Decision for the approval of the Norms on the regulation, recognition, approval or acceptance of the procedure for the remote identification of persons via video means
Decision no. 564 / 11 November 2021 issued by the Authority for the Digitization of Romania (the “Authority”) approving the norms on the regulation, recognition, approval or acceptance of the procedure for the remote identification of persons via video means (the “Norms“), was published with the Official Gazette on 24 November 2021 and entered into force on 24 December 2021.
The Norms were set forth in order to allow remote identification activities via video means, in the light of the provisions of EU Regulation no. 910/2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93 / EC (the eIDAS Regulation).
The main topics covered by the Norms are: (i) the legal framework for the remote identification of persons via video means in their interaction with public institutions and private entities, (ii) the related technical requirements and (iii) the obligations and responsibilities of entities participating in the identification.
In order to use video means for the remote identification of clients, the payment service providers, the credit institutions and the non-banking financial institutions, must file a notice with the Authority, together with documents such as:
- a) the description of the technical solution and the equipment used in the process of remote identification via video means;
- b) an audit report confirming the compliance with the requirements set out in the Norms;
- c) a third-party civil liability insurance policy, for an amount of 100,000 euros;
- d) the legal representative’s statement that the payment service provider has implemented policies and procedures with respect to identification and decrease of the risk associated with the means of identification, including qualified personnel, according to the provisions of the Law no. 129/2019 on the prevention and combating of money laundering and terrorism financing;
- e) the list of the standards recommended by ETSI and the European Commission, if they were defined at European Union level, pursuant to which the video identification is carried out;
- f) the legal representative’s statement indicating that the provider has implemented procedures regarding the personal data protection in the process of remote identification via video means, in compliance with the applicable legislation.
Within 30 days as of the submission of the full documentation, the Authority must issue an approval allowing the service providers registered in Romania to carry out the remote identification of persons via video means.
The remote identification of persons via video means is carried out using a system and it requires both identity documents, which are captured using video means, and data obtained from trustworthy and independent sources, to the extent that such are available. The remote identification of persons via video means may be carried out by automated verification means, without a human operator, or by verification means using an instructed human operator.
The services of third parties may also be used in the process of remote identification via video means. The list of third parties that may remotely identify persons via video means will be managed by the Authority and published on its Internet page.
Throughout the remote identification process, it is mandatory to use an additional authentication factor by sending a one-time-password (OTP) to the user or by sending a link with a limited duration, especially created for that purpose, individually generated (by e-mail or SMS). The remote identification procedure may only be finalized if the transmission and the validation of the OTP were finalized or only if the transmission and the access of the link were finalized.
The entire process of remote identification of persons via video, in all its stages, must be recorded and kept.
The providers of services for remote identification of persons via video means are required to comply with the requirement provided by the Norms within 240 days as of the date the Norms were published with the Official Gazette of Romania (namely 24 November 2021).
***
If you are interested in receiving further information on this topic, please do not hesitate to contact us. You can also find this legal update in the News section of our website: www.leroylaw.ro
DISCLAIMER: This free electronic publication is edited by the law firm Leroy şi Asociaţii and is intended to provide non-exhaustive, general legal information. This publication should not be construed as providing legal advice. The addressee is solely liable for any use of the information contained herein. Leroy şi Asociaţii shall not be held responsible for any damages, direct, indirect or otherwise, arising from the use of this information
