Electronic Signature Legality for Security in European Union

How to eSign a document: electronic signature legality for Security in European Union

[Music] hello and welcome to today's webcast see I des regulations and solutions I'm your host my name is Ronald Ronald I'm among VP strategic sales for Ramaiya here at Global sign thank you all for joining us today I say we have many people from around the globe interested in this topic and it's great that you could all join us please keep in mind that this is a recorded presentation and you will be offered a link to the slides as well as a recording and also the opportunity to submit any questions to the presenters using the posted contact information at the conclusion of the presentation so our guest presenter today is andreas Aveda who is head of the european task force a government and Trust at European Commission DG connect he will be reviewing the latest updates and information on the Ida's regulations and features advantages and benefits they bring actually to citizens and businesses after andreas presentation I will offer brief introduction to global sign and the solutions we bring alongside the IRS regulations in terms of our digital signing solutions and as a qualified trusted service provider okay let's get started Andrea take it away good morning to everybody my name is Andres vida I'm the head of the unit a government trust a digit connector of the European Commission and today I would like to give you just a brief overview of what is the others regulation on electronic identification trust services which is going to f----- in life to end its journey on the 29th of September this year when the final part own module recognition of electronic identification will enter into force what is the other regulation the other the regulation in a nutshell is first a regulation it means that it is a piece of legislation that apply as such in all the 28 member states it doesn't need to be transposed it doesn't need to be interpreted it is applicable as low and as a prevailing legal effect any national or regional local legislations of which may touch own part or the entirety of the scope of the regulation itself which means that it is a law that it applies a from Stockholm to Porto from from Paris to Sofia everywhere in Europe and covers few things the first part is about mutual recognition of electronic identification means which is not really the subject of today the main part which is the relevant for today's is the chapter 3 that is about providing the market condition and defining the legal effect of electronic trust services as defined in the regulation namely electronic signatures electronic sales electronic time stamping electronic registered delivery services and website authentication in addition to those services there are also validation services which are defined under the regulation in connection to verifying the validity of electronic signature and electronic sales last but not least anything is important to bring the forward is the part on setting the minimal minimum elements of non-discrimination that applies to electronic documents this is the first time ever since the white paper of Jacques the lower in the early nineties said that a piece of legislation the European level provide non-discrimination define non-discriminatory rules for electronic documents to be accepted and recognized in court disregarding the fact that they are indeed in electronic form so it said that the minimum elements that will allow for an electronic document to be accepted cross-border provided that of course I would say things will be associated to this document to ensure integrity authenticity and I would say the proof of origin what is the others in an chill is about building trust it's about supporting citizen and businesses and public administration to make digital transaction to be more convenient which means to be used in a seamless way across all the possible available digital platforms and devices and to be used across border in a way that such services and the associated transactions India transactions to reach those services are associated to be to be not only secure but also trustworthy and recognized across the 28 member states this is why it is about business it's about developing the digital single market is about making the citizen businesses let's not forget that in Europe we have nearly 23 million small and medium enterprise across the 28 member states and of course I mean such businesses are normally those who have less I would say information available to them in relation to what may or may not be allowed and even more importantly what may or may not be legally binding or possible when in the dealing with electronic transaction in the digital world so it is about trust is about businesses about cross-border and is about convenience and this is why for instance thinking of what was the the previous legal framework that applied until 2014 he had this regulation introduced clearly the possibility to use a trust services in the mobile and in remote in remote usage scenario so which means using and creating and relying on electronic signature electronic sales electronically deliver the electron you register delivery services for instance by relying on a cloud-based services all remote creation devices like HSM hardware security modules that makes it possible for the owner of the and of the credentials that are needed to be transacted in order to create for instance an electronic signature to do all these on on a gsm on an iPad on on a more portable device as well as on desktop or I would say in on any other platforms of the babe that may be available to the user of course a DS they should not bring in any sense additional risk compared to the way in which the services may be provided consumed and access to in one or other type of digital digital platform so this is why the regulation is defining very I would say baseline principles and rules for the on the one hand the provisioning of trust services in order to define what are the baseline conditions that certain Detra Services has defined in the regulation should indeed mean should meet in order to be trusted ing to the others relation but even more importantly to be possibly associated with a specific legal effect that which is indeed associated to the level of security and assurance of such a services indeed them the provision of associating special legal effect to certain type of trust service in particularly qualified one is one of the key elements that qualified the other circulation as a cornerstone of the for the development of the of the digital single market providing the requirements of for the for the trust services of course important because it brings along a legal certainty in relation to what a dietra services are about but is not sufficient unless also clear clear rules are set up for those providers that are finding these services in a way that will make the services than to be associated to the probative value and the legal effect that pertain to such services ing to the instead of the to the under circulation and what is important is that that rules are set in order to promote transparency and accountability but also technical neutrality and even more importantly they are based on risk management approach which means that is left to the trust service provider to say is mandated to the trust service provider to define to identify what are the risk of their operations to characterize what is the risk and to define what is indeed the set of of the same security measures and risk management measure that they may like to adopt in order to cushion risk it in a way that those measures will be then I would say possibly possible they will possibly constitute what will make the truck service provider to be accountable for the services they provide and of course I mean for the empowerment or I would say the recognition of the primary responsibility of the service provider is key but of course I mean we have also to ensure that those who have less means that to understand what is being offered to them and how what is offered could be used are also protected and this is why there is in in the others regulation a set of rules about the supervision and the Supervisory bodies that each and every member states they should establish to govern the the market that is being created based on the other donation but even more importantly to intervene to ensure that either the services are provided in the right way or they are accredited in particular they are if they are qualified in ing to the others regulation and help the I would say parties would be relying party of any kind a business public administration citizen should people go wrong in connection to what is indeed the service being offered being consumed in in Europe and of course I mean it is important to highlight that all these is I was saying really connected to clear rules so that makes the services to have a specific legal effect in all Member States at the same time so what is qualified you will see later is indeed qualified everywhere in Europe these lines to some extent is a pictorial representations of the architectural framework of four trusted services you see a number of horizontal principles which do map onto the verse a previous specific provisions that we have in the regulation like you know the rules on the liability on international aspect security requirements security breach notification trusted list and they do apply in in a way that is indeed homogeneous or movie news on applies to all the the services that you see underneath that the horizontal principle block a little signature electronic seals time stamping electronica register delivery services and website identification what are the general the the in a nutshell the principles which govern the provisioning of trust services first of all I would say about an ideal liability regimes which is introduced for both qualified and non-qualified raw service provider and of course the liability regimes means that the rules are more stringent and stricter if the service that is provided is indeed not associated with a special legal effect as it is the case for qualified trust services why because indeed the higher is the level of legal the higher is the level of the higher or the greater is the the legally fine that is provided by Pali by a service the stricter should be the rules that will make the trust service provider and the users be they will make them liable for what might be a misuse or negligence or I would say the the non correct applications of what are is going to be associated to the provisioning of the services and of course I mean I think that the liability is in itself I would say always linked to requirements minimum requirements in relation to security and security breach notification why because the approach as we said is risk management article 19 makes reference to the obligation of trust service provider qualified or not to identify the risk and to adopt the appropriate security measures which correspond to the state of knowledge in the domain and these should be documented in a way that is to be authorized before the the services are provided in the case of qualified to a service provider and X and X post in the event that services which are not qualified may indeed be subject to investigation because of problems which are encountered by either the user or relying party in relying on those services I think that this is important because it also distinguishes very very clearly what is indeed the type of guarantees and measures that qualified trust service provider have to to adopt and what is the the new regard that is paid to the way in which these services are provided before such services are offered on the market visibly what is just about saying the normal type of trust that could be provided in a way that will not require any prior or scrutiny and assessment by the supervisory authority the others regulation is assent is applicable across the 28 member states and in order to make sure that there is a good understanding and a clear understanding of what is indeed that is being used and how what is being used could be verified as such whether is qualified or not the the others review nation introduced two main tools which are designed to reinforce the transparency and the accountability of the towards the D citizen with regard to the services that they are rely upon these two tools are associated to qualify through Services and qualified service providers and they do pertain to what is an important tool which has a constitutive value under the others regulation that is the trusted list what is in the trusted list is qualified what is not in the trust and list is not qualified the trusted list that such is mandatory for the qualified trust services and the qualified row service providers which are providing such services and easels list of trusted lists which are maintained at the national level and which are all managed together with a single entry point by the European Commission's which is indeed managing the trusted list of qualified trust service provider the European level however in such a list there might be and this is discretion to the Member States willingness to give visibility to such services may include include in a way that is clearly distinguished from from the qualified service provider also information on trust services which are not qualified what is the I would say value of it No fighters service intro service provided to be indicating trust and enlist nothing just an information point which is not giving any guarantee of the kind that indeed is associated with the presence in the list of a qualified service provider the the for which the indeed presence in the in the trusted list confirm and states in in the constitutive way the effect that the transfers provider is qualified and the services which are mentioned the every further in the trust and list are indeed qualified and therefore relying parties could rely on those services with the associated legal effect of which the address regulation I would say defines in in the bulk of the legislation the second important element which is more - I would say help citizen users to better distinguish what is being offered to them is the trans mark which is the thing a very easy pictorial is a lot as you can see on the slide which can only be associated to qualify trust services by qualified reservist provider and it should be linked to the trusted list that will therefore allow the user to check is exactly whether the use of these of these of these trans mark is indeed appropriate with a VD service that the user is interested - I will just I would say some information on the main electron electronic transfer visas in particular tronic sales and electronic signatures as you see on on on the slide the legal effect of an electronic signature is associated only to natural person and is assimilated to the handwritten signature for the yields ECS is a means to prove integrity of the data and the correctness of the origin of the data to which Diesel's is associated the the recognition of qualified electronic signature in the Latin ICI is based on requirements which have to be verified in order to become to be qualified as such and they do I would say define those services and those those products as to be I would say to enjoy the presumption of equivalence of two handwritten signature everywhere in Europe indeed it is important to highlight and this is critical for all the qualified service provider that what is indeed provide what is in that trust service provider that are qualified in a country because the qualification procedures is managed at the national level but who is whoever is qualified in a country is qualified everywhere in the you whatever service is qualified in a country is qualified across the U which means that my case I'm Italian I have a qualified service provider that provides me I would say qualified electronic signature and is a qualified attorney is disqualified services based in Austria I can use and generate the signature by using the technologies that which is linked to me under the agreements that have withdraw service provider and water generators qualified electronic signature is a qualified electronic signature everywhere in Austria needle in all the other 26 Member States without any possibility for Member States to reject or introduce requirements that will go beyond what was in the in the in the regulation why I'm saying this because the other circulation does not define what should be the use of electronic services it defines the condition for the provision of the services and the legal effect that the different services are associated to and it's up to the parties in particular the user in the reliant artists to define on the basis of risk management what is indeed the best tools and service that may be relied upon for the transaction that they want to do to support for instance if we can think of of the issue in a banking environment electronic mandate illiterate mandates are cross-border by construction if banks do not want to be challenged in relation to having the electronic signatures which is generated in creating in a country to for for a given mandate if the banks would like not all banks would not like these to be challenged in in the country should something go wrong and in the country where they reside then of course going for qualified electronic signature will I would say eliminate any possible legal risk associated to the recognition of the property value of the signature in court should something should the dispute be be happening of course I mean you can imagine that because the trust services have quite a good coverage of the cover from signature to whose time time stamping website authentication to electronic reduce the delivery services which is the equivalent of registered surface care and career under the postal service directive the potential impact of these these services and the potential use of these services quite huge I have put here in the slide just a few of those legislations aware electronic reserve assist and electronic identification of could indeed play a role and do play a role for instance the anti-money laundering where indeed the electronic identification which are services fully recognized to support the digitisation of canvassing processes cross-border because indeed the trapped services and electronic identification under yardas are recognized across border but the same is for instance in the contest of one solely principle and that the single digital gateway where indeed the use of electronic scenes electronic signature and electronic identification allows for the the employee allows or the enabled implementation of our technical solutions that would make it possible for a user would be a nature person or legal person to provide to a public administration in a country where indeed the user need to complete a procedure demanded to fetch the information under the control of the user we to fetch information in another country where dance info this information which are related to the to the Administrative Procedure are stored and the user is a full control to see which information is being transferred and to approve the the possible transmission of this information before they reach the consuming public administration and the Member States and of course I mean these goes also in the context of the company law where the proposal for the directive which is under discussion now makes full or say takes full benefit of the others regulation in particular electronic signature traditions electron deliver electronic register delivery services and timestamp in just a little information on the time stamp in time stamping is actually the core technology for blockchain and of course I mean the use while blockchain give immutability of the transaction the recognition of the transaction in terms of I would say presumption of equivalents or presumption of equivalence in terms of meeting the integrity of the time of the data and of the linking of the time to the data as per the others regulation is only associated to the qualified time stamping everything else is just the technical technical I would say implementation that could be used just few words on the ID I skip the one on on the principles of what just to highlight that electronic identity is of course a preconditions for the possible acceptance of etre services I think that one of the key reason for one of the key reason that led to the known fool in recognition the complete recognition of of the directive of 99 on electronic signature was defined that the electronic signature was recognized as a mineral authentication and being authentication of people in particular the individual people be these these these elements to be critically linked to the citizenship that the of at the natural at the national level it was very difficult for country aid to recognize as authentic of water is provided by country beef because the identification of the education process of citizen is a completely different from one country to another yad is resolving all these and by making electronic identification to be recognized cross-border gives as our Commissioner Gabrielle says gives the Europeans a new freedom that is the the freedom to rely for online transaction to on electronic electronic identification means which are recognized at the national level so if I use an electronic identification means in my country if these means are notified under the others I will be able to use those means that works the services offered by the public administration private sector everywhere in Europe of course I mean the journey to go from digital from paper-based to digital in in the energy is quite long but we are getting there and indeed as I mentioned at the beginning of my speech on the 29th of September as you see here on the slides the final the the chapter on electron mutual recognition of electronic identification will kick in and this will ensure the recognition across 20 the 28 member states of annika identification means from online access and once I have been able to associate a my identity to a digital transaction of course I can do everything else digitally whether I use a kyc whether the customer due diligence procedure or is I would say voting for I would say political election this is what I wanted to to tell you in a nutshell this is the list of the implementing act and here are the links to what sites where you may find more detailed information on the regulation and the application of the regulation across you thank you very much for your attention thank you very much Andrea excellent information and well presented of course as mentioned at the beginning of this webcast we will now briefly review who global scientists and the solutions we bring to the IRS regulations and Ray has just presented in terms of our digital signing solutions and as a qualified trust service provider as many of you may already know global sign is a global identity service company providing cloud-based high scalable PGI solutions for enterprises needing to conduct safe commerce communications content delivery and community interactions our identity and security solutions enable businesses large enterprises cloud-based service providers and IOT innovators around the world to convict secure online communications and many verified digital identities and ultimate authentication and encryption thousands of enterprises around the world rely on global sign identity management services to protect our environments reduce management costs and secure mission-critical workflows and services without getting too much into technical detail a global sign actually has annalistic approach to enterprise certificate lifecycle management the global sign sauce based identity and security services are delivered via robust scalable infrastructure with global data centers redundancy availability etc so our services scaled to meet the demands of all our customers including the emerging IOT market and IO II and leading cloud service providers where the ability to make secure network connections among people services and because everything to have a trusted identity that can be managed as well and as our solutions relate to the Ida's initiative global sign in addition to being a trusted global certificate authority for which we offer a range of digital signing solutions we are now also created as a qualified trusted service provider as detailed previously by Andrea and can of course support both advanced as well as qualified electronic signatures obviously Global sign under and the stringent numbers of audits to ensure all associated processes made to requirements established by the IDIS and therefore being a qualified trust service provider or cutie SP it means global sign offers qualified through services in this case first of all qualified certificates for electronic signatures which are certificates used to provide identity for digital signatures associated to a natural person or natural person incorporated in a legal person and next to that we also offer qualified certificates for electronic seals which are certificates used to provide identity for digital signatures associated to a legal person or corporate identity only cutie SPS can provide qualified to our services and appear also on the EU trust list so if an entity is not on that list they can obviously not provide qualified trust services so you would find us there as well further on Global sign standard line of digital signature certificates and solutions already met the requirements for advanced electronic signatures because they are of course also uniquely linked to the signatory they are capable of identifying the signatory also created using electronic signature creation data that the signatory can with high level of confidence use on their sole control and link to the data signed therewith in such a way that any subsequent change in the data is detectable and through global science standard range of deployment options global science advanced electronic signatures and seals are available to individuals as well as organizations and these includes well based options hardware security modules or HSMs and also the global signed digital signing service which is in nearly and completely cloud-based service that integrates directly with document workflows and applications and eliminates actually the need for Hardware altogether so organizations can leverage existing integrations such as design maybe or others or build digital signatures into their own customer workflows using the service of Tokyo global sign digital signing service which is based on REST API so that concludes our global signed webcast today on the itis regulations and relate to the global sign solutions for any questions you may have for Andrea or myself please forward them directly to our global signed contact information and someone will get back in touch with you very soon thank you all for viewing and have a wonderful day thank you for watching for more global sine videos on identity cybersecurity and PKI please follow one of the links on your screen to keep up to date with the latest content please don't forget to subscribe to our Channel