Opinion No. 1/2023 of the Cooperation Network on the Bulgarian eID scheme “Evrotrust”

 

Having regard to Article 12(5) and (6) of Regulation (EU) 910/2014 ("the eIDAS Regulation").

Having regard to Article 14(i) of Commission Implementing Decision (EU) 2015/296.

Having regard to Article 4 of the Rules of Procedure of the Cooperation Network.

Whereas:

Article 12 of the eIDAS Regulation obliges Member States to cooperate with regard to the interoperability and security of notified electronic identification schemes.

Article 14(i) of Commission Implementing Decision (EU) 2015/296 on cooperation mandates the Cooperation Network to adopt opinions on how an electronic identification scheme to be notified meets the requirements of the eIDAS Regulation.

Bulgaria, with a view to notify its eID scheme Evrotrust, in line with Article 7 (g) of the eIDAS Regulation provided the following information to the Member States on May 4th 2022 (hereinafter referred to as: "prenotifications"):

  • Notification form
  • Supporting Documentation.

On June 27th 2022, the Cooperation Network:

  • agreed to peer review the Bulgarian eID scheme Evrotrust according to Article 12(6) (c) of the eIDAS Regulation and Chapter III of Commission Implementing Decision (EU) 2015/296;
  • formed a "Peer Review Group" and
  • agreed which topics the peer review process would cover and how it would be organized according to the provisions of Chapter III of Commission Implementing Decision (EU) 2015/296.

The Peer Review Group submitted its report according to Article 11 of Commission Implementing Decision (EU) 2015/296 to the Cooperation Network on December 23rd 2022. The Cooperation Network has examined and discussed the Peer Review Report today.


Taking into account the outcomes of the peer review, the additional information provided by Bulgaria, and that Bulgaria commits to:

  • disable remote biometric identification for level of assurance “High”;
  • only use physical identification during enrollment for level of assurance “High";
  • always require a PIN for authentication on level of assurance “High”.

 

The Cooperation Network adopted the following opinion:

Opinion

Based on the examination of the pre-notification documents provided by Bulgaria and the findings of the Peer Review Report, the Cooperation Network is of the opinion that the pre-notification documents and additional information provided by Bulgaria demonstrate sufficiently how the Evrotrust eID scheme to be notified meets the requirements

  • for assurance levels “Substantial” and “High”;

in line with the requirements of Article 7, Articles 8(1)-(2) and 12(1) of the eIDAS Regulation and Commission Implementing Regulation (EU) 2015/1502. 

According to Article 4(6) of the Rules of Procedure the Cooperation Network agrees to publish this opinion.


Brussels, 18th of April 2023

  • No labels