The European Commission invited feedback from civil society and data protection experts on the current version of the Architecture Reference Framework (ARF). We draw on our work with EU institutions throughout the whole eIDAS legislative process. Our submission approaches the ARF from a legal perspective with the goal to uphold privacy safeguards enshrined in the law.
In essence, we see severe shortcomings of the ARF that either contradict the regulation or ignore
important elements of it. The focus of this analysis is towards user rights and risk mitigation.
Sometimes the ARF invents requirements that are not in the regulation. In other instances, simplistic
approaches ignore important legal provisions that leave the user exposed to risks the legislator has
dealt with.
The European Commission invited feedback from civil society and data protection experts on the current version of the Architecture Reference Framework (ARF). We draw on our work with EU institutions throughout the whole eIDAS legislative process. Our submission approaches the ARF from a legal perspective with the goal to uphold privacy safeguards enshrined in the law.
In essence, we see severe shortcomings of the ARF that either contradict the regulation or ignore important elements of it. The focus of this analysis is towards user rights and risk mitigation. Sometimes the ARF invents requirements that are not in the regulation. In other instances, simplistic approaches ignore important legal provisions that leave the user exposed to risks the legislator has dealt with.
The submission on behalf of epicenter.works is publicly available here: https://epicenter.works/en/content/eidas-arf-14
We welcome further discussion and hope our recommendations are taken into account.