COMMISSION STAFF WORKING PAPER IMPACT ASSESSMENT Accompanying the proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on electronic identification and trust services for electronic transactions in the internal market /* SWD/2012/0135 final - COD 2012/0146 */
TABLE OF CONTENTS List of annexes............................................................................................................................. iv Procedural issues
and consultation of interested parties. 5 1........... Introduction. 5 1.1........ Electronic
identification, authentication and signatures - key elements for electronic
interactions and the Digital Single Market 6 1.2........ Policy context of
electronic identification, authentication and signatures. 6 1.3........ External expertise and
consultation of interested parties. 7 1.4........ Commission inter-service
consultation and Impact Assessment Board process. 7 2........... Identification and
assessment (definition) of the problem.. 7 2.1........ Introduction. 7 2.2........ Lack of a common
framework for electronic interactions and main problems. 8 2.3........ The drivers behind the
identified problems. 11 2.4........ Who is affected and to
what extent?. 16 2.5........ Baseline scenario - how
would the problem evolve, all things being equal?. 16 Fragmentation,
interoperability problems not solved. 16 Legal certainty not
ensured. 16 Users' needs not
fully satisfied. 17 Leading European
(policy) initiatives not fully leveraged. 17 International
coordination opportunities missed. 18 Conclusion. 18 2.6........ EU added value and right
to act 18 2.6.1..... Treaty basis. 18 2.6.2..... Subsidiarity. 19 3........... Definition of the
policy objectives. 20 4........... Policy options. 23 4.1........ Options for the Scope of
the Framework. 23 Option 0: Repeal of
the e-signature Directive and no regulatory activities with respect to eID or
related trust services 23 Option 1 No policy
change. 24 Option 2 - Enhancing
legal certainty, boosting coordination of national supervision and ensuring
mutual recognition and acceptance of eIDs. 24 Option 3 – Expansion
to incorporate certain related trust services. 25 4.2........ Options for the Legal
Instrument of the Framework. 25 Option A: One
comprehensive legal instrument vs Option B: Two separate legislative
instruments. 25 Option C: Directive
vs Option D: Regulation. 25 4.3........ Options for the Level of
Supervision of e-Trust services. 25 Option i):
Maintaining national supervision schemes (“basic variant”) 25 Option ii):
Establishing a EU-based supervision system (“advanced variant”) 25 5........... Assessment of the
policy options. 26 5.1........ Scope of the Framework. 26 5.1.1..... Assessment of Option 0: ‘No
EU Policy’ 26 5.1.2..... Assessment of Option 1:
‘Status quo’ (No Policy change) 28 5.1.3..... Assessment of Option 2:
‘Enhancing legal certainty, boosting coordination of national supervision and
ensuring mutual recognition and acceptance of eIDs’ 31 5.1.4..... Assessment of Option 3:
Expansion to incorporate certain related trust services. 34 5.2........ Legal instrument of the
Framework. 39 5.2.1..... Option A. One instruments vs
Option B. two instruments. 39 5.2.2..... Option C. Directive vs Option
D Regulation. 40 5.3........ Level of supervision of
e-Trust services. 40 5.3.1..... Option i: Maintaining
national supervision scheme. 40 5.3.2..... Option ii: Establishing an
EU-based supervision system (‘advanced variant’) 41 5.3.3..... Comparison of costs
(cost-efficiency) of managing the supervision schemes. 42 6........... Comparison of the
options. 43 7........... Monitoring and
Evaluation. 45 COMMISSION STAFF WORKING PAPER IMPACT ASSESSMENT Accompanying the proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on electronic identification and
trust services for electronic transactions in the internal market List of Annexes Annex 1 – List of acronyms and glossary Annex 2 - List of studies and workshops in
relation to electronic identification, authentication and signature Annex 3 - Policy Context of Electronic
Signature and Electronic Identification Annex 4 – Overview of responses of the Public
Consultation Annex 5 – SME Test Annex 6 – E-Signature Market Segmentation and Trends Annex 7 –Difficulties encountered by each
of the stakeholders and the interest in the revision of the framework Annex 8 – Detailed assessment of impacts –
related trust services – EU supervision level Annex 9 – Impact assessment matrix COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT Accompanying the document Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on electronic identification and
trust services for electronic transactions in the internal market Procedural issues and consultation of
interested parties Identification Lead DG: Information
Society and Media Directorate-General Agenda Planning: 2012/INFSO/002 1. Introduction This report assesses
the impact of policy options for a European legal framework for cross-border
recognition and interoperability of electronic Identification, Authentication,
Signature and electronic related trust services (referred
to as 'elAS services'). The objective is to enable secure
and seamless electronic interactions between businesses, citizens and public
authorities, thereby increasing the effectiveness of public and private online services
and electronic commerce in the EU, thus creating trust in electronic
transactions in the internal market. This initiative is a
step further to the development of a digital single market from which citizens,
businesses and public authorities could fully benefit and for the fostering of
a European citizenship, which are both essential to improve the functioning of
the internal market in the digital age. The framework builds on the revision of
Directive 1999/93/EC on a community framework for electronic signatures ("e-signature
Directive"). This report analyses
alternative policy scenarios by assessing how they would help to overcome
current obstacles to eIAS. The impact of these options on consumers/citizens, the
private sector and public administrations will be considered. This document does
not pre-judge the final form of any decision to be taken by the European
Commission. 1.1. Electronic
identification, authentication and signatures - key elements for electronic interactions
and the Digital Single Market Easy to use and reliable eIAS can create
user convenience and trust and confidence, thereby facilitating a full
'European citizenship' in the digital single market and favouring electronic
business transactions. At the same time, a
well regulated and operational Digital Single Market is an incentive for the
accelerated development of online services, at national and cross-border level,
which in turn will favour the development of the knowledge economy, generating
potential favourable impacts on economic growth and the creation of jobs. Nonetheless, still
existing barriers to the cross-border access of online services need to be
eliminated to fully reap these economic and social benefits of the Digital
Single Market. In order to be productive enablers, rather than barriers to
cross border services, electronic identification, authentication and signatures
need to be mutually recognised and accepted throughout the EU. E-identification,
e-authentication and e-signatures are the electronic
equivalent of personal identification, validation of personal identification
and integrity of documents and handwritten signatures respectively. In simple terms, they perform the same functions in an electronic
environment as in the paper world: a person provides his/her name
(identification) and proves (e.g. by showing a passport or identity card) the
correctness of the data provided (authentication). Currently only an
e-signature has been formally defined at the European level, as “data in
electronic form which are attached to or logically associated with other
electronic data and which serve as a method of authentication"[1]. Collectively, eIAS services
serve as a basic ‘trust ecosystem’, that allows participants in the digital
society to communicate and engage in transactions with the necessary confidence
in electronic claims, in particular when a high degree of certainty and
security is required. As such, eIAS services are crucial to citizens,
businesses and public administrations in enabling the transition from a largely
physical and paper based society to a European citizenship in the digital world,
where reliable, trustworthy and seamless alternatives are available. 1.2. Policy context of electronic identification,
authentication and signatures The Single Market Act (SMA)[2] stresses the need for boosting confidence in electronic
transactions and restates the objective “to make secure, seamless electronic
interaction possible between businesses, citizens and public authorities,
thereby increasing the effectiveness of public services and procurement,
service provision and electronic commerce (including the cross-border
dimension)”. The Digital Agenda for Europe[3] (DAE) identifies existing barriers to Europe’s digital development
and proposes legislation on e-signatures (Key Action 3) and the mutual
recognition of e-identification and authentication (Key Action 16),
establishing a clear legal framework eliminating fragmentation and the lack of
interoperability, enhancing digital citizenship and preventing cybercrime. The Roadmap for
Stability and Growth[4] underlines the key role of the future common legal basis for mutual
recognition and acceptance of eIAS across borders for the development of the
digital economy. 1.3. External
expertise and consultation of interested parties The Commission has
collected feedback from Member States, the European Parliament and stakeholders
during discussions, workshops and conferences. The Commission launched a number
of studies in relation to eIAS (see annex
3) and assessed available literature published by third parties. A wide online public
consultation on eIAS was launched from 18.2.2011 to 15.4.2011 with a view
to provide input for policymakers on how eIAS can contribute to delivering the
European Digital Single Market[5]. The on-line questionnaire was accessible through the "Your
Voice" website. The consultation was complemented by a "SME Test
Panel" to identify the specific views and needs of SMEs[6]. 1.4. Commission inter-service consultation and Impact
Assessment Board process To support the
preparation and drafting of this impact assessment, a Commission inter-service
steering group was established. Given the overarching nature of the subject,
all Commission Services were invited to participate. The group met three times.
On 2 March 2012, the
Impact Assessment Board (IAB) asked DG INFSO to submit a revised version of the
report. Following the IAB examination and in line with the Board's comments and
recommendations, the following modifications were made to the report: (a) the
final impact assessment report provides now an structured presentation of the
problems; (b) the policy options are presented more clearly; (c) the report
provides a narrower analysis of impacts and comparison of the options; (d) the views
of stakeholders are clearer distinguished and monitoring and evaluation
arrangements defined. In line with the suggestions of the Board, the report
respects the recommended presentation standards set out in the IA guidelines
and refrains from advance conclusions on the preferred option. 2. Identification
and assessment (definition) of the problem This chapter identifies
and describes the problems at stake. 2.1. Introduction Increasing mobility
and flexibility of citizens and businesses within the internal market together
with the technological transition to digital economies and administrations show
the need for secure and trustworthy cross-border online services that are
accessible without creating new electronic barriers. The examples below should
illustrate the main difficulties citizens and businesses encounter today when
it comes to the cross-border use of eIAS services. Examples - Elisa, a Belgian
student, wants to enrol in a university in Italy. She logs in to the university
website and discovers that she cannot use her Belgian electronic identification
when she is asked to identify herself. The reason is simple: her Belgium eID is
neither recognised nor accepted in Italy. Elisa then has to buy a train ticket
to Italy and to queue up to do the necessary paperwork in person which
involves an unnecessary waste of time and money. - A SME based in Hungary
wants to participate electronically to a public call for tenders launched by
the Portuguese administration but because of specific national requirements and
interoperability problems the electronic signature is denied. As a result, it
will need to submit a bid on paper, which implies additional administrative
burdens and costs for the company (printing of multiple copies and sending them
by courier) and, hence, impair its competitiveness compared to Portuguese
competitors. - An international
company based in France wants to sign contracts electronically with a
counterpart based in Latvia. This is technically possible, but the legal requirements
for trust services such as electronic seals, electronic documents, time
stamping, etc. differ. The French multinational company will need to perform a
very expensive exercise to assess whether it is legally possible to use
electronic documents and processes. -
An notice of default must be delivered from Estonia to Germany. The Estonian
sender would like to use an electronic document, but is this legally valid
under Estonian and German law? He will need to examine the applicable laws in
both countries, and in case of ambiguities will likely opt for paper mail. In the sections
below, we will identify the specific problems concerning the secure and
seamless cross-border use of electronic identification, authentication and
signatures encountered by the different stakeholders, describe possible
solutions and explain the consequences of the lack of a common European
framework regulating eIAS. 2.2. Lack
of a common framework for electronic interactions and main problems eIAS services are pre-requisites for a wide range of electronic
interactions such as e-banking, е-government or е-health services. A regulatory
framework has been set up at EU level for electronic signatures, but there is
no specific framework for mutual recognition and acceptance of elD and
е-authentication, or for related trust services such as the time stamping, long-term
preservation of e-signatures or registered document delivery services. Problem 1:
Fragmentation of the Market a) e-signatures With respect to e-signatures
the CROBIES[7]
Study has demonstrated that the European harmonisation brought about by the
e-signatures Directive is imperfect and incomplete, resulting in market
fragmentation. The major problems identified are: (1)
Divergent national implementations due to
different interpretations by MS of the current Directive[8] leading to cross-border
interoperability problems and thus to a segmented EU landscape and distortions
in the internal market[9]; (2)
A de facto usage of the "public
sector clause" of the Directive[10]
to justify additional requirements for the use of electronic signatures in the
public sector. As a result, the Commission is unable to undertake actions when
eSignatures barriers are created or maintained by the Member States in the
public sector, as they can be justified on the basis of the public sector
clause. Thus, interoperability challenges within the EU public sector can
remain, contrary to the goals of the Directive[11]; (3)
Outdated standards leading to a highly complex
EU standardisation framework. Standards are no longer in line with current
market expectations, e.g. the use of mobile phones[12] or highly secure remote
signing technologies[13]
are increasingly popular in the European e-signature market, but they are not
clearly addressed by the European framework[14]: (4)
Trust in e-signatures depends to some extent on national
supervision[15].
The Directive is vague on supervision obligations, leading to a lack of trust
as the effectiveness of supervision regimes is unclear, and creating market
distortions for service providers who need to meet different standards
depending on their country of establishment[16]. b) Electronic
identification The usage of electronic
identification is most often limited to the access
of national online services and interactions, i.e. an eID issued in one MS cannot
be used to access online services in a different Member State. The reasons are
of technical and legal nature: (1)
Member States use different technological
solutions for personal identification which lead to interoperability problems
when it comes to cross-border interaction. (2)
There is no framework of reference for
determining the reliability of the entity that issued the eID, the legal
certainty on the cross-border use of eIDs and a clear liability for the
correctness of the ID when it is used as electronic representation of a person. The consequences are discrimination of non
nationals and their exclusion to the access to online services. Evidence of the
effect of electronic barriers is provided in the context of the implementation
of the Services Directive[17]. According to
Article 8 of the Services Directive, Member States are obliged to enable
service providers who want to establish or exercise a business in another
Member States to complete certain administrative procedures through Points of
Single Contact, i.e. websites which act as one-stop-shops for this purpose.
This implies that Member States need to provide online services that allow
service providers to electronically interact with public authorities. In cross
border scenarios, this is highly complicated due to the missing link of mutual
recognition and acceptance of electronic means of identification (including
specifically official eIDs) throughout the EU. Exchanging electronically signed
documents will be equally difficult due to a lack of interoperability. Example An
Austrian citizen moving to Portugal wants to change his address. The website of
the local community where he wants to live asks him to insert the eID card into
his card reader. The Austrian citizen however has no Portuguese eID card but an
Austrian mobile-ID, and the Portuguese commune cannot recognise, accept or
validate the Austrian mobile-ID. The Austrian citizen will have to go to the
city hall in person to change the address. c) Related trust
services With respect to related
trust services, the lack of a common European framework has led to: (3)
The adoption of national rules for some of these
services in some Member States[18]
resulting in potential internal market barriers); (4)
high costs for those service providers who want
to offer their services in other Member States due to the fact that they need
to ensure technical compliance with the rules of the country of destination and
obtain guarantees with respect to trustworthiness of foreign eIAS tools. European companies
providing related trust services are unable to offer their services in
other Member States without incurring in extra costs. Today, conditions are clearly not favourable for dedicated suppliers
of eServices and products in the eIAS market[19].
Example The
Austrian eSignature Ordinance[20]
specifies requirements for qualified time stamping services, including
technical parameters and algorithms which must be used. In contrast, the
Romanian Decision no.896 of 2 October 2008[21]
has its own and different set of standards and norms for time stamping. If time
stamping service providers from other Member States want to ensure the validity
of their services for clients in Austria and Romania, they will have to satisfy
contradictory requirements. This is a clear market barrier for this related
trust service. Problem 2: Lack
of trust and confidence One of the current
barriers impeding European citizens to benefit from the same kind of services
in the digital world as in the physical world is the lack of trust and confidence
in electronic systems[22],
the tools provided and the legal framework, e.g. a feeling of absent legal
safeguards in comparison to physical interactions. The
SME Test Panel replies on e-signature and eID shows that only 11% of SMEs use e-signatures
in the context of cross-border transactions. The lack of common trust
enhancing rules for eIAS was clearly mentioned as a barrier to the cross
border use[23].
This is also confirmed by the public consultation[24]. For e-signature,
the requirements that aim to ensure an adequate security level for e-Signature
services provided for in Directive 99/93/EC are somehow weakened, as detailed by
the "CROBIES" study[25]. For example, as already
mentioned under problem 1, national supervision requirements are
qualitatively very different from MS to MS, ranging from a simple
notification letter of the certification service provider to the supervisory
body to full and periodically recurring audits. This makes it very complex for
relying parties to assess how effectively a service provider is supervised. For eID and related
trust services, the lack of a common European legal framework does not enable
citizens, businesses and administrations to feel secure when interacting online
in cross border scenarios. In particular for
eID and in the context of eGovernment, a major concern is a ‘trust tension’[26] between the need to collect
data on individuals as the basis for providing services, such as electronic health
records and voter registration, and fears of data surveillance or the inappropriate
secondary use of personal information in computer databases. eGovernment raises
indeed particular trust concerns as a number of public services require the
handling of personal data in digital forms[27].
It is therefore of the utmost importance that access to personal data is highly
secured with advanced authentication and identification procedures for end
users to feel confident. 2.3. The
drivers behind the identified problems The main drivers
behind the two identified problems are the following: Driver 1: Insufficient
scope of the current legal framework The current
framework on e-Signatures covers only one of the eIAS-components which are
necessary for the ecosystem of certification services. Hence, legal
uncertainty leading to a lack of trust (problem 2) and new market distortions (problem
1) will inevitably arise, in particular for the mutual recognition and
acceptance of eIDs and related trust services. The narrow scope of
the eSignature Directive results in a patchwork of different national rules for
electronic identification, authentication and related trust services leading to
distortions of the internal market[28]:
although an related trust service provider is allowed to provide services in
other Member States, it cannot provide guarantees with respect to the legal
value of its services. Worse yet, national legislation may be contradictory
between countries, meaning that a service provider would at the very least need
to modify its service offering on a per country basis. De facto, this is a significant
disruption of the eIAS market in Europe. Legal certainty offered by a single Member State is not
sufficient for the take up of the digital economy. The functioning of the Digital
Single Market will depend from the capability to enable the cross-border use of
eIAS. Example The
Italian Decree of 11 February 2005, nr. 6810[29]
establishes rules for electronic registered mail, including references to
mandatory technical requirements. Service providers offering electronic
registered mail services in other countries would need to satisfy these
requirements in order to be legally considered as equivalent to registered mail
in Italy. Most likely, service providers in France would not meet this bar,
even if they comply with their own legal requirements under Article 1369-8 of
the French Civil Code and the executive Decree of 2 February 2011 (n° 2011-144)[30]. Driver 2: Lack of coordination
between eSignature and eID developments National eIAS infrastructures and systems were developed in
isolation without coordination at European level[31]. On the one hand,
the result of these different approaches is the absence of cross-border
interoperability of technical solutions which creates barriers to the
operational achievement of electronic transactions (problem 1). On the
other, the lack of mutual recognition and acceptance is one of the main
reasons why both users and providers of online services are sceptical about
the deployment of eIAS (problem 2). With
regard to eSignatures, the existing Directive foresees mutual recognition
rules of qualified certificates. However, due to the aforementioned problem in
the Directive (diverging national implementations of eSignature systems, Member
States often dismissing foreign signatures in public sector applications),
mutual recognition and acceptance of eSignatures remains problematic in
practice. With
regard to electronic identification, what is missing today is the
possibility of citizens and businesses to use their "official eIDs"[32] throughout the EU when they
need to interact electronically with public administrations of other Member
States in cases they e.g. want to move, travel, study, work or do business
abroad. The lack of commonly agreed legal provisions
allowing for mutual recognition and acceptance of each others' "official eIDs"
makes it currently almost impossible for citizens and businesses to access
cross-border online services of other Member States when they need to identify
themselves electronically. They are cut out of these services due to the
fact that almost no MS foresees the use of other MS' "official eID"
in their online processes or their mutual recognition and acceptance[33]. Besides this cross-border dimension, there is
also a "cross-sector" dimension: eIDs can be issued by private or
public sector parties, and/or their use may be specific to a sector, such as
social security, e-payment or eHealth. In both cases, the absence of a general
framework for eID recognition and acceptance makes it hard to use an eID
outside of its context, mainly because of liability and data protection
challenges. With respect to liability, the primary issue
is that eIDs are made available under a set of guarantees and warranties that
are appropriate for the use in a specific context. Bank issued eIDs will have
liability limitations (e.g. a ‘liability cap’ limiting the liability of the
issuer to an amount of 5.000 EUR) which are appropriate for use in banking
applications. However, these may be insufficient for cross-sector us: a
liability cap of 5.000 EUR might be inappropriate for a public procurement
application in which bids with a value of millions of EUR could be submitted.
With respect to data protection, the challenge relates to ensuring that
personal data is not made needlessly available to third parties. An eHealth
card may e.g. contain health information, or information on the social
insurance scheme of the holder. It would not be appropriate for this
information to be made available to any recipient that does not require it
(e.g. when using the card in an e-tax application). Therefore, clear rules are
needed to determine which data can be share in cross-sector applications, and
to what extent. Example A study[34] showed the important role
of the private sector in some Member States, noting that “13 out of 32
surveyed countries are deploying government supported eID cards, including
however a group of six countries relying on eID cards issued by private operators
with a public sector mandate (Austria, Iceland, Liechtenstein, Luxembourg, the
Netherlands and Sweden); in the seven others eID cards are issued by public
bodies (Belgium, Estonia, Finland, Italy, Lithuania, Portugal and Spain).” The
same study also examined sector specific eIDs, identifying eHealth and
social security eID cards in 6 countries (Belgium, Croatia, Denmark, France,
Italy and Poland); and noting that identification numbers were subject to
legal usage restrictions in 20 out of 32 examined countries to minimise privacy
risks. Both the
cross-border and cross-sector dimensions share the same general challenge, i.e.
allowing electronic information to be used outside of its original context
(with that original context being either a specific country, or a specific
sector, or both (a sector within a country). EU-wide mutual recognition and acceptance of
electronic identification and authentication is vital to ensure the
scalability and sustainability of eIAS which depends on the volume of
cross-border services accessible without barriers and discrimination. Driver 3:
Lack of understanding of security guarantees The e-signatures
Directive recognised that legal certainty can only be attached to electronic
signatures that offer high security guarantees, and are thus sufficiently
protected against forgery or fraud. To this end, the Directive introduced a
category of e-signatures referred to as ‘advanced signatures’, which, under the
current state of the art, require the use of cryptographic algorithms. If the
processes and devices used to create such advanced e-signatures meet clear
security requirements[35],
then the Directive guarantees to these e-signatures the same legal effect as
handwritten signatures. This highly secure type of e-signature is commonly
referred to as a ‘qualified e-signature’. It is of course not
possible to eliminate all security risks: ·
a person might give his or her smartcard and signature
PIN to a third party. This is like giving a signed blank check to somebody or
to sign a blank page. ·
similarly, the use of highly secure devices such
as smart cards does not guarantee that there is no virus on the PC of the
signatory that could try to corrupt the signing process. A virus could sign
changed or additional documents after the signatory enters his or her PIN-code,
in addition to (or instead of) the document the signatory wanted to sign. ·
In much the same way, corrupted or badly
designed signing software might not display faithfully what is to be signed to
the signatory. To date, there is
no report that any qualified e-signature was ever forged. Furthermore, some
manufacturers offer today fully autonomous external devices (e.g. in the form
of USB-drives) that can perform all the computing operations required to create
a qualified signature, without dependence on additional software including to
ensure a proper display of the data to be signed on the PC screen. Thus,
security guarantees are still continuously improving. What the above
highlights, is that high and harmonised security requirements are essential to
create trustworthy solutions (problem 2). This is particularly relevant for the
access to services where sensitive personal data are involved, such as eJustice,
eGovernment and eHealth. The lack of secure
electronic identification and authentication systems is perceived by users
of online services as an important or very important barrier[36]. The traditional userID /
password systems used for accessing online services are often not sufficient
for public administrations, since they need to establish exactly who is asking for
a specific service and whether it is indeed the person he claims to be, in
order to deliver the requested service. To overcome the difficulty
of identifying a person in an unambiguous manner, Member States have
progressively introduced "official eIDs" in recent years, which in
many countries are embedded on ID cards (e.g. BE, EE, DE, PT, ES); in others
they are designed as citizen cards or mobile-ID used simply to access public
online services (e.g. AT)[37].
Yet, the lack of a harmonised legal framework means that the security and
reliability of "official eIDs" cannot be objectively determined
across borders. This creates cross-border barriers thereby leading to a
lack of trust (problem 2) and a fragmented market (problem
1). Another main concern
with regard to electronic identification and authentication is related
to the potential of online theft and fraud[38].
Secure eIDs can help reduce this risk, by combining state of the art
cryptography with common security practices such as private PIN-codes or
passwords. Inversely, badly secured eIDs can increase the risk of identity
theft by making it easier for criminals to obtain false or compromised eIDs. Example National eID
cards commonly base their security policies on the best practices pioneered by
the financial sector to reduce fraud risks. The Belgian national eID card has a
limited duration of five years (shorter than the paper card which it replaced),
operates using a PIN-code only known by the citizen, and can be revoked if a
card is stolen or lost. Like a bank card, the card blocks itself automatically
after three unsuccessful usage attempts. Revocations are published online (https://www.checkdoc.be/CheckDoc/),
and revoked cards cannot be successfully used for electronic identification or
electronic signatures. An online card-stop website and phone number are
available to citizens and the police to immediately block lost or stolen cards
(https://www.docstop.be/DocStop/).
Currently, the
EU has no common practices that would help citizens, businesses and
administrations make the distinction between secure and insecure eIDs. As they
can only trust eIDs that they know in detail, this leads to fragmentation
(problem 1) and lack of trust (problem 2). Driver 4: Lack of awareness and
user adoption The complexity
behind the technologies used in online transactions and the key role played by
trusted third parties result in an environment where it is difficult to assess
trust (problem 2). Particularly end users (citizens and SMEs) who
generally do not have sufficient expertise must be able to rely on rules which
establish clear rights and responsibilities of all stakeholders (online service
providers, end users and governance bodies such as supervisory authorities). Concerning the market demand for trust enablers (eIAS
services) and related trust services, the public consultation demonstrated that
different stakeholder groups (users, policy makers, industry, businesses) are
not fully aware of the added value of eIAS[39]
to secure online transactions. The
SME Panel showed a similar result[40],
which becomes less significant as soon as the use of electronic applications in
general is assessed[41].
2.4. Who is affected and to what extent? The following players of the eIAS market are
the main stakeholders affected by the problems identified: On the supply side, eIAS service or
solution providers mainly suffer from the fragmented market (diverging
national rules and standards) which leads to barriers to enter other European
markets and hamper the deployment of cross-border/cross-sector services. On the demand side, the lack of trust: - prevents the public sector from
moving towards modernisation, cost effectiveness and re-organisation in view to
delivering faster high quality services with less resource consumption (i.e.
reduction of administrative burden); - limits the market for the private sector,
i.e. the European providers of such services, as the legal value of their
services may vary from MS to MS; - reduces confidence and ease of use for end
users who lose the potential benefits that eIAS offer (especially in
cross border scenarios). For an extended overview of the
difficulties encountered by each of the stakeholders and the interest in the
revision of the framework, please refer to Annex 7 2.5. Baseline
scenario - how would the problem evolve, all things being equal? Technological advances are likely to
increasingly threaten Internet security jeopardising the trust and confidence
of users in electronic systems, tools and legal framework. Example The UK
National Fraud Authority estimates that in the UK alone, identity fraud is
estimated to cost victims around £1.9 billion a year (approx €2.3 billion), or some
€36 per capita. As noted in the report, “if the costs of responding to and
dealing with identity fraud are taken into consideration, it is estimated that
the real cost of identity fraud is at least £2.7 billion a year”[42], or €3.2 billion in total or
some €52 per capita. Extrapolated across the EU and assuming equal prevalence
and cost, this would amount to an estimated total cost over €26 billion. The extent and seriousness of the problems
identified under section 2.2 are therefore also expected to increase. Without
further regulatory intervention, it is anticipated that under the baseline
scenario the problems in the current situation would evolve as follows: Fragmentation, interoperability
problems not solved Member States are likely to continue to
implement and enforce the eSignatures Directive in a diverging manner,
including by regulating other services than eSignatures as shown in the
examples above, leading to interoperability challenges and market fragmentation.
As further EU integration and globalisation is expected to result in an
increase in the numbers of businesses operating in more than one Member State
and of citizens performing electronic transactions beyond national borders,
this will become an increasingly greater burden to the mobility of citizens and
businesses. Legal certainty not ensured The problems driven
by the lack of mutual recognition of electronic signatures and by the absence
of a legal framework regulating eID and related trust services would impede the
legal recognition of a range of cross-border interactions. If no common legal
framework exists, cross border scenarios would be avoided due to reasonable
doubts over the legal value of key services in other Member States. The components required
to ensure a legally-proof (irrefutable in front of the Court) interaction like,
e.g. the time (time stamping) or the identification and authentication of participants
(eID) would still be missing. Without certainty on the legal validity of
transactions, take-up of the use of electronic interactions would not increase. Users' needs not fully
satisfied Technological
developments are a key factor in increasing the demand for services by
improving user friendliness. An emerging signature model which is likely to
become very popular is the "remote signature" where the
cryptographic operations are executed on a secure server (called HSM or Hardware
Security Module) of a service provider instead of the equipment of the
signatory – but still under the control of the signatory. This includes mobile eSignatures
(when signing is not performed on the SIM card of the smart phones or tablets)
and mass signature for instance of invoices or contract of a phone company.
Remote signature is excluded by the current framework. Leading European (policy)
initiatives not fully leveraged Recent European policy initiatives which have
endeavoured to eliminate interoperability challenges and cross border
recognition and acceptance issues related to certain types of electronic
interactions will be handicapped by the lack of an appropriate cross-sector legislative
framework. Examples 1. The Services Directive As noted above, Member States are obliged to implement Points of Single Contact which must be accessible to service providers across the EU. In reality, cross-border electronic interactions are in most cases currently not possible since the existing eIDs are only accepted in the country in which they are issued. Similar challenges are encountered with respect to e-signatures (where the legal framework for mutual recognition only covers a small category of e-signatures[43]), and for the communication of e-documents (which is often impossible if e-documents are not accepted). Considering the wide range of service categories covered by the Services Directive and that the fact that the services sector represents around 70% of GDP and employment in the EU, the potential savings missed due to an insufficient legal framework are significant. 2. Roll-out of services building on the results of large scale pilot projects Several large scale pilots (LSPs) have been put in place at the EU level in recent years to support the development of interoperable and trustworthy means of electronic communication (including SPOCS, supporting the implementation of the Services Directive; STORK, supporting the development and use of interoperable eIDs; PEPPOL, supporting the development and use of interoperable eProcurement solutions; epSOS, supporting the development and use of interoperable eHealth solutions; eCodex, supporting the development and use of interoperable eJustice solutions.) Each of these LSPs represents a multi-million euro investment from participating Member States and the European Union. These investments have yielded a significant number of useful and functioning components to support the use of eIAS services (e.g. e-signature validation services, eID/eAuthentication components, quality assurance policies, secure document storage and exchange facilities, etc.). The participation of Member States in these initiatives shows that there is a clear interest in using the results in operational public eGovernment services. However, the policy framework (including legislation) to do so is currently missing at the European level. This means that the outputs of these LSPs have no formal status: there are mere project deliverables. As a result, the investments made in the LSPs cannot be effectively monetized. By way of example: the STORK pilot represents an investment of €20 million, 50% of which was funded by the European Commission[44]. It has piloted working and successful eID interoperability solutions, allowing citizens from one Member State to use their eIDs in applications managed by other Member States. However, as there is no legal framework covering eIDs (regulating the responsibilities and liabilities of service providers and the rights of end users such as businesses and citizens), project results cannot be taken up outside of this pilot context, impeding the monetization of the €20 million investment. International coordination
opportunities missed Maintaining the current
electronic signature framework would impede achieving the globalisation of
digital transactions. In this regard, a broad common understanding on the need for e-signature
recognition at international level was raised during " Stakeholder
Workshop Digital Agenda for Europe: electronic identification, authentication
and signatures in the European digital single market" held the 10th
of March 2011 in Brussels[45]. Moreover,
UNCITRAL[46]
underlined that international mutual recognition could be eased if Article 9.3[47] of the United Nations Convention on the
Use of Electronic Communications in International Contracts was reflected in EU legislation. More specifically, other regions of the world
are currently developing their own eIAS policies and proposals, including the
US National Strategy for Trusted Identities in Cyberspace[48]. In the absence of a common EU
policy on topics such as eID, the EU would not be able to initiate meaningful
discussions with the USA or other key trade partners on common approaches.
Member States could only engage in bilateral or multilateral discussions.
Solutions would be developed purely at the national level, in isolation of
international needs, trends or standards, thus limiting the appeal of European
eIAS products and services on international markets. Conclusion The baseline scenario suggests that the
existing problems of market fragmentation and lack of confidence would remain
or worsen, and that their negative economic impact would become more
significant: investments cannot be optimally monetised, efficient electronic
processes cannot replace paper alternatives, and cross border trade is
hampered. This would harm the development of the Digital Single Market, and in
extension, of a European Citizenship. 2.6. EU
added value and right to act 2.6.1. Treaty basis Legal basis The legal basis for
the legislative proposal is Article 114 TFEU[49].
Indeed, the legislative proposal intends to remove existing barriers to the
functioning of the internal market by promoting the approximation of Member
States legislation, in particular the mutual recognition and acceptance of
electronic identification, authentication, signatures and related trust services
across-borders when needed for the access and completion of electronic
procedures or transactions. This objective pursued cannot be achieved by less
restrictive means than the legislative proposal. The general division of
responsibilities between the Union and the MS with regard to monitoring and
reporting as established under the e-signature Directive are not affected by
the proposed changes compared to the current situation. It
should also be noted that the electronic signatures Directive 1999/93/EC was already
based on article 114 (ex article 95: "Having regard to the Treaty
establishing the European Community, and in particular Articles 47(2), 55 and
95 thereof[50]"). The legal basis of Directive
1999/93/EC is also adequate for related trust services, as they build on
e-signatures and other eIAS components, and share the same challenges and
complexities. Identity
management as such in relation to official eIDs falls under the subsidiarity of
Member States. The scope of the proposal is the mutual recognition and
acceptance of certain official eIDs (as notified by the Member States at their
own choice and discretion), and not harmonisation of national eID-systems and
infrastructures; the latter would likely not be permissible under the legal
basis of Art. 114. What the new regulatory framework would provide for is the
"free movement" of official eIDs used at national level including
their use in each Member States regardless of where they are issued. Finally,
it is important to stress that the proposal (like Directive 1999/93/EC) would not
make the use of any eIAS service obligatory for citizens, businesses or
administrations. The goal of the proposal is solely to ensure that they have
the possibility of using eIAS services when they want to, including in cross-border
or cross-context situations. 2.6.2. Subsidiarity In order for EU action to
be justified, the subsidiarity principle must be respected: a) Transnational
nature of the problem (necessity test) The transnational nature
of eIAS is an important element in determining whether EU action is necessary.
Domestic action alone would not suffice for the fulfilment of the objectives
and the achievement of the targets set out in the Europe 2020 Strategy[51]. Conversely, experience has shown that national
measures have de facto created barriers to the EU-wide
interoperability of e-signatures, and that they are currently having the same
effect for eID, eAuthentication and related trust services. It is therefore necessary that the EU creates the enabling
framework for addressing cross-border interoperability. Improvements to the supervision
schemes, which would now also encompass related trust services in addition to
eSignatures, also require EU level coordination. b) Effectiveness test
(added value) Action at EU level would
produce clear benefits compared with action at the level of Member States. The
objectives outlined below are currently not being achieved by voluntary
coordination among Member States, nor are they reasonably likely to be
addressed by coordination in the future, due to the risk of duplication of
efforts, setting different standards, transnational characteristics of the
spill-overs generated by ICT, and the administrative complexity of establishing
such coordination through bilateral and multilateral agreements. In addition, overcoming
the identified problems, such as an absence of legal certainty related to a
lack of mutual recognition of national provisions due among others to a
heteroclite interpretation of the legal texts and a lack of interoperability of
the systems set up at national level due to non-adapted technical standards,
requires the co-ordination across all EU27 MS which can be carried out more
effectively at the EU level, thereby ensuring interoperability and EU-wide
usability. EU action will ensure that gaps and weaknesses are clearly
identified and concrete action is taken to address the issues at stake. Due to eIAS inherent non-territoriality nature, action at EU
level would be adequate and proportionate to implement the Digital Single Market.
Regulatory measures taken at Member States level cannot be expected to achieve
the same outcome. 3. Definition
of the policy objectives In accordance with
the Impact Assessment Guidelines[52], when defining objectives, a distinction is made between general,
specific and operational objectives. Three
general objectives have been identified: ensuring the development of a
digital single market; stimulating and strengthening competition in the single
market; enhancing user-friendliness (citizens and businesses). These objectives
are in line with strategic EU policies such as the EU 2020 Strategy, the
Digital Agenda for Europe, the Single Market Act and the Roadmap
for Stability and Growth. The general objectives identified are the following: 1. The development of a Digital Single Market 2. Stimulating and strengthening sustainable competition in the Digital Single Market 3. To promote the interest of consumers and to ensure high level of consumer protection for all EU citizens and businesses. The specific objectives express the desired outcomes
specifically related to the eIAS market (the ‘what’) of putting in place
the operational objectives (or ‘measures’). Particular attention was
given to presenting both the envisaged economic objectives (e.g. Specific
objective 1) as well as social objectives[53] (e.g.
Specific objective 5). The specific objectives identified are the following: Increase the availability of cross-border and cross-sector eIAS services and stimulate the take up of cross-border electronic transactions in all sectors (public and private); Ensure an optimal level and scope of governance; Ensure that competitive market developments are stimulated and that technological developments are not hindered in the eIAS market; Strengthen the competitiveness of the European industry and services sector; Ensure that all consumers can benefit from the advantages of (cross-border) eIAS services. Finally,
the operational objectives are directly derived from the problem and problem
drivers identified in sections 2.2 and 2.3. (cf. intervention logic under 3.1),
and point out ‘how’ appropriate policy option can help solving the problems. The operational objectives identified are the following: 1. Ensure mutual recognition and acceptance of notified eIDs 2. Ensure usage of notified eID by public and private sectors 3. Ensure effective supervision models by eIAS 4. Ensure interoperability of eIAS (cross-border and cross-sector) 5. Ensure trust and confidence in the legal certainty and security of eIAS 6. Ensure maximum reduction of administrative burden and increase quality of services. (awareness raising) 3.1 Overview of general, specific and
operational measures 3.2 Intervention logic The intervention logic linking the main problems and the operational
measures is illustrated in the next figure: 4. Policy
options In order to solve the problems and meet the
objectives set out in the previous sections, three different sets of options
are considered, respectively addressing the scope of the envisaged framework,
the legal instruments and the supervision organisation. 4.1. Options
for the Scope of the Framework Option
0: Repeal of the e-signature Directive and no regulatory activities with
respect to eID or related trust services This policy option implies the cessation of all EU activities in the
field of electronic signatures including those already started. It would thus
lead to repealing Directive 1999/93/EC and its two related Decisions
2000/709/EC and 2003/511/EC. Any directives referring to Directive 1999/93/EC
would need to be amended. Only national legal frameworks would remain and would
be free to evolve based solely on the preferences of national legislators. This option also implies
that no legislation would be adopted on eID, e-authentication and related trust
services. Option
1 No policy change This option
corresponds to the baseline scenario developed in section 2.5 above. It implies
retaining the e-signatures Directive as it stands. It should be noted that one
of its weaknesses (outdated references to technical standards) could be
addressed by revising Decision 2003/511/EC. Option
2 - Enhancing legal certainty, boosting coordination of national supervision
and ensuring mutual recognition and acceptance of eIDs This option consists
of expanding the scope of the e-signature Directive by including new provisions
for the cross border recognition and acceptance of certain eIDs. The provisions
of the current Directive in relation to electronic signatures would be revised
in order to solve its current weaknesses. Within this policy
option, the primary change in scope is thus the mutual recognition and
acceptance of 'notified' eIDs, i.e. official eIDs which the Member States
consider suitable for cross-border use[54].
These should benefit from general recognition and acceptance, both in a
cross-border and cross-sector context. Practically, this would imply that
EU-wide use of notified eIDs would become possible in any online interaction
where reliable identification is needed, irrespective of the location of the
end user or service provider. Through the cross-sector approach, the private
sector could also benefit from notified eIDs, in the same way as they can
currently rely on paper official identity documents in offline contexts,
instead of being required to develop their own eID-solutions. It should be noted
that the concept of a notified eID is not limited to public sector issued eIDs:
Member States could also notify eIDs issued by the private sector that they
recognise to be used for their own public sector services. This approach is
necessary to ensure that the strategy is applicable and useful to all Member
States, as not all Member States all Member States have eIDs issued by the
public sector. The outcome would thus be an eID scheme that is conducive to
supporting any eID policy choices made by a Member State at national level. Example: the Netherlands have not yet introduced an official electronic identity card. In the meantime, citizens can use a scheme based on usernames, passwords and SMS confirmations to identify themselves. This scheme is called DigiD[55], and is managed by the public sector. Businesses can identify themselves electronically using solutions offered by the private sector, which have to observe the rules established by the government in a scheme called eHerkenning[56]. Thus, the Netherlands is an example of a country that uses a mixed private-public sector model, for which a cross-sector approach would be important to achieve cross border interoperability. Option
2 would also require that data protection provisions are integrated into the
proposal, to ensure that eID providers are not able to track the behaviour of
eID holders. This is particularly relevant when cross-context usage is
considered: private sector eID issuers should not be able to track when their
customers use eGovernment applications, nor is it desirable that public
administrations can track eID use in private sector services as a matter of
course. Existing experiences at the Member State level can be leveraged to
achieve this result, and the proposal will be aligned with the currently
ongoing revision of the Data Protection Directive (including specifically with
respect to privacy-by-design rules[57]). Example: the Austrian Citizen Card is known for its high level of data protection. The unique identification number of each citizen (the so-called sourcePIN or Stammzahl) is cryptographically hidden from service providers. They can only see identification numbers which are derived from this sourcePIN on a sector per sector basis. As a result, they cannot link citizen behaviour between different sectors. Option
3 – Expansion to incorporate certain related trust services This option expands option 2 by including
further related trust services and credentials in the scope of the legislative
framework. Essential related features to be added in the legislation would be: − Time stamping, i.e. the application of a trustworthy time reference to electronic data, so that its existence at a given point in time can be determined with certainty. − Electronic seals, i.e., the equivalent to the signature of a legal person[58]; in practical terms, this can be thought of as the electronic equivalent of stamps or seals on paper documents, which are tied to a legal entity rather than to a natural person. − Long-term preservation of information, i.e., to ensure the legal validity of electronic signature over extended periods of time, ensuring that e-signatures can be validated irrespective of future technological evolutions. − certified e-document delivery, i.e., the reliable and verifiable electronic delivery of data; this can be thought of as the electronic equivalent to traditional registered mail.[59] − admissibility of electronic documents, i.e. ensuring that paper documents can be converted into electronic equivalents without losing their legal validity; this can be thought of as an electronic equivalent to the paper certified copy (copie conforme). − Website authentication, i.e. an obligation for legal person’s website to include trusted information (e.g. a certificate) allowing the user to verify the authenticity of the website and the existence of the legal person. 4.2. Options for the Legal
Instrument of the Framework Option
A: One comprehensive legal instrument vs Option B: Two separate legislative instruments In the context of these sub-options, two
alternatives are considered for the legal instrument that could implement the
options for the scope of the framework. The legislation would either consist of one
single comprehensive measure covering electronic identification, authentication
and signatures; or of two instruments, namely an Act on electronic
identification and authentication and an Act for the revision of the eSignature
Directive. Option
C: Directive vs Option D: Regulation In the context of these sub-options, the
legislation(s) would either consist of a Directive or of a Regulation. 4.3. Options
for the Level of Supervision of e-Trust services Option
i): Maintaining national supervision schemes (“basic variant”) This option envisages
maintaining the current national based supervision schemes, but with stronger
harmonisation through high level common essential requirements, including e.g.
regular audits of supervised service providers. These essential requirements
should ensure that all national supervision schemes attain a quality level that
fully ensures security and legal certainty. Option
ii): Establishing a EU-based supervision system (“advanced
variant”) This option
envisages the establishment of a EU-based supervision system. The goal would be
to ensure that differences between national supervision approaches are either
further reduced or eliminated entirely, depending on the preferred sub-option
under this scenario. The first and
conceptually simplest sub-option under this scenario would be to eliminate
entirely the existing national supervision schemes, and replace them with a
single European supervision scheme and body. In this sub-option, either a new
European body would have to be created to perform this supervisory function, or
an existing European body would be given this duty. A second sub-option
is to establish a federated supervision system involving an EU-based
supervisory body (again, either as a new body or as an additional mandate for
an existing body) while maintaining the national supervisory schemes and
bodies. Under this federated system, the exact responsibilities of the European body might include: - Interpretation of minimum requirements to be followed by national supervisory bodies; - Supervision of trust service providers established in a Member State, if that Member State has chosen to delegate its supervision competences to the European supervisory body[60]; - Supervision of trust service providers established outside of the EU that also wish to be supervised in Europe on a voluntary basis; - Possibly supervision of remaining national supervisory bodies. 5. Assessment
of the policy options In the following
sections, the policy options will be assessed and compared to the baseline
scenario (i.e. Option 1: Status Quo). 5.1. Scope of the Framework The sections below
present the effectiveness[61]
and coherence[62]
of the different options for the scope of the framework. For the assessment of
the efficiency[63]
of these options, we refer both to the indications of possible the cost(s)
incurred and cost savings made by the different parties involved as well as to
the comparison of the costs of governance (cf. section 0) and costs of managing
the supervision (cf. section 5.3.3). 5.1.1. Assessment of Option 0: ‘No EU Policy’ Economic,
social, environmental impacts and administrative burden of option 0 Member States would
be free to modify substantially their internal legislation, going from
maintaining their current transposition law, to properly cancelling it, and
having also the opportunity to simply adapt it to their own needs. Bilateral or
multilateral agreements would likely be reached between some Member States with
a common view of the topic or with common economic objectives. An integrated
approach set up amongst all 27 Member States, even if theoretically possible,
seems to be an unlikely option. If Member States
collectively decide to cancel their own internal law, then this would lead to a
legal no man's land with absolute market freedom. However, in the absence of a
legal framework, there would also be absolute uncertainty as to the legal
validity of any such service. Economically, the
risk related to investing in eIAS services would remain high and payback
periods long and uncertain. Most probably, all investments made at EU, Member
States, and private sector level would be, proportionally to the attitude of
Member States, lost. Example: a number of Member States have invested in electronic identification cards that allow also the creation of qualified electronic signatures, to ensure that the resulting signatures would be legally equivalent to hand written signatures across the EU (including e.g. Austria, Belgium, Estonia, Spain, Italy). In the absence of European harmonisation on this point, this guaranteed legal effect would disappear, and the millions of Euros invested by each of these Member States in order to achieve this effect would be to some extent wasted. Example: several Member States have implemented Points of Single Contact that rely on the legal framework of the e-signatures Directive and the Commission Decisions to achieve at least a small degree of cross border interoperability (e.g. Cyprus, Greece, Spain, Liechtenstein and Lithuania). If this legal framework disappears, then these Member States would have to develop entirely new solutions, and their existing developments would be largely wasted. Socially, there is a risk to see high and
low level jobs disappear. Indeed, if the electronic signature was no more
effective at cross-border level, the risk of collapsing companies would be very
high due to the fact that the market would be more fragmented and that only the
national market would be easily accessible for companies. In this regard, the
customer potential would be hugely reduced. Environmentally, the potential
benefits raised by the use of electronic interactions – mainly represented by
the reduction of the amount of paper used – could be nullified. The only aspects that would benefit from
this option would be the decreasing of the administrative burden at Member
States level brought by the cancellation of the supervision model, and ensuring
complete freedom for market developments. This option would thus give optimal
room for the development and uptake of voluntary industry initiatives and
standards, such as e.g. OpenID[64]
and the Kantara Initiative[65].
However, it should be noted that these initiatives are by themselves not
sufficient to resolve the identified problems of market fragmentation and
especially the lack of trust, as they do not have any regulatory backing to
establish rights and obligations for services providers and end users. Finally, cancelling
all activities at EU level in the area of electronic signatures would have, on
the one hand, an impact on other EU policies. Indeed, EU policies on
e-invoicing, e-procurement or VAT are strongly related to the efficiency of
cross-border electronic signature. Example: the Public Procurement Directives 2004/17/EC and 2004/18/EC allow Member States to require qualified electronic signatures for the submission of offers. As shown in the 2010 Evaluation of the 2004 Action Plan for Electronic Public Procurement[66], 6 Member States make the use of such signatures mandatory. In total, 13 Member States require the use of at least advanced electronic signatures as regulated by the Directives. The elimination of European rules could threaten all investments made in this policy area, which are based to some extent on the concepts introduced by the Directive. On the other hand,
it would also have a negative impact on potential alignment with third
countries. A fragmented legislation implies the practical impossibility to
reach an agreement at international level to create a global safe environment
for electronic transactions based on electronic signatures. Effectiveness
of Option 0 Based on the
assessment of the economic, social and environmental impacts, the following
conclusions are obtained regarding each of the specific objectives (cf.
detailed assessment presented in Annex 10): Specific Objective 1: Option 0 would first of all not
increase the availability and take-up of cross-border and cross-sector eIAS
services. The inability to increase the availability and take-up of
cross-border and cross-sector eIAS services would not allow for a strong
reduction of barriers. Depending on the efforts made by MS to enable e.g. the
dematerialisation of administrative formalities, improvement of the local
situation could be obtained (as is the case in the Baseline scenario), but this
would not solve the problems related to cross-border transactions. Specific Objective 2: Option 0 would not ensure an optimal
level and scope of governance. Without an EU Policy, it would first of all be
very difficult to increase legal certainty, trust and security of electronic
transactions. The repealing of Directive 1999/93/EC on e-signatures would
furthermore take away the only driver available today for enhancing
harmonisation at the EU level and make it possible for MS to create even more
legal and technical barriers than those still remaining today. Specific Objective 3: Option 0 would not stimulate market
developments and could hinder technological developments in the eIAS market by
eliminating any drive for alignment. While the absence of any EU rules could
avoid the risk of steering the market into a certain direction, this benefit is
likely offset by the risk of Member States adopting their own rules (i.e.
rather than one set of rules, service providers might be governed by 27
separate sets of rules). Furthermore, without an EU Policy, the eIAS market
would remain fragmented. Specific Objective 4: Option 0 would contribute even less
to the strengthening of the competitiveness of the European industry and
services sectors. First of all, the EU industry and services sector would not
be able to build business models on their strong eIAS products and services.
Repealing the Directive 1999/93/EC would furthermore disrupt the current
process of working towards the enabling of cross-border electronic services. It
can be expected that, without support at the EU level, MS will not continue
this process on a voluntary basis, or at least that they would be less
efficient in doing so. MS would meanwhile focus on or limit their efforts to
national eIAS services. The trust landscape created as such would not be very
attractive to investments by foreign eIAS operators. and in the longer run, if
eServices would become clearly less developed in the EU compared to other
regions, this could decrease the attractiveness of the EU for many other
sectors. Specific Objective 5: Option 0 cannot ensure that all
end-users can benefit from the advantage of (cross-border) eIAS services.
Without an EU policy, MS will not have many incentives to create an EU trust
landscape that allows participation to the digital single market by all social
groups. (cf. Regional development). Coherence of
Option 0 Finally, it can
be concluded that Option 0 is not coherent at all with the overarching
objectives of EU policy (cf. EU 2020 Strategy, DAE, Single Market Act and the
Roadmap to Stability and Growth) as presented in section 3. 5.1.2. Assessment of Option 1: ‘Status quo’ (No Policy change) Economic,
social, environmental impacts and administrative burden of option 1 Economically, there
is a high risk of low return on investments in eIAS infrastructure, products
and services since new sectors are difficult to access and take-up rates have
remained low. Opportunities created by the European Large Scale Pilots (LSPs)
cannot be grasped as the required framework for doing so is lacking. Moreover, until today, the unavailability of
an appropriate framework has had a negative impact on the availability of
cross-border electronic services. As such, it is difficult to estimate the
cross-border saving potentials based on real life examples. However, the order
of magnitude of the relative savings already estimated or observed at the
national level provide a good proxy for possible cross-border savings[67]. In this regard, it should be noted that: According to the recent communication on a coherent framework for building trust in the Digital Single Market for e-commerce and online services the potential of the Digital Single Market is enormous and would benefit all the territories and economic sectors of the European Union. In the G8 countries, South Korea and Sweden, the internet economy has brought about 21% of the growth in GDP in the last five years. It also generates 2.6 jobs for every job cut and at times accounts for 25% of net employment creation. Online services are by nature cross-border and can speed up European integration and the creation of the Single Market.’ According to the communication on a coherent framework for building trust in the Digital Single Market for e-commerce and online services ‘The Digital Single Market is far from achieving its full potential; the cost of failure to complete it is expected to be at least 4.1% of GDP between now and 2020, i.e. EUR 500 billion or EUR 1000 per citizen. In the Single Market Act , it was recently reiterated that ‘The development of digital technology is one of the main levers for boosting growth and employment in the EU in various respects: the information and communications technology industry (whose added value to the European economy was approximately EUR 600 billion in 2007 ), an increasing number of Europeans who use the Internet on a regular basis or even daily (65% and 53% respectively in 2010 ), a broadband market which was a world-leader in 2010 , a market for public-sector information estimated at EUR 27 billion , to name just a few.’ The availability of cross-border IAS services could be strongly beneficial to the development of intra-EU market access and trade. In 2009, intra-EU trade in goods represented 37% of GDP (EUR 4 320 billion) and intra-EU trade in services 10.5% of GDP (EUR 1 233 billion). Despite this relatively large figure, only a relatively modest 9% of EU citizens carried out purchases from suppliers in other Member States in that same year. Thus, a significant margin of growth for cross border electronic trade still exists. The above-mentioned figures underline the importance of developing all required building blocks, incl. an appropriate cross-sector framework for secure, trustworthy and easy-to-use electronic interactions, so that the Digital Single Market can develop to its full potential. Some concrete examples 1. eProcurement has been commonly recognised as one of the high-impact services to be provided by European governments, with a significant savings potential. Government purchases in the European Union account for an estimated 19% of GDP, or €2,200B annually. Currently, less than 5% of total procurement budgets are awarded electronically, and only 1.6% of contracts are supplied by an entity in another Member State. It is estimated that a hypothetical reduction of average public procurement budgets of 1% due to the implementation of eProcurement would already amount to a saving of 3.92 billion EUR for EU advertised public procurements, and of 21.6 billion EUR for all EU public procurements together. As a cost saving of 5% is commonly quoted as a realistic outcome of implementing eProcurement, savings of 100 billion EUR for universal adoption would be possible[68]. Given the importance of IAS as a current blocking factor in eProcurement, this already shows the vast economic potential of establishing a coherent trust framework for eID, e-signatures, time stamping, long term archiving, electronic registered mail, and other services which are crucial to ensure the reliability and validity of eProcurements. 2.The French electronic health card Sesam-Vitale shows an impressive example of the cost and time reductions of electronic interactions compared to paper interactions[69] in the national context. Taking into account that 190 million European Health Insurance Cards (EHIC) were issued by 2009, and that some 3 to 4% of EU citizens are using their card in case of health care services used abroad, electronic interactions could potentially replace at least some 5.7 million tedious manual cross-border reimbursements if systems would be interoperable. If similar solutions could be implemented in other Member States with similar results, the economic impact could be very substantial. 3. Not all benefits can be expressed in terms of monetary gain. Estonia became an early adopter of eVoting via the Internet (rather than via dedicated eVoting booths) in 2005, leveraging its national eID scheme. While cautioning that this approach would certainly not be more cost effective initially, due to high set-up costs and low scale of deployment (with around 1 million eligible Estonian voters), the use of eVoting was seen as a potential way of increasing voter turnout and participation[70]. Based on available statistics[71], the number of eVoters out of the eligible voters in the population has increased from 3.4% in 2007 to 15.4% in 2011. In terms of actual voters (rather than all eligible voters), eVoter participation rose from 5.5% in 2007 to 24.3% in 2011. Total participation in voting (including electronic and traditional voting) rose from 61.9% in 2007 to 63.7% in 2011. Obviously, this does not prove conclusively that eVoting is solely or even partially responsible for this modest increase in voter turnout, but the increased adoption of eVoting shows the appeal of this option to voters. Furthermore, it is worth noting that eVotes cast by Estonian citizens in foreign countries represented 3.9% of all eVotes in 2011, with votes being cast from a total of 105 different countries. This last figure is a concrete example of digital citizenship being enabled through reliable IAS infrastructure that will become increasingly important as citizen mobility in the EU continues to grow. Socially, the
hindering of market and technological developments are finally hindering the
growth of employment in the ICT market (employment of mainly highly skilled
workers). Administratively and
environmentally, there would be not much room for reducing the administrative
burden by using eIAS, the possibilities would remain limited to some specific
(national) closed environments. As a direct consequence, the possibility of
reducing the amount of paper used would remain very limited. Effectiveness
of Option 1 (cf. detailed
assessment presented in Annex 10): Specific Objective 1: the current framework is not optimally
stimulating market dynamics. If the current EU policy is not changed, the EU
economy would not be able to benefit much from an increased impact of ICT
investments in eIAS services on overall productivity and competitiveness,
especially not for cross-border transactions. In extension, the lack of
availability of eIAS and/or a lack of trust and confidence in (cross-border)
electronic transactions does not allow reaping the benefits related to the wide
availability of broadband connections which could allow exercising many
professions from a distance, incl. in rural areas. Specific Objective 2: The current regulatory approach is
also not ensuring an optimal level and scope of governance. The current
Directive is not providing sufficient legal certainty, trust and security of
electronic transactions throughout the EU. It also cannot be excluded that MS
could continue to use the public service clause[72], leading to interoperability
challenges for which no clear legal recourse is available. Moreover, the
differences in national supervision will continue to lead to fragmentation of
the market and lack of trust. The EU Framework is currently largely limited to e-signatures
reducing the possible economies of scale and scope for suppliers of eIAS
products and services. Finally, since electronic identification and
authentication is currently not included in the EU framework, the risk of fraud
and ID theft can vary between MS and cannot be reduced by EU-measures. Specific Objective 3: The current framework does not allow
the development of competitive markets and technological developments are
hindered. Indeed, the potential offered by innovative services is jeopardised
due to market fragmentation. Specific Objective 4: The baseline scenario is not helping
to strengthen the competitiveness of the European industry and services sector.
Full electronic processing of transactions is currently often (technically) not
possible (e.g. due to interoperability problems at the EU level) and the
development of on-line services is furthermore hampered by legal uncertainty
and trust issues which are not sufficiently dealt with by the current EU
Framework. Development of online services is therefore mostly limited to local
applications. In extension, there is currently little incentive for companies
from outside the EU or from other MS to invest in the development of eIAS
products and services that can be used in a particular MS. Moreover, as for
option 0, in the longer run, if eServices would become clearly less developed
in the EU compared to other regions, this could decrease the attractiveness of
the EU for many different sectors. Specific Objective 5: Option 1 does not ensure that
consumers can benefit from the advantage of (cross-border) eIAS services. The lack
of a sufficient level of trust and security of eIAS infrastructures, products
and services as well as the lack of interoperability make eIAS unnecessarily
complicated (e.g. because of the need of different devices, the unavailability
of notified eID, ...) placing social groups that have less developed eSkills at
risk. Secondly, the faltering development of (cross-sector and cross-border)
on-line services has a negative impact on the accessibility of services (e.g.
eHealth, eGovernment) for people living in rural areas and could thus
negatively affect regional development. Coherence
of Option 1: Option 1
is not coherent with the overarching objectives of EU policy (cf. EU2020
Strategy, DAE, Single Market Act and the Roadmap to Stability and Growth) as
presented in 1.2. 5.1.3. Assessment
of Option 2: ‘Enhancing legal certainty, boosting coordination of national
supervision and ensuring mutual recognition and acceptance of eIDs’ Economic, social, environmental impacts and administrative burden of
option 2 Economically, many types of electronic transactions
become more efficient with an eID system. These systems enable individuals to
authenticate when using online services and create legally-binding electronic
signatures when concluding a contract on-line or registering for a service. Estonia has issued approximately 1.2 million eID smartcards. Since inception, cardholders in Estonia have used their eID to create more than 52 million electronic signatures and authenticate more than 88 million electronic transactions. The government has not placed any restrictions on the use of the eID in the private sector and the authentication mechanism is available to any outside developer. Currently, applications exist for using the eID to authorise online bank transactions, to sign contracts and tax declarations, to authenticate to wireless networks, to access government databases, and for automated building access.[73] The risk of
exclusion from the digital economy for SMEs (and even more for micro-enterprises)
is unlikely to increase. While there is an initial set-up cost for SMEs (or
other end users), this cost is dwarfed by the economic benefits of reduction of
administrative burden through trustworthy economic communications. Through the Estonian e-Business portal, a simple limited liability company can be set up entirely electronically. This type of business is particularly suitable for SMEs. The entire process can currently be completed online in18 minutes[74]. Creating a company via the internet requires an Estonian ID card, or alternatively ID cards from Belgium, Portugal, Lithuania, and Finland. A legal framework for eID recognition could boost the scope of this project to other Member States, as Estonia would be able to trust eIDs from other Member States without assessing them on a case-by-case basis. Obviously, the monetary gain compared to a tradition paper process (which would require travel to Estonia to physically appear before the competent officials) is enormous. Similar gains can be made in other policy areas: in eProcurement, the cost of preparing and submitting a paper bid is orders of magnitude higher than the cost of preparing and submitting an electronic bid. The cost of sending a paper bid via courier in cross border procurements alone can easily cost between 50-100 EUR per offer. Compared to an eID cost of e.g. 17,50 EUR per card in Belgium[75], or 10 EUR in Estonia[76], and generic USB card readers costing around 20 EUR[77], costs are easily recuperated. This is even more so when other use cases are factored in, such as e.g. annual submission of company balance sheets. In Estonia, this process was streamlined from a paper process that took 3 months and involved countless person hours for printing, sending, scanning and manually inputting data into a register, to an electronic process called e-Annual Report that takes 20 minutes from the final preparation to inclusion into a register. The time saving (and thus cost saving) is clear, if usable eIDs are available. In order to have
access from eIAS services, internet access is absolutely required. In this
regard, other policies can be used (ex. Universal services directive, Connecting
Europe Facility (CEF)) to deploy internet in remote places. From a social point
of view, Option 2 would make it much easier to exercise a profession or develop
an (e-)business in rural areas, since many administrative formalities and
business could be done from a distance. This could bring about a positive
effect on employment. A priori, this would involve mainly highly skilled
workers. Regional development is hard to predict. While certain Member States certainly have a more advanced eIAS infrastructure in place at this time than others, there are some indications that advanced services already exist in all Member States. As a small indicator, it can be noted that the national trust lists containing supervised (and in some Member States accredited) service providers show that currently more than 100 companies are providing qualified certificates to the public, spanning 24 out of 27 Member States. From those 24, commercial offers (i.e. not focused exclusively on the public sector) for the issuance of qualified certificates are available in 20 Member States. Thus, even when focusing exclusively on this small group of relatively technologically advanced service providers, there is a relatively even spread across the Member States. Regional development would thus likely not be harmed by a policy focus on advanced eIAS tools. The increased
availability of eIAS will also fully enable their potential to reduce the
administrative burden, as shown by the examples above in relation to balance
sheet submission. By consequence, Option 2 would allow making paperless a
significant number of transactions that currently require a 'physical'
identification, authentication or signature. Government receives many of the
benefits from increased efficiency, for example by eliminating duplicate data
entry, and reducing the costs associated with unnecessary paperwork including
printing costs, storage, transportation and disposal. Security added value brought by eID provisions: Finally, Option 2 can improve the security of online transactions and help prevent fraud and identity theft. eIDs can make it more secure for users to login to information systems by enabling multi-factor authentication. An example of multi-factor authentication is requiring the user both to know a PIN and have an eID token to login to a website (i.e., the same security system as when using a bank-card). Since users must remember multiple usernames/passwords today, they often choose an easier-to-remember password or re-use the same password for different services. As Option 2 would instead allow users to use a single reliable eID in multiple contexts (i.e. cross border and cross sector), then the need for multiple passwords disappears and bad security habits can be reduced.[78] Obligations for the different
stakeholders This option will mainly impact governments (which
would need to modify national supervision schemes and to notify
"official" eIDs), the service providers themselves (which
would need to seek supervision if they wish to benefit from cross border market
recognition), and solution providers (which would need to comply with
common European standards if they wish to benefit from European level
interoperability). In particular, the new system of notified eIDs implies that Member States: - who want their official eIDs mutually recognised and accepted at EU level would need to notify these to the Commission. The Commission would set up a list of notified eIDs which would be published (Delegated Act). - will be liable for the notified eID: this liability will be limited to the unambiguous link between the identification data attributed to a person via the eID (e.g. person data such as name, date of birth and person identifier such as tax number in Italy, or the residence register in Austria). This ensures that each individual can be uniquely identified, even if some attributes are shared (e.g. multiple John Smiths, who may even share the same date of birth or city of residence). Member State liability would not extend to the entire transaction in which an eID is used (e.g. the validity of an eProcurement offer), but only to the exact identification of the person. - Need to provide an authentication possibility in order to check and verify that an eID is still valid (e.g. that it was not revoked after the theft of an eID card). They would also be responsible (and liable) for the correctness of this authentication process. . Note that this does not imply an obligation for Member States to change their eID-systems and infrastructures. However, if they wish to notify official eIDs (which is their own choice), then they will need to meet the European regulatory requirements, including by providing the required interfaces to their systems. The costs needed to put in place the required interfaces and infrastructures would be nonetheless limited as many countries – the 14 MS that have participated in the LSP STORK (AT, BE, EE, FR, DE, IT, LU, NL, PT, SL, ES, SE, UK and SK) – have already an interface and infrastructure, developed within STORK, which allows for the cross-border interoperability of eIDs. Assuming a MS has its own eID and the infrastructure associated with it, then it is a question of implementing these common STORK components. This is a relatively cheap activity, compared to the now sunk cost of the development of these components , and an estimate in the region of 100k should be largely sufficient. Should a MS not have its own eID in place, , then Option 2 will make it more attractive for them to adopt an eID: the existing interoperability components would still be available for their use, meaning that the potential use of an eID is much greater, and that no unnecessary costs would be incurred to create any new interoperability solutions. The major challenges relate more to organisational and governance problems. A sustainable governance is possible in the context of the proposed CEF and the planned digital service infrastructure for electronic identification and authentication. It
should be noted that for end users of these products and services (which
can include citizens, businesses (including SMEs and administrations) no new
obligations/responsibilities are contemplated under any of the options of the
proposal. While their range of choices and options increases, they would not be
compelled to undertake new actions. Specifically, it is not envisaged to make
the use or acceptance of eIAS or related trust services mandatory
(notwithstanding the fact that use/acceptance may already be mandatory under
separate and independent frameworks, such as within the context of the Services
Directive, or national obligations to file certain tax declarations
electronically). Moreover, as with the eSignatures Directive, national laws
regulating the contractual area will not be modified by the new legal
framework. A special attention must be paid to the SMEs case: Following an on-going study carried out by Formit and studying the usage of e-signatures in 6 different countries (Spain, Italy, Luxembourg, Finland, Romania and Germany), the current usage of e-signatures depend first, on the size of the enterprise and second on the sector of activities. This conclusion confirms Eurostat figures showing that the use of eSignatures is higher in large enterprises than in SMEs. However, analysing these figures, we can notice that the growth is proportionally higher for SMEs: - Large: 2009: 44% - 2010: 48% - Medium: 2009 36% - 2010: 40% - Small: 2009: 23% - 2010: 26% Nonetheless, if one of the objectives is to further raise SMEs' awareness on using use eSignatures and related trust services, the impacts of the initiative will be the same for all categories of enterprises. Indeed, the requirements of the new Regulation would have to be fulfilled by MS, from one hand, and CSPs from the other. However,
if businesses wish to use eIDs and electronic signatures, they will incur costs
for certificates and software: the price of certificates is very heterogeneous
and depends on three main parameters (Member State sponsorship, quality of the
certificate and validity periods). The important variability in prices and
price structure makes it very difficult to give a scale of prices. As the
aforementioned examples of Estonia and Belgium show, government sponsored eIDs
can be provided relatively cheaply (approx. 20 EUR). The annual price for a
qualified signature certificate issued by commercial service providers (absent
of government sponsorship varies between EUR 25 and 299, and between EUR 10 and
150 for a non qualified one. Effectiveness of option 2 (cf.
detailed assessment presented in Annex 11): Specific Objective 1: Option 2 would improve the
availability and take-up of cross-border and cross-sector eIAS services. eIAS
products and services would gain appeal, which in turn would positively impact
the return on investments made in eIAS infrastructure, products and services.
New services would be created, and new markets and new investments can be
unlocked, thus stimulating innovation. Highly innovative companies presently exist, offering some of the services which are currently not covered by harmonized legislation, such as time stamping services offered by Universign in France[79], electronic registered mail offered by UnifiedPost in Belgium[80], or electronic archiving offered by Unizeto in Poland[81]. However, these companies cannot offer their clients clear guarantees on the legal value of their services across Europe in the absence of common rules. By introducing such rules, their market potential would expand to the whole internal market, benefiting the availability of services in countries where no similar providers exist yet, and opening the market for new opportunities. Specific Objective 2: a better level and scope of
governance would also be achieved to a large extent under Option 2. Indeed, a
harmonised regulatory approach at EU-level that would also cover eIDs (unlike
under Option 1) would enhance legal certainty, trust and security of electronic
transactions and reduce the fragmentation of the market for eIDs, since
cross-border interoperability would be improved by allowing references to a
clear, flexible and reality-proof set of common technical standards.
Furthermore, since notified and mutually recognised eIDs could also be used for
applications in private sectors, these latter could profit from the large scale
roll-out of (notified/official) eIDs (which took already place over the last
few years) for accessing a large number of potential clients. Specific Objective 3: The technology neutral EU Regulation
for e-signature and eID as proposed under Option 2 would stimulate competitive
market developments and ensure that technological developments in the eIAS
market are not hindered. Option 2 will allow that easy-to-use and trustworthy
eIAS products and services become more easily available, also in remote regions
and/or MS for which currently not much eIAS services were developed. Specific Objective 4: Through the development of eIAS services, Option 2 would in the
end strengthen the competitiveness of the European industry and service sector.
First of all, by using eIAS the European industry and services sector could
innovate some steps of their internal and external processes. The development
of on-line services could be positively impacted since the concept of
"notified eID" would allow that the private sector could benefit from
the important roll-out of eID already realised by many MS. Furthermore, the
mutual recognition and acceptance of these eID would stimulate the development
of on-line services, especially at the cross-border level, for both the public
and private sector. Option 2 would remedy the current market fragmentation,
creating an important harmonised outlet market for eIAS which could also
attract investments from outside the EU. The possibility for MS to implement
the Services Directive without compromising on security or trustworthiness
would furthermore decrease the administrative barriers for setting up a
business in any EU MS. Specific Objective 5: The regulatory approach of Option 2 would finally also help ensure
that all consumers can benefit from the advantage of (cross-border) eIAS
services. Making eIAS a mass product would furthermore avoid that costs of
implementation create a barrier to this participation. Finally, the
cross-border and cross-sector use of notified eIDs could strongly reduce the
complexity of eIAS (e.g. multiple devices, passwords, etc.), and remedy the
main obstacles related to eIAS currently impeding the access to (on-line)
services in rural areas. This view was also expressed in an expert survey
organized between August and October 2011 by the SSEDIC Network[82]. Based on replies from 211 experts (comprising representatives of
the IT & Telecoms sector, as well as public sector representatives, consultants
and academics/researchers), 88.6% of respondents agreed that “there should be a
clear common legal framework for the use of eIDs at the European and even
international level”, and 77.1% of respondents agreed that “digital identities
should be subject to EU regulation”[83]. Thus,
this position has clear support among stakeholders. Coherence
of Option 2: Option
2 is to a very large extent contribution to the achievement of the overarching
objectives of EU policy (cf. EU2020 Strategy, DAE, Single Market Act and the
Roadmap to Stability and Growth) as presented in 1.2. 5.1.4. Assessment
of Option 3: Expansion to incorporate certain related trust services Option
3 further expands the legal framework for trust services to include certain related
trustservices: time stamping, electronic seals, long-term preservation of information,
certified e-document delivery, admissibility of electronic documents and
website authentication. Indeed,
a strong interconnection between e-signature, eID and related trust services is
required in order to create a trusted environment. The implementation of
provisions on related trust services would have a positive impact on the legal
recognition of a range of cross-border interactions. Indeed, in order to ensure
the legal validity of certain electronic interactions in cross border scenarios
(as at national level), the e-signatures that might be used are not the only
relevant component. These
other components include the time and the duration of the interaction, its
content, the channel of communication, and the participants themselves. Without
certainty on the legal validity of all these components in case of conflict,
businesses and citizens would remain reluctant to use the digital interactions
as their natural way of interaction. The Public Consultation
also addressed this issue, asking respondents to indicate for which trust
building services and credentials legal or regulatory measures should be
considered at EU-level in order to ensure their cross-border use. This resulted
in the following overview: 64,57% of respondents
asked for provisions on certified electronic documents, 52.39% on time
stamping, 51.67% on electronic seals, 46.65% on certified delivery of email,
45.69% on long term archiving and only 6,22% felt that no further services
required any regulation (see table in annex 7). This shows a very wide support
among stakeholders for the notion that greater efficiencies in the underlying
processes could be achieved through a broader policy approach. Each
of these related trust services has multiple possible use cases, and will have
advantages and drawbacks that might not be shared with other related trust services.
Therefore, in the section below, we will first briefly examine each related
trust service separately, before assessing the option as a whole. Selected individual related trust services 1. Qualified time stamps and time stamping services are required to introduce a non disputable time stamp on a signed document which serves as a proof that it existed at a point-in-time and that it has not changed since then. Example of use case: somebody has submitted by e-mail at 23:55, his application to a competition with a deadline at midnight but the e-mail was delayed for some technical reason. With a time stamp, the e-mail delay would have no consequence. So far at least AT, CZ, DE, EE, ES, FR, GR, HU, IT, LV, LT, LU, PL, PT, RO, SK, SL and ES have integrated or are considering to integrate time stamping in their national legislation. Given the high number of MS integrating this service in their national legislation, a common EU framework regulating time-stamping will undoubtedly contribute to a successful and interoperable cross-border use of electronic signatures. 2. Qualified information preservation services through signing. This service makes use of electronic signatures and time-stamping to maintain the authenticity and integrity of documents when stored over long periods[84]. Example of use case: electronic university degrees have to be kept for decades and are regularly submitted to third parties during the course of the career of their owner. Already/about to be in AT, BE, CZ, DE, EE, FI, FR, HU, IT, RO and SK legislation. The wide application of this service in the MS also calls for the need of a EU framework in order to ensure interoperability across MS. 3. Qualified electronic seal which is equivalent to the e-signature of a legal person. Example of use case: using a qualified e-seal, a company could issue millions of authentic invoices matching EU legal requirements; without e-seals, a responsible person of the company should sign each invoice separately to reach the same level of legal certainty. Already or about to be implemented in AT, CZ, DE, EE, ES, IT, LV and PL legislation. 4 Qualified certified e-document delivery service which is the electronic equivalent to registered mail at EU level. Currently, the legal effect of the "registration" stops at the border of the Member State of origin of an e-mail unless the Member State of destination recognises the registered nature of the email via a bilateral agreement. Already implemented in BE, DE, DK, FI, FR and IT legislation. 5 Recognition and acceptance of e-documents: to establish the conditions of equivalence of a native electronic document with a paper document and the equivalence of a scanned document with its paper original. This is the sine qua non condition for paper less business to take-up (indeed, businesses need legal certainty that their electronic documents will be recognised by third parties like paper documents). Already or about to be implemented in AT, BE, EE, ES and PL legislation. For instance, AT has introduced the concept of official signature, which provides for legal equivalence to official attestations and supports the validation of print-outs. Again, different regimes may lead to Member State A not recognising an e-document legally valid in Member State B. 6 Website authentication: an obligation for legal person’s website to include trusted information (e.g. a certificate) allowing the user to verify the authenticity of the website and the existence of the legal person. Users will benefit from website authentication because they will be sure that the information they get from the website is genuine or that they will carry out a transaction with the real organisation. Organisations will equally benefit from the assurance that no hacker can to set-up a fake website that could ruin the organisation's reputation or rob their transactions with their users. Website authentication is becoming fairly common: when the address of a website becomes green in the browser, it means that the website is authenticated with a certificate. However, the conditions of issuance of website certificate depend on the commercial practices of producers of mainstream web browsers: i.e. the level of guarantee is unknown to the user. Furthermore, not all EU organisations are securing (yet) their website with this kind of mechanism. All services would be subject to supervision if they are offered at a high security (qualified) level, to ensure their cross border validity. Economic,
social, environmental impacts and administrative burden of Option 3 Economically
and socially speaking, the creation of new (cross-border) activities related to
the related trust services would bring competition at the EU level, leading to
lower prices in the medium term. These new service developments would imply
high-level job creation but could also provoke low level job losses,
specifically in sectors with high usage of paper-based services today. It is
however impossible to assess whether the job creation due to a successful
technological sector development (e.g. certified delivery email) will perfectly
balance the loss because of the cessation of paper-based activities (e.g. a
specific branch of the postal sector). However,
increasing economic efficiency through modernization generally has a beneficial
impact on jobs and economic growth, with a McKinsey report showing that e.g. in
France, the Internet economy “generates 2.6 jobs for every job cut and at
times accounts for 25% of net employment creation”[85]. Employment and
regional development could be beneficially impacted by a broader eIAS
framework. The number of citizens working in another Member State was reported
to stand at 5.8 million citizens in 2009, equivalent to 2.5% of the EU working
population[86].
This shows the societal importance of facilitating access to electronic cross
border services, especially in the light of cross border eVoting, and cross
border access to eJustice and eHealth. These are practical issues that European
citizens working in a different Member State than their home country must be
able to resolve efficiently in order to go towards a European Citizenship in
the Digital Single Market. Administratively and environmentally
speaking, the completion of the scope of the current electronic signature
framework will lead to a safe and legally-proof contractual area allowing
stakeholders to interact completely in a digital way. This would lead to a simplification
of administrative procedures (in B2B, B2G, B2C and G2C interactions) as well as
to a massive reduction of paper-based processes. Indeed, the replacement of
paper-based interactions by electronic interactions allows for savings to be
realised at many different levels such as postage, printing costs, processing
time, ease of reuse of information, reduced error rates in data processing,
transportation costs, archiving costs, etc. A study from the Finnish University of Jyväskylä showed that fully electronic invoicing dropped costs from 8,60 EUR per invoice to 1,89 EUR per invoice (-78%)[87]. According to a CapGemini study funded by the Commission, savings of 70 to 75% were realistic, and cost savings through generalised European e-invoicing for B2B transactions alone could amount to 40 billion EUR per year[88]. To achieve these results, however, full management of the e-invoicing lifecycle is necessary. This includes components such as time stamping, e-document delivery and e-archiving, which are related trust services and currently not yet a part of the European policy framework. The results of the SME Panel quoted above
corroborate this to a certain extent, with surprisingly high self-reported
take-up numbers for e-invoicing (28%) and especially electronic archiving
(35%). Thus, market interest in these services clearly exists, even when (as in
the case of electronic archiving) no clear legal framework for these services
has been implemented. An expanded legal framework (as contemplated by Option 3)
would only expand this appeal. Effectiveness
of Option 3 (cf. detailed assessment presented in Annex 11): The detailed
assessment of the economic, social and environment impacts of Option 3: “Expansion
to incorporate certain related trust services” indicates that there are
significant benefits to be gained from a broader EU policy covering at least
certain related trust services. Specific objective 1: Option 3 is significantly more effective than option 2 in
increasing the availability and take-up of cross-border and cross-sector eIAS
services by completing the ecosystem for trust services remaining incomplete
under option 2 in the absence of other fundamental building blocks. Specific objective 2: The assessment shows that market fragmentation already exists for
some related trust services, such as eSeals, time stamping and certified
eDocument delivery, as a result of some Member States being more proactive in
establishing national legal frameworks for such rules. In the absence of
harmonising provisions at the European level, the European internal market
would thus be distorted. Specific objective 3 & 4: Moreover, certain gains expected from the legal framework for
trust services (such as improved accessibility of services, increased
efficiencies, stimulating innovation) depend on a scope of regulation that goes
beyond e-signatures and eID. Excluding related trust services would lead to
situations where e.g. documents could be signed electronically, but not
exchanged reliably (i.e. in a way that could be shown in court to be legally
effective) nor archived over a longer period of time. Paper would remain
crucial for such processes, thus reducing the potential beneficial impact of
European policy intervention, and discouraging the investment in innovative
services. Specific Objective 5: Option 3 is more effective in ensuring that all end-users can
benefit from the advantage of (cross-border) trust services, specifically by
ensuring that related trust services can be used in cross border scenarios as
well. Coherence of
Option 3: Option 3 is fully
contributing to the achievement of the overarching objectives of EU policy (cf.
EU2020 Strategy, DAE, Single Market Act and the Roadmap to Stability and
Growth) as presented in 1.2. Expected Impacts of the different options Advantages of options || Option 0 No Action || Option 1 No Policy change || Option 2 Revision of eSignature Directive and Mutual recognition and acceptance of eID || Option 3 expanding to related trust services Economic impact || Free “budget area” for Member States that could be open for other kind of expenses. || Stand-still situation means no further expenses for Member States and CSPs. || Investments made in large scale pilot projects would bring full benefits & increase competition in the national market by a “de jure” and “de facto” possibility for foreign companies to enter it. This leads to an important increase of economic development at the EU level. || Creation of new cross-border sector of activities Social impact || || || High level-Job creation || Creation of high-level jobs to implement and run the systems Environmental Impact || || || No need for travelling and filling in paper documents thanks to the opportunity given to identify online. Reduction of paper based relationships thanks to the possibility to identify your recipient and the possibility to agree on the terms of your agreement with an electronic signature. || Completion of the process of giving up paper based relationships by ensuring the time, value of the document and validity through time of the agreement. Further increase in possibilities for saving paper. Administrative burden || For those Member States that would still align themselves to the directive or for those who decide to stop their national legislation on eSignature - decrease of administrative burden directly related to the implementation of eIAS regulation. || No additional administrative burden at national level as the situation stays at it is. || Simplification of the procedure when interacting with stakeholders established in a different MS and with authorities established in the same MS. Decrease of administrative burden in the medium-turn as a direct consequence of the eIAS framework. || Further decrease of administrative burden at national level in the mid and long-rum, enabled by the usage of eIAS,including related trust services. Disadvantages of options Economic impact || Investments in the establishment of the current infrastructures would be lost. This impacts MS but even more the CSPs that would be put in a situation of total legal uncertainty. || High risk to see the eIAS services being reduced to a “lost budget area” for Member States spending money for the administration of a non-functioning sector. || The need to create the interfaces and infrastructures needed for the cross-border interoperability of eIDs will have a budgetary impact for Member States || The need to create the interfaces and infra-structures needed for the cross-border inter-operability of eIDs will create have a budgetary costs impact for Member States Social impact || Jobs losses both at private and public level. Missed opportunities of having access to services from rural areas || Missed opportunities of opening up new markets and thus creating new jobs, the high risk of failure in the development of eIAS services would lead to job losses || Possibility of low-level jobs losses || Possibility of low-level jobs losses (specifically in sectors covered by “paper services” like certified delivery mail) Environmental Impact || Missed opportunity for moving towards paperless transactions and thus a cleaner environment || Missed opportunity for moving towards paperless transactions and thus a cleaner environment || || Administrative burden || For the MS that stop their eIAS legislation: missed opportunity to streamline processes || || The need to maintain the interfaces and infrastructures for the cross-border interoperability of eIDs will create administrative burdens for MS. || As the bodies needed for the administration of the eID and eSignature sector would be mutatis mutandis the same that the one needed for related trust services, not much additional increase of the administrative burden is expected compared to Option 3. Cost of governance The cost of governance relates to the costs
incurred by the public authorities that are charged with the development and
maintenance of the regulatory approach for eIAS. Depending on the option
chosen, these global costs can significantly differ. Also, the distribution of
the cost of governance between the EU level and the MS can be impacted
depending on the option chosen, as shown in the table below. 5.2. Legal
instrument of the Framework 5.2.1. Option
A. One instruments vs Option B. two instruments Providing a
comprehensive framework within one instrument (Option A) would
contribute to ensure the consistency of the legislations regulating the
different elements of eIAS products and services. Indeed, electronic signatures
and electronic identification are inseparable when analysing the requirements
needed to ensure legal certainty, trust and security in electronic
transactions. In this regard, common provisions and principles are needed in
order to create a safe digital environment. Following this reasoning, using two
separate instruments (Option B) could introduce slight differences in the
legal provisions adopted for both electronic signatures and electronic
identification – and more important, in the orientation of the initiatives.
These differences could lead to hamper the take up of eIAS products and
services and, in extension, the use of electronic interactions. 5.2.2. Option C. Directive vs Option D Regulation The Commission plans to table
a proposal with the aim to harmonise the national transposition laws on
electronic signature and create a secure legal framework for the mutual
recognition of notified eIDs and related trust services. In this regard, adopting a
Directive (Option C) has shown its limits since 1999. Indeed, the freedom
given to MS when transposing a Directive (in terms of interpretation and of
implementation of the systems) contributed to the current problems of mutual
recognition of services and products and of cross-border interoperability.
Moreover, the delays inherent to a Directive’s implementation period would not allow the expendiency matching the needs of other EU legislation
like the Services, Public Procurement or VAT (e-invoices) Directives. Delays
may also jeopardise the efforts and investments made in large scale pilots by
Member States and the Commission to provide EU-wide electronic services. Meanwhile, a
Regulation (Option D) provides immediate applicability
and stronger harmonisation. Indeed, the objective of
the Commission is to present an immediate solution to current problems and
develop a long-term-use instrument. In this respect, the direct applicability
of a Regulation will contribute to solving problems of harmonisation, and will avoid
the interpretational issues that have plagued the e-Signatures Directive since
its adoption, thus better fitting the purpose of the proposed legislation than
a Directive. Furthermore, a Regulation would be capable of providing quick
relief for the challenges currently encountered by leading European and
national eIAS initiatives. 5.3. Level of supervision of
e-Trust services 5.3.1. Option i: Maintaining national supervision scheme Under
this option, the new legislation will maintain the current national based
supervision scheme and impose on Member States the responsibility to supervise
the activities of service providers by following minimum essential
requirements. In particular, MS should ensure that service providers fulfil the
obligations provided for in the new legislation in order to manage the risks
posed to security of the provided electronic services. The new legislation
would thus strengthen the national supervision of trust service providers by: -
defining the specific tasks of the supervisory
body; -
setting clear rules concerning notification of
security breaches; -
specifying essential rules for supervising
service providers (e.g. regular audits); -
verifying compliance with requirements for
qualified electronic service providers (e.g. ensuring financial resources for
their activities); -
ensuring mutual assistance between Member States
supervisory bodies to facilitate the cross-border supervision of trust service
providers; -
establishing a system of peer review by Member
States of their respective supervision schemes to reinforce mutual trust. Moreover, the current supervision system,
only applicable to electronic signatures, will be extended to the full set of related
trust services in order to ensure an adequate level of security for all of the
aspects of a transaction. It is assumed that the
homogeneity of supervision that would result from common essential supervision
requirements of eIAS services and related trust services would increase trust,
facilitate fraud detection and foster the development of measures to prevent
identity theft. The harmonised approach
at EU-level for both e-signature and related trust services,
improving effective supervision would enhance legal certainty, trust and
security of electronic transactions, leading to convince more social groups
(e.g. through an effective communication strategy) to participate to the
digital single market. 5.3.2. Option ii: Establishing an EU-based supervision system (‘advanced
variant’) Under this option,
the framework adds an EU-based supervision system for the trust service
providers covered by the relevant regulatory instrument. As noted in the detailed
descriptions in Annex 14, two sub-options exist: under the first one, a
European supervision would replace national supervision schemes, under
the second sub-option, an European supervision exists as a complement to
national supervision schemes[89]. Option ii can furthermore be implemented based on a centralised
model, in which a single body at a single location is established, or on a decentralised
model is chosen in which some tasks of the European body are delegated to local
organisations. In general, it can
be assumed that adding an EU-level to the supervision of the eIAS market would
be beneficial for the credibility of the supervision mechanism.
Depending on the variant chosen, the market would know that the consistent application of supervision requirements is monitored by a European body or would be aware that supervision
will be entrusted to an adequately staffed and funded body, either locally or
at the EU level. As such, it would further
increase the effectiveness of Options 2 and 3 of which the basic variants
have a harmonised national supervision model (based on a list of minimum
requirements). Indeed, a credible supervisory system could contribute strongly
to the building of trust and confidence, which is crucial for the development
of the eIAS market. The
most effective option would appear to be federated EU supervision (retaining
national supervision bodies) with delegation power for Member States, closely
followed by decentralised EU supervision (eliminating national supervision
bodies). Only a purely centralised supervision approach compares negatively to
the current system. The
cost effectiveness of a European supervisory body could be further bolstered by
foreseeing other responsibilities. Mainly, such a body could be designated as
an EU point of contact for international discussions on trust services, thus
working towards achieving international interoperability, an area in which the
current e-signatures Directive has proven ineffective. At a more operational
level, the body could also be put in charge of the supervision of trust service
providers established outside of the EU that also wish to be supervised in
Europe on a voluntary basis, in order to benefit from the same status and
certainties as their European counterparts. These additional possibilities
however would create equal advantages in any one of the sub-options, and thus
do not factor into their internal comparison. Nonetheless, in spite of the advantages related to EU supervision,
it should be noted that it should be noted that MS during consultations have
expressed serious reservations about the need for - and value added of -
EU supervision, whilst several raised subsidiarity concerns. The experience has
shown that supervision can be conducted by MS although common requirements with
tangible guidelines and the exchange of best practices is required to ensure
trustworthiness and interoperability. 5.3.3. Comparison of costs (cost-efficiency)
of managing the supervision schemes National supervision schemes While
no exact data is available on current national supervision costs, certain
trends can be derived from an informal questionnaire sent to Member States
during the impact assessment. The total
operational costs for running a supervision scheme seem to range between €100.000
and €200.000 for an average sized MS. Estimates from larger MS are either
unavailable or ambiguous as they do not indicate total operating costs. Costs
for service providers to get supervised vary quite substantially, due to the
role of private sector independent auditors conducting the actual audits and
charging these separately. Based on the available data, a cost for service
providers of €25-30.000 per year seems normal if private auditing is required,
and €3-5000 per year if the supervisory body conducts the audits itself. After
investigation, between 1 and 10 CSPs are located in a Member State, which leads
to a maximum total cost of €300.000 (for countries as Germany or Italy if the
supervision is delegated to a private company.) Expanding
the scope of the supervision scheme under option 2 would obviously increase
costs somewhat, but there would be possibilities to re-use and pool resources.In
term of costs, supervising two types of services is therefore not twice as
expensive as supervising one. Some Member States already supervise time-stamping
service providers, and their costs do not appear to be significantly higher
than other Member States. As a limited but interesting data point, one Member
State indicated that the supervision for qualified eSignatures costs €4500.
According to its response: "If the CSP provides only qualified time-stamping
services, the fee of the initial supervision audit as well as the annual fee
for regular supervision amount to €1500", i.e. the cost of initial
registration is only 30% and the costs of annual audits are 50%." Even
assuming that national supervision costs would double under option 3 in
comparison with the current supervision model (only related to e-Signatures) i.e.
an additional €150.000 EU average per Member State, the total additional
cost of the new supervision scheme compared to the status quo would be around
27x€150k, or approx. €4M. EU Based
supervision schemes In
order to establish an EU based supervision scheme, the EU would have to set up
a new agency. The European Network and Information Security Agency (ENISA) is,
from our point of view, representative of the size of the agency which would be
needed in order to properly carry out the supervision of the CSPs in the 27
Member States. The budget allocated to ENISA for 2012 is €8.5M. Even
doubling our estimation of costs at the national level, the establishment of an
EU based supervision scheme would be more expensive. The
table below gives an overview of the costs related to supervision under the
different scenarios developed above: There are clear indications of possible improvement in the credibility and effectiveness by establishing an EU based supervision system. However, given the strong reservations in accepting EU intervention, it is concluded that supervision should be maintained at the national level. 6. Comparison
of the options The
table below[90]
presents an overview of the scores per operational objective and per policy
option. Please note that the reasoning behind the scores is presented in detail
in Annex 10. The detailed determination of the expected impacts per policy
option was executed through a data analysis exercise which consisted of desk
research, discussions with experts as well as internal brainstorming. These
impacts were furthermore cross-checked with the contributions to the public
consultation of the Commission[91]
and elements related to the assessment by the different stakeholders were
added. The
table below presents the aggregated outcome of this assessment work and allows
for an easy comparison of the way in which each option contributes to all of
the specific objectives and thus the general objectives as presented in Chapter
3. Options || 0 || 1 || 2 || 3 Objectives || Repeal of the existing Directive (No EU Policy) || Baseline option (No Policy change) || EU framework for e-signature and eID (with supervision at national level) || EU framework for e-signature and eID and related trust services (with supervision at national level) EFFECTIVENESS || || || || Overall objective || || || || Harmonised general trust framework for electronic transactions as a building block for the Digital Single Market, || -- || 0 || ++ || +++ Operational objectives || || || || Ensure usage of notified eID by public and private sectors || 0 || 0 || ++ || ++ Ensure effective supervision model for eIAS || -- || 0 || ++ || ++ Ensure mutual recognition and acceptance of notified eIDs || 0 || 0 || ++ || ++ Ensure interoperability of eIAS (cross-border and cross-sector) || -- || 0 || ++ || ++ Ensure maximum reduction of administrative burden and increase of quality of services (awareness raising) || - || 0 || ++ || +++ Ensure trust and confidence in the legal certainty and security of eIAS services || - || 0 || ++ || +++ COHERENCE || || || || Coherence with the overarching objectives of EU policy (cf. EU 2020 Strategy, DAE, Single Market Act and the Roadmap to Stability and Growth) || --- || -- || ++ || +++ EFFICIENCY || || || || Global cost-efficiency for achieving the objectives || --- N/A (Objectives are not achieved) || --- N/A (Objectives are not achieved) || ++ Additional cost of governance ad implementation cost required. No fundamental difference at the level of supervision costs compared to Baseline scenario || ++ Additional cost of governance ad implementation cost required. No fundamental difference at the level of supervision costs compared to Baseline scenario Concerning the Scope of the Framework, the
detailed assessment of Option 0 indicates that in general, without an EU
Policy, the operational and thus specific and general objectives cannot be
reached. Also, the baseline scenario would not allow meeting any of the
objectives mainly because the scope of the current Directive 1999/93/EC is
limited to e-signatures only. Option 2, adding provisions on mutual recognition
of notified eIDs, would significantly contribute to achieve each of the
objectives identified above and results in various positive economic, social
and environmental impacts. However, possibilities would remain limited if there
is no access to harmonised related trust services for which legal certainty and
technical security is ensured. The conclusion that emerges consistently from
the section above is that related trust services are essential in order
to provide the trust and legal certainty needed to ensure that citizens
and businesses can rely on interactions in the electronic world as they do in
the physical environment. Thus, a comparison of these different policy options suggests that Option 3 is the most
suitable to meet the objectives of the initiative. The choice of the legal
instrument is fundamental in view of ensuring that the initiative
will create a more efficient framework for electronic interactions. In this
context, one single legal framework (Legal
instrument - Option A) seems to be the most efficient and effective
instrument to attain the general objective of the initiative. Moreover, a Regulation
seems to be more appropriate than a Directive. Indeed, the objective being to
bring forward immediate solutions to current problems and develop a
long-term-use instrument. In this respect, the direct applicability of a
Regulation will better fit to solve the existing issues. (Legal Instrument –
Option D) Concerning
the adequate level of supervision to be adopted, in terms
of effectiveness, efficiency and coherence, both national systems and EU based
scheme are equivalent. However, the potential reluctance of Member States and
the risk to hurt the principle of subsidiarity, suggest to go for the
improvement of the current national supervision model (option i "Maintaining national supervision scheme") 7. Monitoring
and Evaluation The Commission is
the guardian of the Treaty and therefore will monitor how Member States have
implemented the changes in the electronic signature Framework and the necessary
measures on electronic identification and related trust services. Where needed,
the Commission services will offer assistance to Member States for the
implementation of the legislative changes in the form of workshops with all the
Member States or bilateral meetings at the request of any of them. When
necessary, the Commission will pursue the procedure set out in Article 258 of
the Treaty in case any Member State fails to respect its duties concerning the
implementation and application of Union Law. The Commission will
be monitoring the application of the legislative framework Progress indicators to monitor the application of the legislative framework: 1. Existence of eIAS suppliers that have activities in multiple EU member states: 2. Usage of eIAS services by eService providers in other sectors than the “traditional closed niche sectors”; 3. Degree to which devices become interoperational (e.g. eCard readers) between sectors, countries; 4. Usage of eIAS by all categories of population (cf. via ‘Household survey’-type questionnaires); 5. Follow-up of reasons why consumers remain reluctant to use eIAS (cf. via ‘Household survey’-type questionnaires); 6. Extent to which eIAS are used by end-users for national transactions and international (cross-border) transactions; 7. Degree of harmonisation across members states when regulating eIAS (incl. related trust services). 8. Official eIDs notified to the Commission 9. Services accessible with notified eIDs in the public sector (eGovernment, eHealth, eJustice, eProcurement) 10. Services accessible with notified eIDs provided by central, regional, local authorities 11. Services accessible with notified eIDs provided by Points of Single Contact 12. Electronic delivery systems accessible with notified eIDs 13. Services accessible with notified eIDs in the private sector (online banking, eCommerce, eGambling, login to websites, safer internet services e.g. chatrooms for children) Moreover, the new legislative framework will request Member States to provide the European Commission with statistics based on their supervision activities. The Commission will be mainly responsible
for collecting the data presented above mostly through desk research, online
surveys, conferences, workshops, etc. External contacts for more specific data
collection may be required, as well as cooperation with. Nonetheless, the data
collection related to the monitoring of the legislative framework are not
likely to result in significant additional costs. The evaluation of the impact of the
application of the new Framework could take place four years after the entry
into force of the legislative measure in the form of a Commission report to the
Council and the European Parliament. Indeed, the period of two years left for
evaluation of the current electronic signature Directive proved to be too short
to obtain informative quantitative figures measuring the impact of the
Directive in all the areas concerned. In order to measure efficiently the
impacts mentioned above, 4 year-period seems also appropriate as it is
necessary to take into account the possible progressive modification of
behaviour of the different stakeholders and the possible development of new
technological instruments over time. ENISA could be involved to evaluate
security issues that may arise in the Framework operation. Annex 1
– List of Acronyms and Glossary CAGR || Compound annual growth rate CIP || Critical Infrastructure Protection CSP || Certification Service Provider CEF || Connecting Europe Facilities CEN || European Standards Committee DAE || Digital Agenda for Europe DSM || Digital Single Market EEA || Economic European Area eID || Electronic identification eIAS || Electronic identification, authentication and signature EHIC || European Health Insurance Cards ETSI || European Telecommunications Standards Institute EU || European Union HSM || Hardware security module ICT || Information and Communication Technologies IETF || Internet Engineering Task Force LSP || Large Scale Pilot project MS || Member State of the European Union PIN || Personal identification number PKCS || Public Key Cryptography Standards PKI || Public Key Infrastructure SMA || Single Market Act SME || Small and Medium Enterprise TSPs || Trust Service Providers TTP || Trusted Third Party UNCITRAL || United Nations Commission on International Trade Law Glossary Advanced Electronic Signature || "advanced electronic signature" means an electronic signature which meets the following requirements: · it is uniquely linked to the signatory; · it is capable of identifying the signatory; · it is created using signature means that the signatory can with high level of confidence maintain under his sole control; · it is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable. (art. 2.2, Directive 1999/93/EC) Authentication || Electronic process that allows the validation of the electronic identification of a natural or legal person; or of the origin and integrity of an electronic document; Certified e-document delivery || Service that makes it possible to transmit data by electronic means and provides evidence relating to the handling of the data, including proof of sending or receiving the data, and which protects transferred data against the risk of loss, theft, damage or any unauthorised alterations; Connecting Europe Facility || EU proposal aiming at maximising the potential for growth through the realisation of synergies between transport, energy and telecommunications policies and their implementation, thus enhancing the efficiency of the Union's intervention. Conversion of paper to eDocuments || Ensuring that paper documents can be converted into electronic equivalents without losing their legal validity; this can be thought of as an electronic equivalent to the paper certified copy (copie conforme). Digital Agenda for Europe || EU initiative aiming at delivering sustainable economic and social benefits from a digital single market based on fast and ultra-fast internet and interoperable applications. Digitalisation || The process of converting information in analogue form into digital form. Digital Signature || Mathematical scheme for demonstrating the authenticity of a digital message or document. A valid digital signature gives a recipient reason to believe that the message was created by a known sender, and that it was not altered in transit eCODEX || An e-justice project to improve the cross-border access of citizens and businesses to legal means in Europe as well as to improve the interoperability between legal authorities within the EU. Electronic Transactions || Dealings between people and organisations (such as finding out a piece of information, filling out a form, or making a payment) that take place using electronic networks. epSOS || An European electronic Health (eHealth) interoperability project co-funded by the European Commission and the partners. It focuses on improving medical treatment of citizens while abroad by providing health professionals with the necessary patient data. eSeals || Data in electronic form which are attached to or logically associated with other electronic data to ensure the origin and the integrity of the associated data; e-Signature / electronic signature || data in electronic form which are attached to or logically associated with other electronic data and which are used by the signatory to sign e-Signature product || Hardware or software, or relevant components thereof, which are intended to be used by a certification-service-provider for the provision of electronic-signature services or are intended to be used for the creation or verification of electronic signatures e-Signature Technology Providers || Producers of hardware and software for example electronic components (microchips, smartcards, tokens), and firmware/software products e-Signature Solutions Integrators || Companies that assemble what provided by technology providers to create solutions for e-Signature scenario. Europe 2020 Strategy || Europe 2020 is the EU's growth strategy for the coming decade in order to become, in a changing world, a smart, sustainable and inclusive economy which should help the EU and the Member States deliver high levels of employment, productivity and social cohesion. It implies a set of five ambitious objectives - on employment, innovation, education, social inclusion and climate/energy - to be reached by 2020. Each Member State has adopted its own national targets in each of these areas. Concrete actions at EU and national levels underpin the strategy. Interaction || A two-way exchange of information. Long-term preservation of e-signatures || To ensure the legal validity of electronic signature over extended periods of time, ensuring that e-signatures can be validated irrespective of future technological evolutions. PEPPOL || Pan-European Public Procurement OnLine project, which aims at expanding market connectivity and interoperability between eProcurement communities. PEPPOL enables access to its standards-based IT transport infrastructure through access points, and provides services for eProcurement with standardised electronic document formats Public Key || The publicly-known key associated with a given person's use of a public-key cryptographic system. Public Key Infrastructure (PKI) || PKI is a set of hardware, software, organisation, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority Private Key || The private (secret) key associated with a given person's public key for a public-key cryptographic system. Qualified Certificate || Attestation which links validation data respectively to a natural or a legal person and confirms those data of that person, used to support trust services, issued by a qualified trust service provider and meet the requirements laid down in Annex I of Directive 99/93/EC; Qualified Electronic Signature || Electronic signature which meets the following requirements: - it is uniquely linked to the signatory; - it is capable of identifying the signatory; - it is created using electronic signature creation data that the signatory can with high level of confidence use under his sole control; and - it is linked to the data to which it relates in such a way that any subsequent change in the data is detectable; and has been created by a qualified electronic signature creation device, and which is based on a qualified certificate for electronic signature; Secure Signature Creation Device || Configured software or hardware used to implement the signature-verification-data SPOCS || SPOCS (Simple Procedures Online for Cross- Border Services) is a large-scale pilot project launched in May 2009. SPOCS aims to build the next generation of online portals (Point of Single Contact or PSC), which every European country now has in place, in the context of the Service Directive STORK || A competitiveness and innovation framework programme, co-funded by EU. It aims at implementing an EU wide interoperable system for recognition of eID and authentication that will enable businesses, citizens and government employees to use their national electronic identities in any Member State. It will also pilot transborder eGovernment identity services and learn from practice on how to roll out such services, and to experience what benefits and challenges an EU wide interoperability system for recognition of eID will bring. SWOT Analysis || SWOT analysis is a strategic planning method used to evaluate the Strengths, Weaknesses, Opportunities, and Threats involved in a project or in a business venture. It involves specifying the objective of the business venture or project and identifying the internal and external factors that are favorable and unfavorable to achieve that objective. · Strengths: characteristics of the business, or project that give it an advantage over others · Weaknesses: are characteristics that place the project at a disadvantage relative to others · Opportunities: external chances to improve performance (e.g. make greater profits) in the environment · Threats: external elements in the environment that could cause trouble for the business or project Time stamping || Data in electronic form which binds other electronic data to a particular time establishing evidence that these data existed at that time Token || When used in the context of authentication, a (usually) physical device necessary for user identification. Trust services || Any electronic service consisting in the creation, verification, validation, handling and preservation of electronic signatures, electronic seals, electronic time stamps, electronic documents, electronic delivery and electronic certificates, including certificates for electronic signature, for electronic seals and for website authentication Adapted from Modinis sudy ANNEX 2 – Information
sources: List of studies, workshops and literature in relation to eIAS Communications from the Commission (1) Communication
COM(2010)245 of 19.5.10 - A Digital Agenda for Europe. (2) Communication
COM(2011)206 of the 13.04.11 - Single Market Act (3) Communication
COM(2006)120 of 15.3.06 - Report from the Commission to the European Parliament
and the Council on the operation of Directive 1999/93/EC on a Community
framework for electronic signatures. (4) Communication
COM(2008)798 of 28.11.08 on an Action Plan on e-signatures and e-identification
to facilitate the provision of cross-border public services in the Single
Market. (5) Communication
on a "Proposal for a European Parliament and Council Directive on a common
framework for electronic signatures", COM(1998)297 of 13.5.1998. (6) Communication
from the Commission to the Council, the European Parliament, the Economic and
Social Committee and the Committee of the Regions: "Ensuring security and
trust in electronic communication. Towards a European framework for digital
signatures and encryption". COM(1997)503 of 8.10.1997. (7) Communication
from the Commission to the Council, the European Parliament, the Economic and
Social Committee and the Committee of the Regions "A coherent framework to
build trust in the Digital single market for e-commerce and online
services". COM(2011) 942 final (8) Communication from the Commission to the Council, the
European Parliament, the Economic and Social Committee and the Committee of the
Regions: "Safeguarding Privacy in a Connected World. A European Data
Protection Framework for the 21st Century". COM(2012) 9 final (9)
Communication from the Commission to the Council, the European Parliament, the
Economic and Social Committee and the Committee of the Regions: "A
strategy for e-procurement". COM(2012) 179 final (10)
Communication on a "Proposal for a Directive of the
European Parliament and of the Council on public procurement" COM(2011) 896 final (12) Communication
from the Commission "A roadmap to stability and growth" COM(2011) 669
final (13) Communication
from the Commission "Europe 2020 A strategy for smart, sustainable and
inclusive growth" COM(2010) 2020 Final European
Legislation (1) Directive 1999/93/EC of the European Parliament and of the Council of
13 December 1999 on a Community framework for electronic signatures (2) Directive 95/46/EC of
the European Parliament and of the Council of 24 October 1995 on the protection
of individuals with regard to the processing of personal data and on the free
movement of such data (3) Directive 2002/58/EC
of the European Parliament and of the Council of 12 July 2002 concerning the
processing of personal data and the protection of privacy in the electronic
communications sector (Directive on privacy and electronic communications) (4) Directive 2004/18/EC of the European Parliament and of
the Council of 31 March 2004 on
the coordination of procedures for the award of public works contracts, public
supply contracts and public service contracts (5) Directive 2004/17/EC of
the European Parliament and of the Council of 31 March
2004 coordinating the procurement procedures of entities operating in the
water, energy, transport and postal services sectors REFERENCES
& STUDIES Main
related studies ordered by the Commission or related bodies (1) Study on an electronic
identification, authentication and signature policy (IAS study), 2012,
INFSO, http://ec.europa.eu/information_society/policy/esignature/ias_crobies_studies/index_en.htm
(2) Study on the supply side of the market for
e-signature, 2012, INFSO. (not yet published) (3) Two Impact Assessment support studies on eID
mutual recognition and on eSignatures to support the impact assessment,
2012, INFSO (4) Online public consultation on electronic
identification, authentication and signature, 2011, INFSO, http://ec.europa.eu/information_society/policy/esignature/eu_legislation/revision/pub_cons/index_en.htm
(5) "SME panel" survey on eSignatures and
eID to identify business needs, 2011, ENTR/INFSO (6) European Parliament report on
electronic signatures, www.europarl.europa.eu/activities/committees/studies/download.do?language=en&fil e=41711 , 2011, EP (7) Pan-European survey of practices, attitudes and
preferences as regards personal identity data management, 2011, IPTS for
INFSO (8) Special Eurobarometer 359 - Attitudes on Data
Protection and Electronic Identity in the European Union, 2011, INFSO / JUST /
JRC (9) Study on cross-border interoperability of
e-signatures (CROBIES study). 2010, INFSO (10) The state of the Electronic Identity market:
technologies, infrastructure, services and policies, 2010, JRC/IPTS (11) Feasibility study of a European federated
e-signature validation service, 2010, DIGIT IDABC (12) Several ENISA reports and position paper on eID
and authentication – see www.enisa.europa.eu/publications
(13) Household survey 2010, http://epp.eurostat.ec.europa.eu/cache/ITY_OFFPUB/KS- QA-10-050/EN/KS-QA-10-050-EN.PDF ,
Eurostat (14) Enterprise survey 2010, http://epp.eurostat.ec.europa.eu/cache/ITY_OFFPUB/KS-QA- 10-049/EN/KS-QA-10-049-EN.PDF ,
2010, Eurostat (15) Study on eID interoperability for Pan European
eGovernment Services, 2009, DIGIT IDABC (16) Study
on electronic documents and electronic delivery for the purpose of the implementation
of Art. 8 of the Services Directive, 2009, MARKT (17) Studies
on the set-up of an Electronic Signature Service Infrastructure (ESSI) for the European
Commission, 2009, DIGIT (18) Study
on mutual recognition of e-signatures for eGovernment applications, 2009, DIGIT
IDABC 2009 (19) Flash Eurobarometer
#250, Confidence in the Information Society, 2009, INFSO (20) Study on the EU ICT Security Market, IDC, 2009, http://ec.europa.eu/information_society/policy/nis/strategy/activities/data_ict_market
(21) Study on the
standardisation aspects of e-signature, 2007, INFSO (22) The legal and market
aspects of electronic signatures, 2003, INFSO Standardisation mandate m460 in
the field of information and communication technologies applied to electronic
signatures, 22.12.09. (23) European Parliament
resolutions "Completing the internal market for e-commerce", 21.9.10,
P7_TA(2010)0320. (24) European Parliament
resolution "Internet governance: the next steps", 15.6.10,
P7_TA(2010)0208. (25) Report on a new Digital
Agenda for Europe: 2015.eu, 25.3.10, European Parliament, Committee on
Industry, Research and Energy, P7_TA(2010)0133. (26) PORVOO reports, in
particular "Regulating a European eID: a preliminary study on regulatory
framework for entity authentication and a pan European Electronic ID ",
Thomas Myhr, 31.1.2005, porvoo9.gov.si/Thomas_Myhr_report.pdf (27) Eurostat Survey on ICT usage and e-commerce in enterprises, http://www.imamidejo.si/resources/files/ICT_usage_in_ent._2010.pdf
(28) United Nations Convention
on the Use of Electronic Communications in International Contracts, http://ec.europa.eu/information_society/policy/esignature/docs/workshop_10_03/02_luca_castellani_uncitral.pdf
DISCUSSIONS,
WORKSHOPS, CONFERENCES Major events from which feedback could be
collected on issues related to the e-signature Directive and issues related to
eID. Only the events that occurred after the
publication of Action Plan on e-signature and e-identification COM(2008)798,
28.11.2008 are reported. Indeed the implantation of the action plan indicated
that eIAS issues cannot be fully resolved within the existing legal framework
of the e-signature Directive. A number of bilateral meetings with
stakeholders including Member States are not indicated. Circumstance || Parties || Date || Place Commission workshop with MS on eSignatures || All+MS || 25.1.12 || Brussels Tallinn-Going Local 2011 || MS || 25.11.11 || Tallinn, EE CEN and ETSI Workshop on mandate m460 on e-signature standardisation || All || 21.11.11 || Paris, FR Ministerial eGovernment Conference - Rountable on eID || MS || 17-18.11.11 || Poznan, PL Digital Agenda taskforce of BUSINESSEUROPE || Industry || 17.11.11 || Brussels Polish Presidency and Commission workshop with MS on eSignatures || All+MS || 9-10.11.11 || Warsaw, PL Polish Presidency's conference on eSignatures || MS || 9.11.11 || Warsaw, PL FESA meeting || MS || 8.11.11 || Warsaw, PL eID & ePassport Conference || All || 24-25.10.11 || Istanbul, TR Prague-Going Local 2011 || MS || 6.10.11 || Prague, CZ "IAS study" workshop || All+MS || 3.10.11 || Brussels Small Business Act follow-up meeting with stakeholders || SMEs || 28.9.11 || Brussels European Multi-Stakeholder Forum on E-invoicing || All+MS || 13.9.11 || Brussels SPOCS – ETSI meeting || ESO || 8.9.11 || Den Haag, NL Digital Agenda Assembly workshop on "What next for e-Identity and e-Signatures?" || All+MS || 16.6.11 || Brussels European Parliament, IMCO, presentation of its report on e-signature entitled "Digital Internal Market" || EP || 15.6.11 || Brussels eGovernment High Level Group inaugural meeting || MS || 7.6.11 || Brussels 11th eSignature Conference (EFPE) || All || 6.6.11 || Międzyzdroje, PL Meeting of the Banking Technology Committee of the World Savings Banks Institute / European Savings Banks Group || Industry || 19.5.2011 || Brussels General assembly of European Land Registry Association || Stakeh. || 17.5.11 || Brussels FESA meeting || MS || 5-6.4.11 || Stockholm, SE Stakeholder workshop on electronic identification, authentication and signature || All+MS || 10.3.11 || Brussels General assembly of ChamberSign || Industry || 10.2.11 || Brussels 6th ETSI Security Workshop || All || 19-20.1.11 || Sophia Antipolis, FR BE Presidency conference: "Lift-off towards Open Government 2010" || All+MS || 15-16.12.10 || Brussels AFNOR conference: Sécurite des systèmes d’information: la normalisation, un atout? || All || 26.11.10 || Paris, FR eID & ePassport Conference || All || 19-20.10.10 || Athens, GR FESA meeting || MS || 18.10.10 || Mainz, DE Expert meeting on identity theft and identity management || MS || 4.10.10 || Brussels 9th eSignature Conference (EFPE) || All || 4.7.10 || Międzyzdroje, PL General assembly of Eurosmart || Industry || 30.4.10 || Brussels FESA meeting || MS || 13.4.10 || Warsaw, PL 5th ETSI Security Workshop || All || 20-21.1.10 || Sophia Antipolis, FR Commission workshop with MS on eSignatures || All+MS || 25.1.12 || Brussels Tallinn-Going Local 2011 || MS || 25.11.11 || Tallinn, EE CEN and ETSI Workshop on mandate m460 on e-signature standardisation || All || 21.11.11 || Paris, FR Ministerial eGovernment Conference - Rountable on eID || MS || 17-18.11.11 || Poznan, PL Digital Agenda taskforce of BUSINESSEUROPE || Industry || 17.11.11 || Brussels Polish Presidency and Commission workshop with MS on eSignatures || All+MS || 9-10.11.11 || Warsaw, PL Polish Presidency's conference on eSignatures || MS || 9.11.11 || Warsaw, PL FESA meeting || MS || 8.11.11 || Warsaw, PL eID & ePassport Conference || All || 24-25.10.11 || Istanbul, TR Meeting of the Banking Technology Committee of the World Savings Banks Institute / European Savings Banks Group || Industry || 13.1.2010 || Brussels SE Presidency: 5th Ministerial eGovernment Conference || All+MS || 19-20.11.09 || Malmö, SE National eID conference || All || 22.10.09 || Lisbon, PT RSA Conference || All || 21.10.09 || London, UK FESA meeting || MS || 7.10.09 || Reykjavik, IS 18th meeting of the working group on electronic public procurement || MS || 22.9.09 || Brussels FESA meeting || MS || 28.4.09 || Belgrade, SRB CZ Presidency high-level conference on eID and public registers || All+MS || 7.4.09 || Hradec Králové, CZ Open e-ID Solutions 2009 || All || 4.2.09 || Oslo, NO Meeting of the working group on electronic public procurement || MS || 12.12.08 || Brussels Services Directive comitology: numerous expert meetings to prepare CD 2009/767/EC and 2011/130/EU || MS || 2008-2011 || Brussels IDABC eID interoperability expert group (numerous meetings) || MS || 2008-2009 || Brussels IDABC eSignature interoperability expert group (several meetings) || MS || 2008-2009 || Brussels ISA working group on trusted information exchange (several meetings) || MS || 2010-2011 || Brussels STORK several meetings with consortium partners || All || 2008-2011 || Brussels Key: All = All kinds of stakeholders Annex 3: Policy context of
electronic signature and electronic Identification The policy context of e-signatures The Directive[92] on a Community framework for electronic signatures was adopted to
establish a legal framework for e-signatures, to ensure the mutual recognition
of signature certificates, to remove barriers to the free circulation of
e-signature products. Since 1999, the Commission has undertaken
several actions that have complemented the Directive to implement the EU E-signature
framework: - Directive 1999/93/EC, its two decisions
2000/709/EC and 2003/511/EC, and also the decisions which formally relates to
the Services Directive but de facto complement the e-signature
framework, namely 2009/767/EC as amended by 2010/425/EU and 2011/130/EU. - The standards referred to by the legal
framework and the CEN and ETSI e-signature standards in general, - Implementations under the European
Commission responsibility such as the EU “trusted list” , Research and
innovation, and deployment addressed via the funding of projects by the EU
R&D Framework Programme and the Competitiveness & Innovation Framework
Programme. In 2006[93], the
Commission reported on the operation of the Directive and acknowledged problems
with the mutual recognition and cross-border interoperability of e-signatures. Divergent
solutions adopted in the Member States have created de facto barriers to
the EU-wide interoperability of e-signatures. As a follow-up, the Commission adopted in
2008 an Action Plan on e-signature and e-identification[94] to
remove interoperability obstacles. Some improvements could be achieved as a consequence
of the Action Plan (e.g., the so-called "Trusted List" of providers
of qualified signature certificates but adopted in the formal context of the
Services Directive 2006/123/EC). However, no more barriers can be removed with
the current regulatory framework of Directive 1999/93/EC because the Direciteve
does not permit to adopt implementing measures needed to remove barriers or to
address information society evolutions. More recently, the implementation of the Services
Directive has provided a new impetus for extending the European legal framework
surrounding the e-signature directive, including through a 2009 Commission
Decision[95] that required each Member State to establish, maintain and publish
a "Trusted List" containing information related to the certification
services providers (CSPs) issuing qualified certificates who are
supervised/accredited by Member States, and the 2011 Decision establishing
minimum requirements for the cross-border processing of documents signed
electronically by competent authorities[96]. With relation to standards, European
standardization organisations CEN, CENELEC and ETSI were granted with a
standardization mandate in December 2009[97] with
the objective to update the existing European eSignature standardisation deliverables
in order to create a rationalised framework. The rationalised framework for
electronic signature standardization has been proposed providing a coherent
basis for selection of standard appropriate to business needs. An inventory of
existing standardisation at the International, European and national/sector
level is also available.[98] The policy context of eID The action plan on e-signatures and
e-identification to facilitate the provision of cross-border public services in
the Single Market identified "Electronic Identity Management" as a
key element for the delivery of any e-services ensuring that no unauthorised
use is made of the identity of persons and personal data and the validity of
identity claims. One of the actions envisaged by the Commission was to
determine after the delivery of the results of the Large Scale Pilot on eID
(STORK) scheduled for end of 2011 if and what additional actions might be
required to enable an effective EU wide usage of e-ID. The legislative proposal
on cross-border mutual recognition and acceptance of electronic identification
and authentication is one of these actions. The crucial importance of secure,
trustworthy and easy to use seamless online services for a strong and well-functioning
European Digital Single Market is stressed in the Digital Agenda for Europe. Following
these goals, the Commission announced to take action to ensure mutual recognition of e-identification and e-authentication
with the aim to eliminate fragmented digital markets, lack of interoperability
and to prevent the increase of cybercrime. The need to strengthen confidence in
electronic transactions as necessary condition for the development of a Digital
Single Market from which citizens, businesses and public authorities can fully
benefit is reiterated in the Single Market Act (SMA) where one of its 12 key
actions envisages legislation ensuring the mutual recognition of electronic
identification and authentication across the EU. In its European eGovernment Action Plan 2011-2015[99], the Commission proposes in one of its actions a legislative
measure on mutual recognition of electronic identification and authentication
across the EU with the objective to enhance eGovernment services in Europe in
general and to create the pre-conditions for the EU-wide use of national
electronic identity solutions in particular. Concretely, the action will
support the Member States to "apply and roll out the eID solutions, based
on the results of STORK and other eID-related projects" as foreseen in the
action plan for the period 2012-2014. In addition, they will contribute to
create the necessary conditions for the setting up of digital service
infrastructures for which the Commission proposes an amount of € 2 billion in
the context of the Connecting Europe Facility[100] as
well as the Guidelines for trans-European telecommunication networks[101], both of which embedded in the overall proposal for a Multiannual
Financial Framework 2014-2020. The Council recognises explicitly in its
Conclusions on the European eGovernment Action plan 2011-2015 the proposal of
the Commission of a legislation "to ensure mutual recognition of
e-identification and e-authentication across the EU" [102]. Member States also committed themselves to "deploy and
roll-out cross-border eGovernment services based on and building on results
delivered by the large scale pilots" one of which succeeded to solving the
cross-border interoperability problems of "official eIDs" . Finally, the vital role of a future common
legal basis for mutual recognition and acceptance of electronic identification
and authentication across borders for the virtual cycle of the digital economy
was underlined in the Roadmap for Stability and Growth by getting assigned fast
track priority for 2012. Electronic identification (eID) and authentication of
entities (natural and legal persons) are pre-requisites for electronic
interaction and online transactions: Identification enables to establish
whether the person is indeed the one he/she claims to be; through authentication
the claimed identity can be verified. The European Council confirmed in its
conclusions of October 2011 that "particular attention should be paid to
facilitating secure electronic identification and authentication" in order
to promote a fully integrated Digital Single Market by 2015. ANNEX 4 – Public consultation
on electronic identification, authentication and signatures in the European
digital single market Introduction on the goals and scope of the
consultation On 18 February 2011, the European Commission
launched a public consultation in the context of the Digital Agenda for Europe,
regarding electronic identification, authentication and signatures. The purpose
of this consultation was to seek stakeholder input for policymakers on how
electronic identification, authentication and signatures can contribute to
deliver the European digital single market. The consultation closed on 15 April 2011, and
generated 434 contributions[103]
from 37 countries and
from a wide range of actors, including Member States, EU and national
organisations, regional and local authorities, business and professional
federations, individual companies, and NGOs. Roughly half of the submissions
originated from these organisations, with the
other half of the respondents being from individual citizens. This document summarises the main findings of the consultation. More
details, including the complete
set of contributions, can be found on the consultation’s
website[104]. Main findings on electronic
identification, authentication and signatures usages The overall usage of electronic identification,
authentication and signatures tools by the respondents is reported to be
relatively high (around 80 %), with responses showing no significant
difference between organisations and individuals. electronic identification,
authentication and signatures tools are mainly used for securing transactions
and guaranteeing the integrity of electronic documents. Over 80% of respondents
consider eGovernment and eBanking as the major application areas, emphasizing
the importance of ensuring integrity and security in these domains. e-signatures tailored to face the
challenges of the digital single market When examining how the respondents perceived the
impact and role of e-signatures on the Digital Single Market, almost 80% of
respondents estimated that take-up was low, characterising it as marginal or
moderate. The most frequently indicated causes for this relatively low success
rate were (1) the limited number of services requiring
e-signatures; (2) insufficient user friendliness; (3) cross-border
interoperability issues. As the main interoperability challenges to be
fixed by future initiatives, respondents refer to the heterogeneous approach to
security requirements in different Member States, unclear terminology (both in
the e-signatures Directive and in national implementations), and insufficient
harmonisation of profiles of qualified certificates. These criticisms relate to
areas in which the Directive has seemingly left a margin of appreciation or where
its language is too ambiguous, resulting in diverging implementations that have
caused market disruptions. Generally, respondents suggested that future
regulations could improve interoperability by eliminating ambiguities and
reducing national divergences. In particular, 87%
of respondents replied that EU legislation should also address related trust
services like certified e-documents, time stamping, mandates, e-seals,
certified document delivery or archiving, whereas only 5% entirely
opposed new regulatory initiatives. Finally, 61% favoured the
introduction of eConsent as a building block in EU e-signature
legislation. From a technical point of view, when analysing the options for
addressing e-signature challenges, opinions are less clear. 32% of respondents
are in favour of a creating a central EU signature validation service, 21%
are in favour of a national governmental signature validation service, and 17%
would prefer to have this services managed by the private sector.
Similarly, 50% of respondents believe that a common European e-signature
security classification scheme would be useful, while 22% replied
that the complexity would outweigh any advantages and 11% are against. Other topics found more universal support, such as supporting mobile devices as IAS tools
(favoured by 82% of the respondents), and maintaining or keeping the
EU’s high “qualified” signatures security, as expressed by 66% of
respondents (as opposed to the 16% who would prefer relaxed
requirements). Principles for future e-identification and authentication
legislation and policy The consultation gauged opinion on the perceived
need for legislative measures to address e-identification and e-authentication
in particular, including the fundamental principles of such legislation, expected
effects on the Digital Single Market, potential benefits for users,
cross-sector interoperability and any lessons learned. A large majority of 65% of respondents
favoured EU legislation for electronic identification, whereas only 23% was against.
Key areas to be covered by such legislation according to the respondents are
notably data protection and privacy (78%), transparency (65%), and liability of
the eID provider (59%). Affordability and cross-sector usability were
considered important by 39%. Identity federation saw significantly more support
(44%) than a centralised approach (23%). Respondents thus clearly favoured an
open, trustworthy and interoperable eID environment. Looking at the expected impact of legislative
measures addressing mutual recognition and acceptance of eID across borders on
the Digital Single Market, the main expected effects were an improvement of
legal certainty (62,2%), a reduction of administrative burdens (60,8%), and the
increase of cross-border mobility (59,1%). Economically, respondents expect
that increased economies of scale (49%) will have a strong positive impact as
eIDs would become useful of an increased number of applications. Finally, respondents frequently stressed
the importance of international standardization, if possible supported through
international agreements to use the same standards in international
transactions. IAS services are seen as an inherently international phenomenon,
and European initiatives should be attuned to this reality. ANNEX 5 – The SME Test (1) Consultation with SMEs representatives || Consultation with SMEs took place throughout the following process: · Public consultation which ended on 15.04.2011 – this gave the opportunity to SMEs to respond. · The initiative was discussed during the SBA Follow-up meeting with stakeholders (SMEs European Associations) on 28.09.2011. The discussion focused on the current EU e-Signature framework and the future steps and initiatives to improve the legislative framework. · The SME Panel was available on the Internet and ran from 04.10.2011 to 22.12.2011. 1251 answers from SMEs across Member States were received. · SMEs were also consulted through regular bilateral meetings with specific companies. Feedback from SMEs: SMEs associations gave a positive feedback. They consider the e-Signature could offer many valuable advantages for enterprises with regards to efficiency, costs and time reduction in their commercial relations. The revision of the e-signature Directive is one of their priorities and they believe that this improvement could bring growth and create jobs for SMEs. (2) Preliminary assessment of businesses likely to be affected || See Annex 7 (3) Measurement of the impact on SMEs || There is no specific analysis of the distribution of the potential costs and benefits of the policy options over the businesses' size. Indeed, most of the proposals under the selected option would imply benefits for businesses but not affect them directly (except electronic seals for which impacts identified for SMEs were compared with those of large enterprises). (4) Assess alternative options and mitigating measures || At the end of the impact assessment, the selected option shows that the initiative might result in a reduction of the administrative burden and have a very positive economic impact on the stakeholders in general, including SMEs. Consequently, there is no element showing the need for SME specific measures in order to ensure compliance with the proportionality principle. Annex 6 – E-Signature Market Segmentation and Trends Through a value
chain analysis of the e-signature market we can identify a full range of
actors involved in the sector from hardware providers, technology providers,
solutions integrators, etc, to the end-user or final consumer, citizens, SMEs,
Large Companies, and Administrations. Figure 1 E-signature market failures The absence of "massive usage" of
electronic signatures by citizens, consumers or companies in Europe as well as
the low take up of its market since the adoption of Directive 99/93/EC 12 years
ago does not imply one single explanation. According to
EUROSTAT data[105],
an increasing usage of e-signature by EU enterprises is a considerable
augmentation of the demand of digital signature products and services. The use
of e-Signature by enterprises results increasing by around 5% per year between
2007 and 2010, depending on the market and the EU country, to reach a current
average of 29% (in 2010) of enterprises making use of digital signatures for
their computerised activities. Nonetheless, it should be noticed that in some
countries the use of e-Signature is widespread, like in Spain, where this
indicator reaches 14% in microenterprises with 1 to 9 employees, which is a
tiny percentage if compared to the levels of SMEs - between 10 and 249
employees (52%), and large companies (over 250 employees) using e-Signature (88%)
in 2010. In order ensure
that adequate measures will be taken with regards to needs and expectations of
SMEs, the European Commission, through the Enterprise
Europe Network, consulted from October to December 2011, European SMEs on the
impact of the e-ID and the e-Signature in their business. According to the majority of
respondents 62,1% of the European SMEs use e-Signature. However, few individuals
seek to obtain signature products or services and this lack of potential customers
discourages companies from investing in signature products and applications leading
to low commercial usage for electronic signature. Social grounds
explain the low take-up of e-signature products and services. Firstly, e-signature
is not perceived as a "easy to use product" and private users do not
believe that using e-signature would enhance his or her
job performance or life. Secondly,
a lack of communication on and knowledge of e-signature industry, products,
benefits, etc. is hindering its usage by a major part of the society. Electronic
signature market adjustments Despite a
satisfying average use of e-signature in Europe by companies, the e-signature
market needs to be adjusted. Firstly, costs to quit e-signature industry are high because of the high level
of investment required to enter and participate in the market, meaning that
existing firms will fight hard to survive because they cannot easily transfer
their resources elsewhere. Many “niche” solutions exist in specific sectors (such
as financial services, insurance, telecom) but there are interoperability barriers
often “embedded” within the solution. Secondly, markets
are mainly national and the incumbent champions often based on natural
monopolies. The barriers to enter
these markets are very strong considering for example that the e-signatures Directive imposes more than
thirty different requirements on qualified electronic signatures. In addition,
several countries put additional detailed requirements on the CSP leading to
the creation of barriers for the establishment of foreign CSPs. This situation may
lead to unfair competition and, in extension, acts as a trade obstacle within
the internal market. Thirdly, the natural
market demand for Qualified Certificates and related services is very low. Within
the scope of the Directive, very few applications are in use today , mainly
limited to e-government and e-banking which are the largest
application area in Europe for electronic signatures. Low take-up of electronic signature products and services The public consultation (see annex 4),
enquired how respondents judged the take-up of electronic signatures in Europe.
Almost 80% of respondents in total estimated that take-up was marginal or
moderate, whereas only 15% described it as high or very high. Enquiring
after the main reasons for this relatively modest take-up rate, respondents
primarily noted the limited number of services requiring e-signature, lack of
user-friendliness, and interoperability challenges. Costs and lack of legal
certainty were smaller negative factors. When analysing
the reasons for such a slow take up of the e-signature, the first reason is
that signing a document or an email is not handy (lack of user-friendly signature
solutions). To install a certificate on the computer is uneasy and most
applications used for private purpose badly integrate e-signature
functionalities. Free webmail services (such as hotmail, yahoo or gmail) do not
allow signing emails. The Second
reason is that service providers have little
incentive to develop multi-application electronic signature and prefer to offer
solutions for their own services, for instance, solutions developed by the
banking sector. This slows down the process of developing interoperable
solutions. The lack of applications, such as comprehensive solutions for
electronic archives, might also prevent the development of a multi-purpose
e-signature, which requires reaching a critical mass of users and usage. The third reason is an element that explains the lack of interoperability. The
Directive does not grant enough legal certainty with respect to the use of
electronic signatures and related services. Many businesses in Europe claim
that they are willing to use an e-Signature abroad but having difficulties or
at least uncertainties about the validity of their e-Signature across border. Despite of the market imperfections, new usage
scenarios like signature
creation through mobile devices, remote signatures, mass signing and
server signing are
the new trends of the esignature market that could make it grow. The increasing
convergence of mobile telecommunications and the Internet as well as the
growing number of added value services for mobile devices will result in a
strong market demand for secured transactions on the Internet. CSPs could
target millions of potential customers thanks to the high market penetration of
smart mobile phones. Strengths
and weaknesses of the electronic signature market Electronic Signature Market Strengths || Weaknesses 1. Technology has not changed in the last decade 2. Demand is a constantly and progressively growing. 3. Large investments on the e-signature sector already done by companies, Public administration, etc. 4. Extended government support in most MS as a means to reduce administrative burden (i.e. e-signature directive 1999/93/EC: Market access and internal market provisions) 5. Massive use in some sectors (home banking, healthcare, etc) 6. Supply side competitive and diversified 7. Many tangible and intangible benefits for users and SMEs (facilitate the business transactions and save time, money etc) 8. E-signature products and services are environmentally friendly (i.e. e-archiving, e-invoicing) || 1. The market is fragmented (There are lots of small to medium size companies and where even the big players have stiff competition) 2. Strong barriers to entry through economies of scale. 3. The market is "protected" by European legislation and Member States national legislation. Artificial demand 4. Numerous requirements on qualified electronic signatures. Complex product 5. Few user-friendly signature solutions 6. Limited EU cross-border interoperability 7. Insufficient legal certainty of e-Signature implementations 8. Small potential Return on investments for companies by implement e-signature solutions. 9. Little marketing of product and services. Lack of user's awareness. 10. No perceived cost savings for companies especially for SMEs and private users,. 11. Limited number of services requiring e-signatures. 12. E-signature standardisation framework = lacks business orientation Market
failures and legislative failures Electronic Signature Market failures and legislative failures Market Failures || Legislative Failures The market is fragmented (There are a lots of small to mid size companies and where even the big players have stiff competition) || Legal uncertainties due to the large variety of approaches to e-signatures The market is geographical, working in silos || Mutual recognition and cross-border interoperability of e-signatures Strong barriers to entry through lack of economies of scale. || Mutual recognition and cross-border interoperability of e-signatures. Member States transpose through their own lawmaking processes the provision of a Directive Strong barriers to entry (several countries put additional detailed and unnecessary requirements on the CSP) || Member States transpose through their own lawmaking processes the provision of a Directive Few e-signature applications are in use today and they are almost completely limited to e-government. || Standardisation. The technical framework is outdated and does not clearly link to legal requirements. The market is "protected" by European legislation and Member States national legislation. Artificial demand || Member States transpose through their own lawmaking processes the provision of a Directive Few private customers seek to obtain signature products or services || Unclear supervision leading to lack of confidence Lack of e-signature standardisation framework = lacking business orientation || Standardisation. The technical framework is outdated and does not clearly link to legal requirements. Status of
electronic signature in EU (2010) Country || Providers of qualified signature certificates[106] || Status of providers (public/private)[107] || Number of issued qualified certificates[108] || SSCD certification[109], [110] || Validation services[111] Austria || 1 || 1 private company || 120.000 || DB || MOA – SP (public) Belgium || 1 || 1 private-public company || 10.000.000 || SD || No Bulgaria || 5 || 5 private companies[112] || Unknown || DB[113] || No Cyprus || 0 || - || 0 || No specific rules || No Czech Republic || 3 || 2 private and 1 public company[114] || 193.000 || Only formal verification[115] || No Denmark || 0 || - || 0 || SD || No Estonia || 1 || 1 private company || 1.000.000 || DB || DigiDoc[116] Finland || 1 || 1 State entity || 275.200[117] || DB[118] "authorisation" || No France || 2 || 2 public companies || Unknown || DB[119] || No Germany || 12 || 2 private, 10 public companies || 320.000 || DB || VPS (public) Greece || 3 || 1 private, 2 public companies || Unknown || SD or VAS[120] || No Hungary || 5 || 3 private, 1 public company, 1 State entity || 11.866 || DB[121] || No Ireland || 3 || 2 private, 1 public company || Unknown || SD or VAS[122] || No Italy || 16 || 11 private, 3 public companies, 2 State entities || 3.200.000 || Accredited CSP: DB; Supervised CSP: SD[123] || No Latvia || 1 || 1 public company || 25.000[124] || SD or VAS[125] || No Lithuania || 3 || 1 public, 1 private company, 1 State entity || Unknown || SD or VAS || No Luxembourg || 1 || 1 public-private company || Unknown || SD and obligatory notification[126] || No Malta || 0 || - || 0 || SD or VAS[127] || No Netherlands || 5 || 4 private companies, 1 State entity || 20.000 || Registration compulsory || No Poland || 5 || 4 private, 1 public company || 256.000 || DB[128] || e-Notarius (private) Portugal || 5 || 5 State entities || Unknown || Registration compulsory [129] || No Romania || 3 || 3 private companies || Unknown || SD and obligatory notification [130] || No Slovakia || 5 || 5 private companies || 90.000 || VAS or DB[131] || No Slovenia || 5 || 4 private companies, 1 State entity || Unknown || SD or VAS; registration required to use e-signature within public administration[132] || No Spain || 12 || 5 private, 2 public companies, 5 State entities || Unknown || SD[133] || @firma (public) Sweden || 1 || 1 private company || 50 || SD[134] || No UK || 1 || I private company || 1 || DB[135] || No The table above shows estimates of certificates volumes in
the different countries. The following observations can be made: -
A large
number of Qualified Certificates have been issued by accredited CSPs in Italy.
The main application area for these certificates is for access to company
registration information (InfoCamere). -
In Belgium
and Estonia the large volume is a result of large-scale deployment of
electronic ID cards. -
In Germany
quite a large number of Qualified Certificates have been issued and are
regularly used in various е-government
applications. -
In Slovenia
a substantial number of Qualified Certificates have been issued mainly for
corporate е-banking purposes and for
e-government. -
The
differences in certificates from accredited versus supervised CSPs are mainly a
reflection of the different governments promoting/mandating accredited CSPs. Annex 7 – Table representing the difficulties
encountered by each of the stakeholders and the interest in the revision of the
framework supply Side eService/device producers || How are they affected by the unavailability of an appropriate cross-sector framework for secure, trustworthy and easy-to-use electronic transactions in the Single Market? - Different regulatory approaches in different Member States result in a fragmented market for eService/device producers in the EU. Different legislations create, for producers, a barrier to enter other European markets and hamper the deployment of cross-border services - Some exceptions set apart (banking applications and tax declaration eServices), the volumes of demand for IAS is quite limited generating important limitations on o Service economies of scale o Investment recovery (technology and organisation) o New entrants to the market (barriers to entry) - There are significant barriers to exit and investments are service-specific - IAS What are their specific interests regarding the revision of the current EU legislation about e-signature? - A harmonised legislation for all EU Member States imposing similar standards (legal and technical) which would allow them to develop electronic services and devices usable in all EU countries and by all sectors. As such, they would have access to one European market for their services and products instead of national markets. - An improved alignment between legislation and standards, to support the development of new or more advanced IAS technologies required by the market, such as mobile signatures (through mobile devices) and server signing through HSMs. - A legislation that goes beyond e-signatures, to allow them to develop and promote e.g. also eID tools as part of a rationalised device offering. Demand Side eService providers Public sector Governments and administrations || How are they affected by the unavailability of an appropriate cross-sector framework for secure, trustworthy and easy-to-use electronic transactions in the Single Market? - The definite trend to sophistication of online services is a crucial ingredient to modernisation, cost effectiveness and re-organisation of public administrations with the objective to deliver faster high quality with less resource consumption (i.e. reduction of administrative burdens), the logic consequence is migration to electronic services and transactions which do not stop at national borders especially[136]. These cross-border transactions are currently hampered by a lack of an appropriate EU framework. - By way of an example: not all European contracting authorities have adopted eProcurement and the existing systems are very difficult to access by contractors located in other Member States [137]; these authorities are currently missing the opportunity to receive better and cheaper offers for their procurement from contractors across Europe. This could be remedied by an appropriate framework for IAS services at the EU level. Similar challenges present themselves for other public services, e.g. in the implementation of the Services Directive (requiring the establishment of electronic points of single contact, i.e. service portals that can be used by service providers throughout the EU), or in the development of cross-border eJustice and eHealth systems, which require highly reliable identification and authentication of the relevant professionals. What are their specific interests regarding the revision of the current EU legislation about e-signature? - A EU framework including mutual recognition and the acceptance of “(official) eIDs” as a common way to access public online services in another Member State, and an improved (more effective) recognition and acceptance of e-signatures. This is expected to lead to an increase in the use of these services by citizens and companies allowing for a reduction of administrative burdens, an improvement of the quality of services provided by the administration, a more efficient usage of the budget dedicated to public procurement, etc. - A general EU framework for IAS that is sufficiently comprehensive to support the different e-Government solutions that have been developed in the past years as large scale pilots (e.g. STORK, PEPPOL, SPOCS, eCodex, and epSOS) and should be channelled into long term sustainable digital service infrastructures as proposed by the Connecting Europe Facility[138]. Member States (and the Commission) have invested millions in these projects, which cannot be brought to a fully operational stage without a common legal/policy framework that would support some of the outputs of these projects (such as the STORK Quality Authentication Assurance framework, which allows the classification of official eIDs issued in the Member States on the basis of their reliability assurances). Private sector With existing specific systems for electronic transactions (e.g. banking sector, e-Commerce, liberal professions, etc.) || How are they affected by the unavailability of an appropriate cross-sector framework for secure, trustworthy and easy-to-use electronic transactions in the Single Market? - The fact that (official) eIDs cannot be currently used by the private sector for electronic interactions makes them more complex and not very user-friendly. Indeed, customers need multiple devices and/or remind several different usernames and passwords for each interaction with each individual company. - The lack of trust from consumers due to the unavailability of an appropriate framework ensuring secure, trustworthy and easy-to-use electronic transactions can hinder the take-up of electronic transactions across the EU (e.g. in sector of e-Commerce). This slows down the boost that could be given to the economic activity / recovery in the EU; - The insufficient legal certainty surrounding both electronic interactions and the existing tools for online transactions does not allow companies to easily verify the reliability of information received from a customer (e.g. that the person is actually who he/she claims to be, that he/she actually has the age he/she pretend, the validity of official documents, etc.) - The lack of a general approach to trust services (IAS services and related trust services in general) limits the market for European providers of such services, as the legal value of their services is questionable and may vary from Member State to Member State. If they wish to offer their services in other Member States, they will have to first identify which requirements (if any) exist for their services, and conduct compliance audits. The lack of a common European framework causes a large cost of market entry, which in turn discourages investments into new and innovative trust services. What are their specific interests regarding the revision of the current EU legislation about e-signature? - A framework for electronic transactions ensuring more legal certainty and leading to an increase in trust and ease of use for users. This new framework is expected to increase the number of e-Services users leading to different benefits for the private sector (e.g. reduction of administrative burden, improvement of quality of services provided, innovative services, additional cross-border economic activity, increased growth for e-Commerce, etc.) - A more streamlined and harmonised approach for trust services in general, which lowers their operating costs by limiting or eliminating national regulatory divergences, and thus opening up a European Digital Single Market. private sectors without specific systems for electronic transactions || How are they affected by the unavailability of an appropriate cross-sector framework for secure, trustworthy and easy-to-use electronic transactions in the Single Market? - The fact that (official) eIDs can currently not be used for electronic interactions between private sector service providers and their customers makes their customers less interested in eServices since they need to have several devices and/or remind several different usernames and passwords; - The lack of true interoperability between European service providers means that there is limited competition in IAS markets, which raises the cost for end users. - Closed “niche” solutions have been developed for specific industries such as e-banking, e-payment or e-health, but there is a barrier to using such solutions in other eServices (it is not interoperable) as they are often “embedded” within the solution. Development of new products and services for specific sectors separately is costly and not efficient; - The insufficient legal certainty surrounding both electronic interactions and the existing tools provided to interact online does not allow the exchange of electronic documents between two companies located in different Member States with the same guarantees that exist in the physical world (e.g. contracts, registered mail, etc.); What are their specific interests regarding the revision of the current EU legislation about e-signature? - A framework for electronic transactions leading to increased legal certainty allowing them to engage in electronic transactions (e.g. communicating signed contracts) with the same ease of use and legal value as physical documents; - A framework leading to full interoperability of e-products and services across sector and Member States allowing them to use applications already developed for other sectors for their own business. This would allow e.g. the re-use of eID cards or private sector issued eIDs (bank cards, mobile phones, etc) in any other type of application. End users Citizens/Consumers || How are they affected by the unavailability of an appropriate cross-sector framework for secure, trustworthy and easy-to-use electronic transactions in the Single Market? - The fact that different legislations are applicable across Member States makes citizens not very confident and trusting when travelling to another Member State or shopping cross-border on the Internet, because their rights, and the way of exercising them, can vary significantly depending on the applicable national legislation; - Citizens cannot use their "official eIDs" they obtained in their own Member State throughout the EU in order to benefit fully from the Digital Single Market when they want to move, travel, study, work or do business abroad. They are currently not able to access cross-border online services of other Member States when they need to identify themselves electronically due to the fact that almost no Member States foresee or support the use of other Member States' official eIDs; - It is currently not possible to use “official eID” for cross-border electronic interactions with the private sector. This results in citizens receiving multiple devices, usernames and passwords, which reduces the appeal of these eServices and encourages bad security practices as end users are likely to re-use the same passwords; What are their specific interests regarding the revision of the current EU legislation about e-signature? - A legislation solving the problem of the lack of interoperability of their “eID” between Member States (e.g. allowing them to fulfil administrative formalities from abroad); - A legislation guaranteeing secure and trustworthy cross-border electronic transactions and allowing them to benefit fully and uniformly from their rights across the EU; - A legislation leading to user-friendly, easy-to-use and uniform e-products and Services for end users. Business (including SMEs) || How are they affected by the unavailability of an appropriate cross-sector framework for secure, trustworthy and easy-to-use electronic transactions in the Single Market? - Businesses cannot use any eIDs given by their own Member State throughout the EU in order to benefit fully from the Digital Single Market when they want to move or do business abroad[139]. They are currently not able to access cross-border online services of other Member States when they need to identify themselves electronically due to the fact that almost no Member States foresee or support the use of other Member States eID for businesses; - The lack of a common framework for all IAS services (including eID) results in limited accessibility of crucial e-Services. By way of example, e-Procurement is not adopted by all European contracting authorities. This can lead companies to miss business opportunities. Moreover, enterprises willing to participate in procurements in other Member States can be discouraged by the more complicated procedures and higher administrative costs. The fact that electronic procedures may be available to national tenderers but not to foreign ones also distorts competition, as this raises the cost of participation for foreign tenderers. - The lack of a common framework for other trusted services also impedes the use of more advanced trust services, such as electronic registered mail or e-archiving. Companies therefore miss out on the opportunity of using such services in a legally reliable manner, needlessly increasing their cost of operation. What are their specific interests regarding the revision of the current EU legislation about e-signature? - A legislation solving the problem of the lack of interoperability of eIDs between Member States (e.g. improving e-Procurement availability and accessibility across the EU); - A legislation guaranteeing secure and trustworthy cross-border electronic transactions and allowing them to benefit fully and uniformly from their rights across the EU; - A legislation leading to user-friendly, easy-to-use and uniform e-products and Services for end users. Governments and administrations || How are they affected by the unavailability of an appropriate cross-sector framework for secure, trustworthy and easy-to-use electronic transactions in the Single Market? - The lack of a common framework for all IAS services means that governments and administrations as end users cannot easily support eIDs and e-signature solutions offered by third parties, especially in other Member States. Migration to electronic services and transactions therefore cannot be completed: foreign citizens and businesses often cannot benefit from electronic public sector services provided to them. This is a barrier to the Digital Single Market. It also creates unnecessary costs, as (less efficient) paper systems are the only solution that can currently be offered to foreign users. - This also implies that it is difficult for public administrations to fully comply with their legal obligations under various European legislations. Both the implementation of e-Procurement platforms and the creation of points of single contact under the Services Directive require that public administrations provide certain electronic services to citizens and businesses, including in other Member States. The development of such services is difficult or impossible, at least while Member States require secure and advanced methods of eID and e-signatures to use such systems. What are their specific interests regarding the revision of the current EU legislation about e-signature? - As end users of IAS services, their interests are the same as in their role of eService providers: they are interested in an EU framework including mutual recognition and the acceptance of “(official) eIDs” as a common way to access public online services in another Member State, and an improved (more effective) recognition and acceptance of e-signatures. Similarly, any solution should allow them to support the different e-Government solutions that have been developed in the past years as large scale pilots (e.g. STORK, PEPPOL, SPOCS, eCodex, and epSOS). Annex 8 – Detailed assessment of impacts – related
trust services – EU supervision level I. Detailed
assessment of impacts The following
section presents a comprehensive outline of the main economic, social and
environmental impacts that could result from the implementation of option 2, 3
or 4. 1. Economic
impacts Macro-economy How significant could the economic impact of a European Digital Single Market be? The answer to this question is based on model scenarios using estimates of the productivity impact of increased use of digital technologies and services in Europe. Scenarios and how they relate to the Digital Single Market The scenarios can be used to quantify the possible impact of an accelerated diffusion of digital technologies and services in Europe. This acceleration can be formulated as the difference between the “base case” (assuming “business-as-usual” and a continuation of the current trend) and a “best case” (assuming an acceleration of the use of digital technologies and services), Three scenarios for Pan European Framework for Identification, Authentication and Signature impact of the digital economy In a study for the European Commission (DG Information Society and Media), entitled “The Impact of Broadband on Growth and Productivity” the consultants MICUS (2009) has developed a model of the macro economic impact of broadband that can be transposed to the Pan European Framework on Identification, Authentication, and Signature. The study by MICUS (2009) works with two key scenarios: “Best case”: The speed of adoption of online services increases to that of advanced knowledge societies (Belgium, Denmark, Finland, Luxembourg, Netherlands and Sweden). The adoption rate in these countries was on average 4.1 percent during 2004-2006. The advanced knowledge societies are also better at taking advantage of online services. Therefore, the best case scenario has both a higher adoption rate and a greater effect on GDP. “Base case”: The speed of adoption of online services continues at the speed during the period 2004-2006. The study also operates with a “worst case”. This is less relevant for our purpose, but for the sake of completeness, it is assumed that the speed of adoption of online services drops to that of countries with less developed broadband (Bulgaria, Greece, Latvia, Poland, Romania and Slovakia). The adoption rate in these countries was on average 1.8 percent during 2004-2006 with a corresponding lower ability to take advantage of online services. Therefore, the worst case scenario has both a lower adoption rate and a lower effect on GDP[140]. The model and scenarios are useful for our purpose, because they allow for a quantification of the effects linked to an increased use of online services, improved digital infrastructure, and improved e-skills. Better regulation of the digital economy and harmonisation of the regulation across European borders can create a framework which stimulates competition and innovation and thereby accelerates the creation of new digital technology and services. This is precisely what is needed to make the difference between “business-as-usual” (i.e. the base case) and the accelerated diffusion of the digital economy (i.e. the best case). The recent study prepared for the European Commission in the digital economy, see Micus (2009), focuses on two factors, namely “digital infrastructure” and “digital readiness” as the main policy drivers for economic impact. It is the impact of these two factors which are specifically analysed in their study. The Pan European Framework for Identification, Authentication and Signature is focusing on a third factor - “digital content & services” - and stresses the impact of a well-functioning market, providing incentives for innovation in the services layer which requires harmonisation and a large unified market in order to achieve the required scale and scope. We claim that the “best case” scenario will not stand a chance of materialising without the third factor, which aims at stimulating content provision and innovation in the service layer of the digital economy. The policy instruments required to foster this third factor are regulatory harmonisation, large scale markets and a focus on innovation. These are exactly the ingredients brought about by the Pan European Framework for Identification, Authentication and Signature. The digital single market stimulates the development and take-up of online services, encourages online trade, has a population with high e-skills, and it encourages investment in digital infrastructure. It is hard to predict to what extent the Pan European Framework for Identification, Authentication and Signature will affect the take-up of online services and how it will influence e-skills. We argue that the impetus provided by the Pan European Framework for Identification, Authentication and Signature will make a significant contribution to the possible acceleration of the use of electronic interactions. Impact on GDP in Scenarios The digital economy is a major source of growth and innovation. The analysis of the GDP impact of these scenarios shows that the digital economy can contribute with up to a 12 percent increase in EU27 GDP between 2010 and 2020 (corresponding to an increase in the annual growth rate of +1.09 percent). 1. Best Case: Over a ten year period from 2010 to 2020, the cumulative impact of a best case acceleration of the digital economy on EU27’s GDP is in the order of 12 percent higher GDP in 2020, cf. Micus (2009). 2. Base Case: Uptake of digital technologies are already increasing at a rapid speed, so even without any further acceleration the digital economy will continue to add to GDP. A continuation of the current trend, as in a “base case” scenario, will add 8 percent to EU27 GDP over a ten year period, cf. Micus (2009). An 8 percent increase of EU27 GDP is large, and it corresponds roughly to the size of Spain’s GDP. 3. Net impact of acceleration (= best case – base case): The net impact of a best case acceleration of the digital economy on EU27’s GDP is estimated to be in the order of 4 percent over a ten year period. This is calculated as the difference between the “best case” (+12 percent) and the “base case” (+ 8 percent). Micro-Economy Today's
economic impact of e-signature Today, digital
service infrastructure can generate large economic impacts. A 2010 KPMG study
estimated that the cadastre's online access and digital certifications
provision was saving Spanish tax-payers at least €157M a year (against
cadastral budget of €118M for the same year). Another cost-benefit-analysis
conducted by RSO and Cap Gemini showed the Cadastre’s electronic office was
saving the tax payer about €7,758M[141]. For businesses, the
cost savings that organisations realise by replacing paper-based processes with
fully digital ones incorporating e-signatures can be very significant -
Forrester estimates up to 75% of the amount previously spent pushing paper
around. Firms implementing e-signatures save considerable amounts of money on
materials (chiefly paper and copy supplies) and personnel (to generate, send,
receive, process, and store all that paper). But cycle time is also a key
component: the value of this advantage increases exponentially with the number
of signers or the number of stages of a multistep signing process involved in
completing the execution of a contract. Moreover, the likelihood of customers
signing and returning a document within minutes of receipt is far higher when
the process does not involve copying, and returning paper. Financial services
firms and insurance companies report average contract cycle times falling from
one or two weeks to a matter of days - or hours. 2. Positive externalities Positive
externalities are benefits that do not accrue to only a single economic actor,
but spill over to society as a whole – thus making the social returns to
capital investment higher than initial outlays[142]. The following main categories of positive externalities of common
European action in the area of eIAS would emerge both at regional / MS level: a. The Innovation
Diffusion Externality. New and more innovative services emerge that would
benefit a growing number of users, thus ultimately improving the overall
quality of life. From the infrastructure side, penetration rates correlate
positively with the “e-Readiness”, or the capacity of consumers, businesses and
governments to reap the full benefits of the Information Society[143].
Single sign on
solutions, secure e-delivery and e-safes are not only essential key enablers of
electronic interaction but also new and innovative online services. They are
already available in EU27, although with a different degree of frequency (75%
eIDs and single sign on, 47% secure e-delivery, 38% electronic safes. More than
half of the countries having in place e-Safes use also single sign on and
e-Delivery. Official eIDs are used by all of them as access key. The table
below demonstrates their interdependencies[144].
b. The Economic
Efficiency Externality. Transaction costs are reduced; which makes it easier to
conduct online business and attract foreign investments to certain locations[145]. Electronic signature is already supporting a wide and increasing
number of dedicated business, government and leisure applications and services.
Bringing electronic signature to new areas means expanding the market for
e-Commerce: more consumers would be able to purchase on-line, including across
border, thus enlarging the market base, and to access public services on-line. Similar effects can be achieved with the cross border and cross sector use of electronic identification. Emerging sectors such as the e Gambling industry which expects a growth from €8.3B to €12,5B in 2012[146] could profit from the possibility of minimal data disclosure made possible by the use of official eIDs (e.g. only the age of a person needs to be provided without the need to disclose other person data). Looking to the potential market figures from Germany gives an idea of the potential scale. The brutto amount per gambler increased between 2005 and 2009 on average 361% from €8,3M to €29M. The betting amount totalled to €477 million in 2009 leading to a gross earning of around 6%[147]. With the growth of the online gambling market regulation on standards became stricter. Full identification of gamblers is required in order allow them to play, for pay out or when account funds reach certain levels. Identification allows the protection of minors and vulnerable people but prevents also potential fraudsters and money launderers from accessing online gambling. Today's offline identification means makes it difficult for operators to face the challenges of online identification without compromising ease of use for customers. The challenges rise with the increasing number of cross border gamblers of different nationalities. Official eIDs would correspond to the different requirements of the online gambling market by making secure and unequivocal identification possible. They would also allow for minimal data disclosure and the verification of the identity claims of gamblers. The proposed Framework for electronic identification, authentication and signature enabling the mutual recognition and acceptance of official eIDs represent to the online gambling market a powerful trans national alternative to current solutions. Another important sector which could benefit from mutual recognition and acceptance of official eIDs across border is the e Health sector. According to a study carried out in Italy[148], overall savings from the introduction of Information and Communication Technologies in the health sector (online physicians, electronic prescriptions and sick leave certificates, digital health records, online booking of health services through online payments and medical reports, telemedicine) are estimated at around 11,7% of National Health Service (NHS) expenditures (i.e. €12,4 billion). Savings due to the introduction of online prescriptions should account for around 1,84% (almost € 2 billion). Territorial trials allow the conclusion that the introduction of online prescriptions could follow a 8 10% reduction of pharmaceutical and specialist healthcare expenditure (i.e. from €1,2 billion to €1,5 billion) currently originated by different causes such as misuse, material errors, wrong use of prescriptions, misalignment among registry offices or verification of exemptions. c. Network
Externality. The more users that benefit from the Pan European Framework for
Identification, Authentication and Signature, the more visible and effective
the above impacts are. Technological progress e.g. in remote care, which
directly lowers health care costs, postpones or eliminates the need for
institutionalised care, and makes it possible to increase workforce
participation from home. As an example, the Scottish West Lothian council
independent living programme has succeeded in ensuring that elderly couples
with severe impairments can stay in their own homes. They have thus saved the
public budget £84,000 on an annual basis. The public consultation (see Annex 4) showed
that stakeholders expect an impact of legislative measures addressing mutual
recognition and acceptance of eID across borders. The main expected effects
(with positive reply rates of more than 50%) were higher legal certainty
(62,2%), reduction of administrative burden (60,8%), and the increase of
cross-border mobility (59,1%). Economically, a positive impact is expected
through the increase of economies of scale (49%). 3. Sector specific impacts of
electronic identification and authentication 3.1. e-Procurement On average, foreign suppliers in the e-Procurement sector are still limited to approximately 5% of total registered suppliers, signalling the relative weakness of the single market integration in public procurement[149]. A few small countries appear to be more open: Ireland (with 25% of foreign suppliers) and Cyprus, Estonia, Malta (with more than 10%). These economies use the national e-Procurement platform also to ease the access of suppliers from elsewhere in Europe, for the convenience of their public buyers. Another group of platforms (in Austria, France, Portugal, United Kingdom) declares a presence of foreign suppliers between 4 and 6% of the total registered suppliers and the other countries are around 1 to 2%. The public sector market has always been difficult for non domestic suppliers and the transparency and standardization of electronic procurement processes is a way around legal and practical barriers. Even if these numbers are still low, they represent a first step towards a greater opening of the internal market. In the field of e-Procurement potential savings are the driver of implementing new systems and procedures. From the Scottish example we can learn about audited savings of almost £800 million over a 4-year period. Sweden has reported a reduction on prices between 10% and 30% as well as efficiency improvements in the procurement process of 20% going up to 30% when the entire tender is processed online. In Portugal there is a much shorter time to process tenders accompanied with a greater level of transparency. PECAP the Plataforma Electrònica de Contractació de les Administracions Públiques in Spain documents savings between 15 and 45% on overall prices of energy and telecom services for the local administrations. Similarly the Basque Country Regional Government has announced overall savings of 20% on purchase prices due to the increase in competition made possible by the electronic channel. Although the opportunities offered by e-Procurement are not yet fully reaped some of the national examples show the potential of further growth. eIAS with its different use cases (e.g. secure identification of bidders access to online platforms) could bring further benefits. Official eIDs have the advantage that they are already issued and used in the Member States with the connected authentication system in place allowing for verification and validation of identity claims. E-Procurement could profit from these already existing solutions and their EU-wide use enabled by the proposed action on mutual recognition and acceptance of official eIDs throughout the Union. 3.2. Identity theft Official eIDs and
authentication can also help to reduce fraud and identity theft in the
internet. The growing number of threats demonstrate that action is needed.
Compared to 2009, Germany registered an increase of 19% of cybercrime in 2010
(FN: Bundeslagebericht "Cybercrime 2010", Bundeskriminalamt, 2011,
www.bka.de). The damage caused by internet crime grew from €39,6 million to
€61,5 million in 2010. According to estimates the volume of cases not
officially reported may be higher than 50%. A significant increase of phishing
attacks (more than 82% compared to 2009) were reported totalling to 5.300 cases
were criminals tried to get access to bank accounts via online banking .
Source: Cybercrime 2010, Federal Status Report, Federal Criminal Police Office,
Germany Secure electronic
identification through the use of national eIDs could become attractive to all
business sectors involved in or offering online business such as the credit
card sector or online shops. Stolen credit card would become more difficult as
national eIDs in combination with their related authentication systems are
technologically much less easy to crack than currently used identification
systems based on e.g. userdID and password. The use of eIDs
issued in the Member States to securely access public online services could
create significant added value for all those sectors where a higher security
level of electronic identification is needed. One of these could be the
environmental sector, in particular the new EU Emission Trading Scheme managing
allowances with assets of around €110 billion. In January 2011 the Commission
had to suspend transactions due to phishing attacks in the Member States which
lead to the theft of emission certificates of a value of €28 million. The
losses reported in Germany amounted to around 3 € million with 200.000 to
250.000 stolen certificates. 3.3. Large Scale
Pilot STORK The EU co funded Large Scale Pilot STORK offers an EU wide cross-border authentication platform for electronic services. The pilot enables European citizens to access services in participating countries in a secure way, by using their national eIDs. The process allows the individual the control of its ID data and the STORK infrastructure provides a high level of trust, security, privacy and data protection. STORK is implemented by a consortium of 32 partners, including 17 EU Member and Associated States, a number of companies and organisations from the private, academic and civil society sectors. As EU wide systems cannot be built without the support of industry and the interest of future users, the project has also created various communities of interest (Member States Reference Group, Industry Group) involving these stakeholders. The different pilots running already real time show the wide range of use cases for official eIDs and secure authentication. "Safer Chat" demonstrates that official eIDs can be used by children and young people by building a platform for a safer online environment. The key to enter the room is the age of the chat user provided by the official eID. No further identity data are needed – one of the characteristics of official eIDs which would add value to the online gambling sector as described above. The pilot "Student Mobility" enables foreign students to get access to any online administrative service offered by a particular University using their national eID for identification purposes. It is used for the registration of Erasmus students which represent a population of 230.000 per year. The implementation of the pilot by the partner lead to spill over effects as universities involved integrated the official eID in their own environment for the whole range of online services in use. Other spill overs can be expected as the interest of other universities for take-over is very high. "Electronic Delivery" is piloting the mechanisms developed for secure cross-border delivery online. From the 9th Benchmarking eGovernment Report we already know that the electronic delivery is available in 47% of EU+27. The change of address pilot has shown also interesting spill over effects in the case of Portugal where the change of address is connected to another cascade of online services available to the citizens reporting the change of address. When communicating the change of address the foreign citizens can also opt to automatically communicate the change of addresses to e.g. the water supply company, electricity supply company, etc. "ECAS integration" is piloted by the Member States together with the Commission which operates numerous electronic services that require user authentication. Work is carried out in close cooperation between the STORK Member States supporting the pilot, the Directorate General Informatics (DIGIT), and the Commission’s application owners. In practice, the pilot enables Member States experts to access the CIRCA network with their national eID. What STORK and the future roll out of STORK enabled services is missing is an EU wide legislation for mutual recognition and acceptance. Currently, STORK and its pilots are based on agreements between partners to overcome the lack of common legal EU provisions for official eIDs. The proposed framework would provide these and with them the necessary conditions for the long term sustainability of STORK and all other projects and applications using the STORK platform. 4. Social
impacts The development of
an eIAS Framework will also have significant employment effects. The Framework is
expected to foster competitiveness and innovation. This will lead to greater
employment in the EU and to a shift in employment structure towards more
high-skilled jobs. This does not imply that the low skilled labour will become
unemployed, but that their job-content increases because they move to sectors
with higher productivity. However, it must be acknowledged that there are
transition costs related to the inevitable transformation away from ‘old’
industries. To give a concrete example of job creation in the area of new technology, the improvement of digital infrastructure alone will have important stimulating effects on the economy. Katz et al (2009) estimate that fulfilling the German National Broadband Strategy, where 75 percent of the population has access to 50 Mbps by 2014, will generate around 300,000 jobs from network construction alone. In the current business cycle situation of the EU, this is potentially a welcome stimulus to a construction industry which is more or less idle in some areas. However, the dynamic employment effects of moving towards the eIAS Framework will generate even more jobs in the longer run. Using the MICUS model, we estimate an employment increase in the EU, including an increase in the adoption of online services from 3 percent to 4 percent per year. This is perhaps a conservative estimate, because Katz et al (2009) estimate that in Germany alone the improvement of digital infrastructure will trigger innovation and growth leading to an additional 427,000 jobs over the period 2015-2020. Further social (and
environmental) impacts can affect depopulated rural areas through the
development of tele-working, eCommerce or smart metering. In rural areas the
value added from people going online to profit from e.g. eGovernment, education
and culture, eInclusion and eHealth services is even higher than in urban
areas. 5. Environmental
impacts Organisations are
moving away from the traditional time consuming paper processes and searching
for new innovative technology to improve efficiency. E-signatures can
significantly benefit organisations by eliminating the last of the paper in the
business cycle. The ability to instantly sign and seal documents and
transactions electronically results in much shorter process cycle times,
accelerated customer service and drastic cost savings. Digital signatures
provide enhanced convenience for both the consumer and the organisation, while
significantly reducing application processing time. A Deutsche Bank Research from 2008 analysed the use of automated data exchange for sending or receiving e-invoices by enterprises in the Member States and the EFTA countries. Indeed, this process can significantly have an impact on the environment by hugely reducing the amount of paper used by companies. The top countries are Estonia (39%), followed by Norway (32%) and Italy (29%); while Sweden is beyond the average (18%) and Hungary is the bottom one (5%). Italy expects immediate annual savings for the National Health Service from the abolition of paper flows of almost €600 million[150]. In 2008, prescriptions almost totalled €550M[151]. Following the abolition of printing costs and costs related to the delivery of forms to physicians, as well as costs derived from prescription printing, forwarding and filing a total saving accounting for almost €600 Mio per year could be obtained (with savings for each prescription between 1 and 1,5 euro)[152]. Savings for dependent workers accounting for almost €70 million would result from the abolition of the obligation to send sick leave certificates by certified mail letter to both the competent health administration and the employer. The cost of certified mail letters is €2,80 each, and sick leave certificates issued for private sector employees are almost €12 million a year, for a total of 24 million certified mail letters sent every year. The use of eIAS would be at the basis of most of these online applications thus contributing to the paperless office and its positive impact for the environment. "Tax-online" figures from Austria show a continuous growth of paperless tax declarations since around the last decade, with an increase from 10% in 2002 to 48% in 2010[153]. The multi-channel access to the applications (2,6 mio users and 8,1 mio applications per year, 6,5 mio of which tax declarations) includes the use of the citizen card for electronic identification and authentication with smart cards since 2004 and mobile phone since December 2009. 6. Administrative
burden A major advantage of
the eIAS framework is its ability to greatly reduce administrative burden by speeding
administration and reducing compliance costs (for example, by reducing paper
and mailing costs). In this regard,
Estonian's regulation has to be pointed out as a reference model. Most management
of business with the government can be executed either by e-mail or through
different portals. Simpler proceedings can be performed by way of summary
procedures, but more complex transactions requiring legal certainty must be
confirmed either with personal or notary’s e-signature. The development of
e-services in Estonia has been facilitated by the comprehensive digital
deployment of the Estonian ID card and broad availability of the Internet.
Portugal has a similar aim and other countries are also moving in the same
direction. Most Estonians know that they can communicate with the government
without leaving home and confirm transactions by e-signature, if necessary. Foreigners willing
to do business in Estonia usually establish a company in the country but since
November 2008, the Company Registration Portal[154]
also recognises Portuguese, Finland, Belgium and Lithuania eIDs, allowing them
to set up a company in Estonia through the Internet. Similarly to the Estonian Company Registration Portal, the Portuguese
business portal allows, in addition to the establishment of a company,
submitting annual reports and amending registry details of a company. Electronic proceeding considerably reduces administrative burden and
facilitates the life of businessmen. For instance in 2008, 40% of companies
were established and 20% of annual reports were submitted through the Estonian
Company Registration Portal and the percentages have doubled every year. II. Related Trust Services 1. Electronic seals The current e-signature Directive only
covers e-signatures for natural persons and not for legal persons. The
objective of electronic stamps or seals is to fill this gap by providing the
same kind of instrument to legal entities in transposing mutatis/mutandis the
rules of the currently used electronic signature to legal persons. The
important feature of some documents issued by an entity is their authenticity.
The fact that the document was indeed issued by the entity (e.g. insurance
certificate, authorisation) can be proven by an electronic seal. Estonia and Spain have already introduced
this service in their national legislation. The Estonian case In addition to electronic signatures, Estonian legislation covers the use of electronic seals (digital stamps in Estonian legislation). Electronic seals are technically equal to electronic signatures but have a legally different significance, since they can be performed without the direct consent of a physical person and consequently allowing for automated stamping. Certificates for electronic sealing can be issued to both legal and natural persons, by a certification service provider. It is expected that the public sector will find a number of new applications for the use of electronic sealing and therefore increase the market in this area. In Estonia, electronic seals are technically similar to electronic signatures. Analysis Conceptually, regulating e-seals in the way provided by the Estonian regulation would recognise the specificities of the digital world towards the real one. Indeed, if in the real world a legal entity needs a legal representative, as a natural person, to give its agreement on a transaction, it is because the legal entity has no physical presence. In practice, currently a company proceeds through a physical person to agree on a transaction. This is also the case in the digital world. This means that at least one member of the company needs to possess its own electronic signature certificate. This certificate is supposed to be its own one and, in principle, cannot be shared. However, in practice, the certificates are shared in order to allow other company's members to act on behalf of the company. Obviously, electronic seal will not settle the problem of a magic wand: to be effective, an internal control system must be implemented within the companies in order to provide an efficient tool giving to the company, and its counterpart, the certainty that the right person(s) engaged the company. (a)
2. Time stamping Digital time stamp serves as a proof that
the contents of the document existed at a point-in-time and that the contents
have not changed since that time. The procedures maintain complete privacy of
the documents themselves. The result is simple, secure, independent and
portable proof of electronic record integrity. 52.4% of the respondents to the public
consultation ( see Annex 4) pointed out the need to regulate time stamping at
EU level. The reason lies into the fact that relying parties mainly need to
assess whether an e-signature was valid at the time it was created. So far, at least 8 member states, i.e.
Austria, Czech Republic, Germany, Italy, Romania, Slovakia, Slovenia and Spain
have already have integrated time stamping in their legislation. There is another related trust service
which is built on time stamping: electronic registered delivery. In the absence
of the basic tool, the derivative service cannot be created either. In the absence of harmonising provisions at
the European level, new internal market barriers will develop. A “qualified time
stamping service” in Member State A may have no legal value in Member State B,
either because Member State B has no legal framework for this type of service,
or because the legal framework is different. In practical terms, the time
stamping service provider has no way of learning about possible issues other
than to seek legal advice on a country by country basis, in order to discover
whether its service has any value outside of its national borders, and what
changes might be necessary to satisfy national legal requirements. This would
appear to be a textbook example of the type of barrier that the European
internal market should aim to avoid. (b)
3. Admissibility of electronic documents A paper document is a written or printed
paper that bears the original, official, or legal form of something and can be
used to furnish decisive evidence or information. By extension, an electronic
document would be considered as proof to the same extent as a written document
on paper format, provided that the document is retained in such conditions
which guarantee the integrity of the document. The objective in adding legal provisions on
"electronic documents" in the future legal framework would be to
provide a legal equivalence between physical and electronic documents subject
to define security measures in order to facilitate the uptake of electronic
documents. The first obvious use case for electronic
signatures is to authentically copy the handwritten signatures and hence the
consent or commitment and aim of the signer may be that the electronic
signature is meant and recognised as equivalent to a handwritten signature with
a legal binding of the signer to the signed data. Besides such an expected legal effect and
scope of the signature, different natures or types of commitments may be
associated to the signed data with or without the expression of a desired legal
effect. This can range from positive or negative assertions or even mixing them
to express more complex natures of the consent of signer to a signed data or
document. Typical use cases include the signing of an
electronic document in different application contexts in whatever type of
electronically processed communication or transaction (e.g. e-Business, e-Banking,
e-Government, e-Procurement, e-VAT, e-Guichet, e-Procedures, e-Health, e-Justice,
etc). In this regard, an interesting legislation is the French Act of 13 March 2000 which contains multiple provisions relating to the law of evidence. It amends the French Civil Code: article 1316-1 allows an electronic document as proof to the same extent as a written document on paper format, provided that the document is retained in such conditions which guarantee the integrity of the document. Article 1348 specifies what constitutes an authentic copy. An example of the utility of electronic documents at administration level is provided by the Austrian's eGovernment Act establishing rules for a specific category of signatures for civil servants (the Amtssignatur, §19) and for the authenticity of printouts of electronic documents. The so-called “official signatures” have been defined in the eGovernment Act (§18). Official signatures are indicated by an attribute in the certificate to facilitate recognition of the fact that a document originates from an authority. The official signature is represented in the electronic version of the document by an image which the authority has published on the Internet. Furthermore, the public authority is required to provide information on how to validate the signature. Finally, the eGovernment Act specifies that eDocuments signed with an official signature have equal legal value to official attestations (öffentlichen Urkunde) (§19). The print-out of the document itself must indicate a website where it can be electronically validated. The official signature is an interesting
concept, especially in combination with the electronic document validity and
validation information obligations (i.e. their legal equivalence to official
attestations and the support for validation of print-outs, which facilitates
the transition between paper and electronic documents). Finally, the eIAS Framework should be wide
enough to cover all kind of documents (music, photos,…) (c)
4. Long term preservation of e-signatures The objective would be to ensure the legal
validity of electronic signature through time despite and technology
evolutions. In this respect, ensuring legal and technical ways of
authentication of electronic signature and of certification authorities are of
paramount importance in order to provide legal certainty. The complex areas of archiving and
long-term validation of electronically signed documents are often perceived as
obstacles for the use of electronic signatures. By analysing the existing models, we can determine the different elements which could be taken into account to regulate at national level in order to ensure validity of an electronic signature over time and technological evolutions. 1. Establish the equivalence between electronic documents and paper documents; 2. In order to meet the provisions on national prescription delays and to establish with absolute certainty the starting point of a transaction, ensure the harmonisation of time stamping's legislations. As harmonise the prescription delays seems out of the scope of EU attributions, a mandatory rule fixing the delay of conservation of the document in case of cross-border transaction seems appropriate. This delay should be the longer one provided by national laws applicable to the transaction; 3. Determine standards to guarantee the integrity of the document during the whole process; 4. Establish a "central national archiving office" in charge of taking care of the archiving of documents when required by law, or when asked by citizens and organisations (as well private than public); 5. Establish a term for the storage of documents depending of the duration of the prescription but also the duration of the contract. For example in France, for a contract, the duration of prescription is 10 years but the duration of a leasehold is 99 years. (d)
5. Certified e-document delivery This service would permit to certify the
sending and delivery of a message ( for example, an e-document). Once a document has been created and signed
(e.g. a contract, a notification of a judge), there are no means to send it to
another country using an electronic service equivalent to registered mail.
Provisions at EU level would be useful. Adding "certified e-document delivery"
provisions in the future legal framework would provide a legal equivalence
between certified delivery by post and certified delivery by email subject to
defined security measures. (if complemented by national law) Unlike the common ‘read receipt’, a
registered delivery e-mail helps protecting businesses and citizens with
legally verifiable proof that a sent email was delivered, and legally
verifiable proof of the content sent and received. Belgium, Germany, France and Italy have
already, or about to be, integrated in their national legislation the concept
of registered delivery email. In Belgium, the definition of electronic registered mail was introduced in the Act of 13.12.2010 (withdrawn due to procedural error). This new legislation intended to modify the act governing the organisation of postal services in Belgium and introduced legal constraints for the electronic registered mail in the Act of 9.7. 2001. "Electronic registered mail" is defined as "any service of electronic data transfer that includes a lump sum guarantee against the risk of loss, theft or damage of the data, in which the sender, possibly at his request, receives proof of sending and/or of delivery to the addressee. Electronic registered mail was considered to meet the requirements of registered mail, unless further regulatory requirements applied. In the absence of such requirements, electronic registered mail would be usable in all cases where traditional registered mail is legally required. In France, the Decree of 2.2. 2011 (n° 2011-144) sets out the requirements with regard to the identification of the third party responsible for mailing (its legal status and contact details must be detailed), sending registered mail by electronic means (identification of both sender and recipient, with or without acknowledgment of receipt, warranty for loss, theft or deterioration, etc.). The decree also provides for specific procedures and timeframes for the recipient to accept or refuse the registered e-mail. Another country which has successfully implemented the registered delivery email in its national law is Italy. Electronic registered e-mail (“posta elettronica certificata”) is defined in the Italian Code of Digital Administration as "the communication system able to certify the sending and delivery of an e-mail". What is interesting about the Italian usage of this trusted service is that it appears to be the preferred means of communications between (i) different branches of the public administration, and (ii) the public administration and the citizens and companies, provided that the citizen/company obtained an electronic registered e-mail address and that this address has been registered in specific dedicated databases. It should also be noted that companies are obliged to have an electronic registered e-mail address as well as members of liberal professions enrolled in a registry, such as lawyers, accountants, etc. Citizens are not obliged to have an electronic registered e-mail address but they may get one (and in this case they may use it only to communicate with the public authorities). Public administrations as well shall have an electronic registered e-mail address that shall be published in the Internet site of the public authority concerned. Applications and declarations submitted to the public authorities through electronic registered e-mail are legally valid and accepted provided that the authentication tokens have been issued through the previous identification of the holder and that the system administrator certifies this. 6. Website Authentication
Authentication
is part of verifying a website's ownership to establish trust. Before Web
visitors provide username and password, payment information or other personal
data, they need to know that they can trust the requested website. Improving access to business
information
and making it available for citizens in their
own language could create a safer and
more transparent "online"
environment. A company logo or brand name is not enough because they can be easily faked: First, some
companies provide some sort of identification on their web-sites (such as legal
name, legal form, registration number, address, contact information…) but the
credibility of such self-declared credentials is questionable. Second, some phishing sites are copy sites and make them look as close to
the original as possible (everything from the logo placement, to the fake ads,
etc) but the legal entity behind this web site is not the same as it is claimed.
The idea of
secure authentication of the web company/owner has
come up as an instrument to building up confidence. What is Website Authentication? The question to
be answered is the following: " How to ensure that a Web site is indeed
the website of the organisation X and how can users be sure that the
organisation X legally exists?" Website Authentication
aims to make official company information easily accessible directly on the
company’s website, allow to display a "mark" from with the user will
get a set of data to identify the owner of the website (i.e. Company name and
code, address and contact details, legal form and current status, type of business
activities, date of registration and registration authority, share capital and
date of the latest annual accounts, etc ). "Authentication
thought the Extended Validation (EV) Secure Sockets Layer (SSL)
Certificate" The Extended
Validation (EV) SSL Certificate standard is intended to provide an improved
level of authentication of entities that request digital certificates for
securing transactions on their websites. An SSL provider (Certificate
Authority) verifies an organization's right to use a domain name and other
required identification information. SSL Certificates are uniquely issued to a
specific domain and Web server. First a secure or
encrypted website address using SLL certificates will begin with HTTPS rather
than HTTP. Physically consumers will see a lock icon in the Address bar. Secure
connections use certificates to identify the website and to encrypt the
connection so that it will be more difficult for a hacker to view. A
fully-authenticated EV SSL certificate, contain information about the domain
name and the legal name of the business or organization. It will also contain
the geographical location information for the city, state, and country where
the business is registered to do business. Consumers can
double-click the gold padlock icon from the Internet browser and it will
display the information embedded within the SSL certificate of the site you are
visiting. On the General tab it can see that the SSL certificate is issued to a
specific domain name. The issuer of the certificate is also included. All SSL
certificates will have this basic information: domain, validity period, and
issuer. Authentication
thought the Extended Validation (EV) Secure Sockets Layer (SSL) Certificate seems
to be a good way to ensure that a Web site is indeed the Web site of a specific
organisation. However, there are some elements that do not solve the problem. First, the EV
certificate is issued for a certain period of validation, for instances, one
year.[155] The
certificate do not guarantee that the information about the company – owner has
been adequately updated. As well, sometimes a
company's website is independent of its stores, and the owner it might have
different name than in the real world. The name of the owner display in the
certificate could be different. Finally, many
consumers still do not understand the difference between a secure green address
bar and a regular white bar, or the meaning of a lock icon in the Address bar.
Consumers have not yet fully caught on to how EV certificates work, and not all
older browsers support EV in terms of green bars and company names being
displayed. These larger retailers may not see a large enough benefit to change
their ways. What are the
benefits of identifying organization's Web sites for citizens and Member States? The provision of
information on Internet of legal persons is the responsibility of the market
and business. Despite the efforts made by the private sector, products and
technologies solutions in the market are not fully contributing to reassure
consumers and citizens. The identification
systems of web sites' company owners that can be found on the Market should be
improved with higher security requirements to reinforce the authenticity of
information. However, the
Commission and Members States may play a role in ensuring such information in
order to promote their neutrality and reliability: ·
Website Authentication will provide the Web
users with proof of identity of the organisation owning or operating the Web
Site. It will cover the need to make web pages more transparent by ensuring
that the consumer always knows the identity and contact details of the
supplier. ·
Website Authentication will provide assurance
that the holder of the identification tool is a real and legitimate company,
with a physical presence at an identifiable location. The origin of the mark
(the company registered authorities, chamber of commerce, etc) would bring
trust. ·
Website Authentication will ensure that a web
page really belongs to the legal person and will avoid phishing through fake
web page and potentially increase e-commerce by providing a trusted way to
secure transactions. ·
Website Authentication would be very useful for
businesses to enable them to communicate to current and potential customers
that "it is reputable", the confidentiality of their business, and
the elements you would have in any possible legal action. ·
SSL Certificates providers will be supervised in
a transparent and neutral manner. ·
At this stage, it is hard to define specific
clauses for website authentication. III. EU-based supervision system of
e-trust services Establishing a EU supervision body while
cancelling national supervision Under this sub-option, the national
supervision system would be cancelled, and supervision tasks allocated to an EU
level supervision body. National supervisory bodies that currently exist in all
Member States (as required by the e-signatures Directive) would thus be
abolished, or at least no longer perform any supervisory tasks. The impact of this sub-option partially
depends on whether a centralised model is followed, in which a single body at a
single location is established, or whether a decentralised model is chosen in
which some tasks of the European body are delegated to local organisations. Centralised model At the national level, the economic impact
would be positive, as the cancellation of the national supervisory tasks would
reduce costs to the national budget. This economic benefit would be partially
offset by the need to either establish a new European level body, or to charge
an existing body with supervisory tasks, which inevitably requires funding. A
single centralised body can be expected to be more economically efficient, as
it does not require 27 different bodies to be separately organised, staffed and
funded, which inevitably implies administrative overheads that could be reduced
by a single centralised body. Impact on employment would thus likely be
negative, as a single European body would need less staff than 27 national
bodies. The social impact would also depend in part on the existing structure
adopted by each Member States: if the supervisory body is part of an
established public administration, public officials would likely be relocated
to other services in their administration. Per contra, if the supervision has
been delegated to an external partner or if a specific body has been created,
the social impact of this option would be negative. The global expected economic benefit (lower
operational costs) relates solely to the cost of organisation of supervision. A
centralised body in a single location would be economically inefficient in
other ways. Specifically, the need to effectively supervise service providers
across the EU means that (a) those service providers will need to show that
they satisfy the supervision criteria to a body that might be geographically
remote to them; and (b) that agents of the supervisory body would have to
supervise service providers established across the EU, which might be very
inefficient in cases where local audits are needed. On both counts, geographic
distance will render supervision either expensive due to travel needs, or
ineffective due to the impossibility of local visits. Either way, a strictly
centralised model is likely not optimally efficient and cost effective. Decentralised model Under this option, the European body would
decentralise some its activities, notably those requiring a physical presence, typically
by delegating these tasks to private sector bodies at the national level. This
option could have a positive economic impact: permanent tasks would be
organised at the European level, so that Member States could free up their
national budgets. Local auditing tasks could be contracted to private sector
service providers via framework contracts, thus ensuring that costs are only ensured
when audits are actually needed and performed. This would create a new sector
of auditing activities within private national economies, giving support to the
IT sector and developing a new proximity policy in the field of eIAS products
and services. Moreover, the negative social impact of the centralised model
(due to the elimination of jobs in existing supervisory bodies) would be
reduced, and could even be reversed. Furthermore, the efficiency issue of the
centralised model would be resolved, as trust service providers would still be
audited by local companies, eliminating the challenges created by geographic
remoteness. Perhaps most importantly, the credibility of the supervision system
would be improved significantly compared to the current situation, as the
single European body would apply the same norms, standards and practices across
the EU. This would resolve the current problem of diverging supervisory
practices. This sub-option has an environmental impact
by reducing needs to travel to Member States. Globally, this would result in the
following overview, scored against the status quo of strictly national
supervision: EU supervision model Impact || Centralised || Decentralised Economic impact || +++ || + Social Impact || - || + Environmental impact || -- || 0 Administrative burden || + || - Credibility/effectiveness of supervision || ++ || +++ Score || 3 || 4 A decentralised EU supervision model is
thus clearly preferable to a strictly centralised EU supervision, and also
outperforms the existing national supervision approach. The centralised
approach does not appear to be superior to the current national supervision
approach. Establishing a EU supervision body while
maintaining national supervision Under this sub-option, a federated
supervision system would be established involving an EU-based supervision body
(again, either as a new body or as an additional mandate for an existing body),
while maintaining the national supervisory bodies. Essential requirements for
national supervision would still be developed and applied at the national
level. The supervisory bodies would thus play the same role as it plays today.
The EU level body would primarily be responsible for ensuring the consistent
application of these minimum criteria. Other tasks could also be envisaged for the
European supervisory body, including as an optional supervisor of any European
trust service provider. However, this does not appear to be a viable or
desirable option, as it creates a clear risk of non-desirable competition
between national and European supervision bodies: a service provider who is
negatively assessed by a national body might be tempted to turn to the European
body as a de facto body of appeal. This situation would undermine the authority
and competence of national bodies and install uncertainty. An alternative model would be to allow
Member States on a voluntary basis to delegate their supervision
responsibilities to the European supervisory body. This would have the
disadvantage for the EU body of greater responsibilities and thus greater
economic costs than a mere coordination role, but would create significant
benefits for Member States in which the operation of a credible supervisory
body (including the need to ensure sufficient funding and availability of
skilled experts) would be economically undesirable or impractical. This would
thus be a beneficial option to Member States in which few or no trust service
providers are to be supervised (i.e. Member States for whom the cost would
otherwise be entirely wasted). Both variants of this model would be
beneficial for the credibility of the supervision mechanism: in the first
variant (no delegation powers) the market would know that common minimum
criteria are applied and monitored by a European body; and in the second (delegation
right for the Member States) the market would be aware that supervision will be
entrusted to an adequately staffed and funded body, either locally or at the EU
level. It should be noted that the impacts of the
delegation suboption are hard to quantify, as it depends largely on the number
of Member States that would opt on a voluntary basis to delegate their
supervisory tasks. This issue might be politically sensitive in a number of
Member States. EU supervision model Impact || Federated EU supervision – national supervision in all countries || Federated EU supervision – delegation power for Member States Economic impact || - || + Social Impact || - || + Environmental impact || 0 || 0 Administrative burden || + || + Credibility/effectiveness of supervision || + || ++ Score || 0 || 5 Annex
9 – Impact assessment matrix The
matrix presents the determination of the expected impacts per policy option. The assessment of the impacts under each of
the options was done by analysing the magnitude of the expected impact,
as well as the likelihood that the impact will actually occur as a
result of the proposed policy option. The notation used to express the magnitude of an impact in
comparison with to baseline scenario is the following: - - - very negative impact || - 3 - - negative impact || - 2 - slightly negative impact || - 1 0 no impact || 0 + slightly positive impact || + 1 + + positive impact || + 2 + + + very positive impact || + 3 The likelihood will be expressed as follows: 1 low likelihood || 1 2 medium likelihood || 2 3 high likelihood || 3 The
magnitude of the impact is weighed by to likelihood. The value given for the
likelihood is an absolute score, i.e. not relative to the score of the baseline
scenario. [1] Article 2 of e-signature Directive [2] COM(2011) 206 final of 13.4.2011 [3] COM(2010) 245 of 19.05.2010 [4] COM(2011)669,
12.10.2011 [5] See
http://ec.europa.eu/information_society/policy/e-signature/eu_legislation/revision/pub_cons [6] See
http://ec.europa.eu/information_society/policy/e-signature/eu_legislation/revision. [7] Study on Cross-Border
Interoperability of e-signatures, see http://ec.europa.eu/information_society/policy/e-signature/crobies_study/index_en.htm
[8] An
interesting example of divergent implementations is illustrated by the
introduction of new categories of signature in the different national
regulatory frameworks, such as the “universal electronic signature” in
Bulgaria, the “secure e-signature” in Lithuania and Poland, the RGS
differentiation of “middle, standard or strengthened e-signature” in France or
the “guaranteed electronic signature” in Slovakia. While a purely
terminological issue, one might see how the introduction of new categories of
signatures on a national basis holds a risk of creating market confusion.
Indeed, as noted in the IDABC study on the Study on the Mutual Recognition of
eSignatures (2009) and pointed out in a position paper delivered by Chambersign
in Octor 2010, the lack of a common terminology on the one hand confuses end-users
and complicates the communication strategy of CSPs that have to customise their
services; on the other, it is often unreasonably complex and costly to
determine whether a foreign signature meets the requirement of the national framework. [9] As a basic foundation of the Directive,
internal market rules have been implemented via article 4 . CSPs are thus
largely governed by a country-of-origin rule. This ensures, on the one hand
that they do not need to comply with 27 materially different sets of rules if
they choose to operate in all 27 MS, but on the other, it provides for a
segmented EU landscape. [10] Article 3.7 of the e-signature Directive
allows Member States to impose additional requirements to the ones laid down in
the Directive under certain conditions such as “such requirement may not
constitute an obstacle to cross border services for citizens”. Although not
formally notified to the European Commission, a significant number of Member
States apply this clause. They use (voluntary) accreditation schemes to
determine the accessibility of an e-signature in an e-government application or
their legal framework contains requirements that cannot be met by foreign
solutions. Being excluded from such application hinders significantly the
penetration of a market because the signature is not considered as universally
usable. [11] The Study on Electronic Signatures as
Obstacle for Cross-Border e-procurement in Europe - Lessons from the
PROCURE-project (2009) has for example highlighted that certain MS, in clear
violation of the public sector clause of the Directive, have enacted at least
three additional requirements which constitute an obstacle for cross-border
e-procurement, i.e. conflicting requirements regarding the type of electronic
signatures allowed; the requirements for accreditation and the requirement for
unequivocal identification of the signatory in form of unique national specific
person identifiers. [12] When signing calculations are done on a
server (vs done in the SIM card of the mobile phone). [13] E.g. through Hardware Security Modules
(HSM). [14] E-signatures require a minimum common
technical framework to ensure their operation (for "qualified"
signatures). This technical framework is provided through a fairly high level
set of requirements in its four annexes. The Directive also incorporates a
trust infrastructure to support certification service providers through the
concepts of supervision, conformity determinations and accreditation. The
Annexes do not provide – on purpose - guidance for specific implementation or
assessment activities, as they are too generic for that aim but additional
guidance were provided through two Commission Decisions 2000/709/EC and
2003/511/EC. However, Commission Decision 2003/511/EC only references three
specific standards on signature hardware out of a set of 30 e-signature
standards. The fact that the Directive can only create a presumption of
compliance with the requirements of Annex II(f) and Annex III of Directive
1999/93/EC via this Decision, and not with other requirements, makes it
impossible to provide a formal value to the other standards. Furthermore,
the standards referred to in Decision 2003/511/EC – namely CEN CWA 14169 and
CWA 14167 - are obsolete and do not unambiguously apply to some new e-signature
creation scenarios. For instance, the use of mobile telephones is increasingly
popular in the signature market or the usage of "hardware security
modules" for mass signatures.
NB. CEN is currently working on these two standards and plans to deliver
updated and upgraded versions by mid 2012. Decision 2003/511/EC is therefore
expected to be updated in 2013 still within the scope of Directive 1999/93/EC
comitology. [15] Art. 3.3 of the e-signature directive,
"Each Member State shall ensure the establishment of an appropriate
system that allows for supervision of certification service-providers which are
established on its territory and issue qualified certificates to the public".
Article 2.13 of the directive: " ‘voluntary accreditation’ means any
permission, setting out rights and obligations specific to the provision of
certification services, to be granted upon request by the certification-
service-provider concerned, by the public or private body charged with the
elaboration of, and supervision of compliance with, such rights and
obligations, where the certification-service-provider is not entitled to
exercise the rights stemming from the permission until it has received the
decision by the body. " [16] As
a pragmatic example: an analysis of Member State supervision practices shows
that the frequency with wich service providers are audited by the supervisory
bodies varies widely. 17 Member States are known to organise periodic audits to
re-assess compliance with the Directive and national transposing acts. Of
these, 11 organise annual audits (DK, EE, LV, LT, LU, HU, NL, PL, PT, SK, UK).
The 6 other Member States organise them every 1.5 years (IT), 2 years (AT, MT),
3 years (BE, ES), or 4 years (CY). Of the 10 Member States without known
periodic audits, there is either no data available, or a regimen of audits only
in cases of incidents or suspicion of non-compliance. Thus, in practice the
supervision regime results in an uneven playing field, both with respect to
trustworthiness (some providers are audited annually, some not at all), and
with respect to costs, as audits will incur expenses for the service provider [17] Directive 2006/123/EC of 12 December 2006
on services in the internal market [18]T The ongoing IAS. Study on an electronic
identification, authentication and signature policy (IAS) - IAS in the European
policy context, 28 September 2011, highlighted at least ten Member States who
had adopted national laws in relation to one or more ancillary services; see www.iasproject.eu/attachments/File/deliverables/IAS_Deliverable_D1_%28version_3_28_sept2011%29.pdf,
p. 61 and following. [19] Indeed, trust service providers for
example currently do not even try to perform activities outside of their
country of establishment in significant numbers. [20] See http://www.signatur.rtr.at/en/legal/sigv.html
[21] See
www.glin.gov/download.action?fulltextId=196944&documentId=215798&glinID=215798
for the full version in Romanian [22] As recurrently indicated by surveys (ex.
Eurobarometer 250, 2009; Eurostat household survey 2010, IDC ICT security
market study, 2008). [23] 36% out of 57% indicated that they could
be incentivised to use an e-Signature abroad if it was less burdensome or clear
rules about the validity of e-Signature were in place, in particular in the
cross-border context (See answers to questions 15 and 16 of SME Test Panel) [24] The lack of trust in cross border
applications of e-signatures and ancillary trusted services was also confirmed
by 28% of respondents to the public consultation [25] Also confirmed by the Action Plan on
eSignatures and eID, 2008 [26] Guerra et al 2003 [27] A Legal and Institutional Analysis of
Barriers to eGovernment, Modinis Study, 2007 [28] a)
Austria, as one of the
leading EU Member States in this area, has implemented legislation regulating
not only e-signatures, but also electronic identification, through the 2004
eGovernment Act. - E-Government-Gesetz. b)
Belgium adopted a
generic legal framework for certain trust services in 2007, including
electronic registered mail, time stamping and electronic archiving. Despite a
recent update for the rules on electronic registered mail in 2010 (integrated
into the general e-signatures Act), executive rules were never fixed, and the
law remains largely inoperative at present. However, new legislation in this
area is planned for the near future. - Wet van 15 mei 2007 tot vaststelling van een juridisch
kader voor sommige verleners van vertrouwensdiensten/ Loi du 15 mai 2007 fixant
un cadre juridique pour certains prestataires de services de confiance c)
The Czech Republic has
implemented rules for time stamping in its e-signatures Act of 2000. - Zákon č. 227/2000 Sb., o elektronickém
podpisu a o změně některých dalších zákonů (zákon o elektronickém podpisu). d)
Estonia, as another
technology leader in the EU, has a legal framework that supports (and indeed
requires) time stamping, digital stamps, and official e-mails.-
Digitaalallkirja seadus, RT I 2000, 26, 150. e)
Similarly, Finland has
adopted an Act on strong electronic identification and electronic signatures. -
Laki vahvasta sähköisestä tunnistamisesta ja sähköisistä allekirjoituksista,
7.8.2009/617. f)
Germany likewise
introduced the notion of qualified time stamping in its e-signatures Act. -
Gesetz über Rahmenbedingungen für elektronische Signaturen (Signaturgesetz -
SigG) vom 16.5.2001 (BGBl. I S. 876). g)
Italian law contains
rules on electronic registered mail. - Through the Codice dell’Amministrazione
Digitale (the current version is Decreto Legislativo 30 dicembre 2010, n. 235);
Roberta Falciai and Laura Liberati, ‘The Italian certified e-mail system’, Digital
Evidence and Electronic Signature Law Review, 3 (2006) 50 – 54. h)
The Slovakian
e-signatures Act contains specific rules for time stamping. - Zákon č.215/2002
Z.z. o elektronickom podpise a o zmene a doplnení niektorých zákonov –The Slovakian Act (‘as amended’ or ‘v znení
neskorších predpisov’) was consolidated in 2009 (§9 of this Act still
explicitly refers to time stamping (Časová pečiatka – time stamping)), see
http://www.zbierka.sk/zz/predpisy/default.aspx?PredpisID=208862&FileName=zz2009-00076-0208862&Rocnik=2009. i)
The Slovenian
e-signatures Act recognises the concept of a time stamp as being comparable to
advanced e-signatures, with the same rules applying mutatis mutandis; - Zakon o
elektronskem poslovanju in elektronskem podpisu. j)
Finally, the Spanish Act
on Electronic Citizen Access to Public Services recognises e-signatures,
e-seals (company signatures), and time stamping. - Ley 11/2007, de 22 de junio,
de acceso electrónico de los ciudadanos a los Servicios Públicos. NB. This listing is not exhaustive. [29] See http://www.digitpa.gov.it/sites/default/files/normativa/DPR_11-feb-2005_n.68.pdf
[30] See http://legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000023513151&categorieLien=id
[31] Notwithstanding some coordinating effect
of the "European E-Signature Standardisation Initiative" (EESSI,
www.ictsb.org/Working_Groups/EESSI) and via the Forum of European
Supervision Authorities (FESA, www.fesa.eu). [32] eID issued by or on behalf of a Member
State. [33] Example: The Large Scale Pilot STORK shows
how citizenship in the Digital Single Market could work (www.eid-stork.eu). STORK implements a European wide eID interoperability
platform that enables citizens, businesses and civil servants to use their
national electronic identities in any participating Member State for certain
public eGovernment services. The pilot-micro-environment served as
"playing ground" to settle the challenges of a future EU-wide
eID-infrastructure as envisaged in the Connecting Europe Facility proposal by
the Commission. The following real time use cases show the wide range
of beneficiaries of "official eIDs" and secure authentication: "Safer Chat" enables children and young
people to build a platform for a safer online environment. The key to enter the
room is the age of the chat user provided through "official eID". No
further identity data are needed. Exactly one of the problems the online
gambling sector faces today (see chapter 5). Foreign students get access with their "official
eIDs" to any online administrative service offered by universities through
the "Student Mobility" pilot. Beneficiaries of this pilot are in
particular Erasmus students which represent a population of around 230.000 per
year. The "change of address pilot" addresses the
situation of moving to another country. The communication is made via the use
of the "official eID". "ECAS integration" is piloted by the Member
States together with the Commission which operates the ECAS system. It enables
the secure login of national experts to the CIRCA-network through the use of
"official eIDs". The few examples gives a flavour of the variety of
application areas and beneficiaries - public as well as private - which could
profit from the use of "official eIDs" and authentication [34] eID Interoperability for PEGS study, 2009,
see http://ec.europa.eu/idabc/servlets/Doc2ba1.pdf?id=32521
[35] Specifically, the advanced signatures must
be based on qualified signature certificates (which have stringent procedural
and technical requirements behind them), and must be created using a secure
signature creation device, such as highly secured smart cards. With this
combination of tools, qualified e-signatures offer a very high degree of
protection against forgery and fraud. [36] Confirmed by 64% of project survey
participants in the context of the Modinis study (cf footnote 38) [37] The problem of unambiguous identification
of a person is solved by the official eID which links certain person data (e.g.
name, date of birth) to a person identifier assigned to a person (e.g tax
number derived from the tax register, number derived from the population
register or residence register). This mechanism makes it possible to
distinguish clearly each single individual from one another. Especially in
cases of common family names (e.g. John Smith) it is important for the
administration to establish to which John Smith. The 2 basic conditions to get the official eID are the
following: - the person presents him/herself physically to the
authority which issues the official eID (or the entity which does it on behalf
or the responsibility of the authority); - the authority checks and verifies the
identity document demonstrated by the person. [38] Considered an important or very important
barrier by 62% of survey participants in the context of the Modinis study (op.
cit.) [39] Respondents that do not use eIAS indicated as major reasons of their
reluctance the absence need (32%) followed by complexity (15%) and costs
(14%). [40] 16% of SMEs indicated that they do not need electronic signatures for
their business. [41] Although in most of these application
areas electronic solutions are deployed to ensure at least a minimum level of
security for online transaction, the direct demand for more reliable eIAS mechanisms
is less apparent. The fact that online payments are used by a significant
number of SMEs (roughly two thirds of them) may be explained by the fact that
e-payment transactions are carried out in a closed environment, namely the
system operated by the bank. Other services show significantly lower numbers,
as they inherently require interaction with third parties outside of such a
controlled environment. [42] See www.homeoffice.gov.uk/publications/agencies-public-bodies/nfa/annual-fraud-indicator/annual-fraud-indicator-2011?view=Binary
[43] Specifically, only mutual recognition of e-signatures
based on qualified certificates is required by Commission Decision 2009/767/EC
of 16 October 2009 setting out measures facilitating the use of procedures by
electronic means through the points of single contact under Directive
2006/123/EC of the European Parliament and of the Council on services in the
internal market. [44] See https://www.eid-stork.eu/index.php?option=com_content&task=view&id=55&Itemid=76#stork_faq_6
[45] See http://ec.europa.eu/information_society/policy/esignature/eu_legislation/revision/ws_3_2011/index_en.htm [46] United Nations Commission on International Trade Law [47] Article 9.3.: Where the law requires that a
communication or a contract should be signed by
a party, or provides consequences for the absence of a signature, that
requirement is met in relation to an electronic communication if: (a) A method is used to identify the party and
to indicate that party’s intention in
respect of the information contained in the electronic communication; and (b) The method used is either: (i) As
reliable as appropriate for the purpose for which the electronic
communication was generated or communicated, in the light
of all the circumstances, including any relevant agreement; or (ii) Proven
in fact to have fulfilled the functions described in subparagraph (a)
above, by itself or together with further evidence. [48] See
http://www.nist.gov/nstic/identity-ecosystem.html [49] Article 144 TFEU, §1: "Save where otherwise provided in the Treaties, the
following provisions shall apply for the achievement of the objectives set out
in Article 26. The European Parliament and the Council shall … adopt the
measures for the approximation of the provisions laid down by law, regulation
or administrative action in Member States which have as their object the
establishment and functioning of the internal market."
Article 26 TFEU: "1. The Union shall adopt measures with the aim of
establishing or ensuring the functioning of the internal market, in accordance
with the relevant provisions of the Treaties. 2. The internal market shall
comprise an area without internal frontiers in which the free movement of
goods, persons, services and capital is ensured in accordance with the provisions
of the Treaties. 3. …" [50] Article 47(2) addressed the taking-up and
pursuit of activities as self-employed persons and laws governing the
professions with respect to training and conditions of access for natural
persons. Article 55 referred to the right of establishment of service
providers. [51] See
Communication from the Commission: Europe 2020 – A strategy for smart,
sustainable and inclusive growth, COM (2010) 2020 of 3rd March 2010. [52] See European Commission Impact Assessment Guidelines
of 15 January 2009, SEC (2009)92. [53] Relates to social/digital inclusion, the protection of consumers,
etc. [54] More formally: a “notified” eID is an official
eID scheme notified by a given Member State to the Commission, specifically to
ensure that they can benefit from cross-border recognition by other Member
States. [55] See http://www.digid.nl/
[56] See http://www.eherkenning.nl/eRecognition
[57] See the current proposal for a General
Data Protection Regulation, http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf,
notably Article 23 [58] The important feature of some documents
issued by an organisation is their authenticity, i.e. that the document was
genuinely produced by the organisation (ex. a certificate). Authenticity can be
proven by an electronic stamp which is to a certain extent. [59] Once a document has been created and
signed (ex. a contract, a notification of a judge), there are no means to send
it in another country using a electronic service equivalent to registered mail. [60] This could be economically advantageous
and pragmatic for Member States with no or only a very limited number of trust
service providers to be supervised, or who have difficulties in ensuring the
availability of competent staff for their national supervisory body. [61] ‘’Effectiveness’ indicates the extent to which options
achieve the objectives of the proposal. [62] ‘Coherence’ indicates the extent to which options are coherent with
the overarching objectives of EU policy, and the extent to which they are
likely to limit trade-offs across the economic, social, and environmental
domain. [63] ‘Efficiency’ indicates the extent to which objectives can be
achieved for a given level of resources/at least cost (“cost-effectiveness”) [64] See http://openid.net/ [65] See http://kantarainitiative.org/ [66] See http://ec.europa.eu/internal_market/consultations/docs/2010/e-procurement/evaluation-report_en.pdf
[67] Indeed,
all the different categories of cost savings will be more or less the same,
independent of whether the interaction is national or cross-border. Moreover,
it could be argued that cost savings will likely be more significant for
cross-border interactions, given the greater administrative cost for cross
border interactions (e.g. cost of sending paper bids by regular mail, or the
need to provided formal translations of certain documents). [68] Study on the evaluation of the Action Plan
for the implementation of the legal framework for electronic procurement -
Analysis, assessment and recommendations report; http://ec.europa.eu/internal_market/consultations/docs/2010/e-procurement/siemens-study_en.pdf
[69] According to the data of the
organisation, "average cost for an electronic claim is of 0.27€ against
1.74€ for a paper claim processing. Moreover, time to refund insured citizens
for medical expenses has been dramatically reduced. Nowadays, the whole
reimbursement procedure of patients or health professionals (in case of direct
payment by the health insurance) lasts 5 days maximum whereas up to 5 weeks
were needed with the paper based manual procedure". Source: Sesam-Vitale. [70] See E-voting in Estonia 2005. The first
practice of country-wide binding Internet voting in the world, Ülle Madise and
Tarvi Martens, http://www.e-voting.cc/static/evoting/files/madise_martens_estonia2005_13-26.pdf
[71] Published on http://www.vvk.ee/voting-methods-in-estonia/engindex/statistics
[72] Cf. note 57 [73] http://www.itif.org/files/2011-e-id-report.pdf
[74] See http://estonia.eu/about-estonia/economy-a-it/e-estonia.html
[75] See http://www.brussels.be/artdet.cfm?id=4827&
[76] See http://www.itapa.sk/data/att/1965_subor_sk.pdf
[77] See
http://porvoo9.gov.si/pdf/THU_11c_1415_Country_update_Estonia.pdf [78] http://www.itif.org/files/2011-e-id-report.pdf [79] See https://www.universign.eu/
[80] See http://www.unifiedpost.com/en/solutions/de-aangetekende-zending.html
[81] See http://www.unizeto.eu/unizeto/uni,offer_edocument.xml
[82] Scoping the Single European Digital Identity Community;
see http://www.eid-ssedic.eu/ [83] See http://www.eid-ssedic.eu/images/stories/pdf/SSEDIC%20GA%20part%202_V1.1.pdf,
slide 48 [84] Some signed documents need to be kept for
decades. A recent e-signature is almost impossible to forge today but will be
easily forged in ten years. Therefore, a "qualified" service provider
(i.e. matching given reliability requirements) will put an electronically
authenticated document in an "electronic envelope" and seal it
electronically with state-of-the-art technology. Some years later, the service
provider will put the previous envelope in a new one that it will seal again, and
so on, to always be a step ahead of hackers. This service (which may not cost
more than a few cents) will ensure the legal validity of e-signatures through
time. NB. The storage means and place of the "envelope" is not
relevant: it can be with the customer, the preservation service or any other
third party. [85] This has applied to France since 2000. “The impact of the Internet on
the French Economy”, McKinsey. March 2011 [86] Eurostat [87] See http://www.ebrc.fi/kuvat/215-229.pdf [88] [89] A specific task that could be envisaged for
the EU supervisory body could be an ‘optional supervisor of any European trust
service provider’. However, this does not appear to be a viable or desirable
option, as it creates a clear risk of ‘forum shopping’ and competition between
national and European supervision bodies: a service provider who is negatively
assessed by a national body might be tempted to turn to the European body as a
de facto body of appeal. This situation would undermine the authority and
competence of national bodies and install uncertainty. [90] The assessment of all of the impacts under each of the
options was done by analysing the magnitude of the expected impact, as well as
the likelihood that the impact will actually occur as a result of the proposed
policy option. The notation
used to express the magnitude (compared to the baseline scenario) is the
following: - - - very
negative impact - - negative
impact - slightly
negative impact 0 no
impact + slightly
positive impact + + positive
impact + + + very
positive impact [91] See Annex 4. [92]Directive 1999/93/EC on a Community framework for electronic
signatures [93] Report on the operation of e-Signatures Directive COM(2006)120
final [94] COM(2008)798 of 28.11.2008 [95] COM(2009)767 of 16.10.2009 [96] C(2011)1081 of 25.02.2011 [97] http://ec.europa.eu/information_society/policy/esignature/docs/standardisation/mandate/m460_en.pdf
[98] http://www.e-signatures-standards.eu/reference-documentation/rationalised-framework-on-electronic-signature/rationalised-framework-for-electronic-signature-final-version-02-2012
[99] COM(2010)743 of 15.12.2011 [100] COM(2011)669 of 19.10.2011 [101] COM(2011)657 of 19.10.2011 [102] Council Conclusions on the European eGovernment Action Plan
2011-2015, 3093rd Transport, Telecommunicaions and Energy Council, 27 May 2011 [103] Most contributions were made
via the Commission’s online consultation tool (IPM — Interactive Policy
Making), and several others were sent in as separate submissions. [104] Contributions can be accessed online at: http://ec.europa.eu/information_society/policy/e-signature/eu_legislation/revision/pub_cons/index_en.htm
[105] EUROSTAT. Survey on ICT usage and e-commerce in enterprises [106] Source: AT, BE, CZ, DE, HU, IT, PL, SK, SE,
IC, NO: Forum of European Supervisory Authorities for Electronic Signatures
(FESA); rest: CROBIES: Cross-Border
Interoperability of e-signatures, Work Package 2 “Trusted Lists”, Annex 1 –
Observations on the current Trusted Lists in Member States [data as of July
2009] AND also Trusted Lists of Certification Service Providers, http://ec.europa.eu/information_society/policy/e-signature/eu_legislation/trusted_lists. [107] Names of the services providers found on
different websites of supervision authorities and in IDABC Study on Mutual
Recognition of e-signatures: update of Country Profiles: Analysis &
assessment report (in particular country profiles – data as of summer 2009) http://ec.europa.eu/idabc/en/document/6485.
For the purpose of this table, Chambers of Commerce and Professional
Associations are assimilated to public companies. [108] Source: Forum of European Supervisory
Authorities for Electronic Signatures (FESA) – spring 2010. [109] Key:
SSCD, Secure Signature Creation Device; DB = Determination of
conformity by a Designated Body (art. 3.4 of Directive 1999/93/EC); SD:
self-declaration; VAS: voluntary certification scheme. [110] Source CROBIES, Work Package 4, Framework
for Interoperable Secure Signature Creation Devices AND also IDABC study – same
as footnote http://ec.europa.eu/idabc/en/document/6485
unless stated otherwise - see footnotes 106 and 107. [111] Source: IDABC Study
on Mutual Recognition of e-signatures: update of Country Profiles; page 7
http://ec.europa.eu/idabc/servlets/Doc?id=32436
[data from 2009] except Estonia. [112] Source: Communications
Regulation Commission; http://www.crc.bg/files/_en/registar-es-en.pdf [113] In accordance to art. 36 of the Law for the
Electronic Document and Electronic Signature [114] http://www.mvcr.cz/mvcren/article/scope-of-activities-egovernment-electronic-signature.aspx?q=Y2hudW09Mw%3d%3d [115] According to the Section 6 of the Act on
Electronic Signature; http://www.mvcr.cz/mvcren/article/scope-of-activities-egovernment-electronic-signature.aspx?q=Y2hudW09Mg%3d%3d [116] https://digidoccheck.sk.ee [117] www.vaestorekisterikeskus.fi/vrk/fineid/files.nsf/files/5F7890ACBE4B162AC2257700001C8E56/$file/Country_Update_from_Finland.pdf [118] http://www.ficora.fi/en/index/saadokset/maaraykset/laatuvarmennetoiminta.html [119] Décret relatif à la signature électronique,
art. 7; www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITEXT000005630796&dateTexte=vig [120] www.eett.gr/opencms/opencms/EETT_EN/Electronic_Communications/DigitalSignatures/InfoConformityAssess.html [121] http://users.skynet.be/fa283208/pdf/INFSO-CROBIES-DFC-WP4-SEALED-29032010_v1.pdf [122] Electronic Commerce Act, section 29 http://www.ispai.ie/legal/ie/1999-ecomm-act.pdf [123] http://www.cnipa.gov.it/site/it-IT/Attivit%c3%a0/Firma_digitale/ [124] http://ec.europa.eu/idabc/servlets/Doc?id=32284 [125] Electronic Documents Act http://www.dvi.gov.lv/eng/legislation/edl/ [126] Loi sur commerce électronique, art. 29 http://www.ilnas.public.lu/fr/legislation/confiance-numerique/loi-cadre-relative-commerce-electronique/loi-14aout2000.pdf [127] http://www.mca.org.mt/infocentre/openarticle.asp?id=185&pref=22 [128] http://www.mg.gov.pl/English/ECONOMY/Internal+Trade+Regulation/
Law on electronic signature, art. 10 http://isap.sejm.gov.pl/DetailsServlet?id=WDU20011301450 [129] http://www.gns.gov.pt/gns/pt/ce/ [130] Law on electronic signature,
art. 13 http://www.anrcti.ro/Portals/57ad7180-c5e7-49f5-b282-c6475cdb7ee7/LEGE_455_2001.pdf [131] Law on electronic signature,
article 13 http://www.nbusr.sk/ipublisher/files/nbusr.sk/elektronicky-podpis/legislativa/1-3/215_2006en.pdf [132] Law on e-signatures, art. 18 and
next; http://www.uradni-list.si/1/objava.jsp?urlid=200498&stevilka=4284 [133] http://www.mityc.es/dgdsi/es-ES/Servicios/FirmaElectronica/Paginas/Prestadores.aspx [134] http://www.pts.se/en-gb/Industry/Internet/Electronic-signatures/ [135] http://www.tscheme.org/directory/index.html [136] A good indicator for the importance of cross-border
cooperation between public authorities in the EU is the fact that 5,737 national
competent authorities were registered in the IMI (Internal Market Information)
system at the end of 2010 (cf. Single Market Act, Annex 2). IMI is a secure
online application that allows national, regional and local authorities to
communicate quickly and easily with their counterparts abroad. IMI is
accessible via the internet without the need to install any additional software,
http://ec.europa.eu/internal_market/imi-net
). [137] Currently, less than 5% of total
procurement budgets are awarded electronically, and only 1.6% of contracts are
supplied by an entity in another Member State. It is estimated that if
eProcurement is adopted by all European contracting authorities, annual savings
could exceed €50B. [138] Short explanation of CEF [139] A concrete example is the following: The implementation of the
“Services Directive” allowing companies willing to provide their services in
another EU Member State to fulfil the required administrative formalities
remotely is still not possible due to the fact that they are not able to use
their “official eID” in other Member States because of the missing link of
mutual recognition and acceptance of "official eIDs" throughout the
EU. [140] Source Micus (2009) [141] Pricing of Public Sector Information Study, Deloitte,
July 2011 [142] Deloitte report "background support study to the
DAE" [143] A positive correlation is evident with the “2009
e-Readiness Rankings” compiled by The Economist’s Intelligence Unit (EIU) [144] 9th eGovernment Benchmarking Report, December 2010 [145] In October 2008, the IMI, together with the National
Irish Bank, published the results of its tenth survey of multinational
companies located in Ireland. Compared to three years ago, the strategic
importance of broadband availability moved up twelve positions in the ranking
from 18th to 6th. [146] Gamgling Capital, Arpil 2012 [147] Gluckspielmarkt Deutschland 2015, Situation und Prognose
des Gluckspielmarktes in Deutschland, Goldmedia, Berlin, 2010 [148] Confindustria Servizi innovativi e tecnologici, ICT
Project in the field of Health, 2010 [149] 9th eGovernment Benchmarking Report, December 2010 [150] "Tavola della Sanita Elettronica": e-Health
Standing Bureau (TSE) is an institutional platform where stakeholders consult
each others with a view to harmonizing measures and elaborating a framework of
shared technical rules. [151] Source: Federfarma [152] Confindustria Servizi Innovativi e Tecnologici, Data
gathered from elaborations by Confindustria on the basis of the study entitled
“Best Demonstrated Practice eHealth Impact”, commissioned by the European Commission
to Booz Allen Hamilton (2005) [153] Erich Waldecker, Entlastung der Verwaltung, Wirtschaft und
BürgerInnen durch nachhaltige E-Government Projekte der Finanzverwaltung,
e-Government Konferenz 2011, Salzburg, 8-9 June 2011 [154] https://ettevotjaportaal.rik.ee/index.py?chlang=eng
[155] D&B's indicates what follows: A new business opens every
minute, A business files bankruptcy every 8 minutes, A business closes every 3
minutes, A suit, lien or judgment is filed against a company every 14 seconds,
a chief executive office changes every minute, A company name changes every 2
minutes. http://www.dnbmdd.com/mddi/record_updates.aspx