Electronic identification, signatures and trust services - guide

05 June 2012
by eub2 -- last modified 05 June 2012

The European Commission has proposed new rules to enable cross-border and secure electronic transactions in Europe. The proposed Regulation will ensure people and businesses can use their own national electronic identification schemes (e-IDs) to access public services in other EU countries where e-IDs are available. It also creates an internal market for e-Signatures and related online trust services across borders, by ensuring these services will work across borders and have the same legal status as traditional paper based processes. This will give full effect to the major potential savings of eProcurement. The proposal fully respects both existing national ID systems and the preferences of those Member States without national ID schemes. It allows countries with e-ID to opt-in or to remain outside of the European scheme. Once a Member State notifies that they wish to join the pan-European scheme, they must offer the same access to public services via e-ID that they offer to their own citizens.

Terminology

What is eSignature?

e-Signature is the electronic equivalent of a handwritten signature.

What is eIdentification (e-ID)?

eIdentification is the process of unambiguously determining a person/entity 's identity by using electronic means. In Europe many Member States provide their citizens with electronic IDs via smart cards, mobile phones, or other technologies: some Member States combine an e-ID with the function of an identity card used also as a travel document, others have a citizen card to access public online services, others work with mobile devices, or a combination of card and phone.

What is time stamping?

An electronic time stamp is the date and time on an electronic document which proves that the document existed at a point-in-time and that it has not changed since then. For example, a student is entering a competition which closes at midnight, and sends his entry by email at 23:55 but its delivery is delayed due to some technical problems. A time stamp would prove that his entry existed at 23:55 and the delivery problems would have no consequence.

What is an electronic seal?

An electronic seal is the electronic equivalent of a seal or stamp which is applied on a document to guarantee its origin and integrity. An electronic seal means that a company could issue millions of authentic invoices matching EU legal requirements.

What is website authentication?

It is trusted information on a website (e.g. a certificate) which allows users to verify the authenticity of the website and its link to the entity/person owning the website. Organisations can be also sure that that they are protected from hackers setting up a fake website. Website authentication is becoming fairly common: when the address of a website becomes green in the browser, it means that the website is authenticated with a certificate.

What is 'electronic delivery'?

It is a service that, to a certain extent, is the equivalent in the digital world of registered mail in the physical world. At the moment the legal effect of the "registration" of an email stops at the border of the Member State of origin of an e-mail unless the Member State of destination recognises the registered nature of the email.

Basic Facts

Which countries have e-ID already?

Electronic ID cards exist in: Belgium, Estonia, Finland, Germany, Italy, Portugal and Spain.

Other forms of e-ID, like citizen cards and access tokens are used in: Austria, Czech Republic, Denmark, Lithuania, Luxembourg, The Netherlands, Slovakia, Slovenia and Sweden.

17 EU countries also participate in a project called STORK which has proven that e-IDs can be safely recognised across borders.

Who issues official electronic ID?

Official electronic ID in most of the Member States is issued directly at state level, in others they are issued by the private sector under the responsibility of the state (e.g. Austria, Sweden).

What is the current issue?

While hundreds of millions of European are now able to use electronic identification for services like online shopping, and have received better services as a result, these benefits are much less commonly achieved with public services, and especially not outside one's home country.

Citizens can rarely, if ever, use their e-ID to interact online with public administrations of other EU Member States. This undermines our rights as Europeans, and causes inconvenience and extra costs associated with time delays and the hassle of maintaining multiple identity documents.

The absence of common EU rules on legal recognition of e-ID acts as a brake on those citizens who need to be mobile or undertake business or work activity outside their home country.

Equally, the lack of an EU legal framework for essential trust services like time stamping (legally proving the time), electronic documents (legal effect and acceptance), registered electronic delivery (legal proof of a communication channel), and electronic seals (which legally link a person or a company to a document) also means lots of companies divert resources from their key functions to standing in queues, waiting for forms and stamps.

When was this proposal planned / decided?

From 2010 onwards the Digital Agenda for Europe, listed a revision of the eSignature Directive and legal measures to ensure mutual recognition of eIdentification (e-ID) and eAuthentication as an objective.

This call was repeated as one of 12 elements of the Single Market Act (SMA) The European eGovernment Action Plan 2011-2015, and various Council Conclusions both call for legislation "to ensure mutual recognition of eIdentification and eAuthentication across the EU".

Finally, the Roadmap for Stability and Growth, underlines this measure as key to the development of the digital economy.

Why not just update the eSignature Directive?

The eSignature Directive (Directive 1999/93/EC) has been in place for over 12 years. The Directive has gaps, such as undefined obligations for national supervision of service providers, which are holding back cross-border eSignatures, and it does not cover many new technologies.

Given the demand for greater trust in electronics services, these issues are best addressed by an evolution to more comprehensive legislation.

Objectives and benefits

Why extend use of electronic identification?

e-ID is convenient and cost-effective compared to most paper-based or face-to-face transactions with government.

e-ID is a popular form of identification already, for example on social networking, shopping and banking websites.

Who is this Regulation aimed at?

eSignatures trust services and eIdentification are largely relevant for businesses (legal persons), and individuals (natural persons) as they will lead to new opportunities within the EU.

For example, this will affect the 13 million EU citizens who work in another EU country and the hundreds of thousands of students studying in other EU countries. Wider use and improved eSignatures and trust services would help Europe's 21 million SMEs, many of whom work across borders.

What does the Regulation actually do?

There are three key elements.

1. It upgrades the legal framework of electronic signatures replacing, the existing eSignature Directive. For instance, it allows you to "sign" with a mobile phone; it requires higher accountability for security; and it provides clear and stronger rules for the supervision of eSignature and related serviecs.

2. Through requiring mutual recognition between various national eID systems (different to harmonisation or centralisation), the Regulation extends the capabilities - the opportunities available with your existing eID - by making it functional across EU borders.

3. Other trust services are included in the Regulation for the first time, meaning there will be a clear legal framework and more safeguards through strong supervision services of electronic seals, time stamping, electronic document acceptability, electronic delivery and website authentication.

What are the key benefits of this proposal?

    Better online public services as government services get closer to the flexibility and convenience of private sector service.

    Saves you time and money

    More legal certainty for those who use e-ID and eSignatures

    Upholds European citizens' rights - the right to access government services or tenders in other EU countries

What is the Commission NOT proposing?

The Commission's draft Regulation does NOT make it obligatory for all citizens to have an eID card. The European Commission does NOT have the right to legislate on the management of electronic identities; this is a matter of national sovereignty. It is up to Member States to decide whether to have such a form of identification, when it is required, and what technology to use. The Commission's proposal aims only to ensure that where these electronic identifications exist, they can be used across borders fully respecting privacy and data protection rules.

This proposal does NOT create or propose the creation of a new 'European eID' or European database of any kind.

It does NOT set European standards for security, supervision or enrolment for electronic identification.

It will NOT lead to new exchanges of personal data across borders.

Finally it does not oblige Member States to notify their eID schemes to the European Commission.

Is this linked to other Commission initiatives?

Yes. Several other EU policy initiatives (e.g. the Services Directive, the Public Procurement Directives, the eCommerce Directive, the VAT (e-invoices) Directive and the Data Protection Directive) will have a greater impact if there is a consistent legislative framework for easy-to-use, trustworthy and secure electronic transactions in the Digital Single Market.

Why choose "mutual recognition" of e-ID over "harmonisation"?

Member States are solely responsible for the management of their electronic identities, so direct harmonisation is not an option. Direct harmonisation is also unnecessary, given that mutual recognition will achieve most of the same benefits, and quicker.

Mutual recognition is also clearly more politically acceptable and the Commission respects this.

Why choose "harmonisation" for eSignatures?

eSignatures are a single and relatively simple trust service, for which we need to ensure a well functioning internal market. The 1999 eSignature Directive already aimed at harmonisation. eSignatures mostly benefit and affect legal persons (companies) rather than individuals.

Examples

How eIdentification revolutionised banking

Today, because of effective electronic identification, banking takes place 24/7 at cash machines, in restaurants and shops, and online in all countries. e-ID removed artificial barriers from banking transactions and is now an accepted and essential part of our daily life.

By comparison, government services tend to be much more cumbersome. They are often not available online, they are available at limited times and places and at far greater cost – either to the individual or company or indirectly via the taxpayer.

Services likely to see greatest positive impact of greater e-ID use:

Online tax collection, education courses and other social services, eProcurement and eHealth.

Case studies of specific, typical current problems

Elisa, a Belgian student, wants to enrol at a university in Italy. She logs on to the university website but cannot use her Belgian electronic identification when she is asked to identify herself. Why? Her Belgian eID is neither recognised nor accepted in Italy. Elisa has to buy a train ticket to Italy and queue up to do the necessary paperwork in person.

A small company based in Hungary wants to bid online for a contract being tendered by a Portuguese local administration. However, the electronic signature used to seal the bid is denied because of specific national requirements and interoperability problems. The Hungarian company has to submit the bid on paper, print copies and send them by courier to Portugal, which costs lots of extra time and money.

A French multinational wants to sign contracts electronically with a counterpart based in Latvia. This is technically possible, but the two countries have different legal requirements for trust services like electronic seals, electronic documents, time stamping. The French company will need to invest time and money to assess whether it is legally possible to use electronic documents and processes.

An Estonian bank wants to send a notice of default to a borrower based in Germany. The Estonian bank wants to use an electronic document, but is this legally valid under Estonian and German law? The bank will examine the applicable laws in both countries. If in doubt, the bank will probably opt to send the document by traditional mail.

General impacts on stakeholder groups

All citizens will be able to carry out secure and trustworthy cross-border electronic transactions and take full advantage of their rights across the EU.

Workers who get a job in another Member State, or who are residents but not EU citizens, will get more readily the transfer formalities electronically. Businesses will suffer less from red tape and literally from less paperwork. The gains can be enormous for large scale businesses, and can be the difference between profitability and difficulty, and expansion or stagnation for small and medium sized businesses.

Public administrations will save taxpayer's money through reduced administrative burdens and will be able to provide better, more efficient services. Environmental benefits will accrue through reduced travel and paper use.

Private sector companies will be able to use and accept eIDs opening up new e-Business, eCommerce and eGovernment service possibilities.

Real-world examples of e-ID in practice today

The STORK project has technically proven that e-IDs work across borders. 17 EU countries (and a total of 35 partner organisations from private, academic and civil society sectors) with many different approaches to identification systems have developed an interoperable platform to enable cross-border identification and authentication without disruption of national systems. This work was jointly funded by participating Member States and the EU (€26 million since 2008) and members include those who do not have an ID card system, such as the United Kingdom.

The Connecting Europe Facility proposed by the Commission would enable further cross-border digital service infrastructures.

Examples of current cross-border e-ID enabled services

Through the Estonian e-Business portal, a simple limited liability company can be set up online in 18 minutes. Creating a company via the internet can be done with either an Estonian ID card, or one from Belgium, Portugal, Lithuania or Finland. Estonia hopes to extend this service to other ID card systems.

Around 500 students studying in Austria, Estonia, Spain, Italy and Portugal have participated in a student mobility pilot project, where their national e-ID-card gives access to online enrolment, access to online courses or tutorials, and computing infrastructures in other countries.

An interoperable Change of Address framework has been created for Estonian, Portuguese, Slovenian, Spanish and Swedish citizens. This enables foreign citizens to notify all relevant entities in government (and, for example, water and electricity companies) of an address change in one-step and has been used more than 25,000 times in early testing.

German and Polish pension and social care services now provide for recognition of each other's e-ID. This is an example of a bilateral cross-border mutual recognition. This provides a lower level of functionality compared to EU-wide mutual recognition, but shows the value of such services for communities living close to each other but on either side of national borders.

National examples of the positive impact of e-ID

In total, Estonia has issued approximately 1.2 million e-ID smartcards, and conducted 52 million electronic signatures to authenticate more than 88 million electronic transactions. Private sector organisations use the authentication mechanism widely for their own services.

Submitting company balances sheets in Estonia was streamlined from a 3-month long paper process to a 20 minute electronic process. Countless hours for printing, sending, scanning and manually inputting data has been saved.

Austria and Iceland enable 'Safer Chat' for 14-18 year olds where users need their e-ID card to enter chat rooms for 14-18 year olds. This means much greater safety with only minimal disclosure of data.

In Austria the delivery time for a document confirming an individual does not possess a criminal record was reduced to 2 minutes.

Financial

What is the cost burden of this change on Member States?

Both eSignature and eIdentification systems come with an initial upfront cost, but far greater financial returns in the medium and long term.

Much of the technical work has already been done in the STORK large scale pilot project, and further development costs can be largely absorbed through a small portion of the funding being made available by the Connecting Europe Facility, which is designed to support cross-border digital services

The best large scale analogy for the cost-benefit ratio of electronic identification and other trust services is the changes in banking in recent decades. Today a far greater range of services is provided more cheaply and often 24/7 compared with banking based on paper and face-to-face transactions. This has been good for banks and good for their growing number of customers.

Privacy and security

What about my privacy?

Your privacy can be enhanced by electronic identification and authentication as they limit the need to always, and repeatedly, provide personal data

Secure eIDs combine state of the art cryptography with common security practices such as PIN-codes or passwords. This means they are as strong and private as typical bank solutions, which are already widely and safely used.

How will my data be protected?

Under these proposals no unnecessary data is revealed or exchanged.

For example, if a teenager wanted secure access to a chat room for 14-18 year olds, or a gambler needed to prove they were of legal age, the website should only check information about their age from the e-ID card. Other details such as nationality and address would not need to be revealed.

When relying on other forms of identification – for example a person volunteering information that cannot be verified, or a physical photo ID, the result is either lower security or more data being revealed. e-ID avoids this problem.

What are the key safeguards in the eID proposal?

The proposals are designed to avoid the centralisation of information. There is no aggregation of information, beyond the aggregation that already takes place in national systems. However there is one key additional safeguard.

Data protection regimes already apply to national eID schemes. In addition, Member States assume liability for their participating systems. That means you will have the right to sue your government if there is a problem with your data or access to services. This new right, to make one's government liable, is a clear incentive against lax behaviour; it will provide an effective lock on the 'door' of your data file.

What are the key safeguards for other trust services?

Trust service providers already have to comply with EU and national data protection legislation. In addition to this, the mandate of supervisory bodies, which already exist for eSignatures, will now be extended to other trust services.

What about levels of security?

The proposals provide for clear and unambiguous identification and proof of identity. For many public services, users and administrations alike prefer higher levels of security than is necessary, say, for online shopping. For example, using an electronic token with an access code to complete a tax declaration online.

Other security services include electronic signatures, electronic seals or time stamping. These enable online transactions to be concluded with the same legal validity as in the physical world. Such use of the Internet can speed up enormously the time it takes for small companies to carry out their business.

What about data storage?

These proposals do not create new databases or deliver personal information to other databases.

All people using mutual recognition and other services must strictly comply with EU data protection legislation.

Impact on the private sector

New business opportunities

The new rules require governments to recognise any eSignature provider that meets the standard. Equipment makers therefore have significant new opportunities.

In Estonia the government has not placed any restrictions on the use of eID in the private sector and the authentication mechanism is available to any outside developer. Currently, applications exist for using eID to authorise online bank transactions, to sign contracts and tax declarations, to authenticate to wireless networks, to access government databases, and for automated building access.

Next steps

The Commission's proposal will now be passed on to the European Parliament and the Council of Ministers for scrutiny and debate. This process may take between one and two years, but is impossible to give an accurate estimate.

The Regulation would take effect immediately in all EU Member States as soon as it has been formally approved by the European Parliament and Council and 20 days after publication in the Official Journal.

Source: European Commission