Opinion of the Economic and Social Committee on the 'Proposal for a European Parliament and Council Directive on a common framework for electronic signatures` (1999/C 40/10)

On 30 July 1998, the Council decided to consult the Economic and Social Committee, under Article 100a of the Treaty establishing the European Community, on the above-mentioned proposal.

The Section for the Single Market, Production and Consumption, which was responsible for preparing the Committee's work on the subject, adopted its opinion on 28 October 1998. The rapporteur was Mr Burani.

At its 359th plenary session (meeting of 2 December 1998) the Economic and Social Committee unanimously adopted the following opinion.

1. Introduction

1.1. The Commission proposal for a directive on a legal framework for electronic signatures is the concrete follow-up to the Communication entitled 'Ensuring security and trust in electronic communication - Towards a European framework for digital signatures and encryption` ().

1.2. The Communication highlighted a situation calling for the attention of the European authorities, namely that several Member States have adopted, or are adopting, different approaches to the regulation of electronic signatures. This lack of mutual recognition may well fragment the single market in electronic commerce and on-line services in the European Union. There is therefore an urgent need to establish a common framework which meets two main requirements - to create a precise legal framework, but one that is flexible enough to keep up with the ongoing march of technology.

1.3. The Economic and Social Committee agreed with the Commission's views () and proposed that the regulatory framework observe the principles of self-regulation and subsidiarity, albeit within the precise limits of a minimum common legislation. Furthermore, in its remarks on a later Commission Communication, entitled 'Globalization and the Information Society - The need for strengthened international coordination` (), the Committee pointed out that the harmonization of European legislation with the rest of the world - fundamental for the security of electronic commerce which, by its very nature, knows no bounds - is progressing too slowly because there are too many uncoordinated initiatives.

1.4. The Commission's decision to propose a directive represents a step in the right direction, not least because it focuses on flexibility - a necessity in view of any kind of international coordination.

2. General comments

2.1. Electronic signatures allow the recipients of electronically-sent data to check the origin of the data (authenticity) and to verify that the original data are complete and unaltered (integrity). Checking the authenticity and integrity of the data does not necessarily prove the identity of the person sending the electronic signature; it is therefore necessary to obtain confirmation from third parties, known as certification service providers. The use of this signature certification system is therefore an essential way of reassuring the contracting parties and building confidence in electronic commerce.

2.2. In order to ensure mutual recognition of the principles of legal certainty underpinning the certification of electronic signatures, the Commission has been guided by concepts that are consistent with a continually evolving situation:

- the regulations are neutral from a technical point of view and are open to authentication mechanisms other than public-key cryptography, as it is quite possible that new systems will emerge;

- Member States should refrain from adopting prior authorization systems for certification service providers, although voluntary accreditation schemes could prove to be useful;

- the directive concerns only electronic signatures on messages exchanged on open networks; in the case of closed networks, it will be up to each individual service provider to decide whether or not to comply;

- as electronic signatures must be legally recognized, basic requirements and responsibilities for service providers must be specified.

2.3. The Committee agrees with this general approach, which is based on free-market principles, but believes that not enough consideration has been given to the protection of users. It therefore reserves the right to make comments or suggestions during its examination of the Commission document.

2.4. As regards placing the European regulations in a global context, the Commission observes that 'many activities and discussions are underway` () and mentions, inter alia, the UNCITRAL, OECD and WTO initiatives. As the Committee has already pointed out (), such initiatives may be commendable, but they present a concrete risk of overlapping between the institutions, and of duplication, or - even worse - of conflict, between the various sets of rules. Ultimately, this would lead to red tape, delays and expense for the taxpayer. The Committee regrets to note that, in the attempt to kill two birds with one stone, global institutions are producing the opposite effect and creating confusion and uncertainty.

3. Specific comments

3.1. Article 1

The aim of the directive is to establish a legal framework for certification services that are available to the public, in other words to make electronic signatures easier to use and to ensure their legal recognition. The directive does not, however, cover other aspects related to the conclusion and validity of contracts. In the light of this article and of the clarifications in the tenth 'whereas` clause, the scope of the directive is restricted to open systems; for closed systems the Commission leaves it up to the parties to decide the conditions under which electronic signatures are to be accepted and recognized.

3.1.1. The Committee has some reservations on this point: while the respect for contractual freedom is laudable, it has to be said that several closed systems are available to an ever wider public which is not necessarily aware of the rules governing each individual system. A closed system may have the option of complying with the directive, but the Committee wonders whether it might be wiser - in the interest of the users and managers of such systems - to extend the scope of the directive to closed systems that are available to the public.

3.2. Article 3(1) and 3(2)

Member States may not make the provision of certification services subject to prior authorization; they may, however, introduce or maintain voluntary accreditation schemes, without limiting the number of service providers.

3.2.1. The Committee recommends that careful consideration be given to the scope of these provisions. The act of certification is valid not only for the parties but also, if necessary, in respect of third parties. Without prejudice to the voluntary nature of the request for accreditation, measures should be introduced to enable a clear distinction to be made between documents certified by accredited service providers and those certified by unaccredited providers; this point will be discussed in more detail later. Article 5(2) should stipulate that electronic signatures admissible as evidence in legal (and extrajudicial) proceedings may only prevail against third parties if they are backed up by a certificate issued by an accredited service provider.

3.2.2. The current situation does not give particular cause for concern; however, legislation cannot ignore unpredictable future developments. If authentication techniques are 'trivialized`, the few, well-known providers around today could multiply. While it is acceptable that the number of certification providers be unrestricted, it would be inadvisable to exempt them from a preliminary check and accreditation. In the interest of consumers and third parties, it should therefore be stipulated that, in the case of open systems or closed systems available to the public, the 'requirements for certification service providers` listed in Annex II be monitored by a public authority.

3.2.3. Accreditation of service providers by the public authorities should be subject to fulfilment of the requirements listed in Annex II. This is a necessary condition, but it is not sufficient. Periodic checks should be made to ensure the continuing fulfilment of the requirements. Public authorities cannot evade responsibility - once regulations have been adopted, the authorities must guarantee they will be respected.

3.3. Article 3(4)

States that Member States may make the use of electronic signatures in the public sector subject to additional requirements.

3.3.1. The Committee endorses this, but feels that it might be advisable to go a step further by obliging those Member States that recognize the validity of electronic signatures in the private sector to accept them also in the public sector. If public authorities - who have the duty of guaranteeing the security of legal institutions and protecting their citizens - take on the responsibility of recognizing the legal validity of an electronic signature in private exchanges of documents, there is no reason why they cannot do the same with documents exchanged with the public administration, albeit with 'additional requirements`.

3.4. Article 4

Regarding the respect of the single market rules, this article provides that Member States may not restrict the provision of certification services originating in other Member States.

3.4.1. In this regard, the Committee points out that the above requirement is indeed consistent with single market principles, but it does not protect the public from the provision of services by unaccredited providers in other Member States. It is already difficult for a consumer to distinguish between accredited and unaccredited providers in his own country, let alone those from a third country. Here an evident analogy can be drawn with the approach taken by the second banking directive: only those institutions that are covered by the directive are granted freedom in the provision of their services; for all others, the provision of (financial) services is restricted to their country of origin.

3.4.2. In the present case, without prejudice to the freedom of movement of electronically-signed documents, their admissibility as evidence in legal or extrajudicial proceedings should be recognized only if the certification has been issued by an accredited body.

3.5. Article 5

Member States will have to make provision in their legislation for ensuring that electronic signatures cannot be denied enforceability, legal effect or validity solely on the grounds that the signatures are in electronic form or are not validated by an accredited certificate. They must also ensure that signatures certified by an accredited service provider have the same legal value as hand-written signatures and that they are admissible as evidence in legal proceedings.

3.5.1. The Committee draws the Commission's attention to a matter which bears out the validity of the comments made in points 3.4.1 and 3.4.2: the only difference between signatures certified by accredited providers and those certified by unaccredited providers lies in the substantiating effect of the certification. In this regard, Article 5(2) does not seem clear and should be reviewed. According to the text, Member States should allow certificates issued by a service provider 'which fulfils the requirements set out in Annex II` to be used as evidence in legal proceedings. This could give the impression that any service provider may issue certificates admissible in legal proceedings, provided that it fulfils the requirements laid down in Annex II. If this is not the intention, the wording should be changed to the unambiguous 'accredited service provider`.

3.5.2. Furthermore - in line with the comments made in point 3.4.1 - the proposal makes no mention of the substantiating effect of certification issued by a provider accredited in a non-member state; in this case, too, the directive should lay down specific provisions. The Committee proposes that such certification be accepted only if the non-member state grants reciprocal recognition to the certificates of EU residents.

3.6. Article 6

With regard to liability, this article prescribes a set of obligations for the certification service provider, who must ensure the information is accurate, comply with the provisions of the directive, and check that the signatory and certifier fulfil the necessary technical and technological requirements. The article also lays down exemptions from liability in the case of mistakes in the original information, and provides for the possibility of limiting both the uses of the certificate and the sum certified.

3.6.1. The Committee believes that the provisions of this article comply with general legal principles and respect contractual freedom. However, it would like to advance an opinion, or, rather, a query: should the certification service provider suspend or terminate the service, what are his responsibilities and what guarantees does the consumer have? Some sort of system should be established to guarantee that consumer rights continue to be protected - for example, by making it compulsory to deposit back-up files with a third party, with certain guarantees.

3.7. Article 7(1)

This article sets out provisions concerning providers from third countries. The certificates from such providers will be recognized as the legal equivalent of European certificates if the provider has been accredited in a Member State under its voluntary accreditation scheme. Failing this, legal recognition will be given if the certificate is guaranteed by a service provider already established in a Member State or if the certificate or provider is recognized under a bilateral or multilateral agreement between the EU and third countries or international organizations.

3.7.1. The Committee disagrees with the overall thrust of these rules. In the name of commercial freedom, they flout the principle of reciprocity which should be the cornerstone of global trade integration (and not just electronic). The guidelines laid out in this paragraph - particularly those regarding the accreditation of a foreign service provider in a Member State and the guaranteeing by a European provider of a certificate issued in a third country - are acceptable only if the third country accords similar or equal treatment to providers and certificates from all EU Member States.

3.7.2. As regards recognition of a certificate or provider from a third country on the basis of a bilateral agreement with a Member State, the Committee notes that the adoption of such a principle would distort competition between Member States or, more specifically, between those whose rules are more 'liberal` and those that are less so. The free movement of services cannot be used as a Trojan horse whereby agents or products from third countries can be introduced into the EU via a bilateral agreement with only one Member State.

3.7.3. Nor is it possible, in defence of the above principle, to cite such precedents as the second banking directive: in this case, the 'host` Member State exercises continuous supervision and guarantees the soundness and solvency of the third country company which, in any case, has to be physically present on the Member State's territory. These are conditions which cannot be met in the guaranteeing of electronic signatures.

3.8. Article 8

Apart from paragraph 4 on the use of pseudonyms, this article requires no particular comment. The service provider must be able to transmit the data concerning the identity of the pseudonym user to the public authorities upon request, with the prior consent of the person in question. However, the draft directive does not state what the position of the provider would be if the pseudonym user denied such consent.

3.8.1. The second part of Article 8(4) raises further doubts regarding investigations into alleged breaches of the rules on the use of electronic signatures under a pseudonym. If national law requires that the service provider transfer data identifying the person in question, the latter is informed of this after the investigation has been completed.

3.8.2. The Committee wonders whether this detail is really necessary. Once the investigation has been completed, the defendant will already be well aware that his/her identity has been revealed, so the rule would seem superfluous. Moreover, the reference to 'national law` should clearly specify which national law is intended - that of the service provider's country (presumably), that of the pseudonym user's country (if known), or even that of another Member State. Since we are clearly (if not explicitly) in the field of crime-fighting, the directive should be more specific as to the procedures to be followed and the rights/duties of the service provider.

3.8.3. All things considered, the Committee wonders whether it might be best to review the entire article and to simply state that the provisions of the directives on personal data protection and money laundering will apply in full. Ultimately, from this standpoint there is no difference between paper and electronic transactions.

3.9. Articles 9 and 10

These articles make provision for the establishment of an 'Electronic Signature Committee`, made up of representatives of the Member States and chaired by a representative of the Commission. This committee will be consulted on the requirements for service providers and on acceptable standards for the creation of electronic signatures. It will also be informed by the Commission on the outcome of the latter's periodic meetings with companies, users and consumers.

3.9.1. The ESC takes note of this initiative but queries the necessity of setting up a committee when the Commission could perfectly well consult Member States and interested parties itself, as part of its institutional duties, without needing an interface which would actually overlap into the Commission's remit. Moreover, this is a procedure that the Commission follows in the normal course of its duties; there is no need to create more red tape which, in the Committee's view, would not increase efficiency.

3.10. Articles 12 and 13: These two articles - the order of which appears inverted in terms of chronology and logic - provide that the directive must be adopted by Member States by 31 December 2000 and that the Commission must submit an initial report on its implementation to the European Parliament and the Council by 31 December 2002. The Committee has stressed, on various occasions (), the urgent need to adopt uniform legislation in the vast field of the information society; it therefore wonders whether Member States need to be granted so much time to adopt the directive, when several of them have already taken pains to pass laws of their own in a very short space of time. It should not cost national legislators too much time or effort to introduce the few harmonization measures that are needed. In the Committee's view, a one-year period from the date of adoption of the directive should be sufficient to make any minor amendments to existing legislation or to draft new laws.

Brussels, 2 December 1998.

The President of the Economic and Social Committee

Beatrice RANGONI MACHIAVELLI

() COM(97) 503 final, 8.10.1997.

() OJ C 157, 25.5.1998.

() OJ C 284, 14.9.1998.

() COM(1998) 297 final, point 7.

() OJ C 284, 14.9.1998.

() OJ C 284, 14.9.1998; OJ C 157, 25.5.1998; OJ C 19, 21.1.1998.