TABLE OF CONTENTS

List of annexes............................................................................................................................. iv

Procedural issues and consultation of interested parties. 5

1........... Introduction. 5

1.1........ Electronic identification, authentication and signatures - key elements for electronic interactions and the Digital Single Market 6

1.2........ Policy context of electronic identification, authentication and signatures. 6

1.3........ External expertise and consultation of interested parties. 7

1.4........ Commission inter-service consultation and Impact Assessment Board process. 7

2........... Identification and assessment (definition) of the problem.. 7

2.1........ Introduction. 7

2.2........ Lack of a common framework for electronic interactions and main problems. 8

2.3........ The drivers behind the identified problems. 11

2.4........ Who is affected and to what extent?. 16

2.5........ Baseline scenario - how would the problem evolve, all things being equal?. 16

Fragmentation, interoperability problems not solved. 16

Legal certainty not ensured. 16

Users' needs not fully satisfied. 17

Leading European (policy) initiatives not fully leveraged. 17

International coordination opportunities missed. 18

Conclusion. 18

2.6........ EU added value and right to act 18

2.6.1..... Treaty basis. 18

2.6.2..... Subsidiarity. 19

3........... Definition of the policy objectives. 20

4........... Policy options. 23

4.1........ Options for the Scope of the Framework. 23

Option 0: Repeal of the e-signature Directive and no regulatory activities with respect to eID or related trust services 23

Option 1 No policy change. 24

Option 2 - Enhancing legal certainty, boosting coordination of national supervision and ensuring mutual recognition and acceptance of eIDs. 24

Option 3 – Expansion to incorporate certain related trust services. 25

4.2........ Options for the Legal Instrument of the Framework. 25

Option A: One comprehensive legal instrument vs Option B: Two separate legislative instruments. 25

Option C: Directive vs Option D: Regulation. 25

4.3........ Options for the Level of Supervision of e-Trust services. 25

Option i): Maintaining national supervision schemes (“basic variant”) 25

Option ii): Establishing a EU-based supervision system (“advanced variant”) 25

5........... Assessment of the policy options. 26

5.1........ Scope of the Framework. 26

5.1.1..... Assessment of Option 0: ‘No EU Policy’ 26

5.1.2..... Assessment of Option 1: ‘Status quo’ (No Policy change) 28

5.1.3..... Assessment of Option 2: ‘Enhancing legal certainty, boosting coordination of national supervision and ensuring mutual recognition and acceptance of eIDs’ 31

5.1.4..... Assessment of Option 3: Expansion to incorporate certain related trust services. 34

5.2........ Legal instrument of the Framework. 39

5.2.1..... Option A. One instruments vs Option B. two instruments. 39

5.2.2..... Option C. Directive vs Option D Regulation. 40

5.3........ Level of supervision of e-Trust services. 40

5.3.1..... Option i: Maintaining national supervision scheme. 40

5.3.2..... Option ii: Establishing an EU-based supervision system (‘advanced variant’) 41

5.3.3..... Comparison of costs (cost-efficiency) of managing the supervision schemes. 42

6........... Comparison of the options. 43

7........... Monitoring and Evaluation. 45

COMMISSION STAFF WORKING PAPER

IMPACT ASSESSMENT

Accompanying the proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on

electronic identification and trust services for electronic transactions in the internal market

List of Annexes

Annex 1 – List of acronyms and glossary

Annex 2 - List of studies and workshops in relation to electronic identification, authentication and signature

Annex 3 - Policy Context of Electronic Signature and Electronic Identification

Annex 4 – Overview of responses of the Public Consultation

Annex 5 – SME Test

Annex 6 – E-Signature Market Segmentation and Trends

Annex 7 –Difficulties encountered by each of the stakeholders and the interest in the revision of the framework

Annex 8 – Detailed assessment of impacts – related trust services – EU supervision level

Annex 9 – Impact assessment matrix

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT

Accompanying the document

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on electronic identification and trust services for electronic transactions in the internal market

Procedural issues and consultation of interested parties

Identification

Lead DG: Information Society and Media Directorate-General

Agenda Planning: 2012/INFSO/002

1. Introduction

This report assesses the impact of policy options for a European legal framework for cross-border recognition and interoperability of electronic Identification, Authentication, Signature and electronic related trust services (referred to as 'elAS services'). The objective is to enable secure and seamless electronic interactions between businesses, citizens and public authorities, thereby increasing the effectiveness of public and private online services and electronic commerce in the EU, thus creating trust in electronic transactions in the internal market.

This initiative is a step further to the development of a digital single market from which citizens, businesses and public authorities could fully benefit and for the fostering of a European citizenship, which are both essential to improve the functioning of the internal market in the digital age. The framework builds on the revision of Directive 1999/93/EC on a community framework for electronic signatures ("e-signature Directive").

This report analyses alternative policy scenarios by assessing how they would help to overcome current obstacles to eIAS. The impact of these options on consumers/citizens, the private sector and public administrations will be considered.

This document does not pre-judge the final form of any decision to be taken by the European Commission.

1.1. Electronic identification, authentication and signatures - key elements for electronic interactions and the Digital Single Market

Easy to use and reliable eIAS can create user convenience and trust and confidence, thereby facilitating a full 'European citizenship' in the digital single market and favouring electronic business transactions.

At the same time, a well regulated and operational Digital Single Market is an incentive for the accelerated development of online services, at national and cross-border level, which in turn will favour the development of the knowledge economy, generating potential favourable impacts on economic growth and the creation of jobs.

Nonetheless, still existing barriers to the cross-border access of online services need to be eliminated to fully reap these economic and social benefits of the Digital Single Market. In order to be productive enablers, rather than barriers to cross border services, electronic identification, authentication and signatures need to be mutually recognised and accepted throughout the EU.

E-identification, e-authentication and e-signatures are the electronic equivalent of personal identification, validation of personal identification and integrity of documents and handwritten signatures respectively. In simple terms, they perform the same functions in an electronic environment as in the paper world: a person provides his/her name (identification) and proves (e.g. by showing a passport or identity card) the correctness of the data provided (authentication). Currently only an e-signature has been formally defined at the European level, as “data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication"[1].

Collectively, eIAS services serve as a basic ‘trust ecosystem’, that allows participants in the digital society to communicate and engage in transactions with the necessary confidence in electronic claims, in particular when a high degree of certainty and security is required. As such, eIAS services are crucial to citizens, businesses and public administrations in enabling the transition from a largely physical and paper based society to a European citizenship in the digital world, where reliable, trustworthy and seamless alternatives are available.

1.2. Policy context of electronic identification, authentication and signatures

The Single Market Act (SMA)[2] stresses the need for boosting confidence in electronic transactions and restates the objective “to make secure, seamless electronic interaction possible between businesses, citizens and public authorities, thereby increasing the effectiveness of public services and procurement, service provision and electronic commerce (including the cross-border dimension)”.

The Digital Agenda for Europe[3] (DAE) identifies existing barriers to Europe’s digital development and proposes legislation on e-signatures (Key Action 3) and the mutual recognition of e-identification and authentication (Key Action 16), establishing a clear legal framework eliminating fragmentation and the lack of interoperability, enhancing digital citizenship and preventing cybercrime.

The Roadmap for Stability and Growth[4] underlines the key role of the future common legal basis for mutual recognition and acceptance of eIAS across borders for the development of the digital economy.

1.3. External expertise and consultation of interested parties

The Commission has collected feedback from Member States, the European Parliament and stakeholders during discussions, workshops and conferences. The Commission launched a number of studies in relation to eIAS (see annex 3) and assessed available literature published by third parties.

A wide online public consultation on eIAS was launched from 18.2.2011 to 15.4.2011 with a view to provide input for policymakers on how eIAS can contribute to delivering the European Digital Single Market[5]. The on-line questionnaire was accessible through the "Your Voice" website. The consultation was complemented by a "SME Test Panel" to identify the specific views and needs of SMEs[6].

1.4. Commission inter-service consultation and Impact Assessment Board process

To support the preparation and drafting of this impact assessment, a Commission inter-service steering group was established. Given the overarching nature of the subject, all Commission Services were invited to participate. The group met three times.

On 2 March 2012, the Impact Assessment Board (IAB) asked DG INFSO to submit a revised version of the report. Following the IAB examination and in line with the Board's comments and recommendations, the following modifications were made to the report: (a) the final impact assessment report provides now an structured presentation of the problems; (b) the policy options are presented more clearly; (c) the report provides a narrower analysis of impacts and comparison of the options; (d) the views of stakeholders are clearer distinguished and monitoring and evaluation arrangements defined. In line with the suggestions of the Board, the report respects the recommended presentation standards set out in the IA guidelines and refrains from advance conclusions on the preferred option.

2. Identification and assessment (definition) of the problem

This chapter identifies and describes the problems at stake.

2.1. Introduction

Increasing mobility and flexibility of citizens and businesses within the internal market together with the technological transition to digital economies and administrations show the need for secure and trustworthy cross-border online services that are accessible without creating new electronic barriers. The examples below should illustrate the main difficulties citizens and businesses encounter today when it comes to the cross-border use of eIAS services.

Examples

- Elisa, a Belgian student, wants to enrol in a university in Italy. She logs in to the university website and discovers that she cannot use her Belgian electronic identification when she is asked to identify herself. The reason is simple: her Belgium eID is neither recognised nor accepted in Italy. Elisa then has to buy a train ticket to Italy and to queue up to do the necessary paperwork in person which involves an unnecessary waste of time and money.

- A SME based in Hungary wants to participate electronically to a public call for tenders launched by the Portuguese administration but because of specific national requirements and interoperability problems the electronic signature is denied. As a result, it will need to submit a bid on paper, which implies additional administrative burdens and costs for the company (printing of multiple copies and sending them by courier) and, hence, impair its competitiveness compared to Portuguese competitors.

- An international company based in France wants to sign contracts electronically with a counterpart based in Latvia. This is technically possible, but the legal requirements for trust services such as electronic seals, electronic documents, time stamping, etc. differ. The French multinational company will need to perform a very expensive exercise to assess whether it is legally possible to use electronic documents and processes.

- An notice of default must be delivered from Estonia to Germany. The Estonian sender would like to use an electronic document, but is this legally valid under Estonian and German law? He will need to examine the applicable laws in both countries, and in case of ambiguities will likely opt for paper mail.

In the sections below, we will identify the specific problems concerning the secure and seamless cross-border use of electronic identification, authentication and signatures encountered by the different stakeholders, describe possible solutions and explain the consequences of the lack of a common European framework regulating eIAS.

2.2. Lack of a common framework for electronic interactions and main problems

eIAS services are pre-requisites for a wide range of electronic interactions such as e-banking, е-government or е-health services. A regulatory framework has been set up at EU level for electronic signatures, but there is no specific framework for mutual recognition and acceptance of elD and е-authentication, or for related trust services such as the time stamping, long-term preservation of e-signatures or registered document delivery services.

Problem 1: Fragmentation of the Market

a) e-signatures

With respect to e-signatures the CROBIES[7] Study has demonstrated that the European harmonisation brought about by the e-signatures Directive is imperfect and incomplete, resulting in market fragmentation. The major problems identified are:

(1) Divergent national implementations due to different interpretations by MS of the current Directive[8] leading to cross-border interoperability problems and thus to a segmented EU landscape and distortions in the internal market[9];

(2) A de facto usage of the "public sector clause" of the Directive[10] to justify additional requirements for the use of electronic signatures in the public sector. As a result, the Commission is unable to undertake actions when eSignatures barriers are created or maintained by the Member States in the public sector, as they can be justified on the basis of the public sector clause. Thus, interoperability challenges within the EU public sector can remain, contrary to the goals of the Directive[11];

(3) Outdated standards leading to a highly complex EU standardisation framework. Standards are no longer in line with current market expectations, e.g. the use of mobile phones[12] or highly secure remote signing technologies[13] are increasingly popular in the European e-signature market, but they are not clearly addressed by the European framework[14]:

(4) Trust in e-signatures depends to some extent on national supervision[15]. The Directive is vague on supervision obligations, leading to a lack of trust as the effectiveness of supervision regimes is unclear, and creating market distortions for service providers who need to meet different standards depending on their country of establishment[16].

b) Electronic identification

The usage of electronic identification is most often limited to the access of national online services and interactions, i.e. an eID issued in one MS cannot be used to access online services in a different Member State. The reasons are of technical and legal nature:

(1) Member States use different technological solutions for personal identification which lead to interoperability problems when it comes to cross-border interaction.

(2) There is no framework of reference for determining the reliability of the entity that issued the eID, the legal certainty on the cross-border use of eIDs and a clear liability for the correctness of the ID when it is used as electronic representation of a person.

The consequences are discrimination of non nationals and their exclusion to the access to online services. Evidence of the effect of electronic barriers is provided in the context of the implementation of the Services Directive[17]. According to Article 8 of the Services Directive, Member States are obliged to enable service providers who want to establish or exercise a business in another Member States to complete certain administrative procedures through Points of Single Contact, i.e. websites which act as one-stop-shops for this purpose. This implies that Member States need to provide online services that allow service providers to electronically interact with public authorities. In cross border scenarios, this is highly complicated due to the missing link of mutual recognition and acceptance of electronic means of identification (including specifically official eIDs) throughout the EU. Exchanging electronically signed documents will be equally difficult due to a lack of interoperability.

Example

An Austrian citizen moving to Portugal wants to change his address. The website of the local community where he wants to live asks him to insert the eID card into his card reader. The Austrian citizen however has no Portuguese eID card but an Austrian mobile-ID, and the Portuguese commune cannot recognise, accept or validate the Austrian mobile-ID. The Austrian citizen will have to go to the city hall in person to change the address.

c) Related trust services

With respect to related trust services, the lack of a common European framework has led to:

(3) The adoption of national rules for some of these services in some Member States[18] resulting in potential internal market barriers);

(4) high costs for those service providers who want to offer their services in other Member States due to the fact that they need to ensure technical compliance with the rules of the country of destination and obtain guarantees with respect to trustworthiness of foreign eIAS tools.

European companies providing related trust services are unable to offer their services in other Member States without incurring in extra costs. Today, conditions are clearly not favourable for dedicated suppliers of eServices and products in the eIAS market[19].

Example

The Austrian eSignature Ordinance[20] specifies requirements for qualified time stamping services, including technical parameters and algorithms which must be used. In contrast, the Romanian Decision no.896 of 2 October 2008[21] has its own and different set of standards and norms for time stamping. If time stamping service providers from other Member States want to ensure the validity of their services for clients in Austria and Romania, they will have to satisfy contradictory requirements. This is a clear market barrier for this related trust service.

Problem 2: Lack of trust and confidence

One of the current barriers impeding European citizens to benefit from the same kind of services in the digital world as in the physical world is the lack of trust and confidence in electronic systems[22], the tools provided and the legal framework, e.g. a feeling of absent legal safeguards in comparison to physical interactions.

The SME Test Panel replies on e-signature and eID shows that only 11% of SMEs use e-signatures in the context of cross-border transactions. The lack of common trust enhancing rules for eIAS was clearly mentioned as a barrier to the cross border use[23]. This is also confirmed by the public consultation[24].

For e-signature, the requirements that aim to ensure an adequate security level for e-Signature services provided for in Directive 99/93/EC are somehow weakened, as detailed by the "CROBIES" study[25]. For example, as already mentioned under problem 1, national supervision requirements are qualitatively very different from MS to MS, ranging from a simple notification letter of the certification service provider to the supervisory body to full and periodically recurring audits. This makes it very complex for relying parties to assess how effectively a service provider is supervised.

For eID and related trust services, the lack of a common European legal framework does not enable citizens, businesses and administrations to feel secure when interacting online in cross border scenarios.

In particular for eID and in the context of eGovernment, a major concern is a ‘trust tension’[26] between the need to collect data on individuals as the basis for providing services, such as electronic health records and voter registration, and fears of data surveillance or the inappropriate secondary use of personal information in computer databases. eGovernment raises indeed particular trust concerns as a number of public services require the handling of personal data in digital forms[27]. It is therefore of the utmost importance that access to personal data is highly secured with advanced authentication and identification procedures for end users to feel confident.

2.3. The drivers behind the identified problems

The main drivers behind the two identified problems are the following:

Driver 1: Insufficient scope of the current legal framework

The current framework on e-Signatures covers only one of the eIAS-components which are necessary for the ecosystem of certification services. Hence, legal uncertainty leading to a lack of trust (problem 2) and new market distortions (problem 1) will inevitably arise, in particular for the mutual recognition and acceptance of eIDs and related trust services.

The narrow scope of the eSignature Directive results in a patchwork of different national rules for electronic identification, authentication and related trust services leading to distortions of the internal market[28]: although an related trust service provider is allowed to provide services in other Member States, it cannot provide guarantees with respect to the legal value of its services. Worse yet, national legislation may be contradictory between countries, meaning that a service provider would at the very least need to modify its service offering on a per country basis. De facto, this is a significant disruption of the eIAS market in Europe. Legal certainty offered by a single Member State is not sufficient for the take up of the digital economy. The functioning of the Digital Single Market will depend from the capability to enable the cross-border use of eIAS.

Example

The Italian Decree of 11 February 2005, nr. 6810[29] establishes rules for electronic registered mail, including references to mandatory technical requirements. Service providers offering electronic registered mail services in other countries would need to satisfy these requirements in order to be legally considered as equivalent to registered mail in Italy. Most likely, service providers in France would not meet this bar, even if they comply with their own legal requirements under Article 1369-8 of the French Civil Code and the executive Decree of 2 February 2011 (n° 2011-144)[30].

Driver 2: Lack of coordination between eSignature and eID developments

National eIAS infrastructures and systems were developed in isolation without coordination at European level[31]. On the one hand, the result of these different approaches is the absence of cross-border interoperability of technical solutions which creates barriers to the operational achievement of electronic transactions (problem 1). On the other, the lack of mutual recognition and acceptance is one of the main reasons why both users and providers of online services are sceptical about the deployment of eIAS (problem 2).

With regard to eSignatures, the existing Directive foresees mutual recognition rules of qualified certificates. However, due to the aforementioned problem in the Directive (diverging national implementations of eSignature systems, Member States often dismissing foreign signatures in public sector applications), mutual recognition and acceptance of eSignatures remains problematic in practice.

With regard to electronic identification, what is missing today is the possibility of citizens and businesses to use their "official eIDs"[32] throughout the EU when they need to interact electronically with public administrations of other Member States in cases they e.g. want to move, travel, study, work or do business abroad. The lack of commonly agreed legal provisions allowing for mutual recognition and acceptance of each others' "official eIDs" makes it currently almost impossible for citizens and businesses to access cross-border online services of other Member States when they need to identify themselves electronically. They are cut out of these services due to the fact that almost no MS foresees the use of other MS' "official eID" in their online processes or their mutual recognition and acceptance[33].

Besides this cross-border dimension, there is also a "cross-sector" dimension: eIDs can be issued by private or public sector parties, and/or their use may be specific to a sector, such as social security, e-payment or eHealth. In both cases, the absence of a general framework for eID recognition and acceptance makes it hard to use an eID outside of its context, mainly because of liability and data protection challenges.

With respect to liability, the primary issue is that eIDs are made available under a set of guarantees and warranties that are appropriate for the use in a specific context. Bank issued eIDs will have liability limitations (e.g. a ‘liability cap’ limiting the liability of the issuer to an amount of 5.000 EUR) which are appropriate for use in banking applications. However, these may be insufficient for cross-sector us: a liability cap of 5.000 EUR might be inappropriate for a public procurement application in which bids with a value of millions of EUR could be submitted. With respect to data protection, the challenge relates to ensuring that personal data is not made needlessly available to third parties. An eHealth card may e.g. contain health information, or information on the social insurance scheme of the holder. It would not be appropriate for this information to be made available to any recipient that does not require it (e.g. when using the card in an e-tax application). Therefore, clear rules are needed to determine which data can be share in cross-sector applications, and to what extent.

Example

A study[34] showed the important role of the private sector in some Member States, noting that “13 out of 32 surveyed countries are deploying government supported eID cards, including however a group of six countries relying on eID cards issued by private operators with a public sector mandate (Austria, Iceland, Liechtenstein, Luxembourg, the Netherlands and Sweden); in the seven others eID cards are issued by public bodies (Belgium, Estonia, Finland, Italy, Lithuania, Portugal and Spain).” The same study also examined sector specific eIDs, identifying eHealth and social security eID cards in 6 countries (Belgium, Croatia, Denmark, France, Italy and Poland); and noting that identification numbers were subject to legal usage restrictions in 20 out of 32 examined countries to minimise privacy risks.

Both the cross-border and cross-sector dimensions share the same general challenge, i.e. allowing electronic information to be used outside of its original context (with that original context being either a specific country, or a specific sector, or both (a sector within a country).

EU-wide mutual recognition and acceptance of electronic identification and authentication is vital to ensure the scalability and sustainability of eIAS which depends on the volume of cross-border services accessible without barriers and discrimination.

Driver 3: Lack of understanding of security guarantees

The e-signatures Directive recognised that legal certainty can only be attached to electronic signatures that offer high security guarantees, and are thus sufficiently protected against forgery or fraud. To this end, the Directive introduced a category of e-signatures referred to as ‘advanced signatures’, which, under the current state of the art, require the use of cryptographic algorithms. If the processes and devices used to create such advanced e-signatures meet clear security requirements[35], then the Directive guarantees to these e-signatures the same legal effect as handwritten signatures. This highly secure type of e-signature is commonly referred to as a ‘qualified e-signature’.

It is of course not possible to eliminate all security risks:

· a person might give his or her smartcard and signature PIN to a third party. This is like giving a signed blank check to somebody or to sign a blank page.

· similarly, the use of highly secure devices such as smart cards does not guarantee that there is no virus on the PC of the signatory that could try to corrupt the signing process. A virus could sign changed or additional documents after the signatory enters his or her PIN-code, in addition to (or instead of) the document the signatory wanted to sign.

· In much the same way, corrupted or badly designed signing software might not display faithfully what is to be signed to the signatory.

To date, there is no report that any qualified e-signature was ever forged. Furthermore, some manufacturers offer today fully autonomous external devices (e.g. in the form of USB-drives) that can perform all the computing operations required to create a qualified signature, without dependence on additional software including to ensure a proper display of the data to be signed on the PC screen. Thus, security guarantees are still continuously improving.

What the above highlights, is that high and harmonised security requirements are essential to create trustworthy solutions (problem 2). This is particularly relevant for the access to services where sensitive personal data are involved, such as eJustice, eGovernment and eHealth.

The lack of secure electronic identification and authentication systems is perceived by users of online services as an important or very important barrier[36]. The traditional userID / password systems used for accessing online services are often not sufficient for public administrations, since they need to establish exactly who is asking for a specific service and whether it is indeed the person he claims to be, in order to deliver the requested service.

To overcome the difficulty of identifying a person in an unambiguous manner, Member States have progressively introduced "official eIDs" in recent years, which in many countries are embedded on ID cards (e.g. BE, EE, DE, PT, ES); in others they are designed as citizen cards or mobile-ID used simply to access public online services (e.g. AT)[37]. Yet, the lack of a harmonised legal framework means that the security and reliability of "official eIDs" cannot be objectively determined across borders. This creates cross-border barriers thereby leading to a lack of trust (problem 2) and a fragmented market (problem 1).

Another main concern with regard to electronic identification and authentication is related to the potential of online theft and fraud[38]. Secure eIDs can help reduce this risk, by combining state of the art cryptography with common security practices such as private PIN-codes or passwords. Inversely, badly secured eIDs can increase the risk of identity theft by making it easier for criminals to obtain false or compromised eIDs.

Example

National eID cards commonly base their security policies on the best practices pioneered by the financial sector to reduce fraud risks. The Belgian national eID card has a limited duration of five years (shorter than the paper card which it replaced), operates using a PIN-code only known by the citizen, and can be revoked if a card is stolen or lost. Like a bank card, the card blocks itself automatically after three unsuccessful usage attempts. Revocations are published online (https://www.checkdoc.be/CheckDoc/), and revoked cards cannot be successfully used for electronic identification or electronic signatures. An online card-stop website and phone number are available to citizens and the police to immediately block lost or stolen cards (https://www.docstop.be/DocStop/).

Currently, the EU has no common practices that would help citizens, businesses and administrations make the distinction between secure and insecure eIDs. As they can only trust eIDs that they know in detail, this leads to fragmentation (problem 1) and lack of trust (problem 2).

Driver 4: Lack of awareness and user adoption

The complexity behind the technologies used in online transactions and the key role played by trusted third parties result in an environment where it is difficult to assess trust (problem 2). Particularly end users (citizens and SMEs) who generally do not have sufficient expertise must be able to rely on rules which establish clear rights and responsibilities of all stakeholders (online service providers, end users and governance bodies such as supervisory authorities).

Concerning the market demand for trust enablers (eIAS services) and related trust services, the public consultation demonstrated that different stakeholder groups (users, policy makers, industry, businesses) are not fully aware of the added value of eIAS[39] to secure online transactions. The SME Panel showed a similar result[40], which becomes less significant as soon as the use of electronic applications in general is assessed[41].

2.4. Who is affected and to what extent?

The following players of the eIAS market are the main stakeholders affected by the problems identified:

On the supply side, eIAS service or solution providers mainly suffer from the fragmented market (diverging national rules and standards) which leads to barriers to enter other European markets and hamper the deployment of cross-border/cross-sector services.

On the demand side, the lack of trust:

- prevents the public sector from moving towards modernisation, cost effectiveness and re-organisation in view to delivering faster high quality services with less resource consumption (i.e. reduction of administrative burden);

- limits the market for the private sector, i.e. the European providers of such services, as the legal value of their services may vary from MS to MS;

- reduces confidence and ease of use for end users who lose the potential benefits that eIAS offer (especially in cross border scenarios).

For an extended overview of the difficulties encountered by each of the stakeholders and the interest in the revision of the framework, please refer to Annex 7

2.5. Baseline scenario - how would the problem evolve, all things being equal?

Technological advances are likely to increasingly threaten Internet security jeopardising the trust and confidence of users in electronic systems, tools and legal framework.

Example

The UK National Fraud Authority estimates that in the UK alone, identity fraud is estimated to cost victims around £1.9 billion a year (approx €2.3 billion), or some €36 per capita. As noted in the report, “if the costs of responding to and dealing with identity fraud are taken into consideration, it is estimated that the real cost of identity fraud is at least £2.7 billion a year”[42], or €3.2 billion in total or some €52 per capita. Extrapolated across the EU and assuming equal prevalence and cost, this would amount to an estimated total cost over €26 billion.

The extent and seriousness of the problems identified under section 2.2 are therefore also expected to increase. Without further regulatory intervention, it is anticipated that under the baseline scenario the problems in the current situation would evolve as follows:

Fragmentation, interoperability problems not solved

Member States are likely to continue to implement and enforce the eSignatures Directive in a diverging manner, including by regulating other services than eSignatures as shown in the examples above, leading to interoperability challenges and market fragmentation. As further EU integration and globalisation is expected to result in an increase in the numbers of businesses operating in more than one Member State and of citizens performing electronic transactions beyond national borders, this will become an increasingly greater burden to the mobility of citizens and businesses.

Legal certainty not ensured

The problems driven by the lack of mutual recognition of electronic signatures and by the absence of a legal framework regulating eID and related trust services would impede the legal recognition of a range of cross-border interactions. If no common legal framework exists, cross border scenarios would be avoided due to reasonable doubts over the legal value of key services in other Member States.

The components required to ensure a legally-proof (irrefutable in front of the Court) interaction like, e.g. the time (time stamping) or the identification and authentication of participants (eID) would still be missing. Without certainty on the legal validity of transactions, take-up of the use of electronic interactions would not increase.

Users' needs not fully satisfied

Technological developments are a key factor in increasing the demand for services by improving user friendliness. An emerging signature model which is likely to become very popular is the "remote signature" where the cryptographic operations are executed on a secure server (called HSM or Hardware Security Module) of a service provider instead of the equipment of the signatory – but still under the control of the signatory. This includes mobile eSignatures (when signing is not performed on the SIM card of the smart phones or tablets) and mass signature for instance of invoices or contract of a phone company. Remote signature is excluded by the current framework.

Leading European (policy) initiatives not fully leveraged

Recent European policy initiatives which have endeavoured to eliminate interoperability challenges and cross border recognition and acceptance issues related to certain types of electronic interactions will be handicapped by the lack of an appropriate cross-sector legislative framework.

Examples 1. The Services Directive As noted above, Member States are obliged to implement Points of Single Contact which must be accessible to service providers across the EU. In reality, cross-border electronic interactions are in most cases currently not possible since the existing eIDs are only accepted in the country in which they are issued. Similar challenges are encountered with respect to e-signatures (where the legal framework for mutual recognition only covers a small category of e-signatures[43]), and for the communication of e-documents (which is often impossible if e-documents are not accepted). Considering the wide range of service categories covered by the Services Directive and that the fact that the services sector represents around 70% of GDP and employment in the EU, the potential savings missed due to an insufficient legal framework are significant. 2. Roll-out of services building on the results of large scale pilot projects Several large scale pilots (LSPs) have been put in place at the EU level in recent years to support the development of interoperable and trustworthy means of electronic communication (including SPOCS, supporting the implementation of the Services Directive; STORK, supporting the development and use of interoperable eIDs; PEPPOL, supporting the development and use of interoperable eProcurement solutions; epSOS, supporting the development and use of interoperable eHealth solutions; eCodex, supporting the development and use of interoperable eJustice solutions.) Each of these LSPs represents a multi-million euro investment from participating Member States and the European Union. These investments have yielded a significant number of useful and functioning components to support the use of eIAS services (e.g. e-signature validation services, eID/eAuthentication components, quality assurance policies, secure document storage and exchange facilities, etc.). The participation of Member States in these initiatives shows that there is a clear interest in using the results in operational public eGovernment services. However, the policy framework (including legislation) to do so is currently missing at the European level. This means that the outputs of these LSPs have no formal status: there are mere project deliverables. As a result, the investments made in the LSPs cannot be effectively monetized. By way of example: the STORK pilot represents an investment of €20 million, 50% of which was funded by the European Commission[44]. It has piloted working and successful eID interoperability solutions, allowing citizens from one Member State to use their eIDs in applications managed by other Member States. However, as there is no legal framework covering eIDs (regulating the responsibilities and liabilities of service providers and the rights of end users such as businesses and citizens), project results cannot be taken up outside of this pilot context, impeding the monetization of the €20 million investment.

International coordination opportunities missed

Maintaining the current electronic signature framework would impede achieving the globalisation of digital transactions. In this regard, a broad common understanding on the need for e-signature recognition at international level was raised during " Stakeholder Workshop Digital Agenda for Europe: electronic identification, authentication and signatures in the European digital single market" held the 10th of March 2011 in Brussels[45].

Moreover, UNCITRAL[46] underlined that international mutual recognition could be eased if Article 9.3[47] of the United Nations Convention on the Use of Electronic Communications in International Contracts was reflected in EU legislation.

More specifically, other regions of the world are currently developing their own eIAS policies and proposals, including the US National Strategy for Trusted Identities in Cyberspace[48]. In the absence of a common EU policy on topics such as eID, the EU would not be able to initiate meaningful discussions with the USA or other key trade partners on common approaches. Member States could only engage in bilateral or multilateral discussions. Solutions would be developed purely at the national level, in isolation of international needs, trends or standards, thus limiting the appeal of European eIAS products and services on international markets.

Conclusion

The baseline scenario suggests that the existing problems of market fragmentation and lack of confidence would remain or worsen, and that their negative economic impact would become more significant: investments cannot be optimally monetised, efficient electronic processes cannot replace paper alternatives, and cross border trade is hampered. This would harm the development of the Digital Single Market, and in extension, of a European Citizenship.

2.6. EU added value and right to act

2.6.1. Treaty basis

Legal basis

The legal basis for the legislative proposal is Article 114 TFEU[49]. Indeed, the legislative proposal intends to remove existing barriers to the functioning of the internal market by promoting the approximation of Member States legislation, in particular the mutual recognition and acceptance of electronic identification, authentication, signatures and related trust services across-borders when needed for the access and completion of electronic procedures or transactions. This objective pursued cannot be achieved by less restrictive means than the legislative proposal. The general division of responsibilities between the Union and the MS with regard to monitoring and reporting as established under the e-signature Directive are not affected by the proposed changes compared to the current situation.

It should also be noted that the electronic signatures Directive 1999/93/EC was already based on article 114 (ex article 95: "Having regard to the Treaty establishing the European Community, and in particular Articles 47(2), 55 and 95 thereof[50]").

The legal basis of Directive 1999/93/EC is also adequate for related trust services, as they build on e-signatures and other eIAS components, and share the same challenges and complexities.

Identity management as such in relation to official eIDs falls under the subsidiarity of Member States. The scope of the proposal is the mutual recognition and acceptance of certain official eIDs (as notified by the Member States at their own choice and discretion), and not harmonisation of national eID-systems and infrastructures; the latter would likely not be permissible under the legal basis of Art. 114. What the new regulatory framework would provide for is the "free movement" of official eIDs used at national level including their use in each Member States regardless of where they are issued.

Finally, it is important to stress that the proposal (like Directive 1999/93/EC) would not make the use of any eIAS service obligatory for citizens, businesses or administrations. The goal of the proposal is solely to ensure that they have the possibility of using eIAS services when they want to, including in cross-border or cross-context situations.

2.6.2. Subsidiarity

In order for EU action to be justified, the subsidiarity principle must be respected:

a) Transnational nature of the problem (necessity test)

The transnational nature of eIAS is an important element in determining whether EU action is necessary. Domestic action alone would not suffice for the fulfilment of the objectives and the achievement of the targets set out in the Europe 2020 Strategy[51]. Conversely, experience has shown that national measures have de facto created barriers to the EU-wide interoperability of e-signatures, and that they are currently having the same effect for eID, eAuthentication and related trust services. It is therefore necessary that the EU creates the enabling framework for addressing cross-border interoperability.

Improvements to the supervision schemes, which would now also encompass related trust services in addition to eSignatures, also require EU level coordination.

b) Effectiveness test (added value)

Action at EU level would produce clear benefits compared with action at the level of Member States. The objectives outlined below are currently not being achieved by voluntary coordination among Member States, nor are they reasonably likely to be addressed by coordination in the future, due to the risk of duplication of efforts, setting different standards, transnational characteristics of the spill-overs generated by ICT, and the administrative complexity of establishing such coordination through bilateral and multilateral agreements.

In addition, overcoming the identified problems, such as an absence of legal certainty related to a lack of mutual recognition of national provisions due among others to a heteroclite interpretation of the legal texts and a lack of interoperability of the systems set up at national level due to non-adapted technical standards, requires the co-ordination across all EU27 MS which can be carried out more effectively at the EU level, thereby ensuring interoperability and EU-wide usability. EU action will ensure that gaps and weaknesses are clearly identified and concrete action is taken to address the issues at stake.

Due to eIAS inherent non-territoriality nature, action at EU level would be adequate and proportionate to implement the Digital Single Market. Regulatory measures taken at Member States level cannot be expected to achieve the same outcome.

3. Definition of the policy objectives

In accordance with the Impact Assessment Guidelines[52], when defining objectives, a distinction is made between general, specific and operational objectives.

Three general objectives have been identified: ensuring the development of a digital single market; stimulating and strengthening competition in the single market; enhancing user-friendliness (citizens and businesses). These objectives are in line with strategic EU policies such as the EU 2020 Strategy, the Digital Agenda for Europe, the Single Market Act and the Roadmap for Stability and Growth.

The general objectives identified are the following: 1. The development of a Digital Single Market 2. Stimulating and strengthening sustainable competition in the Digital Single Market 3. To promote the interest of consumers and to ensure high level of consumer protection for all EU citizens and businesses.

The specific objectives express the desired outcomes specifically related to the eIAS market (the ‘what’) of putting in place the operational objectives (or ‘measures’). Particular attention was given to presenting both the envisaged economic objectives (e.g. Specific objective 1) as well as social objectives[53] (e.g. Specific objective 5).

The specific objectives identified are the following: Increase the availability of cross-border and cross-sector eIAS services and stimulate the take up of cross-border electronic transactions in all sectors (public and private); Ensure an optimal level and scope of governance; Ensure that competitive market developments are stimulated and that technological developments are not hindered in the eIAS market; Strengthen the competitiveness of the European industry and services sector; Ensure that all consumers can benefit from the advantages of (cross-border) eIAS services.

Finally, the operational objectives are directly derived from the problem and problem drivers identified in sections 2.2 and 2.3. (cf. intervention logic under 3.1), and point out ‘how’ appropriate policy option can help solving the problems.

The operational objectives identified are the following: 1. Ensure mutual recognition and acceptance of notified eIDs 2. Ensure usage of notified eID by public and private sectors 3. Ensure effective supervision models by eIAS 4. Ensure interoperability of eIAS (cross-border and cross-sector) 5. Ensure trust and confidence in the legal certainty and security of eIAS 6. Ensure maximum reduction of administrative burden and increase quality of services. (awareness raising)

3.1 Overview of general, specific and operational measures

3.2 Intervention logic

The intervention logic linking the main problems and the operational measures is illustrated in the next figure:

4. Policy options

In order to solve the problems and meet the objectives set out in the previous sections, three different sets of options are considered, respectively addressing the scope of the envisaged framework, the legal instruments and the supervision organisation.

4.1. Options for the Scope of the Framework

Option 0: Repeal of the e-signature Directive and no regulatory activities with respect to eID or related trust services

This policy option implies the cessation of all EU activities in the field of electronic signatures including those already started. It would thus lead to repealing Directive 1999/93/EC and its two related Decisions 2000/709/EC and 2003/511/EC. Any directives referring to Directive 1999/93/EC would need to be amended. Only national legal frameworks would remain and would be free to evolve based solely on the preferences of national legislators.

This option also implies that no legislation would be adopted on eID, e-authentication and related trust services.

Option 1 No policy change

This option corresponds to the baseline scenario developed in section 2.5 above. It implies retaining the e-signatures Directive as it stands. It should be noted that one of its weaknesses (outdated references to technical standards) could be addressed by revising Decision 2003/511/EC.

Option 2 - Enhancing legal certainty, boosting coordination of national supervision and ensuring mutual recognition and acceptance of eIDs

This option consists of expanding the scope of the e-signature Directive by including new provisions for the cross border recognition and acceptance of certain eIDs. The provisions of the current Directive in relation to electronic signatures would be revised in order to solve its current weaknesses.

Within this policy option, the primary change in scope is thus the mutual recognition and acceptance of 'notified' eIDs, i.e. official eIDs which the Member States consider suitable for cross-border use[54]. These should benefit from general recognition and acceptance, both in a cross-border and cross-sector context. Practically, this would imply that EU-wide use of notified eIDs would become possible in any online interaction where reliable identification is needed, irrespective of the location of the end user or service provider. Through the cross-sector approach, the private sector could also benefit from notified eIDs, in the same way as they can currently rely on paper official identity documents in offline contexts, instead of being required to develop their own eID-solutions.

It should be noted that the concept of a notified eID is not limited to public sector issued eIDs: Member States could also notify eIDs issued by the private sector that they recognise to be used for their own public sector services. This approach is necessary to ensure that the strategy is applicable and useful to all Member States, as not all Member States all Member States have eIDs issued by the public sector. The outcome would thus be an eID scheme that is conducive to supporting any eID policy choices made by a Member State at national level.

Example: the Netherlands have not yet introduced an official electronic identity card. In the meantime, citizens can use a scheme based on usernames, passwords and SMS confirmations to identify themselves. This scheme is called DigiD[55], and is managed by the public sector. Businesses can identify themselves electronically using solutions offered by the private sector, which have to observe the rules established by the government in a scheme called eHerkenning[56]. Thus, the Netherlands is an example of a country that uses a mixed private-public sector model, for which a cross-sector approach would be important to achieve cross border interoperability.

Option 2 would also require that data protection provisions are integrated into the proposal, to ensure that eID providers are not able to track the behaviour of eID holders. This is particularly relevant when cross-context usage is considered: private sector eID issuers should not be able to track when their customers use eGovernment applications, nor is it desirable that public administrations can track eID use in private sector services as a matter of course. Existing experiences at the Member State level can be leveraged to achieve this result, and the proposal will be aligned with the currently ongoing revision of the Data Protection Directive (including specifically with respect to privacy-by-design rules[57]).

Example: the Austrian Citizen Card is known for its high level of data protection. The unique identification number of each citizen (the so-called sourcePIN or Stammzahl) is cryptographically hidden from service providers. They can only see identification numbers which are derived from this sourcePIN on a sector per sector basis. As a result, they cannot link citizen behaviour between different sectors.

Option 3 – Expansion to incorporate certain related trust services

This option expands option 2 by including further related trust services and credentials in the scope of the legislative framework.

Essential related features to be added in the legislation would be: − Time stamping, i.e. the application of a trustworthy time reference to electronic data, so that its existence at a given point in time can be determined with certainty. − Electronic seals, i.e., the equivalent to the signature of a legal person[58]; in practical terms, this can be thought of as the electronic equivalent of stamps or seals on paper documents, which are tied to a legal entity rather than to a natural person. − Long-term preservation of information, i.e., to ensure the legal validity of electronic signature over extended periods of time, ensuring that e-signatures can be validated irrespective of future technological evolutions. − certified e-document delivery, i.e., the reliable and verifiable electronic delivery of data; this can be thought of as the electronic equivalent to traditional registered mail.[59] − admissibility of electronic documents, i.e. ensuring that paper documents can be converted into electronic equivalents without losing their legal validity; this can be thought of as an electronic equivalent to the paper certified copy (copie conforme). − Website authentication, i.e. an obligation for legal person’s website to include trusted information (e.g. a certificate) allowing the user to verify the authenticity of the website and the existence of the legal person.

4.2. Options for the Legal Instrument of the Framework

Option A: One comprehensive legal instrument vs Option B: Two separate legislative instruments

In the context of these sub-options, two alternatives are considered for the legal instrument that could implement the options for the scope of the framework.

The legislation would either consist of one single comprehensive measure covering electronic identification, authentication and signatures; or of two instruments, namely an Act on electronic identification and authentication and an Act for the revision of the eSignature Directive.

Option C: Directive vs Option D: Regulation

In the context of these sub-options, the legislation(s) would either consist of a Directive or of a Regulation.

4.3. Options for the Level of Supervision of e-Trust services

Option i): Maintaining national supervision schemes (“basic variant”)

This option envisages maintaining the current national based supervision schemes, but with stronger harmonisation through high level common essential requirements, including e.g. regular audits of supervised service providers. These essential requirements should ensure that all national supervision schemes attain a quality level that fully ensures security and legal certainty.

Option ii): Establishing a EU-based supervision system (“advanced variant”)

This option envisages the establishment of a EU-based supervision system. The goal would be to ensure that differences between national supervision approaches are either further reduced or eliminated entirely, depending on the preferred sub-option under this scenario.

The first and conceptually simplest sub-option under this scenario would be to eliminate entirely the existing national supervision schemes, and replace them with a single European supervision scheme and body. In this sub-option, either a new European body would have to be created to perform this supervisory function, or an existing European body would be given this duty.

A second sub-option is to establish a federated supervision system involving an EU-based supervisory body (again, either as a new body or as an additional mandate for an existing body) while maintaining the national supervisory schemes and bodies.

Under this federated system, the exact responsibilities of the European body might include: - Interpretation of minimum requirements to be followed by national supervisory bodies; - Supervision of trust service providers established in a Member State, if that Member State has chosen to delegate its supervision competences to the European supervisory body[60]; - Supervision of trust service providers established outside of the EU that also wish to be supervised in Europe on a voluntary basis; - Possibly supervision of remaining national supervisory bodies.

5. Assessment of the policy options

In the following sections, the policy options will be assessed and compared to the baseline scenario (i.e. Option 1: Status Quo).

5.1. Scope of the Framework

The sections below present the effectiveness[61] and coherence[62] of the different options for the scope of the framework. For the assessment of the efficiency[63] of these options, we refer both to the indications of possible the cost(s) incurred and cost savings made by the different parties involved as well as to the comparison of the costs of governance (cf. section 0) and costs of managing the supervision (cf. section 5.3.3).

5.1.1. Assessment of Option 0: ‘No EU Policy’

Economic, social, environmental impacts and administrative burden of option 0

Member States would be free to modify substantially their internal legislation, going from maintaining their current transposition law, to properly cancelling it, and having also the opportunity to simply adapt it to their own needs. Bilateral or multilateral agreements would likely be reached between some Member States with a common view of the topic or with common economic objectives. An integrated approach set up amongst all 27 Member States, even if theoretically possible, seems to be an unlikely option.

If Member States collectively decide to cancel their own internal law, then this would lead to a legal no man's land with absolute market freedom. However, in the absence of a legal framework, there would also be absolute uncertainty as to the legal validity of any such service.

Economically, the risk related to investing in eIAS services would remain high and payback periods long and uncertain. Most probably, all investments made at EU, Member States, and private sector level would be, proportionally to the attitude of Member States, lost.

Example: a number of Member States have invested in electronic identification cards that allow also the creation of qualified electronic signatures, to ensure that the resulting signatures would be legally equivalent to hand written signatures across the EU (including e.g. Austria, Belgium, Estonia, Spain, Italy). In the absence of European harmonisation on this point, this guaranteed legal effect would disappear, and the millions of Euros invested by each of these Member States in order to achieve this effect would be to some extent wasted. Example: several Member States have implemented Points of Single Contact that rely on the legal framework of the e-signatures Directive and the Commission Decisions to achieve at least a small degree of cross border interoperability (e.g. Cyprus, Greece, Spain, Liechtenstein and Lithuania). If this legal framework disappears, then these Member States would have to develop entirely new solutions, and their existing developments would be largely wasted.

Socially, there is a risk to see high and low level jobs disappear. Indeed, if the electronic signature was no more effective at cross-border level, the risk of collapsing companies would be very high due to the fact that the market would be more fragmented and that only the national market would be easily accessible for companies. In this regard, the customer potential would be hugely reduced. Environmentally, the potential benefits raised by the use of electronic interactions – mainly represented by the reduction of the amount of paper used – could be nullified.

The only aspects that would benefit from this option would be the decreasing of the administrative burden at Member States level brought by the cancellation of the supervision model, and ensuring complete freedom for market developments. This option would thus give optimal room for the development and uptake of voluntary industry initiatives and standards, such as e.g. OpenID[64] and the Kantara Initiative[65]. However, it should be noted that these initiatives are by themselves not sufficient to resolve the identified problems of market fragmentation and especially the lack of trust, as they do not have any regulatory backing to establish rights and obligations for services providers and end users.

Finally, cancelling all activities at EU level in the area of electronic signatures would have, on the one hand, an impact on other EU policies. Indeed, EU policies on e-invoicing, e-procurement or VAT are strongly related to the efficiency of cross-border electronic signature.

Example: the Public Procurement Directives 2004/17/EC and 2004/18/EC allow Member States to require qualified electronic signatures for the submission of offers. As shown in the 2010 Evaluation of the 2004 Action Plan for Electronic Public Procurement[66], 6 Member States make the use of such signatures mandatory. In total, 13 Member States require the use of at least advanced electronic signatures as regulated by the Directives. The elimination of European rules could threaten all investments made in this policy area, which are based to some extent on the concepts introduced by the Directive.

On the other hand, it would also have a negative impact on potential alignment with third countries. A fragmented legislation implies the practical impossibility to reach an agreement at international level to create a global safe environment for electronic transactions based on electronic signatures.

Effectiveness of Option 0

Based on the assessment of the economic, social and environmental impacts, the following conclusions are obtained regarding each of the specific objectives (cf. detailed assessment presented in Annex 10):

Specific Objective 1: Option 0 would first of all not increase the availability and take-up of cross-border and cross-sector eIAS services. The inability to increase the availability and take-up of cross-border and cross-sector eIAS services would not allow for a strong reduction of barriers. Depending on the efforts made by MS to enable e.g. the dematerialisation of administrative formalities, improvement of the local situation could be obtained (as is the case in the Baseline scenario), but this would not solve the problems related to cross-border transactions.

Specific Objective 2: Option 0 would not ensure an optimal level and scope of governance. Without an EU Policy, it would first of all be very difficult to increase legal certainty, trust and security of electronic transactions. The repealing of Directive 1999/93/EC on e-signatures would furthermore take away the only driver available today for enhancing harmonisation at the EU level and make it possible for MS to create even more legal and technical barriers than those still remaining today.

Specific Objective 3: Option 0 would not stimulate market developments and could hinder technological developments in the eIAS market by eliminating any drive for alignment. While the absence of any EU rules could avoid the risk of steering the market into a certain direction, this benefit is likely offset by the risk of Member States adopting their own rules (i.e. rather than one set of rules, service providers might be governed by 27 separate sets of rules). Furthermore, without an EU Policy, the eIAS market would remain fragmented.

Specific Objective 4: Option 0 would contribute even less to the strengthening of the competitiveness of the European industry and services sectors. First of all, the EU industry and services sector would not be able to build business models on their strong eIAS products and services. Repealing the Directive 1999/93/EC would furthermore disrupt the current process of working towards the enabling of cross-border electronic services. It can be expected that, without support at the EU level, MS will not continue this process on a voluntary basis, or at least that they would be less efficient in doing so. MS would meanwhile focus on or limit their efforts to national eIAS services. The trust landscape created as such would not be very attractive to investments by foreign eIAS operators. and in the longer run, if eServices would become clearly less developed in the EU compared to other regions, this could decrease the attractiveness of the EU for many other sectors.

Specific Objective 5: Option 0 cannot ensure that all end-users can benefit from the advantage of (cross-border) eIAS services. Without an EU policy, MS will not have many incentives to create an EU trust landscape that allows participation to the digital single market by all social groups. (cf. Regional development).

Coherence of Option 0

Finally, it can be concluded that Option 0 is not coherent at all with the overarching objectives of EU policy (cf. EU 2020 Strategy, DAE, Single Market Act and the Roadmap to Stability and Growth) as presented in section 3.

5.1.2. Assessment of Option 1: ‘Status quo’ (No Policy change)

Economic, social, environmental impacts and administrative burden of option 1

Economically, there is a high risk of low return on investments in eIAS infrastructure, products and services since new sectors are difficult to access and take-up rates have remained low. Opportunities created by the European Large Scale Pilots (LSPs) cannot be grasped as the required framework for doing so is lacking.

Moreover, until today, the unavailability of an appropriate framework has had a negative impact on the availability of cross-border electronic services. As such, it is difficult to estimate the cross-border saving potentials based on real life examples. However, the order of magnitude of the relative savings already estimated or observed at the national level provide a good proxy for possible cross-border savings[67].

In this regard, it should be noted that: According to the recent communication on a coherent framework for building trust in the Digital Single Market for e-commerce and online services the potential of the Digital Single Market is enormous and would benefit all the territories and economic sectors of the European Union. In the G8 countries, South Korea and Sweden, the internet economy has brought about 21% of the growth in GDP in the last five years. It also generates 2.6 jobs for every job cut and at times accounts for 25% of net employment creation. Online services are by nature cross-border and can speed up European integration and the creation of the Single Market.’ According to the communication on a coherent framework for building trust in the Digital Single Market for e-commerce and online services ‘The Digital Single Market is far from achieving its full potential; the cost of failure to complete it is expected to be at least 4.1% of GDP between now and 2020, i.e. EUR 500 billion or EUR 1000 per citizen. In the Single Market Act , it was recently reiterated that ‘The development of digital technology is one of the main levers for boosting growth and employment in the EU in various respects: the information and communications technology industry (whose added value to the European economy was approximately EUR 600 billion in 2007 ), an increasing number of Europeans who use the Internet on a regular basis or even daily (65% and 53% respectively in 2010 ), a broadband market which was a world-leader in 2010 , a market for public-sector information estimated at EUR 27 billion , to name just a few.’ The availability of cross-border IAS services could be strongly beneficial to the development of intra-EU market access and trade. In 2009, intra-EU trade in goods represented 37% of GDP (EUR 4 320 billion) and intra-EU trade in services 10.5% of GDP (EUR 1 233 billion). Despite this relatively large figure, only a relatively modest 9% of EU citizens carried out purchases from suppliers in other Member States in that same year. Thus, a significant margin of growth for cross border electronic trade still exists. The above-mentioned figures underline the importance of developing all required building blocks, incl. an appropriate cross-sector framework for secure, trustworthy and easy-to-use electronic interactions, so that the Digital Single Market can develop to its full potential. Some concrete examples 1. eProcurement has been commonly recognised as one of the high-impact services to be provided by European governments, with a significant savings potential. Government purchases in the European Union account for an estimated 19% of GDP, or €2,200B annually. Currently, less than 5% of total procurement budgets are awarded electronically, and only 1.6% of contracts are supplied by an entity in another Member State. It is estimated that a hypothetical reduction of average public procurement budgets of 1% due to the implementation of eProcurement would already amount to a saving of 3.92 billion EUR for EU advertised public procurements, and of 21.6 billion EUR for all EU public procurements together. As a cost saving of 5% is commonly quoted as a realistic outcome of implementing eProcurement, savings of 100 billion EUR for universal adoption would be possible[68]. Given the importance of IAS as a current blocking factor in eProcurement, this already shows the vast economic potential of establishing a coherent trust framework for eID, e-signatures, time stamping, long term archiving, electronic registered mail, and other services which are crucial to ensure the reliability and validity of eProcurements. 2.The French electronic health card Sesam-Vitale shows an impressive example of the cost and time reductions of electronic interactions compared to paper interactions[69] in the national context. Taking into account that 190 million European Health Insurance Cards (EHIC) were issued by 2009, and that some 3 to 4% of EU citizens are using their card in case of health care services used abroad, electronic interactions could potentially replace at least some 5.7 million tedious manual cross-border reimbursements if systems would be interoperable. If similar solutions could be implemented in other Member States with similar results, the economic impact could be very substantial. 3. Not all benefits can be expressed in terms of monetary gain. Estonia became an early adopter of eVoting via the Internet (rather than via dedicated eVoting booths) in 2005, leveraging its national eID scheme. While cautioning that this approach would certainly not be more cost effective initially, due to high set-up costs and low scale of deployment (with around 1 million eligible Estonian voters), the use of eVoting was seen as a potential way of increasing voter turnout and participation[70]. Based on available statistics[71], the number of eVoters out of the eligible voters in the population has increased from 3.4% in 2007 to 15.4% in 2011. In terms of actual voters (rather than all eligible voters), eVoter participation rose from 5.5% in 2007 to 24.3% in 2011. Total participation in voting (including electronic and traditional voting) rose from 61.9% in 2007 to 63.7% in 2011. Obviously, this does not prove conclusively that eVoting is solely or even partially responsible for this modest increase in voter turnout, but the increased adoption of eVoting shows the appeal of this option to voters. Furthermore, it is worth noting that eVotes cast by Estonian citizens in foreign countries represented 3.9% of all eVotes in 2011, with votes being cast from a total of 105 different countries. This last figure is a concrete example of digital citizenship being enabled through reliable IAS infrastructure that will become increasingly important as citizen mobility in the EU continues to grow.

Socially, the hindering of market and technological developments are finally hindering the growth of employment in the ICT market (employment of mainly highly skilled workers).

Administratively and environmentally, there would be not much room for reducing the administrative burden by using eIAS, the possibilities would remain limited to some specific (national) closed environments. As a direct consequence, the possibility of reducing the amount of paper used would remain very limited.

Effectiveness of Option 1

(cf. detailed assessment presented in Annex 10):

Specific Objective 1: the current framework is not optimally stimulating market dynamics. If the current EU policy is not changed, the EU economy would not be able to benefit much from an increased impact of ICT investments in eIAS services on overall productivity and competitiveness, especially not for cross-border transactions. In extension, the lack of availability of eIAS and/or a lack of trust and confidence in (cross-border) electronic transactions does not allow reaping the benefits related to the wide availability of broadband connections which could allow exercising many professions from a distance, incl. in rural areas.

Specific Objective 2: The current regulatory approach is also not ensuring an optimal level and scope of governance. The current Directive is not providing sufficient legal certainty, trust and security of electronic transactions throughout the EU. It also cannot be excluded that MS could continue to use the public service clause[72], leading to interoperability challenges for which no clear legal recourse is available. Moreover, the differences in national supervision will continue to lead to fragmentation of the market and lack of trust. The EU Framework is currently largely limited to e-signatures reducing the possible economies of scale and scope for suppliers of eIAS products and services. Finally, since electronic identification and authentication is currently not included in the EU framework, the risk of fraud and ID theft can vary between MS and cannot be reduced by EU-measures.

Specific Objective 3: The current framework does not allow the development of competitive markets and technological developments are hindered. Indeed, the potential offered by innovative services is jeopardised due to market fragmentation.

Specific Objective 4: The baseline scenario is not helping to strengthen the competitiveness of the European industry and services sector. Full electronic processing of transactions is currently often (technically) not possible (e.g. due to interoperability problems at the EU level) and the development of on-line services is furthermore hampered by legal uncertainty and trust issues which are not sufficiently dealt with by the current EU Framework. Development of online services is therefore mostly limited to local applications. In extension, there is currently little incentive for companies from outside the EU or from other MS to invest in the development of eIAS products and services that can be used in a particular MS. Moreover, as for option 0, in the longer run, if eServices would become clearly less developed in the EU compared to other regions, this could decrease the attractiveness of the EU for many different sectors.

Specific Objective 5: Option 1 does not ensure that consumers can benefit from the advantage of (cross-border) eIAS services. The lack of a sufficient level of trust and security of eIAS infrastructures, products and services as well as the lack of interoperability make eIAS unnecessarily complicated (e.g. because of the need of different devices, the unavailability of notified eID, ...) placing social groups that have less developed eSkills at risk. Secondly, the faltering development of (cross-sector and cross-border) on-line services has a negative impact on the accessibility of services (e.g. eHealth, eGovernment) for people living in rural areas and could thus negatively affect regional development.

Coherence of Option 1:

Option 1 is not coherent with the overarching objectives of EU policy (cf. EU2020 Strategy, DAE, Single Market Act and the Roadmap to Stability and Growth) as presented in 1.2.

5.1.3. Assessment of Option 2: ‘Enhancing legal certainty, boosting coordination of national supervision and ensuring mutual recognition and acceptance of eIDs’

Economic, social, environmental impacts and administrative burden of option 2

Economically, many types of electronic transactions become more efficient with an eID system. These systems enable individuals to authenticate when using online services and create legally-binding electronic signatures when concluding a contract on-line or registering for a service.

Estonia has issued approximately 1.2 million eID smartcards. Since inception, cardholders in Estonia have used their eID to create more than 52 million electronic signatures and authenticate more than 88 million electronic transactions. The government has not placed any restrictions on the use of the eID in the private sector and the authentication mechanism is available to any outside developer. Currently, applications exist for using the eID to authorise online bank transactions, to sign contracts and tax declarations, to authenticate to wireless networks, to access government databases, and for automated building access.[73]

The risk of exclusion from the digital economy for SMEs (and even more for micro-enterprises) is unlikely to increase. While there is an initial set-up cost for SMEs (or other end users), this cost is dwarfed by the economic benefits of reduction of administrative burden through trustworthy economic communications.

Through the Estonian e-Business portal, a simple limited liability company can be set up entirely electronically. This type of business is particularly suitable for SMEs. The entire process can currently be completed online in18 minutes[74]. Creating a company via the internet requires an Estonian ID card, or alternatively ID cards from Belgium, Portugal, Lithuania, and Finland. A legal framework for eID recognition could boost the scope of this project to other Member States, as Estonia would be able to trust eIDs from other Member States without assessing them on a case-by-case basis. Obviously, the monetary gain compared to a tradition paper process (which would require travel to Estonia to physically appear before the competent officials) is enormous. Similar gains can be made in other policy areas: in eProcurement, the cost of preparing and submitting a paper bid is orders of magnitude higher than the cost of preparing and submitting an electronic bid. The cost of sending a paper bid via courier in cross border procurements alone can easily cost between 50-100 EUR per offer. Compared to an eID cost of e.g. 17,50 EUR per card in Belgium[75], or 10 EUR in Estonia[76], and generic USB card readers costing around 20 EUR[77], costs are easily recuperated. This is even more so when other use cases are factored in, such as e.g. annual submission of company balance sheets. In Estonia, this process was streamlined from a paper process that took 3 months and involved countless person hours for printing, sending, scanning and manually inputting data into a register, to an electronic process called e-Annual Report that takes 20 minutes from the final preparation to inclusion into a register. The time saving (and thus cost saving) is clear, if usable eIDs are available.

In order to have access from eIAS services, internet access is absolutely required. In this regard, other policies can be used (ex. Universal services directive, Connecting Europe Facility (CEF)) to deploy internet in remote places. From a social point of view, Option 2 would make it much easier to exercise a profession or develop an (e-)business in rural areas, since many administrative formalities and business could be done from a distance. This could bring about a positive effect on employment. A priori, this would involve mainly highly skilled workers.

Regional development is hard to predict. While certain Member States certainly have a more advanced eIAS infrastructure in place at this time than others, there are some indications that advanced services already exist in all Member States. As a small indicator, it can be noted that the national trust lists containing supervised (and in some Member States accredited) service providers show that currently more than 100 companies are providing qualified certificates to the public, spanning 24 out of 27 Member States. From those 24, commercial offers (i.e. not focused exclusively on the public sector) for the issuance of qualified certificates are available in 20 Member States. Thus, even when focusing exclusively on this small group of relatively technologically advanced service providers, there is a relatively even spread across the Member States. Regional development would thus likely not be harmed by a policy focus on advanced eIAS tools.

The increased availability of eIAS will also fully enable their potential to reduce the administrative burden, as shown by the examples above in relation to balance sheet submission. By consequence, Option 2 would allow making paperless a significant number of transactions that currently require a 'physical' identification, authentication or signature. Government receives many of the benefits from increased efficiency, for example by eliminating duplicate data entry, and reducing the costs associated with unnecessary paperwork including printing costs, storage, transportation and disposal.

Security added value brought by eID provisions: Finally, Option 2 can improve the security of online transactions and help prevent fraud and identity theft. eIDs can make it more secure for users to login to information systems by enabling multi-factor authentication. An example of multi-factor authentication is requiring the user both to know a PIN and have an eID token to login to a website (i.e., the same security system as when using a bank-card). Since users must remember multiple usernames/passwords today, they often choose an easier-to-remember password or re-use the same password for different services. As Option 2 would instead allow users to use a single reliable eID in multiple contexts (i.e. cross border and cross sector), then the need for multiple passwords disappears and bad security habits can be reduced.[78]

Obligations for the different stakeholders

This option will mainly impact governments (which would need to modify national supervision schemes and to notify "official" eIDs), the service providers themselves (which would need to seek supervision if they wish to benefit from cross border market recognition), and solution providers (which would need to comply with common European standards if they wish to benefit from European level interoperability).

In particular, the new system of notified eIDs implies that Member States: - who want their official eIDs mutually recognised and accepted at EU level would need to notify these to the Commission. The Commission would set up a list of notified eIDs which would be published (Delegated Act). - will be liable for the notified eID: this liability will be limited to the unambiguous link between the identification data attributed to a person via the eID (e.g. person data such as name, date of birth and person identifier such as tax number in Italy, or the residence register in Austria). This ensures that each individual can be uniquely identified, even if some attributes are shared (e.g. multiple John Smiths, who may even share the same date of birth or city of residence). Member State liability would not extend to the entire transaction in which an eID is used (e.g. the validity of an eProcurement offer), but only to the exact identification of the person. - Need to provide an authentication possibility in order to check and verify that an eID is still valid (e.g. that it was not revoked after the theft of an eID card). They would also be responsible (and liable) for the correctness of this authentication process. . Note that this does not imply an obligation for Member States to change their eID-systems and infrastructures. However, if they wish to notify official eIDs (which is their own choice), then they will need to meet the European regulatory requirements, including by providing the required interfaces to their systems. The costs needed to put in place the required interfaces and infrastructures would be nonetheless limited as many countries – the 14 MS that have participated in the LSP STORK (AT, BE, EE, FR, DE, IT, LU, NL, PT, SL, ES, SE, UK and SK) – have already an interface and infrastructure, developed within STORK, which allows for the cross-border interoperability of eIDs. Assuming a MS has its own eID and the infrastructure associated with it, then it is a question of implementing these common STORK components. This is a relatively cheap activity, compared to the now sunk cost of the development of these components , and an estimate in the region of 100k should be largely sufficient. Should a MS not have its own eID in place, , then Option 2 will make it more attractive for them to adopt an eID: the existing interoperability components would still be available for their use, meaning that the potential use of an eID is much greater, and that no unnecessary costs would be incurred to create any new interoperability solutions. The major challenges relate more to organisational and governance problems. A sustainable governance is possible in the context of the proposed CEF and the planned digital service infrastructure for electronic identification and authentication.

It should be noted that for end users of these products and services (which can include citizens, businesses (including SMEs and administrations) no new obligations/responsibilities are contemplated under any of the options of the proposal. While their range of choices and options increases, they would not be compelled to undertake new actions. Specifically, it is not envisaged to make the use or acceptance of eIAS or related trust services mandatory (notwithstanding the fact that use/acceptance may already be mandatory under separate and independent frameworks, such as within the context of the Services Directive, or national obligations to file certain tax declarations electronically). Moreover, as with the eSignatures Directive, national laws regulating the contractual area will not be modified by the new legal framework.

A special attention must be paid to the SMEs case: Following an on-going study carried out by Formit and studying the usage of e-signatures in 6 different countries (Spain, Italy, Luxembourg, Finland, Romania and Germany), the current usage of e-signatures depend first, on the size of the enterprise and second on the sector of activities. This conclusion confirms Eurostat figures showing that the use of eSignatures is higher in large enterprises than in SMEs. However, analysing these figures, we can notice that the growth is proportionally higher for SMEs: - Large: 2009: 44% - 2010: 48% - Medium: 2009 36% - 2010: 40% - Small: 2009: 23% - 2010: 26% Nonetheless, if one of the objectives is to further raise SMEs' awareness on using use eSignatures and related trust services, the impacts of the initiative will be the same for all categories of enterprises. Indeed, the requirements of the new Regulation would have to be fulfilled by MS, from one hand, and CSPs from the other.

However, if businesses wish to use eIDs and electronic signatures, they will incur costs for certificates and software: the price of certificates is very heterogeneous and depends on three main parameters (Member State sponsorship, quality of the certificate and validity periods). The important variability in prices and price structure makes it very difficult to give a scale of prices. As the aforementioned examples of Estonia and Belgium show, government sponsored eIDs can be provided relatively cheaply (approx. 20 EUR). The annual price for a qualified signature certificate issued by commercial service providers (absent of government sponsorship varies between EUR 25 and 299, and between EUR 10 and 150 for a non qualified one.

Effectiveness of option 2

(cf. detailed assessment presented in Annex 11):

Specific Objective 1: Option 2 would improve the availability and take-up of cross-border and cross-sector eIAS services. eIAS products and services would gain appeal, which in turn would positively impact the return on investments made in eIAS infrastructure, products and services. New services would be created, and new markets and new investments can be unlocked, thus stimulating innovation.

Highly innovative companies presently exist, offering some of the services which are currently not covered by harmonized legislation, such as time stamping services offered by Universign in France[79], electronic registered mail offered by UnifiedPost in Belgium[80], or electronic archiving offered by Unizeto in Poland[81]. However, these companies cannot offer their clients clear guarantees on the legal value of their services across Europe in the absence of common rules. By introducing such rules, their market potential would expand to the whole internal market, benefiting the availability of services in countries where no similar providers exist yet, and opening the market for new opportunities.

Specific Objective 2: a better level and scope of governance would also be achieved to a large extent under Option 2. Indeed, a harmonised regulatory approach at EU-level that would also cover eIDs (unlike under Option 1) would enhance legal certainty, trust and security of electronic transactions and reduce the fragmentation of the market for eIDs, since cross-border interoperability would be improved by allowing references to a clear, flexible and reality-proof set of common technical standards. Furthermore, since notified and mutually recognised eIDs could also be used for applications in private sectors, these latter could profit from the large scale roll-out of (notified/official) eIDs (which took already place over the last few years) for accessing a large number of potential clients.

Specific Objective 3: The technology neutral EU Regulation for e-signature and eID as proposed under Option 2 would stimulate competitive market developments and ensure that technological developments in the eIAS market are not hindered. Option 2 will allow that easy-to-use and trustworthy eIAS products and services become more easily available, also in remote regions and/or MS for which currently not much eIAS services were developed.

Specific Objective 4: Through the development of eIAS services, Option 2 would in the end strengthen the competitiveness of the European industry and service sector. First of all, by using eIAS the European industry and services sector could innovate some steps of their internal and external processes. The development of on-line services could be positively impacted since the concept of "notified eID" would allow that the private sector could benefit from the important roll-out of eID already realised by many MS. Furthermore, the mutual recognition and acceptance of these eID would stimulate the development of on-line services, especially at the cross-border level, for both the public and private sector. Option 2 would remedy the current market fragmentation, creating an important harmonised outlet market for eIAS which could also attract investments from outside the EU. The possibility for MS to implement the Services Directive without compromising on security or trustworthiness would furthermore decrease the administrative barriers for setting up a business in any EU MS.

Specific Objective 5: The regulatory approach of Option 2 would finally also help ensure that all consumers can benefit from the advantage of (cross-border) eIAS services. Making eIAS a mass product would furthermore avoid that costs of implementation create a barrier to this participation. Finally, the cross-border and cross-sector use of notified eIDs could strongly reduce the complexity of eIAS (e.g. multiple devices, passwords, etc.), and remedy the main obstacles related to eIAS currently impeding the access to (on-line) services in rural areas. This view was also expressed in an expert survey organized between August and October 2011 by the SSEDIC Network[82]. Based on replies from 211 experts (comprising representatives of the IT & Telecoms sector, as well as public sector representatives, consultants and academics/researchers), 88.6% of respondents agreed that “there should be a clear common legal framework for the use of eIDs at the European and even international level”, and 77.1% of respondents agreed that “digital identities should be subject to EU regulation”[83]. Thus, this position has clear support among stakeholders.

Coherence of Option 2:

Option 2 is to a very large extent contribution to the achievement of the overarching objectives of EU policy (cf. EU2020 Strategy, DAE, Single Market Act and the Roadmap to Stability and Growth) as presented in 1.2.

5.1.4. Assessment of Option 3: Expansion to incorporate certain related trust services

Option 3 further expands the legal framework for trust services to include certain related trustservices: time stamping, electronic seals, long-term preservation of information, certified e-document delivery, admissibility of electronic documents and website authentication.

Indeed, a strong interconnection between e-signature, eID and related trust services is required in order to create a trusted environment. The implementation of provisions on related trust services would have a positive impact on the legal recognition of a range of cross-border interactions. Indeed, in order to ensure the legal validity of certain electronic interactions in cross border scenarios (as at national level), the e-signatures that might be used are not the only relevant component.

These other components include the time and the duration of the interaction, its content, the channel of communication, and the participants themselves. Without certainty on the legal validity of all these components in case of conflict, businesses and citizens would remain reluctant to use the digital interactions as their natural way of interaction.

The Public Consultation also addressed this issue, asking respondents to indicate for which trust building services and credentials legal or regulatory measures should be considered at EU-level in order to ensure their cross-border use. This resulted in the following overview:

64,57% of respondents asked for provisions on certified electronic documents, 52.39% on time stamping, 51.67% on electronic seals, 46.65% on certified delivery of email, 45.69% on long term archiving and only 6,22% felt that no further services required any regulation (see table in annex 7). This shows a very wide support among stakeholders for the notion that greater efficiencies in the underlying processes could be achieved through a broader policy approach.

Each of these related trust services has multiple possible use cases, and will have advantages and drawbacks that might not be shared with other related trust services. Therefore, in the section below, we will first briefly examine each related trust service separately, before assessing the option as a whole.

Selected individual related trust services 1. Qualified time stamps and time stamping services are required to introduce a non disputable time stamp on a signed document which serves as a proof that it existed at a point-in-time and that it has not changed since then. Example of use case: somebody has