Several of the procedures listed in Annex II of the SDG regulation are procedures about legal persons. In these procedures, Evidence Requesters typically need to establish that the user (a natural person) has the power to represent the legal person in the electronic procedure in order to be able to proceed with the application. This requirement applies whether or not any evidences are exchanged in the electronic procedure and is therefore independent and separate from the Once-Only Technical System. This section is about requirements on the OOTS for the exchange of evidences about legal persons.
When processing requests for evidence about legal persons, the Online Procedure Portal must authenticate users acting either directly or through a representative using electronic identification means defined in Article 3(2) of Regulation (EU) 910/2014 issued under the electronic identification schemes notified in accordance with that Regulation. Even if the representative attributes MUST NOT be explicitly requested in the eIDAS Authentication request, the Online Procedure Portal MAY receive from the eIDAS service one representative attribute set in case of representation. (see 2.8 of the eIDAS SAML Attribute Profile 1.2). This means that the Online Procedure Portal may receive in case of representation two attribute sets, one for the representative and one for the represented person. The attributes for representative must follow the same specifications as defined in sections 2.2, 2.3 of the eIDAS SAML Attribute Profile 1.2 and must have the attribute’s FriendlyName prefixed with “Representative”.
When making evidence requests, the evidence requester shall include all the attribute sets obtained using eIDAS. A Data Service, when processing an evidence request, shall use all identity attributes of the user that are included in the request. The Data Service may choose to re-authenticate the user, or use the attributes sets in combination with additional security services as defined in 2.2 - OOTS eID additional security services - Q4 2022 to determine if pieces of evidence can be returned. In both cases, the Data Service must ensure that the attributes of the user and of the representative where applicable match the attributes held by it.
Please note that the current eIDAS technical specifications do not consider any constraints of representation. The scope of powers or mandates may be described in the notification process of eID schemes that concern either legal persons or natural persons representing legal persons, but this information is not available to the evidence requester and there is no agreed syntax to encode it.