Regulations Regarding the Technical and Organisational Requirements for the Electronic Service Provider

Issued pursuant to
Section 19, Paragraph three of the Law
on Electronic Identification of Natural Persons

1. The Regulation prescribes the technical and organisational requirements with which the electronic service provider must comply upon receiving the qualified or qualified increased security electronic identification service.

2. The electronic service provider shall ensure that a natural person, prior to identification for an electronic service, has access to the information regarding the level of credibility - qualified or qualified increased security - of the means of electronic identification and the extent to which the respective electronic service can be received.

3. The indication regarding the level of credibility of the means of electronic identification shall be clearly visible and legible.

4. The electronic service provider shall report to the supervisory body if the availability of authentication ensured by the qualified or qualified increased security electronic identification service provider in a calendar month is less than:

4.1. 99.5 % during working days from 9.00 to 18.00 in the time zone of Latvia;

4.2. 97 % during the time which is not referred to in Sub-paragraph 4.1 of this Regulation.

5. The electronic service provider shall ensure that:

5.1. the electronic service provision systems have been synchronised with a credible source of accurate time;

5.2. the permitted duration of standstill is specified.

6. The electronic service provider shall retain the following information regarding unsuccessful authentication attempts:

6.1. if possible, an indication as to whether the qualified or qualified increased security electronic identification service has been used;

6.2. if possible, information regarding the natural person who made an unsuccessful authentication attempt;

6.3. the time and date of authentication;

6.4. the Internet Protocol address from which the unsuccessful authentication attempt was made;

6.5. the name of the browser and the version identification data;

6.6. the name of the electronic service for which the natural person made an unsuccessful authentication attempt;

6.7. the session identifier.

7. Upon a request of the qualified or qualified increased security electronic identification service provider, the electronic service provider shall issue the information referred to in Paragraph 6 of this Regulation thereto, insofar as it does not contain personal data.

8. The electronic service provider shall ensure that the natural person has access to the contact details of the qualified and qualified increased security electronic identification service provider.

9. If the electronic service provider uses the shared solution for the identification of a person of the State information system integrator under supervision of the State Regional Development Agency, then the contact details referred to in Paragraph 8 of this Regulation shall be ensured to the natural person by the manager of the State information system integrator.

10. This Regulation shall come into force on 1 January 2018.

Prime Minister Māris Kučinskis

Minister for Defence Raimonds Bergmanis

Translation © 2018 Valsts valodas centrs (State Language Centre)