter alia, subject, at their own expense and at least every 24 months, to an audit by a conformity assessment body in order to verify that they comply with the requirements of eIDAS 2 and Article 21 of the NIS2 Directive, i.e. cybersecurity risk-management measures.³

Non-qualified trust service providers will have to comply with notification obligations⁴ and other additional requirements for managing legal, business, operational and other direct or indirect risks to the provision of the said non-qualified trust service.

Compliance with the GDPR⁵

The eIDAS 2 Regulation provides that any processing of personal data carried out by the Member States or on their behalf by bodies or parties responsible for the provision of European Digital Identity Wallets as electronic identification means shall be carried out in accordance with appropriate and effective data protection measures. Compliance of such processing with the GDPR shall be demonstrated. 

What’s next?

eIDAS 2 entered into force on the 20^th day following its publication in the Official Journal of the EU. Implementing acts from the Commission with the technical specifications for the ID Wallet will follow within 6 to 12 months thereafter. By way of illustration, by 21 November 2024 the Commission will have to establish a list of reference standards for the certification of the ID Wallet. Within 24 months from the date of entry into force of the implementing acts, EU Member States will have to make available at least one ID Wallet to all citizens and residents. The Commission will also eventually publish and maintain in a machine-readable form a list of certified ID Wallets.