Opinion No. 01/2020 of the Cooperation Network on the Danish eID scheme

Having regard to Article 12(5) and (6) of Regulation (EU) 910/2014 ("the eIDAS Regulation").

Having regard to Article 14(i) of Commission Implementing Decision (EU) 2015/296.

Having regard to Article 4 of the Rules of Procedure of the Cooperation Network.

Whereas:

Article 12 of the eIDAS Regulation obliges Member States to cooperate with regard to the interoperability and security of notified electronic identification schemes.

Article 14(i) of Commission Implementing Decision (EU) 2015/296 on cooperation mandates the Cooperation Network to adopt opinions on how an electronic identification scheme to be notified meets the requirements of the eIDAS Regulation.

The Kingdom of Denmark, with a view to notify its eID scheme, in line with Article 7 (g) of the eIDAS Regulation provided the following information to the Member States on 19^th August 2019 (hereinafter referred to as: "prenotifications"):

• Notification form
• Supporting Documentation.

On 2^nd October 2019 the Cooperation Network:

• agreed to peer review the Danish eID scheme according to Article 12(6) (c) of the eIDAS Regulation and Chapter III of Commission Implementing Decision (EU) 2015/296;
• formed a "Peer Review Group" and
  agreed which topics the peer review process would cover and how it would be organized according to the provisions of Chapter III of Commission Implementing Decision (EU) 2015/296.

The Peer Review Group submitted its report according to Article 11 of Commission Implementing Decision (EU) 2015/296 to the Cooperation Network on 28.01.2020. The Cooperation Network has examined and discussed the Peer Review Report today.

Taking into account the findings in the peer review report regarding:

• Enrolment
• letter based enrolment
• current online enrolment
• Support
• visual recognition,
• voice recognition
• and written inquiry

and that

• Denmark commits to take the appropriate technical and organizational measures
• by enhancing the online enrolment and issuance processes methods by requiring verification of possession of physical evidence,.
• and limiting to revocation and suspension the support offerings based on visual and voice recognition and written inquiry.
• NemID will be migrated to the successor MitID starting in 2021 and OTP Key cards will not be a supported authentication mean in MitID,
• Denmark commits to only allowing citizens access to cross-border services who have been verified to be in possession of physical evidence,
• Denmark will inform the Cooperation Network on the progress and timeline in this respect,

and that Denmark will provide official documentation for the implemented changes to be presented to the Cooperation Network,

the Cooperation Network adopted the following opinion:

Opinion
Based on the examination of the pre-notification documents provided by the Kingdom of Denmark and the findings of the Peer Review Report, the Cooperation Network is of the opinion that the pre-notification documents and additional information provided by the Kingdom of Denmark demonstrate sufficiently how the Danish eID scheme to be notified meets the requirements of Article 7, Articles 8(1)-(2) for assurance level “substantial” and 12(1) of the eIDAS Regulation and Commission Implementing Regulation (EU) 2015/1502. 

According to Article 4(6) of the Rules of Procedure the Cooperation Network agrees to publish this opinion.

Brussels, 30 January 2020