Online connectivity that requires people to authenticate back to the servers to make sure it is a legitimate licence is one of the things we are doing.

(b) data authentication equipment that calculates a Message Authentication Code (MAC) or similar result to ensure that no alteration of text has taken place or to authenticate users, but that does not allow for encryption of data, text or other media, other than that needed for the authentication; and

(ii) data authentication equipment that calculates a Message Authentication Code (MAC) or similar result to ensure that no alteration of text has taken place or to authenticate users, but that does not allow for encryption of data, text or other media other than that needed for the authentication, and

22. ‘strong customer authentication’ means a procedure to verify the validity of a payment instrument based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others and is designed in such a way as to protect the confidentiality of the authentication data.

22. ‘strong customer authentication’ means a procedure to verify the validity of a payment instrument based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others and is designed in such a way as to protect the confidentiality of the authentication data.

55. Recalls that while the final responsibility for security measures relating to different payment methods cannot lie with customers, they should be informed about security precautions, and financial institutions should be responsible for fraud costs, unless caused by the customer ‘by acting fraudulently or by failing to fulfil one or more of his obligations under Article 56 of the Payment Service Directive with intent or gross negligence’; considers, therefore, that public information campaigns should be encouraged with a view to increasing public awareness and knowledge of digital security issues in particular; calls on the Commissi ...[+++]on, when developing a strategy and instruments for the integration of payment markets by card, internet and mobile phone, to take into account the standards and recommendations of EDPS regarding transparency, identification of the controller/ processor, proportionality and rights of the data subject; considers it important that all payment frauds in SEPA are reported to a centralised site for monitoring, statistics and evaluation, in order to respond quickly to new security threats, and that the main developments should be made public; asks the Commission to extend the concept of privacy by design beyond authentication mechanisms and security safeguards so as to ensure data minimisation, to implement privacy by default settings, to limit the access to individual's information to what is strictly needed to provide the service,- and to implement tools enabling users to better protect their personal data;