L.S. 426.04 Regolamenti dwar Servizzi Fiduċjarji Elettroniċi (Proċeduri ta’ Identifikazzjoni mill-Bogħod)

(1)Any reference in these Regulations to "the Act" is a reference to the Electronic Commerce Act, and any reference to "the eIDAS Regulation" is a reference to the Regulation (EU) No. 910/ 2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/ EC. Unless stated otherwise in these Regulations the provisions of article 2 of the Act, and of Article 3 of the eIDAS Regulation shall apply in relation to these Regulations. Definitions. Cap. 426.

(2)requires: Regulation (EU) No. 910/

1. In these regulations unless the context otherwise "Authority" means the Malta Communications Authority established under the Malta Communications Authority Act; "Data Protection law" means the Data Protection Act, any regulations made thereunder and any applicable EU legislation regulating data protection including Regulation (EU) 2016/679 (General Data Protection Regulation); "identity document" means an identity card, a residence document or an identification document issued under the Identity Card and Other Identity Documents Act, or an identity card or passport issued by the pertinent authorities of a Member State of the European Union, Norway, Iceland, Liechtenstein or Switzerland; Cap.
2. Cap.
3. Cap.
4. "Malta trusted list" means the list established and maintained by the Authority in accordance with Article 22 of the eIDAS Regulation; and "video-conferencing" refers to such means of communication that consists of any form of interactive communication that allows the transmission and capture of sound, image and data in real time. 3.

(1)The purpose of these regulations is to regulate the use of remote identification procedures by means of videoconferencing by qualified trust service providers, which procedures provide equivalent assurance in terms of reliability to physical presence as referred to in Article 24

(1)(d) of the eIDAS Regulation. Purpose and application. 1 2 [ S.L. 426.04 ELECTRONIC TRUST SERVICES (REMOTE IDENTIFICATION PROCEDURES)

(2)These regulations shall only apply to qualified trust service providers authorised to provide qualified trust services in Malta as listed on the Malta Trusted List. Submission of a conformity assessment report. 4.

(1)A qualified trust service provider that intends to identify individuals through remote identification procedures in accordance with the provisions of Article 24

(1)(d) of the eIDAS Regulation, shall prior to the implementation of such procedures, submit to the Authority a conformity assessment report issued by a conformity assessment body. This report shall consist of a separate report that shall unequivocally confirm or otherwise that the qualified trust service provider concerned and the aforesaid remote identification procedures provide equivalent assurance in terms of reliability to physical presence, and meet the requirements stated in regulations 5 to 14: Provided that such a report shall in any case be distinct from the conformity assessment report confirming the operations of the qualified trust service provider concerned: Provided further that the remote identification process shall then be assessed as part of the overall qualified trust service provider operations during the scheduled conformity assessments and at minimum on a bi-yearly basis.

(2)A qualified trust service provider shall not make use of a remote identification procedure unless the Authority first approves in writing the conformity assessment report required in accordance with sub-regulation

(1): Provided that the Authority shall communicate its decision in writing giving its reasons therefor as to whether it approves or not the required conformity assessment report to the qualified trust service provider within three months from the receipt by the Authority of the aforesaid report. Risk assessment and risk management. 5.

(1)Prior to the adoption of a remote identification procedure a qualified trust service provider shall: (a) carry out and thoroughly document a risk analysis in accordance with Article 19

(1)of the eIDAS Regulation with regard to the implementation of the identification of individuals through remote identification procedures. Such risk analysis shall in particular identify: (

1. i)the risk of mistaken identification and impersonation, (
2. ii)the risks related to the presentation of falsified or counterfeited documents, and ELECTRONIC TRUST SERVICES (REMOTE IDENTIFICATION PROCEDURES) [ S.L. 426.04 (iii) the risks related to the tampering of image capturing systems or of communication channels; and (
3. b)carry out tests of the effectiveness and of the safety of the implemented remote identification method; (
4. c)carry out an internal assessment of the adequacy of the remote identification method used to mitigate the risks identified in the risk analysis: Provided that within the context of any such assessment, efficiency of identifying the aforesaid risks shall be at least equivalent to the physical presentation of the identity document.

(2)Any analysis, test or opinion however so described made under this regulation shall be recorded and logged for a minimum period of three years or any such longer period as the Authority may consider appropriate in the circumstances. 6.

(1)Remote identification methods shall only be operated by trained and fully skilled persons who are duly authorised by a qualified trust service provider to act on its behalf and to undertake any work related to such methods. Requirements relating to the personnel of a qualified trust service provider.

(2)A qualified trust service provider shall ensure that any persons who operate remote identification methods on its behalf, undertake such training as the Authority may in writing from time to time require with regards to the verification of national approved identification documents, to the identification of fraud and, or to counterfeit practices of identity evidence and, or of documents. The Authority may in this regard issue such guidelines as it may consider necessary in line with European Union and, or international standards. 7. A qualified trust service provider shall ensure that: (

1. a)remote identification is carried out by means of video-conferencing done in real time and without interruption or pause, and in a place with restricted access both physically and from a computer and, or communications network perspective; (
2. b)the remote identification session relating to the person to be identified is adequately protected with end-to-end encryption ensuring its integrity and confidentiality; (
3. c)the remote identification session is recorded in such a manner as to adequately ensure sound and colour image recording of sufficient quality to allow verification of the collected identification data: Technical and organisational requirements. 3 4 ELECTRONIC TRUST SERVICES (REMOTE IDENTIFICATION PROCEDURES) [ S.L. 426.04 Provided that such a recording shall include the date and time of the recording and the identification of the person or persons who operated and were responsible for the remote identification session, which date and time shall be synchronised to a calibrated and traceable source assessed during the scheduled conformity assessments: Provided further that the data of the remote identification session shall be recorded in such a manner as to ensure its integrity and to prevent any counterfeiting thereof; (
4. d)the means of remote identification is of adequate quality such as to allow the clear identification with a high degree of definition, of the elements and security features of the identification document of the person to be identified; (
5. e)the system used for remote identification recognises and interprets the machine-readable zone (MRZ) of the identification document; and (
6. f)it establishes and regularly updates written and documented scripts for conducting remote identification, which scripts shall be used by any person acting on its behalf in the context of any remote identification video-conferencing conducted in accordance with these regulations: Provided that such scripts shall enable the verification of identification documents and of the person to be identified in such a manner that ensures that the checks and the order of such checks cannot be predicted: Provided further that the scripts shall include the use of a single disposable code of limited duration, such as a one-time password, specifically provided for the purpose of the remote identification session, which code shall be generated centrally ensuring the traceability of the identification procedure and the provision of real time and uninterrupted videoconferencing. Such a code shall be sent to the person to be identified through a secondary channel such as by secure e-mail or by short message service (SMS). Permitted identification documents. 8.

(1)The procedure for remote identification shall be applicable only to natural persons who have an identification document which is recognised under Maltese or European Union law and which allows clear identification and verification of the photograph of the holder of the aforesaid identification document, includes the signature of the person concerned on the said document, and a minimum set of at least two security features of different categories.

(2)The qualified trust service provider shall make publicly ELECTRONIC TRUST SERVICES (REMOTE IDENTIFICATION PROCEDURES) [ S.L. 426.04 5 available a list of the identification documents it accepts for the purpose of remote identification, which list the aforesaid service provider shall submit for approval by the Authority. Any changes to the list are to be notified to the Authority in accordance with regulation 13

(1). 9.

(1)A qualified trust service provider when operating a remote identification method shall: (

1. a)check the status of the identification document used by the person to be identified, ensuring that the document is not damaged or altered in any way; (
2. b)check the overall layout of the identification document, its size, the position, spacing and size of the characters, and the typographic font: Provided that in doing so, comparison shall be made against a verification template of the document being checked; (
3. c)categories; check at least two security features of different (
4. d)require the person to be identified to tilt the document horizontally and, or vertically in front of the camera; (
5. e)check the content of the individual characteristics found in the identification document, namely the comparison of primary and secondary photographs (identigram); (
6. f)capture a front identification document; and back image of the (
7. g)verify that the photograph and the personal description in the document identify the person to be identified; (
8. h)verify the accuracy of the information contained in the identification document; (
9. i)ascertain the veracity of the information provided by the person to be identified during the remote identification session; (
10. j)use type and sequence of questions that are not identical in consecutive identification sessions; (
11. k)verify the consistency of the information collected about the person to be identified and the information resulting from the automatic calculation of machine-readable zone (MRZ) characters; and Requirements to be observed during remote identification. 6 [ S.L. 426.04 ELECTRONIC TRUST SERVICES (REMOTE IDENTIFICATION PROCEDURES) (
12. l)ask the person to be identified to do one or more causal acts so as to demonstrate the authenticity of the remote identification process.

(2)The procedure for proving identification shall only be considered to be complete after the insertion by the person identified of the single code such as a one-time password, and of the respective confirmation of that unique code by the remote identification methods used.

(3)An identification document provided for the purposes of these regulations, must include a recent and recognizable photograph of the person concerned, his signature and must be issued by a competent public authority duly authorised to issue such a document. Interruption of identification procedure. 10. A remote identification session shall be interrupted and considered as null and void and without any effect at law if: (

1. a)the technical conditions necessary for the proper conduct of the remote identification are not adhered to, especially in the case of, but not limited to, poor picture quality, poor lighting, poor sound or interruptions or delays in the remote identification session or video transmission; (
2. b)the identification document presented during the remote identification session, gives rise to any doubt as to its content, authenticity, timeliness, accuracy or adequacy; or (
3. c)during a remote identification session there is any doubt as to the veracity of any of the identification elements. Declaration. 11.

(1)Prior to a remote identification session, the qualified trust service provider shall capture any photograph and any other identification document that shall be recorded throughout the entire remote identification session in relation to the identified individual: Provided that in accordance with this regulation, the remote identification session shall be logged by the qualified trust service provider.

(2)Prior to the commencement of a remote identification session the qualified trust service provider shall provide the person to be identified with all the necessary information about the processing of his personal data, and then shall require such a person to sign a declaration that he is aware of the use that may be made of his photograph and, or any other identification document that may be required of him in order to facilitate any such session. Retention and recording. 12. The qualified trust service provider shall ensure that the entire remote identification session is recorded and that the recording ELECTRONIC TRUST SERVICES (REMOTE IDENTIFICATION PROCEDURES) [ S.L. 426.04 thereof is kept for a minimum period of three years after the expiry of the qualified certificate issued as a result of a session in accordance with Article 24

(2)(h) of the eIDAS Regulation. 13.

(1)A qualified trust service provider shall in writing notify the Authority of any change in the implementation of the remote identification procedures covered by the conformity assessment report referred to in regulation 4: Changes to the remote identification procedures. Provided that any such change shall be notified to the Authority at least sixty days prior to the proposed implementation of such changes by the qualified trust service provider.

(2)Any changes to the remote identification procedures shall not be implemented unless first approved in writing by the Authority.

(3)The Authority may, on being notified of any change to the remote identification procedure, require the qualified trust service provider to request a conformity assessment body to perform and provide a conformity assessment report of the changes to the remote identification procedures to confirm or otherwise that the changes are in compliance with the provisions of these regulations: Provided that if the Authority requires conformity assessment report then the provisions of regulation 4 shall apply: Provided further any expenses related to any such report shall be borne by the qualified trust service provider. 14. The qualified trust service provider shall ensure that any personal data is processed in accordance with data protection law. Compliance with data protection law. 15.

(1)Without prejudice to its powers under the Malta Communications Authority Act, the Authority shall have the power to inspect and, or require any information from any person about any remote identification procedures carried out under these regulations: Enforcement powers of the Authority. Cap. 418. Provided that the Authority may also require that the qualified trust service provider at its expense requests a conformity assessment body to perform a conformity assessment of its remote identification procedures.

(2)The Authority may at any time require any person to desist forthwith from the continued use of any remote identification methods in accordance with these regulations, if the Authority considers that there may be non-compliance with any of the provisions of these regulations: Provided that in doing so the Authority shall in writing state its reasons for doing so, which reasons shall be communicated to 7 8 [ S.L. 426.04 ELECTRONIC TRUST SERVICES (REMOTE IDENTIFICATION PROCEDURES) the person concerned. Non-compliance with these regulations. Cap.

2. The Authority may, in accordance with its powers under Part VII of the Malta Communications Authority Act, impose such sanctions as it may consider appropriate for any breach of these regulations: Provided that any administrative fines that the Authority may decide to impose shall not exceed the amount of twenty-five thousand euro (€25,000) for each breach and two thousand five hundred euro (€2,500) for each day during which failure to observe the provisions of these regulations persists. Fees due on submission of a conformity assessment report.
3. A qualified trust service provider who, in accordance with regulation 4, wishes to provide remote identification procedures, shall when submitting to the Authority a conformity assessment report issued by a conformity assessment body as required under the aforesaid regulation 4, pay to the Authority a one-off fee of two thousand euro (€2,000).