Qualified electronic signature

A qualified electronic signature is an electronic signature that is compliant with EU Regulation No 910/2014 (eIDAS Regulation) for electronic transactions within the internal European market. It enables to verify the authorship of a declaration in electronic data exchange over long periods of time. Qualified electronic signatures can be considered as a digital equivalent to handwritten signatures.

Description

The purpose of eIDAS was to create a set of standards to ensure that electronic signatures could be used in a secure manner while conducting business online or while conducting official business across borders between EU member states. The qualified electronic signature is one such standard that has been outlined under eIDAS.

A qualified electronic signature is an advanced electronic signature with a qualified digital certificate that has been created by a qualified signature creation device (QSCD). For an electronic signature to be considered as a qualified electronic signature, it must meet three main requirements: First, the signatory must be linked and uniquely identified to the signature. The second point is that data used to create the signature must be under the sole control of the signatory. And last it must have the ability to identify if the data that accompanies the signature has been tampered with since the signing of the message.

It is important to note that creating a qualified electronic signature is more than merely adding a qualified certificate to an advanced electronic signature. The signature must also be created using a qualified signature creation device (QSCD). This device is responsible for qualifying digital signatures by using specific hardware and software that ensures that only the signatory has control of their private key. In addition, a qualified trust service provider manages the signature creation data that is produced. The signature creation data must remain unique, confidential and protected from forgery.

Qualified electronic signatures that comply with eIDAS may be technically implemented through three specific digital signature standards, that were developed by the European Telecommunications Standards Institute (ETSI) and then need to be complemented with a qualified digital certificate through the procedures described above:;

• XAdES,
• PAdES
• and CAdES.

Qualified trust service providers

The qualified trust service provider has a crucial role in the process of qualified electronic signing. A trust service provider must receive qualified status from a supervisory governmental body that allows the entity to provide qualified trust services to be used in creating qualified electronic signatures. Regulated in eIDAS, the European Union published an EU Trust List with constitutive effect, meaning that a provider or service will only be qualified if it appears in the Trusted List. Qualified trust service providers are required to abide by the strict guidelines outlined under the eIDAS Regulation, which include as part of the certificate creation process:

• The service provider must provide a valid time and date for created certificates.
• Signatures that have expired certificates must be revoked immediately.
• Personnel employed by the qualified trust service provider must be appropriately trained.
• Software and hardware used by the service provider must be trustworthy and capable of preventing certificate forgery.

Vision and expected impact

Under eIDAS, the intent of the implementation of qualified electronic signatures is to serve several purposes, such as the facilitation of business and public services processes, including those that go across borders. These processes can be safely expedited using electronic signing. Under eIDAS, EU member states have been charged with establishing "points of single contact" (PSCs) for trust services to ensure that electronic ID schemes may be used in cross-border public sector transactions, such as exchanging and accessing healthcare information across borders.

Previously, a signatory would sign a document or message and then return it to the intended recipient via the postal service, facsimile service, by hand or by scanning and then attaching it to an email. The issue with these methods is that they are not always secure or timely. Delays in delivery could occur, and there exists the possibility that signatures could be forged or the enclosed documents may be altered. The risk increases as multiple signatures are required from different people who may be located in different locations. These problems are alleviated by using qualified electronic signatures, which save time, are legally binding, and provide a higher level of technical security.

The increased transparency in the electronic signing and transaction process and the enhanced interoperability are expected to spur innovation in the European internal market.

Legal implications

eIDAS requires that no electronic signature should be denied legal effect or admissibility as evidence solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic signatures. The qualified electronic signature shall have the equivalent legal effect as a handwritten signature. Its evidentiary value depends on the circumstances, but will normally be considered very high. All EU member states are required to recognize a qualified electronic signature as valid, as long as it has been created with a qualified certificate that has been issued by another member state.

Under eIDAS Regulation, Article 27, Electronic signatures in public services, member states are prohibited from requesting signatures of a higher level than qualified electronic signature. Article 25 (2) of eIDAS allows a qualified electronic signature to carry the same legal weight as a handwritten signature.

See also

• Electronic signature
• Digital signature – an electronic signature that employs asymmetric cryptography to ensure data integrity
• Electronic seal