Blogs

Draft principles and guidance on eID interoperability for online platforms – share your views!

  • Andrea SERVIDA profile
    Andrea SERVIDA
    5 October 2017 - updated 3 years ago
  • 2 comments
    Total votes: 9

A few months ago, we launched a discussion with all interested stakeholders on how online platforms and their users could make use of the opportunities provided by the government issued/recognised eID means.

This work was initiated in the context of the Communication on Online Platforms and the Digital Single Market which states that the Commission will further promote interoperability actions, including through issuing principles and guidance on eID interoperability at the latest by 2017.

As a first key step, on 24 April 2017, the Commission organised a dedicated workshop gathering representatives of online platforms, consumer and business organisations, individual businesses, digital identity providers, Member State authorities, academia and think tanks, etc. We exchanged views and ideas on the key issues that need to be address. During the workshop the participants also agreed on the way ahead towards finalising and validating a set of principles in an open and inclusive way.

Since then, we have seen substantial progress in the area of eID. On 26 September 2017, a key milestone was accomplished with Germany becoming the first EU country to complete the formal notification of its eID scheme. During the coming months we will see other European Member States doing the same, which means that their citizens and businesses will be able to use their own national eIDs to access online services in other EU countries. This opens up opportunities for the companies and their users, which should not be missed.

The goal of the principles and guidance is to allow and facilitate online platforms users, if they wish so, to rely on their own government-issued/recognised eID means whenever the access to online platforms may require electronic identification or authentication steps. In this regard, the principles and guidance aim to reflect values that everybody (users and online platform providers) can subscribe to as well as a shared understanding of how everybody can interact and exploit the benefits of the eID framework in the online platform ecosystem in the future.

The draft principles and guidance that we share with you today, build on the ideas collected during the workshop, as well as on further feedback received from stakeholders who volunteered to support the drafting process.

The final text of the principles and guidance will be a result of a participatory and co-creation process involving all relevant stakeholders and supported by the Commission. The overall ambition of this initiative is that, once finalised, the principles and guidance will be endorsed by as many stakeholders, representing various positions, as possible – in particular online platform operators, organisations representing individual and business users, digital identity providers, etc.

What will be the next steps?

  • The current draft principles and guidelines are shared for an open discussion with all of you.

  • The Commission will consolidate the inputs, embracing the views and contributions received from stakeholders.

  • This new draft will be validated in a Workshop on 29 November 2017.

  • The final version of the principles will be made public and with an invitation to stakeholders to officially endorse it.

We would like to hear from everyone interested in this topic! Are the current principles and guidance relevant for you? Do they reflect values that we can all subscribe to? Are they comprehensive? Can you propose other ideas for enriching them?

Share your views by posting a comment here or by sending a message to CNECT-EGOVERNMENT-AND-TRUST@ec.europa.eu before 10 November 2017.

Tags: 
eIDeIDASonline platforms

Comments

Log in to post comments
Nathalie LAUNAY's picture
Nathalie LAUNAY,
06/11/2017 11:11

 

You will find here attached my document and 19 recommendations for a a secure and privacy compliant interoperability framework of private on line platforms with NeiD means.

https://pdf.lu/bs8v/

 

Nathalie LAUNAY

Total votes: 0
Denis PINKAS's picture
Denis PINKAS,
10/10/2017 10:47

The draft document includes a few nice principles related to Privacy, User consent and control and Proportionality.

Privacy

Online platform users should be able to rely upon trusted identification and authentication mechanisms of their choice, which provide them with the desired level of privacy.

User consent and control

Users should be able to exercise control over the data which are being exchanged for the purposes of identification/authentication and to selectively disclose only those attributes that are required for a particular transaction.

Proportionality

The request for personal information by online platform operators to the eID service should be minimal, proportionate and contain only the information relevant to the particular transaction.

The reality is that none of the above principles can be met when following the "Commission Implementing Regulation (EU) 2015/1501 of 8 September 2015 on the interoperability framework pursuant to Article 12(8) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market", since its Annex contains a set of "requirements concerning the minimum set of person identification data uniquely representing a natural or a legal person, referred to in Article 11":

1. The minimum data set for a natural person

The minimum data set for a natural person shall contain all of the following mandatory attributes:

(a) current family name(s);

(b) current first name(s);

(c) date of birth;

(d) a unique identifier constructed by the sending Member State in accordance with the technical specifications for the purposes of cross-border identification and which is as persistent as possible in time.

The minimum data set for a natural person may contain one or more of the following additional attributes:

(a) first name(s) and family name(s) at birth;

(b) place of birth;

(c) current address;

(d) gender.

This means that users using authentication means compliant with the eIDAS Regulation and its Implementing Acts will be unable to choose their desired level of privacy, nor to selectively disclose only those attributes that are required for a particular transaction. As a consequence, the request for personal information by online platform operators to the eID service cannot be "minimal and proportionate".

The draft document states:

Users should be able to preserve a level of privacy and anonymity, e.g. by using a pseudonym (already guaranteed under eIDAS  –  ref. to art 5.2).

This sentence is not really true, ... but every user would like it to be true.

Article 5.2 from the eIDAS Regulation states:

2. Without prejudice to the legal effect given to pseudonyms under national law, the use of pseudonyms in electronic transactions shall not be prohibited.

Recital 58 from the eIDAS Regulation states:

58) When a transaction requires a qualified electronic seal from a legal person, a qualified electronic signature from the authorised representative of the legal person should be equally acceptable.

Pseudonyms are indeed allowed, but only within the context of qualified electronic seals or of qualified electronic signatures, but in practice are not allowed in the context of electronic identification, since the "Commission Implementing Regulation (EU) 2015/1501 of 8 September 2015 is using nowhere in it the word "pseudonym".

If they wish to do so, users should be able to use a pseudonym that is different for every on line service (otherwise these on line services would be able to link their user accounts).

In addition to this major point, while the eIDAS Regulation is only applicable to services provided on line by "public sector bodies", the aim of this document is to make it also applicable to services provided on line by "private sector bodies". This is apparent through the use of the wording "online platforms" which does not discriminate between the public sector and the private sector.

Since the Implementing Act mandates the use of a set of attributes that allows to identify the user using his current family name(s), current first name(s), date of birth and a unique identifier, online platforms (whether they are in the public or private sector) will be able to correlate very easily all their user accounts and hence will be able link information they have about their users.

Finally, these principles only apply to "online platforms" and are thus ignoring eIDAS nodes. eIDAS nodes are able to monitor all the connections done by a user to a service handled by a public sector body. If this guidance was to be followed, eIDAS nodes will be able to monitor all the connections done by a user to any on line service in another EU country, whether it is managed by a public sector body or by a private sector body.

In addition, some national schemes are able to monitor all the connections done by a user to any service handled by a public sector body.

Most of the readers of this document are not aware of these important matters. The current draft document is giving a false sense of privacy.

Writing statements like "Online platform operators should or should not..." is nice but is insufficient. There is the need to have a system where online platform operators are prevented, by design, to do this or that.

If this document were to be progressed in the current direction, users would end up using an interoperability framework able to act as "Big Brother" for all their accesses (whether they are for online platforms in the public sector or in the private sector) without even being aware of it. It is time to inform users what the current reality is in terms of privacy.

It is very late (but better late than never) to start working on an interoperability framework effectively able to fulfill five privacy principles: the three principles related to "Privacy", "User consent and control" and "Proportionality" but also two additional privacy principles:

  • Unlinkability: to prevent the linkability of transactions of a user among distinct servers.
  • Untraceability: to prevent Identity Providers (IdPs) to know which servers are being accessed by their users.

The "Commission Implementing Regulation (EU) 2015/1501 of 8 September 2015 was supposed to apply to the "interoperability framework pursuant to Article 12 of the eIDAS Regulation" as Article 12 of the eIDAS Regulation states:

3 The interoperability framework shall meet the following criteria:

(...)

(c) it facilitates the implementation of the principle of privacy by design;

Instead of facilitating the implementation of the principle of privacy by design, the reality is that "Commission Implementing Regulation (EU) 2015/1501 of 8 September 2015 prevents "the implementation of the principle of privacy by design".

As it would be rather difficult to remove now item (c) of Article 12 from the eIDAS Regulation, this Implementing Act shall be made compliant with item (c) of Article 12 of the eIDAS Regulation, which means that it shall be amended and re-issued.

Denis PINKAS

President of DP Security Consulting SAS. France

Total votes: 4