Opinion No. 4/2019 of the Cooperation Network on the Italian national electronic identity card (“Carta di Identità Elettronica”) and on the addition of a new SPID Identity Provider (“Lepida”)
Having regard to Article 12(5) and (6) of Regulation (EU) 910/2014 ("the eIDAS Regulation").
Having regard to Article 14(i) of Commission Implementing Decision (EU) 2015/296.
Having regard to Article 4 of the Rules of Procedure of the Cooperation Network.
Whereas:
Article 12 of the eIDAS Regulation obliges Member States to cooperate with regard to the interoperability and security of notified electronic identification schemes.
Article 14(i) of Commission Implementing Decision (EU) 2015/296 on cooperation mandates the Cooperation Network to adopt opinions on how an electronic identification scheme to be notified meets the requirements of the eIDAS Regulation.
The Italian Republic, with a view to notify its electronic identification scheme - Italian national electronic identity card (“Carta di Identità Elettronica”- CIE) and the addition of a new SPID Identity Provider named “Lepida” (hereinafter referred to as "CIE" and “Lepida”), in line with Article 7 (g) of the eIDAS Regulation provided the following information to the Member States on 26 and 29 November 2018:
On 30 January 2019 the Cooperation Network:
- agreed to peer review the Italian national electronic identity card and the new SPID Identity Provider according to Article 12(6) (c) of the eIDAS Regulation and Chapter III of Commission Implementing Decision (EU) 2015/296;
- formed a "Peer Review Group" and
- agreed which topics the peer review process would cover and how it would be organized according to the provisions of Chapter III of Commission Implementing Decision (EU) 2015/296.
The Peer Review Group submitted its report according to Article 11 of Commission Implementing Decision (EU) 2015/296 to the Cooperation Network on 3 June 2019.
The Cooperation Network has examined and discussed the Peer Review Report today.
Taking into account the findings in the peer review report and the clarifications provided by the Italian Republic on the existence and the scope of the activation process linked to CIE and considering the confirmation of an established system for the management and control of information security risks, where the governance of the scheme also is being audited by an independent and competent party, the Cooperation Network adopted the following opinion:
Opinion
Based on the examination of the pre-notification documents provided by the Italian Republic, the findings of the Peer Review Report and the clarifications provided by the Italian Republic, the Cooperation Network is of the opinion that the pre-notification documents and the additional information provided by the Italian Republic demonstrate sufficiently how:
- the Italian national electronic identity card “CIE” to be notified meets the requirements for assurance level “High”;
- the new SPID Identity Provider (“Lepida”) to be notified meets the requirements for assurance level “Low”, “Substantial” and “High”
in line with the requirements of Article 7, Articles 8(1)-(2) and 12(1) of the eIDAS Regulation and Commission Implementing Regulation (EU) 2015/1502.
According to Article 4(6) of the Rules of Procedure, the Cooperation Network agrees to publish this opinion.
Brussels, 6 June 2019