European Union data protection.

 

The U.S. is undoubtedly one of the world's greatest centers for business and law, but when it comes to adopting new enterprise technology, the country tends to wait and see what happens with friends across the pond in Europe. That is fine with us!

If you do any business in Europe, you may be somewhat aware that digital signatures are quickly becoming the norm here, and not just for legal matters per se. Banking and finance has caught onto them and in fact, as of this year in France all public tenders and contracts are required to be signed using qualified electronic signatures and seals. In the UK, last year the Land Registry announced a new dawn of “digital mortgages” by moving mortgage processing online.

Times are indeed changing and given the current adoption pace and anticipated legislative updates, I expect that what are known as qualified digital signatures and seals will overtake “wet signatures” as the main means of signing by next year throughout Europe. Because of this, U.S.-based attorneys collaborating with European colleagues, or working with EU-based customers, need to understand these laws. I will explain qualified digital signatures and seals in greater detail a bit later in this piece. But first, let's explore the increasing reliance on digital signatures in Europe.

Digital Signatures in Europe: The Background

Well over a decade ago, as more and more of business was going online, Europeans began questioning the origin and authenticity of digital documents. Questions such as: How can we ensure the identity of a signer? Can we prove the document is authentic? And, can there exist a solution to ensure identity and authenticity can be of documents can be cross EU member state borders?

It was also around this time Europe decided it needed a means to enable the exchange of information or services in a manner that guarantees the identity and authenticity of sender in a strong way. In order to achieve this, in 2014 the European Union's regulation on Electronic Identification and Authentication Services (eIDAS) came into effect. eIDAS sets an electronic identification standard to achieve safe and streamlined online transactions across Europe. And for this purpose, the regulation relies on qualified electronic trust services.

Thanks to eIDAS, the EU guarantees the acceptance of any qualified digital certificate throughout its territory, regardless of country of origin, with the clear goal of eliminating digital borders within the EU. This is a regulation that extends to all sectors with the clear goal of eliminating borders for electronic transactions in the EU and the greater European Economic Area (EEA).

The eIDAS regulation defines three levels of electronic signatures: basic electronic signatures, advanced electronic signatures and qualified electronic signatures. The requirements of each level build on the requirements of the level below it, such that a qualified electronic signature meets the highest level of requirements and a basic electronic signature the least.

What are Qualified Signatures and Qualified Trust Service Providers?

According to eIDAS, companies who require a high level of assurance on their digital transactions and exchanged information should be using advanced or qualified electronic signatures as these are the only signature type that have the same legal value as a handwritten signature.

Qualified signatures can only be issued by a Qualified Trust Service Provider (QTSP). A QTSP plays an important role in the process of qualified electronic signing—the highest assurance level of signature as specified by eIDAS.

Trust service providers must be given qualified status and permission from an EU member state governmental supervisory body to provide qualified Certificates (Natural Persons) and Seals (Legal Persons), which can be used to create qualified electronic signatures in adherence to strict guidelines.

In addition, eIDAS requires that each EU member state maintains a Trust List of the providers and services that have received qualified status in their country. A trust service provider is not entitled to provide qualified trust services if they are not on the EU member state Trust List.

Case in Point: Reducing Operational Burden

As stated upfront, U.S.-based attorneys working with European colleagues and customers need to better understand eIDAS and digital signatures. The following example provides some helpful insight.

Imagine you are a multinational technology provider that employs tens of thousands worldwide. Most of the employees are in North America, but increasingly operations have been ramping up in Europe. Your legal team wants to increase responsiveness to their stakeholders, as well as reduce the operational burden associated with transmitting legal documents over open networks but worry about security and compliance.

This challenge can be easily solved by adding digital signatures onto certain documents such as NDAs, response to tenders (RFPs) and various contracts (often via PDF files). This is now quite simple and common with most major document workflow cloud providers. However, selecting the right type of digital credential that meets government regulations around legal acceptability, as well as determines where the burden of proof lays, depends on the type of certificate issued.

In the case of our theoretical legal department, not all documents necessarily require the highest level of assurance. For example, an M&A agreement might warrant a high assurance issued certificate, whereas an NDA might be perfectly suited for a lesser assurance level.

In terms of eiDAS, the highest level of assurance associated with a digital signature is met by the use of a Qualified Certificate, whereas also legally valid (assuming note QC haven't been mandated) but without the unequivocal burden of proof on the signer, an advanced certificate might be perfectly suited. Giving the legal department the ability to secure their documents with an advanced or qualified signature provides a risk-based method to size the assurance level to the type of document being signed and transmitted. In either case, both types of signatures provide the recipient of the document the identity of the signer and that the document has not been tampered with.

From a legal perspective, the difference between an advanced and qualified signature lies in the fact that a qualified electronic signature reverses the burden of proof in the case of a dispute. With it, the signer has to prove they did not create the signature, instead of the claimant needing to proof it was the presumed signatory that really provided the electronic signature, as it is with basic or advanced signatures.

Digital signatures will be increasingly implemented throughout all of Europe, and eventually, will likely be extended to the U.S and other countries. This will be good news for attorneys who, by that point, should be well-versed in the rules around digital signatures.

 

Arvid Vermote is GlobalSign's worldwide Chief Information Security Officer. Based in Brussels, he is responsible for the security and compliance across the organization, which includes ensuring products and operations are provided in accordance with market regulations such as eIDAS.