The Electronic Signature Issue

1. EESSI Open Seminar Electronic Signature Standardization Paris – 11-12 May 2000 The Electronic Signature Issue A legal view jos.dumortier@law.kuleuven.ac.be http://www.law.kuleuven.ac.be/icri

2. Once there were ... • ... only hand-written signatures • without any legal definition • conditions are set on a case-by-case basis • “signature” doesn’t have the same meaning in every jurisdiction • value of a “signature” depends very often from the context • ... • ... and no standardization at all

3. Unregulated? Not standardized? How can we work with concepts that are not defined and not standardized?

4. Unregulated? Not standardized? How can we work with concepts that are not defined and not standardized? We simply refer to (“common”, “business”, “good”, “fair”, ... ) practices

5. But with modern information technology ... • ... came the need for “electronic” alternatives for hand-written signatures • and people started to use therefore a technique called “digital signatures”

6. ... and came specific legislation • Germany: “we need to explain in rules how digital signatures can be used as a secure alternative for hand-written signatures” • Italy: “from now on, if people use digital signatures according to our rules, it will have the same value as hand-written signatures”

7. Result: what about Europe? • what if every Member State starts to develop its own rules in this area? • don’t we need to harmonize this? • let’s make a draft directive ...

8. Copenhagen Hearing 1998 • “legal recognition of digital signatures is not a matter of one law but of progressive efforts to adapt rules in every area to the digital way of processing information” • “avoid to stifle innovation by describing a priori the only possible electronic alternative for hand-written signatures”

9. digital signatures electronic signatures Do not confuse electronic signatures produced with digital signature tool

10. Standards, not legislation • in 1998 many people asked for standards to launch the market • but many other people said: “there are already too many standards” • “let’s write down how you can make secure electronic signatures” • but only voluntary standards, no binding legislation (much too early)

11. A European Directive? • yes, but we will keep it “technology-neutral” (keep open the door for new things) • our first goal is to keep the internal market intact (one single European e-signatures market) • and we should force the member states to legally recognize e-signatures (what they already did, but anyway...)

12. First goal: internal market • “a community framework for electronic signatures” • example: ChamberSign • association of national chambers of commerce • wants to provide “ChamberSign” certificate services throughout the EU • impossible without some form of “standardization”(where will they get “their” standard from? probably it will be a “higher” standard than simply “qualified”)

13. What kind of standards ... • what kind of standards do you need to make cross-border e-signature services possible? • basically you need a European-wide consensus on how to make secure electronic signatures(variety of models and levels are possible here) • ... and then hope that the market will follow and develop useful applications on the basis of this consensus

14. But there was a second goal ... • the European directive wanted also “legal recognition” for e-signatures • describe how secure e-signatures have to be before they can be considered as equivalent to hand-written signatures

15. Double task for standardization • achieve a European-wide consensus on how to make secure electronic signatures and then hope that the market will follow and develop useful applications on the basis of this consensus (market objective) • describe from which security level e-signatures have always to be considered as equivalent to hand-written signatures (legal objective)

16. Double task for standardization • achieve a European-wide consensus on how to make secure electronic signatures and then hope that the market will follow and develop useful applications on the basis of this consensus (market objective) • describe from which security level e-signatures have always to be considered as equivalent to hand-written signatures (legal objective) [let’s hope that the two objectives don’t conflict too much]

17. The problem is also: is it at all possible to describe an electronic signature that will beconsidered “legal” ?

18. What is exactly in art. 5.1? • in relation to electronic data, a qualified electronic signature should satisfy the legal requirements of a signature ... • ... in the same manner as a hand-written signature satisfies those requirements in relation to paper-based data

19. More clearly • if a legal rule says that a paper document needs a signature • and if the legal rule accepts to use an electronic document instead of paper • then, the qualified electronic signature will be “the signature”. (of course the law can continue to require paperand refuse electronic documents)

20. What makes it so difficult? • describe the requirements of a signature in a paper-based environment • ... and then transpose them to an electronic environment • but there are so many different situations and related requirements for hand-written signatures (and this will, without any doubt, also be true for e-signatures)

21. Standards in the E-Signature Directive – Art. 5.1 • development of detailed technical rules on how qualified e-signatures have to be made • these rules become part of the common legal framework (we are transposing the directive) • this is “co-regulation” (use standardization channels to further develop legal framework)

22. Question • what will be the effective role of “qualified” e-signatures in the laws of the Member States? • there will be conflicts (and case law) about various kinds of e-signatures • laws will be enacted with various security requirements with regard to authentication, etc.

23. Recommendations • the aim of standardization should be to push the market forward • standards should remain voluntary and flexible • it is probably unwise to integrate standards into the legal framework at a very early stage

24. EESSI • will certainly help the Member States to transpose the directive correctly from a legal point of view • more important: it is part of the overall standardization effort in the area of electronic signatures (benefits of standardization process “as such”)

25. EESSI • are we working in the right direction? • perhaps ... • the market will provide the answer • can we anticipate this?