Proposal for a European Parliament and Council Directive on a common framework for electronic signatures
Date: 1998-05-13
Institutions: European Commission
Subjects: approximation of laws, commercial transaction, data protection, electronic mail, information network

COMMISSION OF THE EUROPEAN COMMUNITIES 

•& 

ft 
ft ft 
ft ft 

^ f t^ 

Brussels, 13.05.1998 
COM(1998) 297 final 

98/0191 (COD) 

Proposal for a 
EUROPEAN PARLIAMENT AND COUNCIL DIRECTIVE 

on a common framework for electronic signatures 

(presented by the Commission) 

EXPLANATORY  MEMORANDUM 

I. 

BACKGROUND 

Open  networks  such  as  the  Internet  are  of  increasing  importance  for  world-wide 
communication.  They  offer  the possibility  of interactive  communication  between  parties 
who  may  not  have  pre-established  relationships.  They  offer  new  business  opportunities 
by creating tools to strengthen  productivity  and reduce costs, as well  as new methods of 
reaching  customers.  Networks  are  being  exploited  by  companies  that  wish  to  take 
advantage  of  new ways of  doing  business  and  new means  of working,  such  as telework 
and  shared  virtual  environments. Government  departments  are also using these  networks 
in their  interactions  with companies  and with  citizens. Electronic commerce presents the 
European Union with an excellent opportunity to advance its economic integration. 

In  order  to  make  best  use  of  these  opportunities,  a  secure  environment  with  respect  to 
electronic  authentication  is  needed.  Several  different  methods  exist  to  sign  documents 
electronically  varying  from  very  simple  methods  (e.g.  inserting  a  scanned  image  of  a 
hand-written  signature  in  a  word  processing  document)  to  very  advanced  methods 
(e.g. digital  signatures  using  "public  key cryptography").  Electronic  signatures  allow the 
recipient  of  electronically  sent  data  to  verify  the  origin  of  the  data  (authentication of 
data source)  and  to  check  that  the  data  are  complete  and  unchanged  and  thereby 
safeguard  their integrity (integrity of data). 

Verification  of  the  authenticity  and  integrity  of  data  does  not  necessarily  prove  the 
identity of the signatory who creates the electronic signatures. For instance, how does the 
recipient  of  a  message  know  that  the  sender  is  really  the  one  he  claims  to  be?  The 
recipient  may  therefore  wish  to  obtain  more  reliable  information  on  the  identity  of  the 
signatory.  Such  information  can  be  given  by the  signatory  himself,  issuing  the  recipient 
with satisfactory  proof  Another way is to have it confirmed  by a third party (e.g. a person 
or  institution  mutually  trusted  by  both  parties).  In  the  context  of  this  Directive,  these 
third parties are called certification service providers. 

In  its  Communication  on  "A  European  Initiative  in  Electronic  Commerce1"  of 
16 April  1997 directed  to  the  European  Parliament,  the  Council,  the  Economic  and 
Social Committee and the Committee of the Regions, the Commission recognized  digital 
signatures  as  an  essential  tool  for  providing  security  and  developing  trust  on  open 
networks.  The  Bonn  Ministerial  Declaration2  also  identified  the  need  for  digital 
signatures as a key issue for electronic commerce. 

in  Electronic  Communication 

As a  first  step, the  Commission  presented  a Communication  on "Ensuring  Security  and 
Trust 
for 
Digital  Signatures  and  Encryption"3,  to  the  European  Parliament,  the  Council,  the 
Economic  and  Social  Committee  and  the Committee  of the Regions, which  outlined  the 
need  for  a coherent  approach  in this field.  On  1 December  1997, the Council  welcomed 
to  submit  a  proposal  for  a 
the  Communication  and 
European Parliament  and  Council  Directive  on  digital  signatures  as  soon  as  possible. 

-  Towards  a  European 

the  Commission 

framework 

invited 

1  COM(97)  157 final,  16.4.1997. 
2 

Puropean  Ministerial  Conference  "Global  Information  Networks:  Realizing  the  Potential",  Bonn, 
6-8 July  1997. 

1  COM(97) 503 final, 8.10.1997. 

Following  the  publication  of  the  Communication  and  as  a  result  of  meetings 
the 
with  Member  States,  with 
European cryptography industry, and of the Copenhagen international expert hearing4, the 
Commission received  input from  the various parties involved. The following  conclusions 
can be drawn from the information  collected: 

the  private  sector,  notably 

representatives  of 

1. 

2. 

3. 

4. 

5. 

6. 

7. 

The increasing legislative activity in this area in several Member States emphasize 
the urgent  need  for  a harmonized  legal  framework  at the  European  level  so as to 
avoid 
the 
Internal Market. 

the  development  of  serious  obstacles 

the  functioning  of 

to 

While there is much discussion and work on digital  signature technologies  which 
employ  public-key  cryptography,  a  Directive  at  the  European  level  should  be 
technology-neutral  and should not focus only on these kinds of signatures. Since a 
variety  of  authentication  mechanisms  is  expected  to  develop,  the  scope  of  this 
Directive should be broad enough  to cover a spectrum  of "electronic  signatures", 
which  would  include digital  signatures  based  on public-key  cryptography  as well 
as other means of authenticating data. 

In order to ensure the functioning  of the  Internal  Market  and  to  support  the  rapid 
development of the market in terms of user demand and technological  innovation, 
prior  authorization  has  to  be  avoided.  As  a  means  to  gain  the  confidence  of 
consumers,  voluntary  accreditation  schemes  for  certification  service  provider 
aiming at providing enhanced  levels of security  is considered  to be useful.  As  far 
as  such  measures  are  required  by  the  market,  they  could  give  a  clearer  or  more 
predictable  level  of  legal  security  for  both  the  certification  service  provider  and 
the consumer. 

Electronic  signatures  used  within  closed  groups,  for  example,  where  contractual 
relationships  already  exist,  should  not  automatically  fall  within  the  scope  of  this 
Directive. Contractual freedom  should prevail in such a context. 

Ensuring legal recognition  - in particular  across borders - of electronic  signatures 
and  of certification  services  is regarded  as the most  important  issue  in this  area. 
This  involves  clarifying  the  essential  requirements  for  certification  service 
providers, including their liability. 

Industry  is  supposed  to  take  the  lead  with  standardization  bodies  in  developing 
internationally  agreed  standards for  electronic  signatures. These  standards  should 
focus  on  establishing  an  open  environment  for  interoperable  products  and 
services. The role of the Commission will be to support this process. 

At  the  international  level,  many  activities  and  discussions  are  underway.  The 
United  Nations  Commission  on  International  Trade  Law  (UNCITRAL)  has 
adopted a Model  Law on Electronic Commerce and has initiated  subsequent work 
rules  on  digital  signatures.  The 
aimed  at 
Organization  for  Economic  Cooperation  and  Development  (OECD)  also  has 
work  underway in this area, following  upon its  1997 Guidelines for  Cryptography 
Policy. Other international  organizations, including the World Trade  Organization 
issues.  These  ongoing 
(WTO),  have  also  become 

the  preparation  of  uniform 

in  related 

involved 

4 

International  Hearing, Copenhagen, 23-24 April  1998. 

3 

developments  should  be  taken  into  account  in  the  implementation  of  a  legal 
framework  at the European level. 

II. 

NEED FOR  HARMONIZATION 

Several  Member  States  have  already  started  detailed  legislative  initiatives  related  to 
electronic signatures: 

Member State 

Status of legislative initiatives 

Austria 

Preparatory work 

Belgium 

•  Telecommunications  law:  voluntary  prior  declaration  scheme  for 

service providers; 

•  Drafting  of law on certification  services related to digital signatures; 
•  Drafting  of  law  amending  the  Civil  Code  with  regard  to  electronic 

evidence; 

•  Drafting  of law on the use of digital signatures in social security and 

Denmark 

public health. 

law  on 
Drafting  of 
digital communications. 

the 

secure 

and 

efficient 

use  of 

France 

•  Telecommunication  Law (Authorization and Exemption Decrees): 

=> supply  of  electronic  signature  products  and  services  subject  to 

information  procedure; 

=>use,  import  and  export  of  electronic  signature  products  and 

services free. 

•  Legislation concerning the use of digital signatures in social security 

and public health. 

Finland 

•  Drafting  of  law  on  the  electronic  exchange  of  information  in 

administration  and administrative judicial procedures; 

Germany 

Italy 

•  Drafting  of  law  on  the  status  of the  Population  Register  Centre  as 

provider of certification  services. 

•  Digital  signature  law  and  ordinance  in  place:  conditions  under 
which  digital  signatures  are deemed  secure; voluntary  accreditation 
of service providers; 

•  Drafting  of catalogue of suitable security measures; 
•  Public  consultation  on  legal  aspects  of  digital  signatures  and 

digitally signed electronic documents currently ongoing. 

•  General  law on the reform  of the public  service  and  administrative 
simplification  in  place:  principle  of  legal  recognition  of  electronic 
documents; 

•  Decree  on  creation,  archiving  and  transmission  of  electronic 

documents and contracts; 

•  Decree on requirements on products and services under preparation; 
•  Decree  on  the  fiscal  obligations  arising  from  electronic  documents 

under preparation. 

Netherlands 

•  Voluntary accreditation scheme for service providers in preparation; 
of 
for 
•  Taxation 

electronic 

providing 

filing 

law 

the 

income statements; 

•  Draft  law amending the Civil Code under preparation. 

Spain 

•  Circulars  of  the  customs  department  on  the  use  of  electronic 

signatures; 

•  Resolution  in  the  field  of  social  security  regulating  the  use  of 

electronic means; 

•  Laws  and  circulars  in  the  field  of  mortgages,  taxation,  financial 
services and registration of enterprises allowing the use of electronic 
procedures; 

•  Budget  Law  1998  mandating  the  Mint  to  act  as  a  certification 

Sweden 

United 
Kingdom 

service provider. 

Preparatory work. 

•  Drafting  of  legislation  concerning 

licensing  of 
certification  service providers and the legal recognition  of  electronic 
signatures. 

the  voluntary 

The overview shows that the different  initiatives in the Member States lead to a divergent 
legal  situation. Although  Member  States seem  to  focus  on the  same  issues, in  particular 
the requirements on service providers and products, the condition  under which  electronic 
signatures  will  have  legal  effect,  and  the  structure  of  accreditation  schemes,  it  becomes 
apparent  that the relevant  regulations, or the lack  of them, will  be different  to the extent 
that the functioning  of the Internal Market in the field of electronic  signatures is going to 
be  endangered.  Divergent  rules  concerning  the  legal  effect  attributed  to  electronic 
signature are particularly  detrimental  to the further  development  of electronic  commerce 
and,  for  this  reason,  to  economic  growth  and  employment  in  the  Community.  Further 
uncertainty  results  from  different  liability  rules  and  the  risk  of  uncertain  jurisdiction 
concerning  liability  where  services  are provided  among  different  Member  States.  It  also 
seems  likely  that  Member  States  will  set  up  different  technical  conditions  under  which 
electronic signatures will be presumed secure. 

This diverging situation could create a serious barrier to communication  and business via 
open  networks  throughout  the  European  Community,  by  inhibiting  the  free  use  and 
supply  of  electronic  signature-related  services,  as  well  as  limiting  the  development  of 
new  economic  activities  linked  to  electronic  commerce.  The  objective  pursued  by  the 
attached  proposal  for  a  Directive  is  to  remove  obstacles,  in  particular  differences 
concerning  the  legal  recognition  of  electronic  signatures  and  restrictions  on  the  free 
movement  of  certification  services  and  products  between  the  Member  States.  Given  the 
objectives  pursued,  the  responsibility  for  the  planned  measure  falls  under  the  exclusive 
competence of the Community. The proposal for a Directive aims at "enabling" the use of 
electronic signatures within an area without internal frontiers  by focusing  on the essential 
requirements  for  certification  services  and  leaves  detailed  implementation  provisions  to 
the Member  States. It is consistent  with the Commission's  legislative  policy  with  regard 
to subsidiarity, proportionality and legislative simplification  necessary. 

Therefore,  the  Commission  proposes  Articles  57(2), 66  and  100A  as the  legal basis  for 
the  present  proposal.  For  reasons  of  proportionality,  the  Commission  considers  a 
Directive to be the appropriate form of a legal instrument. 

III.  AIM AND SCOPE OF THE DIRECTIVE 

1. 

2. 

3. 

4. 

5. 

This  Directive  aims  at  ensuring  the  proper  functioning  of the  Internal  Market  in 
the  field  of  electronic  signatures  by  creating  a harmonized  and  appropriate  legal 
framework  for  the  use  of  electronic  signatures  within  the  Community  and 
establishing  a  set  of  criteria  which  form  the  basis  for  legal  recognition  of 
electronic signatures. 

Global  electronic  communication  and  commerce  are  dependent  upon  the 
progressive  adaptation  of  international  and domestic laws to the rapidly  evolving 
technological  infrastructure.  Although  in  many  situations  analogies  to  existing 
rules  could  provide  satisfactory  solutions,  certain  adaptations  to  these  existing 
laws  in  the  light  of  new  technologies  may  be  required  in  order  to  avoid 
inappropriate  and undesirable  effects.  Although  digital  signatures produced  using 
cryptographic techniques are currently regarded  as an important type of electronic 
signature,  a  European  regulatory  framework  must  be  flexible  enough  to  cover 
other techniques that may be used to provide authentication. 

There  are  obvious  applications  of  electronic  signature  technology  in  closed 
environments, e.g. a company's local area network, or a bank system.  Certificates 
and electronic  signatures are also used for  authorization purposes, e.g. to access a 
private  account.  Within  the  constraints  of  national  law,  the  principle  of 
contractual  freedom  enables  contracting  parties  to  agree  among  themselves  the 
terms  and  conditions  under  which  they  do  business,  e.g.  accept  electronic 
signatures. In these areas, there is no evident need for regulation. 

Given  the  range  of  services  and  their  possible  application,  certification  service 
providers  should  be  allowed  to  offer  their  services  without  being  required  to 
obtain  prior authorization.  Service providers, however,  may wish to benefit  from 
the  legal  validity  of  the  associated  electronic  signatures  by  means  of  voluntary 
accreditation  schemes  linked  to  common  requirements.  Accreditation  should  be 
regarded  as  a  public  service  offered  for  certification  service  providers  which 
would  like to  provide  high-level  services. This  should  by no  means  imply that a 
non-accredited  service is automatically  less secure. 

A certification  service  provider  may  offer  a  wide  range  of  services.  The  present 
Directive  focuses  particularly  on  certification  services  in  connection  with 
electronic  signatures.  Certificates  can  be  used  for  a variety  of  functions  and  can 
contain different  pieces of information.  The information  can include  conventional 
identifiers  such  as  name, address, registration  number  or  social  security  number, 
VAT  or  tax  identification  number,  or  specific  attributes  of  the  signatory  for 
instance, their authority to act on behalf of a company, their credit worthiness, the 
existence of payment guarantees, or the holding of specific permits or licenses. As 
a  consequence,  a  variety  of  certificates  are  envisaged  for  a  range  of  uses. 
However,  a  legal  framework  is  mainly  needed  for  certillcates  to  enable  the 
authentication  of  the  electronic  signature  of  a  signing  individual.  The  present 
Directive  therefore  focuses  on  the  function  of  a  certificate  (called  "qualified 
certificate")  as a linkage to the civil identity or the role of a person. 

6. 

7. 

8. 

9. 

The legal effects  manifested  by electronic signatures are a key element in an open 
but  trustworthy  system  for  electronic  signatures.  The  application  of  the  present 
Directive  shall  also  contribute  to  a  harmonized  legal  framework  within  the 
Community  by  ensuring  that  an  electronic  signature  should  not  be  denied  legal 
validity,  effect  or  enforcement  solely  on  the  grounds  that  it  is  in  the  form  of 
electronic  data, not  based  upon a qualified  certificate  or upon  a certificate  issued 
by  an  accredited  certification  service  provider,  and  that  electronic  signatures 
should  be  legally  recognized  in  the  same  manner  as  hand  written  signatures. 
Moreover, national  evidence schemes should be opened  up and recognize the use 
of electronic signatures. 

The  legal  recognition  of  electronic  signatures  should  be  based  upon  objective, 
transparent,  non-discriminatory  and  proportional  criteria  and  not  to  be  linked  to 
any  authorization  or  accreditation  of  the  service  provider  involved.  Common 
requirements  for  certification  service  providers  would  support  the  cross-border 
recognition  of  signatures  and  certificates  within  the  European  Community.  The 
requirement  catalogue  shall  be  applicable  for  certification  service  providers, 
independent of the accreditation  model of the individual  Member  State. Since the 
future  technological  or  market  development  might  demand  adaptations,  the 
requirements  may  need  to  be  revised  from  time  to  time.  The  Commission  may 
propose revised sets of requirements on the basis of advice received in the  future. 

Common  liability  rules  would  support  the  trust-building  process  for  both 
consumers  and  business  that  rely  on  the  certificates,  and  service  providers,  and 
thus would promote the broad acceptance of electronic signatures. 

Cooperative  mechanisms  which  would  support  the  cross-border  recognition  of 
signatures  and  certificates  with  third  countries  are  important  to  the  development 
of  international  electronic  commerce.  In particular,  enabling  certification  service 
providers  within  the  Community  to  vouch  for  third-country  certificates  to  the 
same  extent  as  they  guarantee  for  their  own  certificates  could  facilitate 
cross-border services in a simple but efficient  way. 

Proposal for a 
EUROPEAN  PARLIAMENT AND COUNCIL DIRECTIVE 

on a common framework  for electronic signatures 

(Text with EEA relevance) 

THE 
EUROPEAN 
EUROPEAN  UNION, 

PARLIAMENT  AND 

THE  COUNCIL  OF 

THE 

Having  regard  to  the  Treaty  establishing  the  European  Community,  and  in  particular 
Article 57(2) and Articles 66 and  100A thereof, 

Having regard to the proposal from  the Commission5, 

Having regard to the opinion of the Economic and Social Committee6, 

Having regard to the opinion of the Committee of the Regions7, 

Acting in accordance with the procedure laid down in Article  189b of the Treaty8, 

(1)  Whereas on  16 April  1997 the Commission presented to the European Parliament, 
the  Council,  the  Economic  and  Social  Committee  and  the  Committee  of  the 
Region, a Communication on an European Initiative in Electronic Commerce9; 

(2)  Whereas 

on 

8  October  1997 

the 
European Parliament,  the  Council,  the  Economic  and  Social  Committee  and  the 
Committee  of  the  Regions,  a  Communication  on  Ensuring  security  and  trust  in 
electronic communication  - Towards a European framework  for digital  signatures 
and encryption10; 

the  Commission 

presented 

to 

(3)  Whereas  on  1 December  1997, the Council  invited  the Commission  to submit  as 
soon  as  possible  a  proposal  for  a  Directive  of  the  European  Parliament  and  the 
Council on digital signatures; 

(4)  Whereas  electronic  communication  and  commerce  necessitate  electronic 
signatures  and  related  services  allowing  data  authentication;  whereas  divergent 
to  legal  recognition  of  electronic  signatures  and  the 
rules  with  respect 
accreditation  of certification  service providers in the Member  States may create a 
significant  barrier  to  the  use  of  electronic  communications  and  electronic 

5  OJC 
6  OJC 
7  OJC 
8  OJC 
9  COM(97)  157 final. 
10  COM(97) 503 final. 

commerce  and  thus  hinder  the  development  of  the  Internal  Market;  whereas 
divergent  actions  in  the  Member  States  indicate  the  need  for  harmonization  at 
Community level; 

(5)  Whereas the interoperability of electronic signature products should be promoted; 
whereas,  in  accordance  with  Article  7a  of  the  Treaty,  the  Internal  Market  is  to 
comprise an area in which the free  movement  of goods is to be ensured;  whereas 
essential  requirements  specific 
to  electronic  signature  products  used  by 
certification  service  providers  must  be  met  in  order  to  ensure  free  circulation 
within the Internal Market and to build trust in electronic signatures; 

(6)  Whereas  the  rapid  technological  development  and  the  global  character  of  the 
Internet  necessitate  an  approach  which  is  open  to  various  technologies  and 
services  capable  of  authenticating  data  electronically;  whereas,  however, 
digital signatures  based  on  public-key  cryptography  are  currently  the  most 
recognized form of electronic signature; 

(7)  Whereas  the  internal  market  enables  certification  services  providers  to  develop 
their  cross-border  activities  with  a view  to  increasing  their  competitiveness,  and 
thus to offer  consumers  and business  new opportunities  to exchange  information 
and  to  trade  electronically  in  a  secure  way,  regardless  of  frontiers;  whereas  in 
order  to  stimulate  the  Community-wide  provision  of  certification  services  over 
open  networks,  certification  service  providers  should  in  general  be  free  to  offer 
their  services without  prior authorization;  whereas there  is no immediate  need  to 
ensure  the  free  circulation  of  certification  services  by harmonizing justified  and 
proportionate national restrictions on the provision of those services; 

(8)  Whereas  voluntary  accreditation  schemes  aiming  at  enhanced  level  of  service 
provision  may  offer  certification  service  providers  the  appropriate  framework  to 
develop  further  their  services  towards  the  levels  of  trust,  security  and  quality 
demanded  by  the  evolving  market;  whereas  such  schemes  should  encourage  the 
development  of  best  practice  among  certification  service  providers;  whereas 
certification  service  providers  should  be  left  free  to  adhere  to  and  benefit  from 
such  accreditation  schemes;  whereas  Member  States  should  not  prohibit 
certification  service providers from  operating outside such accreditation  schemes; 
whereas  it  should  be  ensured  that  accreditation  schemes  do  not  reduce 
competition  for  certification  services; whereas  it  is  important  to  strike  a  balance 
between consumer and business needs; 

(9)  Whereas  this  Directive  should  therefore  contribute  to  the  use  and  legal 
recognition  of electronic  signatures within  the Community;  whereas  a  regulatory 
framework  is not  needed  for  electronic  signatures  exclusively  used  within  closed 
systems; whereas the freedom  of parties to agree among themselves the terms and 
conditions under which they accept electronically  signed data should be respected 
to  the  extent  allowed  by  national  law;  whereas  this  Directive  is  not  intended  to 
harmonize  national  rules  concerning  contract  law, particularly  the  formation  and 
performance  of  contracts,  or  other  non-contractual 
requiring 
signatures;  whereas  for  this  reason  the  provisions  concerning  the  legal  effect  of 
to  formal  requirements 
electronic  signatures  should  be  without  prejudice 
prescribed  by national  law with  regard to the conclusion  of contracts  or the rules 
determining where a contract is concluded; 

formalities 

( 10)  Whereas  in order to contribute  to the general  acceptance  of electronic  signatures, 
an  electronic  signature  should  not  be  denied  legal  validity  solely  on the  grounds 
that  it  is  in  the  form  of  electronic  data,  not  based  upon  a qualified  certificate  or 
upon a certificate  issued by an accredited certification  service provider, or that the 
service  provider  who  has  issued  the  related  certificate 
is  from  another 
Member State;  whereas  electronic  signatures  which  are  related  to  a  trustworthy 
certification  service  provider  who  complies  with  the  essential  requirements 
should have the same legal effect  as hand written  signatures; whereas it has to be 
ensured that electronic  signatures can be used as evidence  in legal proceedings in 
all  Member  States; whereas the  legal  recognition  of  electronic  signatures  should 
be  based  upon  objective  criteria  and  not  be  linked  to  authorization  of  the 
service  provider  involved;  whereas  harmonized  rules  concerning  the  legal 
effect  of  electronic  signatures  will  preserve  a  coherent  legal  framework  across 
the Community; 

(11)  Whereas certification  service providers offering  certification  services to the public 
are subject to national liability rules; whereas differences  in the scope and content 
of  such  liability  rules  may  result  in  legal  uncertainty,  particularly  concerning 
third parties  relying  on  their  services;  whereas  such  uncertainty  will  be 
detrimental  to the development  of cross-border  trade  and  will  hamper the  proper 
functioning  of  the  Internal  Market;  whereas  harmonized  liability  rules  provide 
legal  security  and  predictability  for  both  certification  service  providers  and 
consumers;  whereas  such  rules  would  contribute  to  the  general  acceptance  and 
legal recognition of electronic signatures within the Community and consequently 
have a beneficial  effect  on the functioning  of the Internal Market; 

(12)  Whereas 

the  development  of 

international  electronic  commerce  requires 
those 
involve 
cross-border  mechanisms  which 
mechanisms  should  be developed  at a business  level; whereas  in order to  ensure 
interoperability  at  a  global 
level,  agreements  on  multilateral  rules  with 
third countries on mutual recognition of certification  services could be beneficial: 

third  countries;  whereas 

(13)  Whereas in order to stimulate electronic communication and electronic commerce 
by  ensuring  user  confidence,  Member  States  should  oblige  certification  service 
providers  to respect  data protection  legislation  and  individual  privacy and  should 
be required to provide certification  services also for pseudonyms at the request of 
the signatory; whereas national law should  lay down if and  under what conditions 
the  data  revealing  the  identity  of  the  data  subject  must  be  transferred  for 
investigation  of criminal  offences;  whereas  certification  service providers  should 
inform  users in advance of their conditions, in particular regarding the precise use 
of  their  certificates  and  limitations  of  their  liability,  in  writing  and  in  readily 
understandable language and using a durable means of communication; 

(14)  Whereas  for  the  purposes  of  the  application  of  this  Directive,  the  Commission 

should be assisted by a consultative Committee; 

10 

(15)  Whereas  in  accordance  with  the  principles  of  subsidiarity  and  proportionality  as 
set  out  in  Article  3b  of the  Treaty, the  objective  of  creating  a harmonized  legal 
framework  for  the  provision  of  electronic  signatures  and  related  services  cannot 
be  sufficiently  achieved  by  the  Member  States  and  can,  therefore,  be  better 
achieved  by  the  Community;  whereas  this  Directive  confines  itself  to  the 
minimum required in order to achieve that objective  and does not go beyond what 
is necessary for that purpose, 

HAVE ADOPTED THIS DIRECTIVE: 

Article 1 
Scope 

This Directive covers the legal recognition of electronic signatures. 

It does not cover other aspects related to the conclusion and validity of contracts or other 
non-contractual formalities requiring signatures. 

It  establishes  a  legal  framework  for  certain  certification  services  made  available  to 
the public. 

Article 2 
Definitions 

For the purpose of this Directive: 

(1) 

"electronic  signature"  means  a  signature  in  digital  form  in,  or  attached  to,  or 
logically  associated  with,  data  which  is  used  by  a  signatory  to  indicate  his 
approval of the content of that data and meets the following  requirements: 

(a) 

it is uniquely linked to the signatory, 

(b) 

it is capable of identifying  the signatory, 

(c) 

(d) 

it  is  created  using  means  that  the  signatory  can  maintain  under  his  sole 
control, and 

it  is  linked  to  the  data  to  which  it  relates  in  such  a  manner  that  any 
subsequent alteration of the data is revealed. 

(2) 

"signatory" means a person who creates an electronic signature; 

(3) 

(4) 

"signature  creation  device"  means  unique  data,  such  as  codes  or  private 
cryptographic keys, or a uniquely configured  physical  device which is used by the 
signatory in creating an electronic signature; 

"signature  verification  device"  means  unique  data,  such  as  codes  or  public 
cryptographic  keys,  or  a  uniquely  configured  physical  device  which  is  used  in 
verifying the electronic signature; 

H 

(5) 

(6) 

(7) 

1. 

2. 

3. 

4. 

1. 

"qualified  certificate"  means  a  digital  attestation  which  links  a  signature 
verification  device to a person, confirms  the identity of that person and meets the 
requirements laid down in Annex I; 

"certification  service  provider"  means  a  person  who  or  an  entity  which  issues 
certificates or provides other services related to electronic signatures to the public; 

"electronic  signature  product"  means  hardware  or  software,  or  relevant 
components  thereof,  which  are  intended  to  be  used  by  a  certification  service 
provider for the provision of electronic signature services. 

Article 3 
Market access 

Member  States  shall  not  make  the  provision  of  certification  services  subject  to 
prior authorization. 

Without prejudice  to the provisions of paragraph  1, Member  States may introduce 
or  maintain  voluntary  accreditation  schemes  aiming  at  enhanced  levels  of 
certification  service  provision.  All  conditions  related  to  such  schemes  must  be 
objective,  transparent,  proportionate  and non-discriminatory.  Member  States may 
not limit the number of certification  service providers for reasons which fall under 
the scope of this Directive. 

The  Commission  may,  in  accordance  with  the procedure  laid  down  in  Article  9, 
establish  and  publish  reference  numbers  of  generally  recognized  standards 
for  electronic 
the 
in 
European Communities.  Member  States  shall  presume  compliance  with  the 
requirements  laid  down  in  point  (e)  of  Annex  II  when  an  electronic  signature 
product meets those standards. 

the  Official  Journal 

signature 

products 

of 

Member  States  may  make  the  use  of  electronic  signatures  in  the  public  sector 
subject  to  additional  requirements.  Such  requirements  shall  be  objective, 
transparent,  proportionate,  and  non-discriminatory,  and  shall  only  relate  to  the 
specific characteristics of the application concerned. 

Article 4 
Internal Market principles 

Each  Member  State  shall  apply  the  national  provisions  it  adopts  pursuant  to  this 
Directive  to  certification  service  providers  established  on  its territory  and  to  the 
services  they  provide.  Member  States  may  not  restrict  the  provision  of 
certification  services  which  originate  in  another  Member  State  in  the  fields 
covered by this Directive. 

2. 

Member  States shall  ensure that electronic  signature products which comply with 
this Directive are permitted to circulate freely  in the Internal  Market. 

12 

Article 5 
Legal  effects 

1. 

2. 

Member  States shall ensure that an electronic  signature is not denied  legal  effect, 
validity and enforceability  solely on the grounds that the signature is in electronic 
form, or is not based upon a qualified  certificate,  or is not based upon a  certificate 
issued by an accredited certification  service provider. 

Member  States  shall  ensure  that  electronic  signatures  which  are  based  on  a 
qualified  certificate  issued  by  a  certification  service  provider  which  fulfils  the 
requirements set out in Annex II are, on the one hand, recognized as satisfying  the 
legal  requirement  of  a  hand  written  signature,  and  on  the  other,  admissible  as 
evidence in legal proceedings in the same manner as hand written signatures. 

Article 6 
Liability 

1. 

Member  States  shall  ensure that, by issuing  a qualified  certificate,  a  certification 
service  provider 
the 
certificate  for: 

is  liable  to  any  person  who  reasonably  relies  on 

(a) 

(b) 

(c) 

(d) 

accuracy of all  information  in the qualified  certificate  as from the date on 
which  it  was  issued,  unless  the  certification  service  provider  has  stated 
otherwise in the certificate; 

compliance  with  all  the  requirements  of  this  Directive  in  issuing  the 
qualified  certificate; 

assurance that the person  identified  in the qualified  certificate  held, at the 
time  of  the  issuance  of  the  certificate,  the  signature  creation  device 
corresponding  to  the  signature  verification  device  given  or  identified  in 
the certificate; 

in  cases  where  the  certification  service  provider  generates  the  signature 
creation  device  and  the  signature  verification  device,  assurance  that  the 
two devices function  together in a complementary  manner. 

2. 

3. 

4. 

Member  States  shall  ensure  that  a certification  service  provider  is  not  liable  for 
errors in the information  in the qualified  certificate  that  has been provided  by the 
person to whom the certificate  is issued, if it can demonstrate that  it has taken  all 
reasonably practicable measures to verify  that  information. 

Member  States  shall  ensure  that  a  certification  service  provider  may  indicate  in 
the qualified  certificate  limits on the uses of a certain certificate.  The  certification 
service  provider  shall  not  be  liable  for  damages  arising  from  a contrary  use  of a 
qualified  certificate  which includes limits on its uses. 

Member  States  shall  ensure  that  a certification  service  provider  may  indicate  in 
the  qualified  certificate  a  limit  on  the  value  of  transactions  for  which  the 
certificate  is  valid.  The  certification  service  provider  shall  not  be  liable  for 
damages in excess of that value limit. 

13 

5. 

The  provisions  of  paragraphs  1  to  4  shall  be  without  prejudice 
Council  Directive 93/13/EEC11 

to 

Article 7 
International aspects 

1. 

Member  States  shall  ensure  that  certificates  issued  by  a  certification  service 
provider  established  in  a  third  country  are  recognized  as  legally  equivalent  to 
certificates 
issued  by  a  certification  service  provider  established  within 
the Community: 

(a) 

(b) 

(c) 

if  the  certification  service  provider  fulfils  the  requirements  laid  down  in 
this  Directive  and  has  been  accredited  in  the  context  of  a  voluntary 
accreditation scheme established by a Member State; or 

if  a  certification  service  provider  established  within  the  Community, 
which  fulfils  the  requirements  laid  down  in  Annex  II  guarantees  the 
certificate  to the same extent as its own certificates; or 

if  the  certificate  or  the  certification  service  provider  is  recognized  under 
the regime of a bilateral or multilateral agreement between the Community 
and third countries or international organizations. 

In  order  to  facilitate  cross-border  certification  services  with  third  countries  and 
legal  recognition  of  electronic  signatures  originating  in  third  countries,  the 
Commission  will  make  proposals  where  appropriate  to  achieve  the  effective 
implementation  of  standards  and 
to 
certification  services.  In particular  and  where  necessary,  it will  submit  proposals 
to  the  Council  for  appropriate  mandates  for  the  negotiation  of  bilateral  and 
multilateral  agreements  with  third  countries  and  international  organizations.  The 
Council shall decide by qualified  majority. 

international  agreements  applicable 

Article 8 
Data protection 

Member  States  shall  ensure  that  certification  service  providers  and  national 
bodies responsible  for  accreditation  or supervision  comply  with the  requirements 
laid  down  in  Directives  95/46/EC12  and  97/66/EC13  of the  European  Parliament 
and of the Council. 

Member  States  shall  ensure  that  a  certification  service  provider  may  collect 
personal  data  only  directly  from  the  data  subject  and  only  in  so  far  as  it  is 
necessary  for  the purposes  of issuing  a certificate.  The data  may not be collected 
or processed for other purposes without the consent of the data subject. 

2. 

1. 

2. 

11  OJL95,  21.4.1993, p. 29. 
12  OJL  281, 23.11.1995, p.  31. 
13  OJL  24, 30.1.1998, p. 1. 

14 

3. 

4. 

Member  States  shall  ensure  that,  at  the  signatory's  request,  the  certification 
service  provider  indicates  in  the  certificate  a  pseudonym  instead  of  the 
signatory's name. 

Member  States  shall  ensure  that,  in  the  case  of  persons  using  pseudonyms,  the 
certification  service  provider  shall  transmit  the  data  concerning  the  identity  of 
those persons to public authorities  upon request  and with the consent  of the  data 
subject.  Where  according  to  national  law  the  transfer  of  the  data  revealing  the 
identity of the data  subject  is necessary  for the  investigation  of criminal  offences 
relating to the use of  electronic  signatures  under  a pseudonym,  the transfer  shall 
be  recorded  and  the  data  subject  informed  of the  transfer  of  the  data  relating  to 
him as soon as possible after the investigation has been completed. 

Article 9 
Committee 

The  Commission  shall  be  assisted  by  a  Committee,  called  the  "Electronic  Signature 
Committee" (hereinafter  referred to as "the Committee"), of an advisory nature composed 
of  the  representatives  of  the  Member  States  and  chaired  by  the  representative  of 
the Commission. 

The  representative  of  the  Commission  shall  submit  to  the  Committee  a  draft  of  the 
measures  to  be  taken.  The  Committee  shall  deliver  its  opinion  on  the  draft,  within  a 
time-limit  which  the  Chairman  may  lay down  according  to the urgency  of the  matter,  if 
necessary by taking a vote. 

The opinion  shall be recorded  in the minutes; in addition, each Member  State  shall  have 
the right to ask to have its position recorded in the minutes. 

The  Commission  shall  take  the  utmost  account  of  the  opinion  delivered  by  the 
Committee.  It shall  inform  the  Committee  of  the manner  in  which  its opinion  has  been 
taken into account. 

Article 10 
Consultation of the Committee 

The Committee shall be consulted, where necessary, on the requirements for  certification 
service  providers  laid  down  in  Annex  II  and  on  generally  recognized  standards  for 
electronic signature products pursuant to Article 3(3). 

Article 11 
Notification 

1. 

Member States shall supply the Commission with the following  information: 

(a) 

information  on  voluntary  national  accreditation  regimes,  including  any 
additional requirements pursuant to Article 3(4); 

15 

(b) 

(c) 

the  names  and  addresses  of 
accreditation and supervision; and 

the  national  bodies  responsible  for 

the  names 
and 
service providers. 

addresses  of 

accredited  national 

certification 

2. 

Any  information  supplied  under  paragraph  1  and  changes  in  respect  of  that 
information  shall be notified  by the Member States as soon as possible. 

Article 12 
Review 

1. 

2. 

The Commission shall review the operation of this Directive and report thereon to 
the European Parliament and to the Council by 31 December 2002 at the latest. 

The  review  shall, inter alia, assess  whether  the scope  of the  Directive  should  be 
modified  taking account of technological  and legal developments. The report shall 
in  particular  include  an  assessment,  on  the  basis  of  the  experience  gained,  of 
aspects of harmonization. The report shall be accompanied, where appropriate, by 
complementary  legislative proposals. 

Article 13 
Implementation 

1. 

Member  states  shall  bring  into  force  the  laws,  regulations  and  administrative 
provisions  necessary  to  comply  with  this  Directive  by  31  December  2000  at  the 
latest. They shall immediately inform the Commission thereof. 

When  Member  States  adopt  these  provisions,  these  shall  contain  a  reference  to 
this  Directive  or  shall  be  accompanied  by  such  reference  at  the  time  of  their 
official  publication.  The  procedure  for  such  reference  shall  be  adopted  by 
Member States. 

2. 

Member  States  shall  communicate  to  the  Commission  all  provisions  of  national 
law which they adopt  in the field governed  by this  Directive  and  in related fields 
and a correlation table between this Directive and the national provisions adopted. 

Article 14 
Entry into force 

This Directive shall entry  into  force on the twentieth day following  that of its publication 
in the Official Journal of the European Communities. 

16 

Article 15 
Addressees 

his Directive is addressed  to the Member States. 

Done at Brussels, 

For the European  Parliament 
The President 

For the Council 
The President 

17 

ANNEX 1 

Requirements for  qualified  certificates 

Qualified  certificates  must  contain: 

(a) 

the  identifier  of  the certification  service  provider  issuing  it; 

(b)  the  unmistakable  name  of  the  holder  or  an  unmistakable  pseudonym  which  shall  be 

identified  as  such; 

(c)  a specific  attribute  of  the  holder  such  as, the address, the  authority  to  act  on  behalf  of 
a  company,  the  credit-worthiness,  VAT  or  other  tax  registration  numbers,  the 
existence  of  payment  guarantees or specific  permits or  licences; 

(d)  a  signature  verification  device  which  eorresponds  to  a  signature  creation  device 

under  the control  of  the  holder; 

(e)  beginning  and  end  of  the operational  period  of  (he  certificate; 

(I) 

the  unique  identity  code  of the  certificate; 

(g)  the electronic  signature  of the certification  service  provider  issuing  it; 

(h)  limitations  on  the  scope of  use of the certificate,  if applicable;  and 

(i) 

limitations  on  the  eertilication  service  provider's  liability  and  on  the  value  o( 
transactions  for  which  the certificate  is valid,  i(  applicable. 

18 

ANNEX  II 

Requirements  for certification  service  providers 

Certification  service  providers  must: 

(a)  demonstrate  the reliability  necessary  for offering  certification  services; 

(b)  operate a prompt  and  secure  revocation  service; 

(c)  verify  by  appropriate  means  the  identity  and  capacity  to  act  of  the  person  to  which  a 

qualified  certificate  is  issued; 

(d)  employ  personnel  which  possesses 

the  expert  knowledge,  experience,  and 
qualifications  necessary  for  the  offered  services,  in  particular  competence  at  the 
familiarity 
in  electronic  signature 
managerial 
with  proper  security  procedures; 
they  must  also  exercise  administrative  and 
management  procedures  and  processes  that  are  adequate  and  which  correspond  to 
recognized  standards; 

technology  and 

level,  expertise 

(e)  use  trustworthy  systems,  and  use electronic  signature  products  that  ensure  protection 
against  modification  of  the  products  so  that  they  can  not  be  used  to  perform 
functions  other  than  those  for  which  they  have  been  designed;  they  must  also  use 
electronic  signature  products  that  ensure  the  technical  and  cryptographic  security  oï 
the certification  processes  supported  by the  products; 

(I) 

take  measures  against  forgery  of  certificates,  and,  in  cases  where  the  certification 
service  provider  generates  private  cryptographic  signature  keys,  guarantee 
the 
confidentiality  during  the  process of generating  those  keys; 

(g)  maintain  sufficient  financial  resources  to operate  in conformity  with  the  requirements 
laid  down  in  this  Directive,  in  particular  to  bear  the  risk  of  liability  for  damages,  for 
example,  by obtaining  an  appropriate  insurance; 

(h)  record  all  relevant  information  concerning  a  qualified  certificate  for  an  appropriate 
period  of  time,  in  particular  In  provide  evidence  of  certification  for  the  purposes  o( 
legal  proceedings.  Such  recording  may  be done  electronically; 

(i)  not  store  or  copy  private  cryptographic  signature  keys  of  the  person  to  whom  the 
certification  service  provider  offered  key  management  services  unless  that  person 
explicitly  asks  for  it; 

(j) 

inform  consumers  before  entering  into  a  contractual  relationship  in  writing,  using 
readily  understandable  language  and  a  durable  means  of  communication,  of  the 
precise  terms  and  conditions  for  the  use  of  the  certificate,  including  any  limitations 
on  the  liability,  the  existence  of  a  voluntary  accreditation  and  the  procedures  for 
complaints  and  dispute  settlement. 

ISSN 0254-1475 

COM(98) 297 final 

DOCUMENTS 

EN 

15  06  10  01 

Catalogue  number  :  CB-C0-98-336-EN-C 

ISBN  92-78-36440-1 

Office  loi Official  Publications  of  the  European  Communities 

I .-2t)8.'S  I .uxembourg 

20