eSignature Legality for Supervision in European Union Explained

How to eSign a document: e-signature legality for Supervision in European Union

info credit professional education empowering professionals good morning everyone thank you for participating in the online course understanding the ada's regulation hosted by the ip division my name is evistavrul and i'm and i am an ip training officer we live in difficult times but training remains essential we at ips strive to provide courses and qualifications that add value to the participants we appreciate the time you and your companies have invested in attending this course and we hope to exceed your expectations uh before we begin i'd like to share some important administrative information about the webinar first of all please note that the webinar has been recorded at the end of the webinar you can ask questions in the q a section or leave comments in the chat box if you encounter any technical difficulties please notify the instructor or training officers uh through private message uh you can also call up two two three nine eight two four two or three mail at info ip.com.cy as a participant in this webinar you are entitled to 25 discount on all ip webinars except the webinar international dispute resolution mediation you can get the discount by using the promo code idas23.09 please keep in mind that this seminar is only the beginning and it's also considered a brief overview of the eight house regulation in november we will host a more detailed one on the adaz regulation uh another step the session will start uh the speaker of the webinar is cristiano estido mr sido is an industry expert and thought leader who is an authority in her field she's a passionate educator educating and training regulators public authorities in cuba events private organizations of all sizes investors and entrepreneurs in cyprus the eu and international miss i still the stage is yours thank you thank you everyone thank you very much so guys hello hello everyone thank you for being here with me another afternoon with favorite regimes favorite laws and regulations indeed the idaho is one of my favorite so today is about understanding the ei does regulation really it's an one-hour webinar so it is an overview but i have tried to share with you as much as possible as um avi said you can reach out to us after the regular after the webinar with questions through email or um a message uh with any any uh messengers or social media platforms you can post questions anywhere to us so the regulation uh the regulation on electronic identification and trust services for electronic transactions in the eternal market the so-called e-i-das creates a unified and harmonized eu framework for secure and trusted electronic interactions eides is arguably one of the most important instruments to achieve the eu vision for a digital single market as a regulation it applies to all eu countries without needing specific implementation by the member states it doesn't need to be transposed in a national law so businesses individuals and public authorities in the eu can now follow a consistent predictable and harmonized framework in their electronic interactions the importance of eides is evident when we compare it with a previous framework in electronic transactions before this regulation the eu had only the so-called e-sign directive in place this directive it wasn't a regulation it was a directive this directive merely covered the application of electronic signatures and as a direct as a directive and rather general at that left significant scope for divergence between the member states indeed the previous framework resulted in fragmentation and uncertainty in turn the framework and duly restricted electronic transactions creating inefficiency and hampering the prospect for a digital single market the new framework introduced by the e ida's regulation is more extensive in scope covering other trust services in addition to electronic signatures and we will see what trust services are even though electronic signatures remain of course a point of focus also the framework regulates the electronic identification schemes for identifying individuals and authenticating their details for secure uh conduct of their electronic transactions with public authorities the impact of eides is thus significant in that it is a uniform regulation that displaces the fragmented sources of law and electronic signatures which was the case under the previous framework and it brings new trust services and electronic schemes in the regulatory scope these are welcome and exceptionally helpful developments we now have a more technology oriented and efficiency driven framework we can broadly separate the e-idas into two parts first the electronic identification scheme a regime and second the trust services regime where electronic signatures belong as we have just explained both parts the electronic identification scheme uh and the trust services part of the regulation aim to facilitate the access and use of electronic transactions creating a secure and trusted digital market electronic signatures are an important part of the regulation and of interest to the business world for this reason i would like to focus on them from the start e i does basically establishes the framework for the for the creation of electronic signatures therefore electronic signatures refer to a specific legal concept where the nature and operation of these signatures must satisfy the specific rules set by the regulation to create these signatures interested parties will use the environment and solution provided by these new players these new professionals called trust service providers or tsps who are regulated under the islands as the providers who come offer this electronic signature and other trust services of course solutions to understand the electronic signatures established by eida's it is useful to compare them with digitized signatures digitized signatures are the conversion of written signatures into digital images imagine scanning your handwritten signature and affixing the resulting image to a document the level of security is obviously low here if we understand the function of a signature as that which identifies the signatory and and links such signatory to a specific document and its content to then express their consent then a digitized signature falls short of achieving this function with confidence and certainty this is what the legal concept of electronic signatures seek to remedy the objective for digital interactions is facilitated by the introduction of a digital version of a signature still the digitized version of a handwritten signature is prone to manipulation hence the regulation introduces solutions which are cryptographically secured and enable to allow identification of the signatory and the sufficient linked link to the signed document trust service providers will provide solutions that are able to technically meet the standards posed by the regulation the regulation introduces three types of electronic signatures simple advanced and qualified all electronic signatures may solely be used by natural persons acting either on their own behalf or on behalf of a legal entity the signatures differ in their legal effect in their evidentiary value and security assurance businesses may decide on their optimal solution depending on the outcome they intend a signature adhering to stricter standards such as the signatures may be more appropriate for large value transactions all three types of electronic signatures are recognized in the eu since they cannot be denied legal effects and admissibility to courts just because they are in electronic form as per the regulation they cannot be denied they cannot be denied legal effect they cannot be denied admissibility to courts just because they are in electronic form further qualified electronic signatures as the signatures bearing the highest security standards are granted equivalent legal effects with handwritten signatures meaning they are presumed as valid unless proven otherwise for example if they arise because of fraud the burden lies with the party seeking to disprove their qualified electronic signature simple electronic signatures are signatures that may prove acceptance or approval by the signer by reference to some sort of certificate there there are no specific requirements that would identify signers with a degree of certainty on the contrary simple electronic signatures may be as simple as ticking a box while being afforded legal effect and admissibility these signatures can in principle be more easily disputed advanced electronic signatures uh sorry i was wrong on the slide advanced electronic signatures must meet four um either requirements advanced electronic signature must be uniquely linked to the signatory capable of identifying the signatory created using e signature creation data that the signatory can use with a high level of confidence under the soul control her soul control his soul control and the fourth point here to note is that an advanced electronic signature must be linked to the data sign in a way that subsequent changes are detectable these criteria collectively provide a rather high level of verification high level of security and tamper ceiling of assigners identity and signing tamper sealing means that the document cannot be changed after signing now qualified electronic signatures you will be a little surprised here are advanced electronic signatures thus they meet the requirements i have just mentioned for the advanced electronic signatures but these signatures qualified electronic signatures are created by a qualified electronic signature creation device such as a smart card a usb or a mobile app that create a one-time passcode and which are based on a qualified certificate for electronic signatures so just to mention here for you that for simple trust services uh the trust service providers offer to us simple certificates simple trust certificates the the trust service providers issue certificates these this is part of their service to us so we actually hire them and they issue these certificates to us so they issued these certificates for simple electronic signature for advanced electronic signature and for the qualified electronic signature that's why i just said that the qualified electronic signatures are based on a qualified certificate for electronic signatures in that case when we use that signature the qualified for example the trust service provider will issue a qualified certificate for us to us so qualified electronic signatures can only be created by trust service providers or tsps that are certified as qualified for the pres for the specific trust service requested such as the creation of electronic signatures electronic seals qualified trust service providers are listed in the eu trust list as explained these signatures benefit from the legal presumption of validity as equivalent to handwritten signatures and all member states must accept them as such so to make it simple for you let's say for example a lawyer takes this evidence to court i mean this uh for example provides court this qualified um trust uh service certificate disqualified certificates for a qualified electronic signature in this case the judge will equal that qualified electronic signature and in other words the judge has to accept that that qualified electronic signature is equal to a handwritten signature and this is provided by the regulation it is in the working of the regulation so as i said these signatures benefit from exactly this presumption the legal presumption of validity as equivalent to hand written signatures and all member states must accept them as such we know that while while qualified electronic signatures must be backed by qualified certificates advanced electronic signatures may be backed by qualified certificates this is a somewhat middle solution between qualified and advanced electronic signatures we note that info credit group as an authorized agent in collaboration with jcc jcc is a qualified trust service provider uh so info credit group as an authorized agent in collaboration with jcc carries out the certification process for the issuance of of qualified certificates these solutions especially for advanced and qualified electronic signatures are technically challenging utilizing cryptography and adhering to specified technical standards that the trust service providers offering them are also under strict rules businesses individuals and public authorities seeking to rely on any of these solutions do not really have to understand their technical operation or create them instead they will rely on the solutions offered by these new players in the market these professionals the trust service providers after determining the type of electronic signature that their business model requires this depends um on the level of security confidence certainty and evidentiary value they want to achieve for their documents this decision relies on various factors cost of solution against the cost of potential court disputes number of contracts which of course increases the cost willingness to assume risk especially in the light of the prospect of disputes floodgate risks many similar agreements value and importance of contracting in question other surrounding circumstances for example a party that has continuous dealings with another party may rely on a simple electronic signature in this sense a business entering a large contract may wish to rely on a qualified electronic signature solution that benefits from the presumption of validity another important um issue to note is that uh businesses and individuals must consider whether there are specific legal requirements for the document they wish to sign via irrelevant e-ida's eSignature solution for example the signatory and two witnesses to a will must put their initials on each page of the wheel our legal framework has yet to clarify or bring some handwritten requirements in line with the eSignature regime thankfully this is the case for a limited number of instruments and and and contracts uh electronic signatures are part of the trust services as as we said before the regulation establishes the concept of trust services which are essentially electronic services that enable and underpin the operation of electronic transactions with security and trust these are values and include the creation verification and validation creation verification and validation of electronic signatures electronic seals electronic time stamps electronic registered deliveries delivery services and the corresponding certificates of each of these electronic signatures seals stamps registered delivery services we get certificates for these trust services also of certificates for website authentication or the preservation of electronic signatures seals or certificates related to those services while these services are vary the regulation provides that these trust services are offered by trust service providers uh we have discussed in the context of these signatures just a while ago when they come in a qualified advanced or ship simple nature based on their level of security and their capacity to identify signatories and authenticate their data trust services are essentially electronic services that may confirm the course of electronic transactions whether such such source is trusted and whether the data or the data for identifying the source are authentic like eSignatures other trust services should not be denied legal effect should not be denied admissibility for the sole reason of being in electronic form similar um presumptions of validity and integrity also emerge for the qualified version of the other trust services incidentally while not classified as trust services electronic documents are also recognized in the e-is these electronic documents again should not be denied legal effect or admissibility just because they are electronic this regime recognizes that electronic transactions are widely used especially as the cross-border interactions increase but may raise concerns because of their lack of face-to-face interaction such concerns are mitigated by trust services that offer security and trust between digital counterparts trust service providers that offer these services usually for remuneration are also regulated in the eides without getting into much detail to share with you that trust service providers may be certified as qualified or may be non-qualified based on their status qualified or non-qualified they can offer qualified or non-qualified services meaning advanced or simple services ingly so to put it simply qualified service providers go through honors procedures and processes uh it's not easy for them to become approved as a qualified service providers as i said they go through honors procedures so when they get that approval they enter a list of the qualified service providers these providers the qualified service of providers can provide all levels of trust services they can provide simple advanced and of course qualified they are qualified thrust with providers unlike the non-qualified trust service providers who didn't manage to become approved as qualified or they didn't want to they didn't wish to so these non-qualified trust service providers can offer services or trust services only at the level of simple and advanced so just to make it make it clear to you that we have simple electronic signature advanced electronic signature qualified electronic signature simple electronic stamp qualified electronic stamp advanced electronic stamp simple electronic uh seal qualified electronic seal um advanced electronic sales story and qualify so we get to have all the levels but qualified trust service providers provide all three levels non-qualified trust service providers are able to provide only the first two levels simple and advanced but they can provide for all the services if they wish so and if they apply to provide all of these services so the regulation goes on to regulate their liability i mean the liability of these trust service providers and their capacity to limit such liability and imposes certain breach notification and security requirements in short trust services include as i said before electronic signatures we have already talked about which correspond to signatures and are only available for natural persons electronic seals which correspond to the sales used on paper and are only available to legal persons electronic time stamp is a service that ensures that the time linked to data or a document is accurate may be combined with electronic signature and may also be combined with electronic seal to ensure time of signing and sealing at the same time so we may get to see combination of these services on the same document electronic register delivery address is a service related to the transmission of data between parties by electronic means which provides evidence of such transmission and transmitted data including proof of sending and receiving data it is useful when sending electronic documents and seeking confirm confirmation of delivery website authentication i mentioned website authentication what is this what is the service website authentication which constitutes an attestation that the website is authentic that it is indeed linked to the natural or legal person that has the website to whom the certificate is issued it is important for websites where it is useful for websites to identify the owner such as eshops i mean it is important for example for future disputes and also preservation of electronic um signatures and seal services to preserve these services so trust services include also these service preservation of electronic signatures and seals which is is these services are mainly referred to preservation of the electronic signatures and electronic seals for a period of time businesses and individuals may use a combination as i said before of these trust services uh to support their electronic transactions and interactions in in general another important part of the regulation is the electronic identification regime chapter 2 of the regulation trust services is chapter 3 of the regulation chapter 2 of the regulation establishes offers guidelines and lays down their conditions for electronic identification schemes the regulation provides that member states shall establish their electronic identification schemes for the purposes of their online public services we highlight here that the regulation makes explicit provision for online public services and not private services these schemes are used to identify both natural and legal persons by confirming their identity through electronic data and authenticating the integrity of such data so in simple words i've just shared with you guys that cyprus as a member states already is developing this electronic identification scheme if this word scheme confuses you it's just a system we will we will get to have soon a system that actually is mandatory for the public authorities in cyprus to have and our public authorities will be connected with this system this system will be connected with analogous systems of the rest of the member states so eventually we will get to see this connection among these systems and this is mandatory for the public services of each state for cyprus as well so um these schemes as i said this system will be used to identify us identify both natural and legal persons by confirming their identity through electronic data and also authenticating the integrity of such data electronic identification schemes allow for electronic identification of persons through electronic means these electronic means contain person identification data meaning data in electronic form that uniquely represent a person me you these schemes this system are put in place to ensure that a user seeking to use online public services is first identified with certainty with confidence and security under the rules of a national system and also member states may implement separate electronic identification schemes for access to different public services so what this means is that we may not speak of just one system system but of different systems that eventually will interoperate member states must notify their e um electronic identification scheme to the european commission these schemes may only be accepted if they adhere to the rules provided in the eida's regulation electronic identification schemes must implement at least one of one of the three um available assurance levels in compliance with the specifications standards issued by iso itu and other international organizations standards organizations and procedures provided by the regulation and of course they accompanying decisions these levels are high substantial and low and they vary ing to the security and strictness of procedures they use to identify users after the electronic identification scheme is approved why i say approved i just said we notify the member cyprus must notify the other members member states what they are developing they must give details of the system and the characteristics the standards that they use everything so this is what we um refer to notification notify their scheme the member states must notify to the other member states their schemes their systems so as i said these levels are used to build this system and i'm using i'm using simple language to enable you to help you understand these levels um are high so they may use high level level standards substantial um high assurance level substantial and low these vary ing to the security and strictness of procedures they used to identify users so as i said again after the electronic identification scheme is approved by the rest of the member countries the member states through what we call notification process it is established to the official journal of the eu by the commission once successfully notified the electronic identification scheme must be recognized by all member states based on the principle of mutual recognition on certain conditions in specific a member state requiring its citizens to identify themselves before using any public services based on a high or substantial level of electronic identification scheme massax must accept the electronic identification means used under the electronic scheme of another member state so long as that electronic identification scheme is of equal or higher level of assurance so each member state in simple words guys will assess uh what the other member state are used in order to develop this system and they would need to say ah okay i accept with the means the technological means and the standards you use so i'm okay with uh france who may say i'm okay with the system of cyprus uh italy may say yes i have assessed the system of cyprus i'm fine with the system i am i'm okay i approve it so they will they will look in in details in in into the scheme into the system into the how it was built in simple words and they will provide or they won't provide their approval they they will disapprove so if they disapprove they will we will have to change some design let me put it simply for you in the system so you may question now um you may you may say but why christiana is sharing this with us the the the webinar today is about understanding electronic uh regulation the the ei does regulation uh the either's regulation refers only also to chapter two so i had to mention this chapter two i had to mention um the electronic identification scheme that is provided by this regulation and as per which cyprus is currently developing the system so we will soon see this happening so this is chapter two of the e i does regulation which is something different from chapter three which is on trust services so along to finish here um just to give you an example of what i said before let's in practice let's say germany requires that a user accesses its own um its online tax portal using a substantial level of electronic identification scheme and an italian city citizen has used electronic identification means of a high level scheme in italy germany must recognize these electronic identification means eventually though had a low level electronic identification scheme it would be in germany's discretion whether to accept the relevant electronic identification means the electronic identification scheme regime is intended to ensure cross-border identification and authentication to online services offered by member states for now this is confined uh to online public services as i said before and i repeated that many times and i said the public services will be connected so but clearly clearly the potential is there for private services too because private services may connect to this system voluntarily if they wish to electronic identification schemes designed and notified by member states may be opened at a later stage in other words to private entities to private companies and organizations seeking to identify their online users this would be business changing you know since it would go a long way resolving the issues with the identification and authentication of digital users and their data in digital dealings and interactions currently cyprus is designing as i said it's electronic identification scheme a part of the scheme implements an either's compliant qualified electronic signature the scheme will create a uniform and secure way of accessing electronic systems with a high level of assurance a high level of assurance electronic identification scheme must be recognized as i said by the other member states as well as the electronic signature of electronic documents new online services will in turn emerge you know the system has yet to be notified to the electronic commission but is currently in the works um the regulation is a significant regulatory development businesses can integrate solutions and rely on services for their electronic interactions and transactions the same goes for public authorities which can implement the electronic identification schemes for access to their electronic systems the utility of such schemes may extend to the private sector as i said once these schemes are finalized and put into practice indeed the european commission envisions the creation of a unique electronic identification for each eu consumer to access its personal data and obtain products and services online this will grant control to consumers and online users and would allow businesses and other individuals to interact with each other with confidence uh trust and and and security for now trust services and the solutions implementing uh such uh such services by trust service providers can truly facilitate the electronic dealings of businesses and individuals it is not surprising guys that the electronic signature solution is endorsed by many who wish to sign their contracts electronically but with secure and evidence-based solutions um i have some useful links for you on this slide you can visit uh click on these links and and find out more if you like or in case you want to pose any questions um this is the end of presentation if you guys want to pose any questions if we have the time of course uh info credit do we have the time for a couple of questions if not i promise to uh reply to each and every one of you who have questions in writing if you want so as i see is this is we have two minutes left so thank you everyone uh for spending this afternoon with me this one valuable hour so um i'm open two questions here um [Music] please and please uh every more um yes we have just a few minutes so i think it's better to answer some uh general questions of course only like a few questions so the first one uh is how do we approach a trust service provider so uh as we said the trust service providers um are divided let's say to non-qualif non-qualified and qualified we explain what is a qualified trust service provider and a non-qualified so if we are we if we are to approach a trust service provider we should look at the list listing these trust service providers so we know that they are qualified or non-qualified because you will see in the list the qualified trust service providers so the qualified trustee service providers use also um this trademark oh i forgot to tell you i have it i think on on one slide here ah here you see this uh locker with this tick the and the stars this is the trademark of the qualified trust service provider so what we do is contact them as soon as you uh know their name just write an email to them and discuss to discuss what you need with them and partner with them as we said they offer their services uh in with remuneration we we pay them they are they're also businesses so we pay them for issuing certificates uh to us for when our clients use these services so uh approach them discuss with them they have contracts go through their contracts um the the the the uh there's a number of of qualified trust service providers that offer some period of of um free for a month some of them just 30 days to try their services and then um and provide their services free just for you to try and see how they work how this relationship relationship will be with them so as i said jcc in cyprus is a um is a trust service provider is a qualified trust service provider so they they may for example approach jcc and discuss their needs jcc will help them they did if if they wish to to find out more they would also approach info credit if info credit is a partner of jcc um they they would they can approach info credit and discuss their needs and then info credit will direct them so yes it is one solution or if they want to to approach other trust service providers as i said they they would go um consult the relevant lists and then discuss with them and then see their contracts and be careful with the contracts usually they say their standard form contracts but if they if the businesses need to change something in the contracts the the contracts that they provide that offers to them for for signing um then they should say so this they should negotiate with this trust service providers i mean even even their prices even their fees and anything is this um um is this okay do you uh the person who who posed the question is okay with the answer satisfied um i think we should go on to the next question and maybe as you said they can send you private uh emails and you can't address their questions yeah or to you every move to you and then you come forward to me if it's easier for them or to me directly this is not to say i'm not open i mean directly all right anyone who wants to ask any question uh please on what we shared here today please um please write to me or to info credit and of course as we said before we have this bigger longer course um sometime in november and um that is a course if you are interested that is a course for you to follow guys because it will be full of details and we will we will discuss many things in in that course okay uh would you like to take another question i think we have some time but if we do it it's uh it will be like the last question um what considerations need to be made in order to decide if we need simple or advanced signature uh only simple or advanced as we said simple is the lower level advances the middle and the qualified as we said is um is the same as the advance but we use this special qualified device to generate i mean this is technical but what we need to focus i mean the the businesses um i shared some some some considerations before i mean um the importance of the transaction the numbers the numbers they have i mean are if it's if it is a bank it's different than than a than a company let's say uh rarely um dealing with with contracts you know and uh depends on um if you feel that you will be like led to cold at some time and you want to be strong then you should use like the qualified electronic signatures which is equal to a handwritten signature so many considerations are made that depends on the on the operations of of the specific company um if it's an authority of the state if it's uh if it's a company dealing with um a huge number of clients or a small number of clients that why i say this because that regards costs and expenses the subject matter of of the transaction let's say we're dealing with millions and billions i mean there you need to have more trust and security in the transaction so you would better go for a qualified um signature let's say or seal if it is a legal person the legal persons use seals not not signatures yes this is clear i think from what i shared with you that legal persons only use electronic seals not electronic signatures electronic signatures only by natural persons okay so these generally are the considerations it depends on the intentions of of the user and their business um their size their clients the subject matter of the deals of the the transaction in question yes okay uh that's the time we have for now uh as you said we're gonna host a much bigger in duration uh webinar but that's gonna be more detailed in november um once we have more details we will let you know so you can register time um thank you mr steele for for providing us very much interesting information uh their participants this online course has come to an end uh your email address will be used to send you a certificate of attendance i'd like to remind you that you are entitled to a 25 discount on all ipa ipi ip webinars except the webinar international dispute resolution mediation uh use the promo code eidas23.09 to receive the discount uh we hope we have met your expectations and that this online course has piqued your interest uh please tell your colleagues or partners about your experience thank you once more for joining us and have a wonderful rest of your day thank you very much guys bye-bye see you soon bye bye [Music] info credit professional education empowering professionals