Opinion of the Economic and Social Committee on the 'Proposal for a European Parliament and Council Directive on a common framework for electronic signatures'
Date: 1998-12-02
Institutions: European Economic and Social Committee
Subjects: Community certification, ESC opinion, contract, distance selling, electronic mail, trade regulations

15.2.1999

EN

Official Journal of the European Communities

C 40/29

countries, the Commission proposes to introduce pro-
cedures, administered by the Commission, whereby
defaulting states would be excluded from the preferential
arrangements for a period of three or six months. The
Committee has reservations over a transfer of further
powers to the Commission, but these reservations
are outweighed by the more rapid decision-making
processes. There is, however, in the Committee’s view,
an urgent need for appropriate machinery to protect

the vital
interests of the importers concerned. The
Committee therefore recommends drawing attention in
the Official Journal of the European Communities, at
an early juncture, to any doubts which may arise as
regards the proper application of preference rules to
individual states. Agreements concluded before the
publication of such information should, of course, be
unaffected by any action which may be taken.

Brussels, 2 December 1998.

The President

of the Economic and Social Committee

Beatrice RANGONI MACHIAVELLI

Opinion of the Economic and Social Committee on the ‘Proposal for a European Parliament
and Council Directive on a common framework for electronic signatures’

(1999/C 40/10)

On 30 July 1998, the Council decided to consult the Economic and Social Committee, under
Article 100a of the Treaty establishing the European Community, on the above-mentioned
proposal.

The Section for the Single Market, Production and Consumption, which was responsible for
preparing the Committee’s work on the subject, adopted its opinion on 28 October 1998. The
rapporteur was Mr Burani.

At its 359th plenary session (meeting of 2 December 1998) the Economic and Social Committee
unanimously adopted the following opinion.

1.

Introduction

1.1.
The Commission proposal for a directive on a
legal framework for electronic signatures is the concrete
follow-up to the Communication entitled ‘Ensuring
security and trust in electronic communication —
Towards a European framework for digital signatures
and encryption’ (1).

1.2.
The Communication highlighted a situation call-
ing for the attention of the European authorities,
namely that several Member States have adopted, or are
adopting, different approaches to the regulation of
electronic signatures. This lack of mutual recognition
may well fragment the single market in electronic
commerce and on-line services in the European Union.
There is therefore an urgent need to establish a common

framework which meets two main requirements — to
create a precise legal framework, but one that is flexible
enough to keep up with the ongoing march of technology.

1.3.
The Economic and Social Committee agreed
with the Commission’s views (2) and proposed that
the regulatory framework observe the principles of
self-regulation and subsidiarity, albeit within the precise
limits of a minimum common legislation. Furthermore,
in its remarks on a later Commission Communication,
entitled ‘Globalization and the Information Society —
coordi-
The need for
nation’ (3), the Committee pointed out that the harmon-
ization of European legislation with the rest of the world
— fundamental for the security of electronic commerce
which, by its very nature, knows no bounds — is
progressing too slowly because there are too many
uncoordinated initiatives.

strengthened international

(1) COM(97) 503 final, 8.10.1997.

(2) OJ C 157, 25.5.1998.
(3) OJ C 284, 14.9.1998.

C 40/30

EN

Official Journal of the European Communities

15.2.1999

1.4.
The Commission’s decision to propose a directive
represents a step in the right direction, not least because
it focuses on flexibility — a necessity in view of any
kind of international coordination.

2. General comments

2.4.
As regards placing the European regulations in
a global context, the Commission observes that ‘many
activities and discussions are underway’ (1) and men-
tions, inter alia, the UNCITRAL, OECD and WTO
initiatives. As the Committee has already pointed out (2),
such initiatives may be commendable, but they present
a concrete risk of overlapping between the institutions,
and of duplication, or — even worse — of conflict,
between the various sets of rules. Ultimately, this would
lead to red tape, delays and expense for the taxpayer.
The Committee regrets to note that, in the attempt to
kill two birds with one stone, global institutions are
producing the opposite effect and creating confusion
and uncertainty.

2.1.
Electronic signatures allow the recipients of
electronically-sent data to check the origin of the data
(authenticity) and to verify that
the original data
are complete and unaltered (integrity). Checking the
authenticity and integrity of the data does not necessarily
prove the identity of the person sending the electronic
signature; it is therefore necessary to obtain confirmation
from third parties, known as certification service pro-
viders. The use of this signature certification system is
therefore an essential way of reassuring the contracting
parties and building confidence in electronic commerce.

3. Specific comments

3.1. Article 1

2.2.
In order to ensure mutual recognition of the
principles of legal certainty underpinning the certifi-
cation of electronic signatures, the Commission has been
guided by concepts that are consistent with a continually
evolving situation:

— the regulations are neutral from a technical point of
view and are open to authentication mechanisms
other than public-key cryptography, as it is quite
possible that new systems will emerge;

— Member States should refrain from adopting prior
authorization systems for certification service pro-
viders, although voluntary accreditation schemes
could prove to be useful;

— the directive concerns only electronic signatures on
messages exchanged on open networks; in the case
of closed networks, it will be up to each individual
service provider to decide whether or not to comply;

— as electronic signatures must be legally recognized,
basic requirements and responsibilities for service
providers must be specified.

2.3.
The Committee agrees with this general
approach, which is based on free-market principles, but
believes that not enough consideration has been given
to the protection of users. It therefore reserves the right
to make comments or suggestions during its examination
of the Commission document.

The aim of the directive is to establish a legal framework
for certification services that are available to the public,
in other words to make electronic signatures easier to
use and to ensure their legal recognition. The directive
does not, however, cover other aspects related to the
conclusion and validity of contracts. In the light of this
article and of the clarifications in the tenth ‘whereas’
clause, the scope of the directive is restricted to open
systems; for closed systems the Commission leaves it up
to the parties to decide the conditions under which
electronic signatures are to be accepted and recognized.

3.1.1.
The Committee has some reservations on this
point: while the respect for contractual freedom is
laudable, it has to be said that several closed systems
are available to an ever wider public which is not
necessarily aware of the rules governing each individual
system. A closed system may have the option of
complying with the directive, but the Committee won-
ders whether it might be wiser — in the interest of the
users and managers of such systems — to extend the
scope of the directive to closed systems that are available
to the public.

3.2. Article 3(1) and 3(2)

Member States may not make the provision of certifi-
cation services subject to prior authorization; they may,
however, introduce or maintain voluntary accreditation
schemes, without limiting the number of service pro-
viders.

(1) COM(1998) 297 final, point 7.
(2) OJ C 284, 14.9.1998.

15.2.1999

EN

Official Journal of the European Communities

C 40/31

3.2.1.
The Committee recommends that careful con-
sideration be given to the scope of these provisions. The
act of certification is valid not only for the parties but
also, if necessary, in respect of third parties. Without
prejudice to the voluntary nature of the request for
accreditation, measures should be introduced to enable
a clear distinction to be made between documents
certified by accredited service providers and those
certified by unaccredited providers; this point will be
discussed in more detail
later. Article 5(2) should
stipulate that electronic signatures admissible as evidence
in legal (and extrajudicial) proceedings may only prevail
against third parties if they are backed up by a certificate
issued by an accredited service provider.

The current situation does not give particular
3.2.2.
cause for concern; however, legislation cannot ignore
unpredictable future developments. If authentication
techniques are ‘trivialized’, the few, well-known pro-
viders around today could multiply. While it is acceptable
that the number of certification providers be unre-
stricted, it would be inadvisable to exempt them from a
preliminary check and accreditation. In the interest of
consumers and third parties,
it should therefore be
stipulated that, in the case of open systems or closed
systems available to the public, the ‘requirements for
certification service providers’ listed in Annex II be
monitored by a public authority.

3.2.3.
Accreditation of service providers by the public
authorities should be subject to fulfilment of the require-
ments listed in Annex II. This is a necessary condition,
but it is not sufficient. Periodic checks should be made
to ensure the continuing fulfilment of the requirements.
Public authorities cannot evade responsibility — once
regulations have been adopted, the authorities must
guarantee they will be respected.

3.3. Article 3(4)

States that Member States may make the use of electronic
signatures in the public sector subject to additional
requirements.

3.3.1.
The Committee endorses this, but feels that it
might be advisable to go a step further by obliging those
Member States that recognize the validity of electronic
signatures in the private sector to accept them also in
the public sector. If public authorities — who have the
duty of guaranteeing the security of legal institutions
and protecting their citizens — take on the responsibility
of recognizing the legal validity of an electronic signature

in private exchanges of documents, there is no reason
why they cannot do the same with documents exchanged
with the public administration, albeit with ‘additional
requirements’.

3.4. Article 4

Regarding the respect of the single market rules, this
article provides that Member States may not restrict the
provision of certification services originating in other
Member States.

In this regard, the Committee points out that
3.4.1.
the above requirement is indeed consistent with single
market principles, but it does not protect the public
from the provision of services by unaccredited providers
in other Member States. It is already difficult for
a consumer to distinguish between accredited and
unaccredited providers in his own country, let alone
those from a third country. Here an evident analogy can
be drawn with the approach taken by the second banking
directive: only those institutions that are covered by the
directive are granted freedom in the provision of their
services; for all others, the provision of (financial)
services is restricted to their country of origin.

3.4.2.
In the present case, without prejudice to the
freedom of movement of electronically-signed docu-
ments, their admissibility as evidence in legal or extraju-
dicial proceedings should be recognized only if the
certification has been issued by an accredited body.

3.5. Article 5

Member States will have to make provision in their
legislation for ensuring that electronic signatures cannot
be denied enforceability, legal effect or validity solely
on the grounds that the signatures are in electronic form
or are not validated by an accredited certificate. They
must also ensure that signatures certified by an accredited
service provider have the same legal value as hand-
written signatures and that they are admissible as
evidence in legal proceedings.

3.5.1.
The Committee draws the Commission’s atten-
tion to a matter which bears out the validity of the
comments made in points 3.4.1 and 3.4.2: the only
difference between signatures certified by accredited
providers and those certified by unaccredited providers
lies in the substantiating effect of the certification. In
this regard, Article 5(2) does not seem clear and should
be reviewed. According to the text, Member States
should allow certificates issued by a service provider
‘which fulfils the requirements set out in Annex II’ to be
used as evidence in legal proceedings. This could give
the impression that any service provider may issue

C 40/32

EN

Official Journal of the European Communities

15.2.1999

certificates admissible in legal proceedings, provided
that it fulfils the requirements laid down in Annex II. If
this is not the intention, the wording should be changed
to the unambiguous ‘accredited service provider’.

3.5.2.
Furthermore — in line with the comments
made in point 3.4.1 — the proposal makes no mention
of the substantiating effect of certification issued by a
provider accredited in a non-member state; in this case,
too, the directive should lay down specific provisions.
The Committee proposes that such certification be
accepted only if the non-member state grants reciprocal
recognition to the certificates of EU residents.

3.6. Article 6

With regard to liability, this article prescribes a set of
obligations for the certification service provider, who
must ensure the information is accurate, comply with
the provisions of the directive, and check that the
signatory and certifier fulfil the necessary technical and
technological requirements. The article also lays down
exemptions from liability in the case of mistakes in the
original information, and provides for the possibility of
limiting both the uses of the certificate and the sum
certified.

The Committee believes that the provisions of
3.6.1.
this article comply with general legal principles and
respect contractual freedom. However, it would like to
advance an opinion, or, rather, a query: should the
certification service provider suspend or terminate the
service, what are his responsibilities and what guarantees
does the consumer have? Some sort of system should be
established to guarantee that consumer rights continue
to be protected — for example, by making it compulsory
to deposit back-up files with a third party, with certain
guarantees.

3.7. Article 7(1)

This article sets out provisions concerning providers
from third countries. The certificates from such pro-
viders will be recognized as the legal equivalent of
European certificates if the provider has been accredited
in a Member State under its voluntary accreditation
scheme. Failing this, legal recognition will be given if
the certificate is guaranteed by a service provider already
established in a Member State or if the certificate or
provider is recognized under a bilateral or multilateral
agreement between the EU and third countries or
international organizations.

3.7.1.
The Committee disagrees with the overall
thrust of these rules. In the name of commercial freedom,
they flout the principle of reciprocity which should be
the cornerstone of global trade integration (and not just
electronic). The guidelines laid out in this paragraph —

particularly those regarding the accreditation of a foreign
service provider in a Member State and the guaranteeing
by a European provider of a certificate issued in a third
country — are acceptable only if the third country
accords similar or equal treatment to providers and
certificates from all EU Member States.

3.7.2.
As regards recognition of a certificate or
provider from a third country on the basis of a bilateral
agreement with a Member State, the Committee notes
that the adoption of such a principle would distort
competition between Member States or, more specifi-
cally, between those whose rules are more ‘liberal’ and
those that are less so. The free movement of services
cannot be used as a Trojan horse whereby agents or
products from third countries can be introduced into
the EU via a bilateral agreement with only one Member
State.

3.7.3. Nor is it possible, in defence of the above
principle, to cite such precedents as the second banking
directive: in this case, the ‘host’ Member State exercises
continuous supervision and guarantees the soundness
and solvency of the third country company which, in
any case, has to be physically present on the Member
State’s territory. These are conditions which cannot be
met in the guaranteeing of electronic signatures.

3.8. Article 8

Apart from paragraph 4 on the use of pseudonyms, this
article requires no particular comment. The service
provider must be able to transmit the data concerning
the identity of the pseudonym user to the public
authorities upon request, with the prior consent of the
person in question. However, the draft directive does
not state what the position of the provider would be if
the pseudonym user denied such consent.

The second part of Article 8(4) raises further
3.8.1.
doubts regarding investigations into alleged breaches of
the rules on the use of electronic signatures under a
pseudonym. If national law requires that the service
provider transfer data identifying the person in question,
the latter is informed of this after the investigation has
been completed.

The Committee wonders whether this detail
3.8.2.
is really necessary. Once the investigation has been
completed, the defendant will already be well aware
that his/her identity has been revealed, so the rule would
seem superfluous. Moreover, the reference to ‘national
law’ should clearly specify which national law is intended
— that of the service provider’s country (presumably),

15.2.1999

EN

Official Journal of the European Communities

C 40/33

that of the pseudonym user’s country (if known), or
even that of another Member State. Since we are clearly
(if not explicitly) in the field of crime-fighting, the
directive should be more specific as to the procedures to
be followed and the rights/duties of the service provider.

3.8.3.
All things considered, the Committee wonders
whether it might be best to review the entire article and
to simply state that the provisions of the directives on
personal data protection and money laundering will
apply in full. Ultimately, from this standpoint there is
no difference between paper and electronic transactions.

3.9. Articles 9 and 10

These articles make provision for the establishment
of an ‘Electronic Signature Committee’, made up of
representatives of the Member States and chaired by a
representative of the Commission. This committee will
be consulted on the requirements for service providers
and on acceptable standards for the creation of electronic
signatures. It will also be informed by the Commission
on the outcome of the latter’s periodic meetings with
companies, users and consumers.

3.9.1.
The ESC takes note of this initiative but queries
the necessity of setting up a committee when the
Commission could perfectly well consult Member States
and interested parties itself, as part of its institutional

Brussels, 2 December 1998.

duties, without needing an interface which would
actually overlap into the Commission’s remit. Moreover,
this is a procedure that the Commission follows in the
normal course of its duties; there is no need to create
more red tape which, in the Committee’s view, would
not increase efficiency.

Articles 12 and 13: These two articles — the
3.10.
order of which appears inverted in terms of chronology
and logic — provide that the directive must be adopted
by Member States by 31 December 2000 and that
the Commission must submit an initial report on its
implementation to the European Parliament and the
Council by 31 December 2002. The Committee has
stressed, on various occasions (1), the urgent need to
adopt uniform legislation in the vast field of the
information society; it therefore wonders whether Mem-
ber States need to be granted so much time to adopt the
directive, when several of them have already taken pains
to pass laws of their own in a very short space of time.
It should not cost national legislators too much time or
effort to introduce the few harmonization measures that
are needed. In the Committee’s view, a one-year period
from the date of adoption of the directive should be
sufficient to make any minor amendments to existing
legislation or to draft new laws.

(1) OJ C 284, 14.9.1998; OJ C 157, 25.5.1998; OJ C 19,

21.1.1998.

The President

of the Economic and Social Committee

Beatrice RANGONI MACHIAVELLI