S.L. 426.4 Art. 7Technical and organisational requirements.

A qualified trust service provider shall ensure that:

(a) remote identification is carried out by means of video-conferencing done in real time and without interruption or pause, and in a place with restricted access both physically and from a computer and, or communications network perspective;

(b) the remote identification session relating to the person to be identified is adequately protected with end-to-end encryption ensuring its integrity and confidentiality;

(c) the remote identification session is recorded in such a manner as to adequately ensure sound and colour image recording of sufficient quality to allow verification of the collected identification data: IDENTIFICATION PROCEDURES)

Provided that such a recording shall include the date and time of the recording and the identification of the person or persons who operated and were responsible for the remote identification session, which date and time shall be synchronised to a calibrated and traceable source assessed during the scheduled conformity assessments:

Provided further that the data of the remote identification session shall be recorded in such a manner as to ensure its integrity and to prevent any counterfeiting thereof;

(d) the means of remote identification is of adequate quality such as to allow the clear identification with a high degree of definition, of the elements and security features of the identification document of the person to be identified;

(e) the system used for remote identification recognises and interprets the machine-readable zone (MRZ) of the identification document; and

(f) it establishes and regularly updates written and documented scripts for conducting remote identification, which scripts shall be used by any person acting on its behalf in the context of any remote identification video-conferencing conducted in accordance with these regulations:

Provided that such scripts shall enable the verification of identification documents and of the person to be identified in such a manner that ensures that the checks and the order of such checks cannot be predicted:

Provided further that the scripts shall include the use of a single disposable code of limited duration, such as a one-time password, specifically provided for the purpose of the remote identification session, which code shall be generated centrally ensuring the traceability of the identification procedure and the provision of real time and uninterrupted video-conferencing. Such a code shall be sent to the person to be identified through a secondary channel such as by secure e-mail or by short message service (SMS).