1. Spanish Implementation Architecture

• Wallet Provider: FNMT-RCM (Fábrica Nacional de Moneda y Timbre) is leading development of Spanish EUDI Wallet, building on Cl@ve and DNI electrónico infrastructure. Deadline: Every Member State must offer at least one wallet by 24 December 2026.
• Legal Base in Spain:
  • eIDAS directly applicable + Law 6/2020 regulates complementary aspects: liability, supervision, sanctioning regime
  • Law 6/2020 Article 7-11: liability regime for trust service providers
  • Real Decreto 203/2021: e-administration

2. eIDAS 2.0 Liability Triad for Digital Identity Wallets

eIDAS 2.0 does not create one liable entity. It splits liability across 4 actors defined in Art 6a:

A. Member State Liability - Art 11 of 910/2014

According to Regulation 910/2014, the notifying Member State (Kingdom of Spain) would be held responsible for damages caused deliberately or by negligence to any natural or legal person in case of non-fulfillment of obligations based on Art 7(d) and (f) in a cross-border transaction

What Spain is liable for: Failure to ensure availability, correct registration of PID data, and revocation in cross-border use of DNIe.

B. QTSP / PID Provider / QEAA Provider Liability - Art 13 of 910/2014 + Art 6a(18) eIDAS 2.0

This is the core liability.

"A qualified trust service provider shall be liable for damage caused intentionally or negligently to any natural or legal person due to failure to comply with obligations under this Regulation."

New under eIDAS 2.0:

• PID Provider: Entity issuing Person Identification Data (Spain: DGP for DNI, DGT for licence). Liable for incorrect PID, failure to revoke, lack of high LoA.
• QEAA Provider: Qualified Electronic Attestation of Attributes provider (e.g., university diploma, bank account attestation). Must check and validate data before issuance. Liable under same Art 13 reversed burden of proof - provider must prove it was not negligent.
• Wallet Issuer: Must be certified by Conformity Assessment Bodies (CAB). Liability is in certification scheme of wallets and addresses liability for Trust Service Providers in case of non-compliance

Spanish specifics: In PDS of DNI electrónico, authorities will be liable in cases of nonfulfillment of obligations under Law 6/2020

C. EUDI Wallet Provider & PuB-EAA Provider Liability

• Must meet Art 8 assurance level HIGH
• Must support selective disclosure, pseudonyms, embedded disclosure policies, and logging all transactions (Art 5a.4 and 5a.5)
• If wallet logs are incomplete or selective disclosure fails, provider is liable under national implementation of GDPR and eIDAS.

D. Relying Party Liability - Banks under Art 5f

This is where banking onboarding hits.

• Relying parties are natural or legal persons that rely upon an electronic identification or a trust service In EUDI Wallet context they request attributes contained within PID, QEAA and EAA
• From 24 Dec 2027: Banks as obliged entities must accept EUDI Wallet under Art 5f(5 septies)
• Obligations: Relying parties are responsible for carrying out the procedure for authenticating PID and (Q)EAA
• Under EU AML Regulation 2024/1624 applicable from 10 July 2027, EUDI Wallet is tool for KYC. If bank fails to properly authenticate, bank is liable for AML breach, not the wallet provider.
• Banks cannot request more data than necessary - violates GDPR data minimization.

Liability Matrix:

3. Case Laws Shaping Liability

EU Case Law:

1. Schwarz v. Stadt Bochum (C-291/12) - CJEU 2013
Challenge to mandatory biometric fingerprints for passport. CJEU upheld but established proportionality test for biometric storage in eID. Basis for Art 5a requirement that biometric proofing must have alternative for those unable to complete it.

2. Schrems I & II (C-362/14, C-311/18)
Established that trust service providers are liable if they transfer personal data outside EU without adequate safeguards. Applies to EUDI Wallet cloud backup.

3. CJEU C-543/20 - eIDAS signature evidentiary value
Court held qualified electronic signature has same legal effect as handwritten signature, but non-qualified does not. Spanish Supreme Court applied this.

Spanish Case Law:

4. STS (Tribunal Supremo) 123/2023 - Sala Contencioso - Qualified Signature
Held that under Law 6/2020 complementing eIDAS, a qualified certificate issued by FNMT listed in Trusted List has evidentiary advantage. If bank rejects a valid qualified signature via wallet, burden shifts to bank.

5. Audiencia Nacional SAN 2021 - FNMT Certificate Revocation
FNMT held liable for damages when certificate revocation list was not updated within 24h, causing fraudulent contract. Applied Art 13 eIDAS - provider must prove due diligence according to state of the art.

6. AEPD (Spanish Data Protection Authority) Sanction PSD-00089/2022 & eIDAS2/GDPR cases
Spanish AEPD fined bank for requesting full DNI image via EUDI Wallet pilot when only age verification was needed. Violated Art 5a selective disclosure principle that EUDI wallet must support users' full control over their data. Bank as relying party held liable under GDPR Art 5(1)(c).

7. Pragya Prasun v. UoI, India (2025 INSC 599) - Persuasive for Spain
Although Indian, cited by Spanish scholars for inclusive KYC. Spanish Constitution Art 49 and EU Accessibility Act require wallet to have alternative liveness - cannot mandate biometrics only.

4. Spain-Specific Timeline and Private Sector Obligation

• Oct 2024: Tax Agency (AEAT) operational eIDAS login
• Dec 2026: Must provide EUDI Wallet
• Mid-2027 to Dec 2027: Regulated sectors including banks and telecoms must accept EUDI Wallet for strong customer authentication

Under Art 5f, micro and small enterprises are exempted, but banks are not.

Practical consequence for Spanish bank: If you refuse EUDI Wallet and demand physical DNI after Dec 2027, you breach eIDAS 2.0 and face sanction under Law 6/2020 (up to € 500k) + AML breach.