Czechia, Italy (CIE) and the Netherlands eID schemes notified under eIDAS

©Adobe Stock

On 13 September 2019, the notifications of the Czech eID scheme, the Italian eID card (CIE) and the Dutch Trust Framework for Electronic Identification (issued under eHerkenning) in the context of by the eIDAS regulation have been published to the Official Journal of the European Union. 

These three notifications mean that holders of the Czech eID scheme, the Italian eID card (CIE) and the Dutch eHerkenning will be able to use their eID credentials to access public services in other EU Member States. This makes cross-border interactions easier and more secure for them.  

Figure 1: Status of pre-notification, peer review and notification upon
October 1st, 2019. Source: CEF Digital

The mutual recognition of eID schemes across Europe is mandated by Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market (commonly known as the eIDAS Regulation). The Regulation states that since 29 September 2018, all online public services requiring electronic identification assurance corresponding to a level of 'substantial' or 'high', must be able to accept the notified eID schemes of other EU countries. 

The notification process is composed of three steps: these three countries had previously pre-notified other EU Member States about their intention to notify a specific scheme (c.f. pre-notification article). A peer review has been organised to build trust between the EU Member States. After successful completion, the official notifications are published in the Official Journal. Member States’ public services have then 12 months to adapt their system in order to accept the newly notified eID schemes. 

Czechia, Italy and the Netherlands’ successful notification follow the notifications of 9 additional eID schemes. These are the eID Scheme FAS / eCards (Belgium), the National Identification and Authentication System (Croatia), the Estonian eID scheme, the SPID scheme (Italy), the German eID based on Extended Access Control, the Luxembourg eID card, the Cartão de Cidadão (Portugal), the Documento Nacional de Identidad electrónico (Spain) and GOV.UK Verify (the United Kingdom). A full overview of notified and pre-notified eID schemes under eIDAS can be found here.

About the new notified eID schemes

Czechia’s national eID scheme allows Czech citizens to digitally prove their identity online and access eGovernment services – such as medical prescriptions and insurance, post, taxation, pensions and many other services, including from the private sector - in two ways. As of July 2018, they can use eID cards, or alternatively with a combination of username, password, and one-time codes received on their mobile phone via SMS. There is no minimum age limit for applicants, but Czech citizens are under a legal obligation to apply for a personal eID card as from the age of 15 if they reside within the country. This scheme has been notified with a High Level of Assurance.

Italy’s Carta di Identità elettronica (CIE) allows Italian citizens to digitally prove their identity online and access a wide range of services, such as taxation, education, loans, health, and many others. The CIE is available for both Italian citizens and official residents of all ages. It is equipped with a radio frequency microprocessor that enables online authentication and protects citizens’ personal data and biometric attributes from counterfeiting. On a computer, citizens can securely authenticate with a card-reader and a PIN code; while on a NFC-enabled mobile phone, citizens can simply present their card near the phone and enter their PIN code. This scheme has been notified with a High Level of Assurance. 

Figure 4: Italy’s Carta di Identità elettronica (CIE) 

The Netherlands’ Trust Framework for Electronic Identification is a uniform set of standards, agreements and provisions for authorised access to digital services. The business domain of the Dutch eID, known as eHerkenning, is the first ever notified scheme for legal persons under eIDAS. Representatives of business or public services that have received a specific authorisation use it to access online services on behalf of their organisation and manage their transactions with the government in a totally secure manner. They can use a login token, previously acquired from a number of accredited service providers. Tokens can take the form of a name/password, texting, phone, one time password (OPT), or public key certificate. The domain for citizens, known as Idensys, is not part of the notification. 

Figure 5: eHerkenning, the Dutch eID means for businesses 

The scheme is a public-private partnership between the Ministry of the Interior and a series of accredited suppliers in charge of mean issuance, authentication provision, authorisation registration and eRecognition brokering. Accredited suppliers verify the identity of the organisation's employee and issue log-in resources. Authentication providers authenticate the persons that want to log-in to a service using eHerkenning. Authorisation registers record and maintain the list of authorisations and privileges of each users, acting under the instructions of a legal representative of the organisation. Finally, the eRecognition brokers are responsible for the interface between the eHerkenning network and the service providers. This scheme has been notified at Levels of Assurance Substantial and High.

The Connecting Europe Facility (CEF) eID Building Block primarily supports the Member States in the roll-out of the eIDAS Network (the technical infrastructure which connects national eID schemes). CEF eID is a set of services (including software, documentation, training and support) provided by the European Commission and endorsed by the Member States, which helps public administrations and private Service Providers to extend the use of their online services to citizens from other European countries.

Visit CEF eID Here

To see the full overview of pre-notified and notified eID schemes under eIDAS, Click here