{
  "url": "https://openlegislation.uk/eu-directive-1999-37/annex-II/division-III/division-III.2",
  "json_url": "https://openlegislation.uk/eu-directive-1999-37/annex-II/division-III/division-III.2.json",
  "legislation": "eudr/1999/37",
  "legislation_title": "Council Directive 1999/37/EC of 29 April 1999 on the registration documents for vehicles",
  "legislation_url": "https://openlegislation.uk/eu-directive-1999-37",
  "path": "annex/II/division/III/division/III.2",
  "kind": "division",
  "number": "III.2",
  "heading": "Data storage and protection",
  "text": "Preceded by the harmonised common codes (where appropriate, in connection with the individual codes of the Member States according to Chapter II.7), the following data shall or may be additionally stored on the card surface bearing the legible information as per Chapter III.1:\n(A) Data as per Chapters II.4 and II.5\nAll data specified in Chapters II.4 and II.5 shall be mandatorily stored on the card.\n(B) Other data as per Chapter II.6\nMoreover, the Member States are free to store more data as per Chapter II.6, to the necessary extent.\n(C) Other data as per Chapter II.7\nOptionally, further vehicle-related data of general interest may be stored on the card.\nThe data from the Letters A and B is stored in two corresponding files with transparent structure (see ISO/IEC 7816-4). The Member States may specify the storage of data from Letter C according their requirements.\nThere are no read restrictions on these files.\nWrite access to these files shall be restricted to the national competent authorities (and their authorised Agencies) in the Member State issuing the smart card.\nWrite access is permitted only after an asymmetric authentication with session key exchange for protecting the session between the vehicle registration card and a Security Module (e.g. a Security Module Card) of the national competent authorities (or their authorised Agencies). Thereby Card Verifiable certificates according to ISO/IEC 7816-8 are exchanged before the authentication process. The Card Verifiable certificates contain the corresponding public keys to be retrieved and to be used in the following authentication process. These certificates are signed by the national competent authorities and contain an authorisation object (certificate holder authorisation) according to ISO/IEC 7816-9 in order to encode role specific authorisation to the card. This role authorisation is related to the national competent authority (e.g. to update a data field).\nThe corresponding public keys of the national competent authority are stored as trust anchor (root public key) in the card.\nThe specification of the files and commands needed for the authentication process and the writing process is under responsibility of the Member States. The security assurance has to be approved by Common Criteria Evaluation according to EAL4+. The augmentations are as follows: 1. AVA_MSU.3 Analysis and testing for insecure states; 2. AVA_VLA.4 Highly resistant.\n(D) Verification data for authenticity of registration data\nThe issuing authority calculates its electronic signature about the complete data of a file containing the data of the Letter A or B and stores it in a related file. These signatures allow the authenticity of the stored data to be verified. The cards shall store the following data:\nelectronic signature of registration data related to Letter A,\nelectronic signature of registration data related to Letter B.\nFor verification of these electronic signatures the card shall store:\ncertificates of the issuing authority calculating the signatures about the data of Letters A, B.\nElectronic signatures and the certificates shall be readable without restriction. Write access to electronic signatures and certificates shall be restricted to the national competent authorities.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Substituted by Commission Directive 2003/127/EC of 23 December 2003 amending Council Directive 1999/37/EC on the registration documents for vehicles (Text with EEA relevance)."
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudr/1999/37/annex/II/division/III/division/III.2",
    "retrieved_at": "2026-11-01T15:23:04.829702+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}