Electronic Signatures in German, French and Polish Law Perspective
Total Page:16
File Type:pdf, Size:1020Kb
Article Electronic signatures in German, French and Polish law perspective DR CHRISTIANE BIEREKOVEN, PHILIP BAZIN AND TOMASZ KOZLOWSKI This article presents some significant apply to the German legislation on electronic issues on the recognition of signatures. electronic signatures with regard to It may be stressed that Germany was the first foreign certificates from the country in the European Union that issued a law perspective of German, French and on electronic, respectively digital, signatures prior to the Electronic Signature Directive. The Act on Polish law. The European Union Digital Signatures came into force on 1 August legislation applies to Germany and 1997 and was restricted to the use of digital France, and has served as a guide signatures only. It had to be amended after the for Polish legislation in the course of Electronic Signature Directive was published, preparations of the accession of because the Directive provides for electronic Poland to the European Union. signatures in general and is not restricted to the There are therefore strong use of digital signatures only. similarities between the legislation I of these countries, but as the French The German legislation example shows, the results may also The Electronic Signature Directive was differ with regard to the material implemented into German law by the “Act on law applicable to a contract. The outlining Conditions for Electronic Signatures and difference between simple and for the Amendment of further Regulations” advanced electronic signature is (Gesetz über Rahmenbedingungen für discussed within the context of elektronische Signaturen und zur Änderung weiterer Vorschriften), hereinafter referred to as French law. “SigG” - of 21 May 2001. It came into force on 22 May 2001. It replaces the former Act on Digital This article elaborates on conditions of Signatures (Verordnung zur digitalen Signatur No: recognition of electronic signatures and the Signaturgesetz). relevance of such recognition for the legal systems Art. 23 SigG provides for the recognition of of the Germany, France and Poland. It seems that foreign electronic signatures and products for the Electronic Signature Directive has been electronic signatures. It distinguishes between successfully implemented, and provides for clear electronic signatures originating in EU member recognition criteria within the European Union. states, states of the European Free Trade The recognition of certificates from third countries Association (EFTA) and electronic signatures depends on the fulfillment of the criteria set out in originating in third countries. the Directive. The Polish law provides for a special position of European Union based suppliers of I Electronic Signatures originating in a certificates in terms of their recognition. Member State of the EU or the EFTA Electronic Signatures in According to Art. 23 § 1 SigG electronic Germany signatures, which are based on a qualified certificate of a member state of the EU or the I European background EFTA, are recognized as legally equivalent to The European Directive on Electronic Signatures1 qualified electronic signatures in the sense of the binds the German legislator. Thus, the requirements SigG, provided that those qualified certificates for electronic signatures laid down in this Directive comply with the provisions of Art. 5 § 1 of the 1 Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures (OJ 19.1.2000 L13/12). www.deaeslr.org DIGITAL EVIDENCE AND ELECTRONIC SIGNATURE LAW REVIEW 7 ELECTRONIC SIGNATURES IN GERMAN, FRENCH AND POLISH LAW PERSPECTIVE If the certification Electronic Signature Directive. provider has to present a security concept in the This means that electronic signatures that are sense of Art. 4 § 3 in which it shows that it meets body approves the based on qualified certificates of member states of the requirements of both the SigG and the either the EU or the EFTA that comply with the Signaturverordnung (Regulations on Electronic security concept, provisions of Art. 5 § 1 of the Electronic Signature Signatures), Art. 15 § 1 SigG. This security concept the certification Directive are recognized as legally equivalent with has to be approved by a certification body qualified electronic signatures in the sense of the (“Bestätigungsstelle”), Art. 15 § 2 SigG. If the service provider is SigG. So, the requirements for the recognition may certification body approves the security concept, be determined by Art. 5 § 1 Electronic Signature the certification service provider is entitled to call entitled to call Directive. itself “accredited certification service provider” and to rely on the approved security in the course of itself “accredited I Electronic Signatures originating in a business and legal relations. Third Country certification Pursuant to Art. 23 § 2 SigG electronic Regarding the recognition of electronic signatures in the sense of § 1 are recognized as service provider” signatures originating in third countries, Art. 23 § legally equivalent to qualified electronic signatures 1 SigG implements the provisions of Art. 7 § 1 of based on a certificate of an accredited certification and to rely on the the Electronic Signature Directive and further service provider in the sense of Art. 15 § 1 SigG if it has been demonstrated that they adhere to the approved security requires that the certificate in the sense of Art. 7 § is to be used for an electronic signature in the same security standard. This means that electronic in the course of sense of Art. 5 § 1 Electronic Signature Directive. signatures originating in the member states of the An electronic signature in the sense of Art. 5(1) is EU or the EFTA or in third countries and which business and legal an advanced electronic signature which is based comply with the requirements of Art. 23 § 1 SigG on a qualified certificate and is created by a secure have to show the security standard being relations –signature-creation device. Pursuant to Art. 2 No. applicable to electronic signatures based on a 1 an “advanced electronic signature” is an certificate of an accredited certification service electronic signature which is uniquely linked to the provider. If this is proven, they are recognized as signatory, is capable of identifying the signatory, is legally equivalent to electronic signatures based on created using means that the signatory can a certificate of an accredited certification service maintain under his sole control and eventually is provider in the sense of Art. 15 § 1 SigG and may, linked to the data to which it relates in such a therefore, be promoted as electronic signatures manner that any subsequent change of the data is based on a certificate of an accredited certification detectable. A “qualified certificate” is a certificate service provider. Obtaining approved statues that meets the requirements laid down in Annex I means the accredited certification service provider and is provided by a certification-service-provider can promote this in the course of business and who fulfills the requirements laid down in Annex rely on the legal effect in its relations with its II2, Art. 2 No. 10. A “secure-signature-creation” customers. device is a signature-creation device that meets the I Products for electronic signatures requirements laid down in Annex III3. Hence, if an electronic signature originating in a third country is Products for electronic signatures originating in an advanced electronic signature in the sense of either a member state of the EU or the EFTA which Art. 2 No. 2 Electronic Signature Directive as comply with the provisions of the Electronic outlined before it has to be recognized as legally Signature Directive and which have been officially equivalent to qualified electronic signatures in the approved, are recognized in Germany. This means sense of the SigG. that those products for electronic signatures which have been tested in one of the member states of I Note the EU or the EFTA and which have been officially The German SigG provides for voluntary approved to comply with the requirements of the accreditation in Art. 15. This means that a Electronic Signature Directive are recognized in certification service provider may apply for an Germany. accreditation with the relevant official authorities. It may be stressed that the definition of It has to comply with further requirements of the “products for electronic signatures” in Art. 2 No. SigG. This means that such certification service 13 SigG: 2 The Annexes I and II are attached to the Electronic Signature Directive 1999/93/EC, of 19.01.2000, L 13/18, L13/19. 3 Annex III is attached to the Electronic Signature Directive, L13/20. 8 DIGITAL EVIDENCE AND ELECTRONIC SIGNATURE LAW REVIEW www.deaeslr.org ELECTRONIC SIGNATURES IN GERMAN, FRENCH AND POLISH LAW PERSPECTIVE “Produkte für elektronische Signaturen” sichere “Products for qualified electronic signatures” shall Signaturerstellungseinheiten, be secure signature-creation devices, signature- Signaturanwendungskomponenten und application components, and technical technische Komponenten für Zertifizierungsdienste components for certification services; is not identical with the definition of “electronic-signature product” in Art. 2(12) of the Electronic Signature Directive: ‘electronic-signature product’ means hardware or software, or relevant components thereof, which are intended to be used by a certification-service-provider for the provision of electronic-signature