Opinion of the Commission pursuant to Article 251(2)(c) of the EC Treaty, on the amendments of the European Parliament to the common position of the Council regarding the proposal for a Directive of the European Parliament and of the Council on a Community framework for electronic signatures, amending the proposal of the Commission pursuant to Article 250(2) of the EC Treaty
COMMISSION OF THE EUROPEAN COMMUNITIES Brussels, 26. 11. 1999 COM(1999)626 final 1998/0191 (COD) OPINION OF THE COMMISSION pursuant to Article 251(2) (c) of the EC Treaty, on the amendments of the European Parliament to the Common Position of the Council regarding the Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on a Community Framework for electronic signatures AMENDING THE PROPOSAL OF THE COMMISSION pursuant to Article 250(2) of the EC Treaty EXPLANATORY MEMORANDUM Article 251 (2) c) requests the Commission to express its opinion on the amendments proposed by the European Parliament in its second reading. The Commission hereby presents its opinion on these amendments to the Council’s Common Position regarding the proposal for a European Parliament and Council Directive on a common framework for electronic signatures. The amended proposal incorporates those amendments proposed by the European Parliament at Second Reading which were accepted by the Commission. The amendments to the Commission proposal have been highlighted using strikethrough for deleted text and bold and underlined for new or amended text. 1. INTRODUCTION 1. 1. a) Background On 13 May 1998, the Commission adopted a proposal for a European Parliament and Council Directive on electronic signatures ‘A Common Framework for Electronic Signatures’ (COM (1998) 297 final)1 and formally transmitted the proposal to the European Parliament and to the Council on 16 June 1998. The Economic and Social Committee gave its Opinion on the 2/3 December 19982 and the Committee of the Regions on the 13/14 January 19993. The European Parliament adopted a favourable Resolution at its First Reading on the 13th January 1999, and proposed 32 amendments to the Commission proposal4. On 29 April 1999 the Commission adopted an amended proposal5 in conformity with Article 250 (2) of the Treaty, incorporating 22 of the amendments in full, in part or in principle. The Council, acting in accordance with Article 251 of the Treaty, formally adopted a common position on 28 June 19996 on which the Commission delivered its opinion on 16 July 1999. 7 In the second reading, the European Parliament on 27 October 1999 proposed 5 amendments to the Common Position8. 1 2 3 4 5 6 7 8 OJ C 325, 23. 10. 1998, p. 5 OJ C 40, 15. 2. 1999, p. 29 OJ C 93, 06. 4. 1999, p. 33 OJ C 104, 14. 4. 1999, p. 49 COM (1999)195 final of 29. 4. 1999 OJ C 243 , 27. 8. 1999 p. 33 SEC(1999) 1154 final of 16. 7. 1999 (not yet published) Doc. A5 – 0034/1999 2 1. 2. b) Purpose of the Commission proposal The purpose of the Directive is to facilitate the use of electronic signatures and to contribute to their legal recognition. It aims at establishing a legal framework for electronic signatures and for certain certification services in order to ensure the proper functioning of the internal market. The legal basis for the proposal is Art. 47 (2), 55 and 95 of the Treaty. Based on a technology-neutral approach, the proposed Directive focuses on certificates supplied to the public and aimed at identifying the sender of electronic data. To encourage the development of certification services, it prevents Member States from submitting Certification Service Providers (CSP) to prior authorisation schemes. However, Member States are free to set up voluntary accreditation schemes. It also provides for the legal recognition of electronic signatures as equivalent to hand-written signatures and establishes liability rules for CSP. Finally, the proposed Directive foresees co-operation mechanisms with third countries to meet the requirements of global electronic communications. 2. OPINION OF THE COMMISSION ON THE AMENDMENTS OF THE EP Of the 5 amendments adopted by the European Parliament at Second Reading, the Commission accepted all amendments in full. The Commission accepted those amendments because they enhance the clarity and consistency of the text. 3. CONCLUSION The Commission has accepted all amendments proposed by the European Parliament at Second Reading in whole. In accordance with Article 250 (2) of the EC Treaty, the Commission amends its initial proposal, incorporating these amendments. 4. MODIFIED PROPOSAL a) Principles In response to the second reading by the European Parliament, a number of new provisions have been accepted. The majority of these serve either to remove ambiguities or to enhance the clarity and consistency of the text. In addition, there are some new ideas, which expand on the original text but do not change the fundamental principles. 3 b) Explanation of the main amendments 1. Modification of recital 16: As suggested by European Parliament’s amendment 1, the clarification that the Directive does not aim to regulate systems, which are governed by private law agreements has been added. The proposed modification aims to introduce the “principle of party autonomy” more explicitly by stating that, firstly, systems “governed by voluntary private law agreements between a defined number of participants” do not require a statutory regulatory framework and, secondly, that electronic signatures which are used within such systems should not be denied legal effectiveness and admissibility as evidence in legal proceedings. The new wording does not mention explicitly the so-called “closed user groups”. This is advantageous because the text of the Directive itself does not mention “closed systems” but refers to legal agreements between private persons. This helps avoiding legal uncertainty regarding the exact definition of closed user groups, which is unknown in civil law. 2. Modification of recital 23: Amendment 3 of the European Parliament has been included, adding a new sentence to recital 23. It emphasises that multilateral agreements with third countries on mutual recognition of certification services could be beneficial in order to ensure interoperability at a global level. This is in line with the provisions laid down in Article 7 of the proposed Directive, which specifically addresses the global dimension. Article 7 (2) provides for the Commission to make proposals aimed at facilitating cross-border certification, in particular with respect to the implementation of standards and relevant international agreements. Given the global nature of electronic commerce, it is important to work toward the mutual recognition of certificates in the global marketplace. The proposed new sentence is meant to stress the significance of this issue. 3. Modification of Article 6: As suggested by European Parliament’s amendments 4 and 5, two modifications concerning Article 6 have been added. Firstly, a new phrase has been included in Article 6 (1) (a) in order to ensure that a certification-service-provider is not only liable for the accuracy of all information included in a qualified certificate but also for the completeness of all information required to be considered a qualified certificate. This is of particular significance because for a consumer it is not only important that the information included in a certificate is correct but also that a certificate contains all information necessary to be classified as a qualified certificate. Therefore, this modification contributes to a clearer wording of Article 6 (1). Secondly, amendment 5 of the European Parliament has been introduced by adding a new sentence to Article 6 (4). The additional sentence states that a certification-service-provider shall not be liable for damage arising from the use of a qualified certificate which exceeds the limit on the value of transactions for which the certificate can be used. Thus, the provision makes clear that a certification-service-provider is not liable for an excessive use of the certificate. 4 This amendment contributes to more consistency between Article 6 (3), where a similar provision already has been included, and Article 6 (4). 4. Clarification of the text: As suggested by amendment 2 of the European Parliament, the wording in recital 21 has been changed. This recital refers to Article 5 (1). It is meant to emphasise that it is national law, which determines the fields in which Member States allow electronic documents and electronic signatures to be used. The recital was part of a compromise between the Commission and the Member States in order to mitigate the “strong” wording in Article 5 (1), stating that Member States shall ensure that advanced electronic signatures satisfy the legal requirements of a signature in the same manner as a hand-written signature. The modified sentence expresses more explicit that national law governs the fields in which electronic documents and electronic signatures can be used. 5 Amended proposalΓ for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on a Community Framework for electronic signatures THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty establishing the European Community, and in particular Articles 47(2), 55 and 95 thereof, Having regard to the proposal from the Commission 9, Having regard to the Opinion of the Economic and Social Committee 10, Having regard to the Opinion of the Committee of the Regions 11, Acting in accordance with the procedure laid down in Article 251 of the Treaty 12, (1) (2) (3) (4) Γ 9 10 11 12 Whereas on 16 April 1997 the Commission presented to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions a Communication on an European Initiative in Electronic Commerce; Whereas on 8 October 1997 the Commission presented to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions a Communication on ensuring security and trust in electronic communication - Towards a European framework for digital signatures and encryption; Whereas on 1 December 1997 the Council invited the Commission to submit as soon as possible a proposal for a Directive of the European Parliament and of the Council on digital signatures; Whereas electronic communication and commerce necessitate "electronic signatures" and related services allowing data authentication; whereas divergent rules with respect to legal recognition of electronic signatures and the accreditation of certification-service providers in the Member States may create a significant barrier to the use of electronic communications and electronic commerce; whereas, on the other This document is based on the German original version of the EP amendments OJ C 325, 23. 10. 1998, p. 5. OJ C 40, 15. 2. 1999, p. 29. Opinion delivered on 13 and 14 January 1999 (OJ C 93, 6. 4. 1999, p. 33). Opinion of the European Parliament of 13 January 1999 (OJ C 104, 14. 4. 1999, p. 49), Council Common Position of 28. 6. 99 (OJ C 243, of 27. 8. 1999 p. 33) (not yet published in the Official Journal) and Decision of the European Parliament of. (OJ C. ) (not yet published in the Official Journal). 6 (5) (6) (7) (8) (9) hand, a clear Community framework regarding the conditions applying to electronic signatures will strengthen confidence in, and general acceptance of, the new technologies; whereas legislation in the Member States should not hinder the free movement of goods and services in the internal market; Whereas the interoperability of electronic-signature products should be promoted; whereas, in accordance with Article 14 of the Treaty, the internal market comprises an area without internal frontiers in which the free movement of goods is ensured; whereas essential requirements specific to electronic-signature products must be met in order to ensure free movement within the internal market and to build trust in electronic signatures, without prejudice to Council Regulation (EC) No 3381/94 of 19 December 1994 setting up a Community regime for the control of exports of dual-use goods 13 and Council Decision 94/942/CFSP of 19 December 1994 on the joint action adopted by the Council on the basis of Article J. 3 of the Treaty on European Union concerning the control of exports of dual-use goods 14; Whereas this Directive does not harmonise the provision of services with respect to the confidentiality of information where they are covered by national provisions concerned with public policy or public security; Whereas the internal market ensures the free movement of persons, as a result of which citizens and residents of the European Union increasingly need to deal with authorities in Member States other than the one in which they reside; whereas the availability of electronic communication could be of great service in this respect; Whereas rapid technological development and the global character of the Internet necessitate an approach which is open to various technologies and services capable of authenticating data electronically; Whereas electronic signatures will be used in a large variety of circumstances and applications, resulting in a wide range of new services and products related to or using electronic signatures; whereas the definition of such products and services should not be limited to the issuance and management of certificates, but should also encompass any other service and product using, or ancillary to, electronic signatures, such as registration services, time-stamping services, directory services, computing services or consultancy services related to electronic signatures; (10) Whereas the internal market enables certification-service-providers to develop their cross-border activities with a view to increasing their competitiveness, and thus to offer consumers and businesses new opportunities to exchange information and trade electronically in a secure way, regardless of frontiers; whereas in order to stimulate the Community-wide provision of certification services over open networks, certification-service-providers should be free to provide their services without prior authorisation; whereas prior authorisation means not only any permission whereby the certification-service-provider concerned has to obtain a decision by national authorities before being allowed to provide its certification services, but also any other measures having the same effect. 13 14 OJ L 367, 31. 12. 1994, p. 1. Regulation as amended by Regulation (EEC) No 837/95 (OJ L 90, 21. 4. 1995, p. 1). OJ L 367, 31. 12. 1994, p. 8. Decision as last amended by Decision 99/193/CFSP (OJ L 73, 19. 3. 1999, p. 1). 7 (11) Whereas voluntary accreditation schemes aiming at an enhanced level of service-provision may offer certification-service-providers the appropriate framework for developing further their services towards the levels of trust, security and quality demanded by the evolving market; whereas such schemes should encourage the development of best practice among certification-service-providers; whereas certification-service-providers should be left free to adhere to and benefit from such accreditation schemes; (12) Whereas certification services can be offered either by a public entity or a legal or natural person, when it is established in accordance with the national law; whereas Member States should not prohibit certification-service-providers from operating outside voluntary accreditation schemes; whereas it should be ensured that such accreditation schemes do not reduce competition for certification services; (13) Whereas Member States may decide how they ensure the supervision of compliance with the provisions laid down in this Directive; whereas this Directive does not preclude the establishment of private-sector-based supervision systems; whereas this Directive does not oblige certification-service-providers to apply to be supervised under any applicable accreditation scheme; (14) Whereas it is important to strike a balance between consumer and business needs; (15) Whereas Annex III covers requirements for secure signature-creation devices to ensure the functionality of advanced electronic signatures; whereas it does not cover the entire system environment in which such devices operate; whereas the functioning of the internal market requires the Commission and the Member States to act swiftly to enable the bodies charged with the conformity assessment of secure signature devices with Annex III to be designated; whereas in order to meet market needs conformity assessment must be timely and efficient; (16) Whereas this Directive contributes to the use and legal recognition of electronic signatures within the Community; whereas a statutory regulatory framework is not needed for electronic signatures exclusively used within closed systems, which are based on voluntary agreements under private law between a defined number of participants; nevertheless electronic signatures which fulfil the requirements laid down in this Directive and which are used within closed user-groups should be legally recognised; whereas the freedom of parties to agree among themselves the terms and conditions under which they accept electronically signed data should be respected to the extent allowed by national law; the legal effectiveness of electronic signatures used in such systems and their admissibility as evidence in legal proceedings must be recognised; (17) Whereas this Directive does not seek to harmonise national rules concerning contract law, particularly the formation and performance of contracts, or other formalities of a non-contractual nature concerning signatures; whereas for this reason the provisions concerning the legal effect of electronic signatures should be without prejudice to requirements regarding form laid down in national law with regard to the conclusion of contracts or the rules determining where a contract is concluded; (18) Whereas the storage and copying of signature-creation data could cause a threat to the legal validity of electronic signatures; 8 (19) Whereas electronic signatures will be used in the public sector within national and Community administrations and in communications between such administrations and with citizens and economic operators, for example in the public procurement, taxation, social security, health and justice systems; (20) Whereas harmonised criteria relating to the legal effects of electronic signatures will preserve a coherent legal framework across the Community; whereas national law lays down different requirements for the legal validity of hand-written signatures; whereas certificates can be used to confirm the identity of a person signing electronically; whereas advanced electronic signatures based on qualified certificates aim at a higher level of security; whereas advanced electronic signatures which are based on a qualified certificate and which are created by a secure-signature-creation device can be regarded as legally equivalent to hand-written signatures only if the requirements for hand-written signatures are fulfilled; (21) Whereas in order to contribute to the general acceptance of electronic authentication methods it has to be ensured that electronic signatures can be used as evidence in legal proceedings in all Member States; whereas the legal recognition of electronic signatures should be based upon objective criteria and not be linked to authorisation of the certification-service-provider involved; whereas national law governs the fields in which use of electronic documents and electronic signatures can be used; whereas this Directive is without prejudice to the power of a national court to make a ruling regarding conformity with the requirements of this Directive and does not affect national rules regarding the unfettered judicial consideration of evidence; (22) Whereas certification-service-providers providing certification-services to the public are subject to national rules regarding liability; (23) Whereas the development of international electronic commerce requires cross-border arrangements involving third countries; whereas in order to ensure interoperability at a global level, agreements on multilateral rules with third countries on mutual recognition of certification services could be beneficial; (24) Whereas in order to increase user confidence in electronic communication and electronic commerce, certification-service-providers must observe data protection legislation and individual privacy; (25) Whereas provisions on the use of pseudonyms in certificates should not prevent Member States from requiring identification of persons pursuant to Community or national law; (26) Whereas, for the purposes of the application of this Directive, the Commission should be assisted by a management committee; whereas, since the measures necessary for the implementation of this Directive are management measures within the meaning of Article 2 of Council Decision 1999/468/EC of 28 June 1999 laying down the procedures for the exercise of implementing powers conferred on the Commission15, they should be adopted by use of the management procedure provided for in Article 4 of that Decision. 15 OJ L 184, 17. 7. 1999, p. 23. 9 (27) Whereas two years after its implementation the Commission will carry out a review of this Directive so as, inter alia, to ensure that the advance of technology or changes in the legal environment have not created barriers to achieving the aims stated in this Directive; whereas it should examine the implications of associated technical areas and submit a report to the European Parliament and the Council on this subject; (28) Whereas, in accordance with the principles of subsidiarity and proportionality as set out in Article 5 of the Treaty, the objective of creating a harmonised legal framework for the provision of electronic signatures and related services cannot be sufficiently achieved by the Member States and can therefore be better achieved by the Community; whereas this Directive does not go beyond what is necessary to achieve that objective, HAVE ADOPTED THIS DIRECTIVE: Article 1 Scope The purpose of this Directive is to facilitate the use of electronic signatures and to contribute to their legal recognition. It establishes a legal framework for electronic signatures and certain certification-services in order to ensure the proper functioning of the internal market. It does not cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards form prescribed by national or Community law nor does it affect rules and limits, contained in national or Community law, governing the use of documents. Article 2 Definitions For the purpose of this Directive: (1) (2) "electronic signature" means data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication; "advanced electronic signature" means an electronic signature, which meets the following requirements: (a) it is uniquely linked to the signatory; (b) it is capable of identifying the signatory; (c) (d) it is created using means that the signatory can maintain under his sole control; and it is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable; 10 (3) (4) (5) (6) (7) (8) (9) (10) (11) (12) (13) "signatory" means a person who holds a signature-creation device and acts either on his own behalf or on behalf of the natural or legal person or entity he represents; "signature-creation data" means unique data, such as codes or private cryptographic keys, which are used by the signatory to create an electronic signature; "signature-creation device" means configured software or hardware used to implement the signature-creation data; "secure-signature-creation device" means a signature-creation device which meets the requirements laid down in Annex III; "signature-verification-data" means data, such as codes or public cryptographic keys, which are used for the purpose of verifying an electronic signature; "signature-verification device" means configured software or hardware used to implement the signature-verification-data; "certificate" means an electronic attestation, which links signature-verification data to a person and confirms the identity of that person; "qualified certificate" means a certificate which meets the requirements laid down in Annex I and is provided by a certification-service-provider who fulfils the requirements laid down in Annex II; "certification-service-provider" means an entity or a legal or natural person who issues certificates or provides other services related to electronic signatures; "electronic-signature-product" means hardware or software, or relevant components thereof, which are intended to be used by a certification-service-provider for the provision of electronic-signature services or are intended to be used for the creation or verification of electronic signatures; "voluntary accreditation" means any permission, setting out rights and obligations specific to the provision of certification services, to be granted upon request by the certification-service-provider concerned, by the public or private body charged with the elaboration of, and supervision of compliance with, such rights and obligations, where the certification-service-provider is not entitled to exercise the rights stemming from the permission until it has received the decision by the body. Article 3 Market access Member States shall not make the provision of certification services subject to prior 1. authorisation. 2. Without prejudice to the provisions of paragraph 1, Member States may introduce or maintain voluntary accreditation schemes aiming at enhanced levels of certification-service provision. All conditions related to such schemes must be objective, transparent, proportionate and non-discriminatory. Member States may not limit the number of accredited certification-service-providers for reasons, which fall within the scope of this Directive. 11 3. Each Member State shall ensure the establishment of an appropriate system that allows for supervision of certification-service-providers which are established on its territory and issue qualified certificates to the public. 4. The conformity of secure signature-creation-devices with the requirements laid down in Annex III shall be determined by appropriate public or private bodies designated by Member States. The Commission shall, pursuant to the procedure laid down in Article 9, establish criteria for Member States to determine whether a body should be designated. A determination of conformity with the requirements laid down in Annex III made by the bodies referred to in the first subparagraph shall be recognised by all Member States. 5. The Commission may, in accordance with the procedure laid down in Article 9, establish and publish reference numbers of generally recognised standards for electronic- signature products in the Official Journal of the European Communities. Member States shall presume that there is compliance with the requirements laid down in Annex II, point (f), and Annex III when an electronic signature product meets those standards. 6. Member States and the Commission shall work together to promote the development and use of signature-verification devices in the light of the recommendations for secure signature-verification laid down in Annex IV and in the interests of the consumer. 7. Member States may make the use of electronic signatures in the public sector subject to possible additional requirements. Such requirements shall be objective, transparent, proportionate and non-discriminatory and shall relate only to the specific characteristics of the application concerned. Such requirements may not constitute an obstacle to cross-border services for citizens. Article 4 Internal market principles 1. Each Member State shall apply the national provisions which it adopts pursuant to this Directive to certification-service-providers established on its territory and to the services which they provide. Member States may not restrict the provision of certification-services originating in another Member State in the fields covered by this Directive. Member States shall ensure that electronic-signature products which comply with this 2. Directive are permitted to circulate freely in the internal market. Article 5 Legal effects of electronic signatures Member States shall ensure that advanced electronic signatures which are based on a 1. qualified certificate and which are created by a secure-signature-creation device: (a) satisfy the legal requirements of a signature in relation to data in electronic form in the same manner as a handwritten signature satisfies those requirements in relation to paper-based data; and 12 (b) are admissible as evidence in legal proceedings. Member States shall ensure that an electronic signature is not denied legal 2. effectiveness and admissibility as evidence in legal proceedings solely on the grounds that it is: – – – – in electronic form, or not based upon a qualified certificate, or based not certification-service-provider, or upon a qualified certificate issued by an accredited not created by a secure signature-creation device. Article 6 Liability As a minimum, Member States shall ensure that by issuing a certificate as a qualified 1. certificate to the public or by guaranteeing such a certificate to the public a certification-service-provider is liable for damage caused to any entity or legal or natural person who reasonably relies on that certificate: (a) (b) (c) as regards the accuracy at the time of issuance of all information contained in the qualified certificate and as regards the fact that the certificate contains all the information required to be considered a qualified certificate; for assurance that at the time of the issuance of the certificate, the signatory identified in the qualified certificate held the signature-creation data corresponding to the signature-verification data given or identified in the certificate; for assurance that the signature-creation data and the signature-verification data can be used in a complementary manner in cases where the certification-service-provider generates them both; unless the certification-service-provider proves that he has not acted negligently. As a minimum Member States shall ensure that a certification-service-provider who 2. has issued a certificate as a qualified certificate to the public is liable for damage caused to any entity or legal or natural person who reasonably relies on the certificate for failure to register revocation of the certificate unless the certification-service-provider proves that he has not acted negligently. 3. Member States shall ensure that a certification-service-provider may indicate in a qualified certificate limitations on the use of that certificate, provided that the limitations are recognisable to third parties. The certification-service-provider shall not be liable for damage arising from use of a qualified certificate which exceeds the limitations placed on it. Member States shall ensure that a certification-service-provider may indicate in the 4. qualified certificate a limit on the value of transactions for which the certificate can be used, provided that the limit is recognisable to third parties. The certification-service-provider 13 shall not be liable for damage arising from the use of a qualified certificate which exceeds the limit on the value of transactions placed on it. The provisions of paragraphs 1 to 4 shall be without prejudice to Council 5. Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts 16. Article 7 International aspects 1. Member States shall ensure that certificates which are issued as qualified certificates to the public by a certification-service-provider established in a third country are recognised as legally equivalent to certificates issued by a certification-service-provider established within the Community if: (a) (b) (c) the certification-service-provider fulfils the requirements laid down in this Directive and has been accredited under a voluntary accreditation scheme established in a Member State; or a certification-service-provider established within the Community which fulfils the requirements laid down in this Directive guarantees the certificate; or the certificate or the certification-service-provider is recognised under a bilateral or multilateral agreement between the Community and third countries or international organisations. 2. In order to facilitate cross-border certification services with third countries and legal recognition of advanced electronic signatures originating in third countries, the Commission shall make proposals, where appropriate, to achieve the effective implementation of standards and international agreements applicable to certification services. In particular, and where necessary, it shall submit proposals to the Council for appropriate mandates for the negotiation of bilateral and multilateral agreements with third countries and international organisations. The Council shall decide by qualified majority. Whenever the Commission is informed of any difficulties encountered by Community 3. undertakings with respect to market access in third countries, it may, if necessary, submit proposals to the Council for an appropriate mandate for the negotiation of comparable rights for Community undertakings in these third countries. The Council shall decide by qualified majority. Measures taken pursuant to this paragraph shall be without prejudice to the obligations of the Community and of the Member States under relevant international agreements. 16 OJ L 95, 21. 4. 1993, p. 29. 14 Article 8 Data protection Member States shall ensure that certification-service-providers and national bodies 1. responsible for accreditation or supervision comply with the requirements laid down in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data 17. 2. issues Member States shall ensure that a certification-service-provider which certificates to the public may collect personal data only directly from the data subject, or after the explicit consent of the data subject, and only insofar as it is necessary for the purposes of issuing and maintaining the certificate. The data may not be collected or processed for any other purposes without the explicit consent of the data subject. 3. Without prejudice to the legal effect given to pseudonyms under national law, Member States shall not prevent certification service providers from indicating in the certificate a pseudonym instead of the signatory’s name. Article 9 Committee The Commission shall be assisted by a committee 1. ["Electronic-Signature Committee"], composed of representatives of the Member States and chaired by the representative of the Commission hereinafter referred to as “the committee”. Where reference is made to this paragraph, the management procedure laid down in 2. Article 4 of Decision 1999/468/EC shall apply, in compliance with Article 8 thereof. 3. The period provided for in Article 4(3) of Decision 1999/468/EC shall be 3 months. Article 10 Tasks of the committee The committee shall clarify the requirements laid down in the Annexes to this Directive, the criteria referred to in Article 3(4) and the generally recognised standards for electronic signature products established and published pursuant to Article 3(5), in accordance with the procedure laid down in Article 9. 17 OJ L 281, 23. 11. 1995, p. 31. 15 Article 11 Notification Member States shall notify to the Commission and the other Member States the 1. following: (a) (b) information on national voluntary accreditation schemes, including any additional requirements pursuant to Article 3(7); the names and addresses of the national bodies responsible for accreditation and supervision as well as of the bodies referred to in Article 3(4); (c) the names and addresses of all accredited national certification service providers. Any information supplied under paragraph 1 and changes in respect of that 2. information shall be notified by the Member States as soon as possible. Article 12 Review The Commission shall review the operation of this Directive and report thereon to the 1. European Parliament and to the Council by. ** at the latest. The review shall inter alia assess whether the scope of this Directive should be 2. modified, taking account of technological, market and legal developments. The report shall in particular include an assessment, on the basis of experience gained, of aspects of harmonisation. The report shall be accompanied, where appropriate, by legislative proposals. Article 13 Implementation 1. Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive before. ***. They shall forthwith inform the Commission thereof. When Member States adopt these measures, they shall contain a reference to this Directive or shall be accompanied by such a reference on the occasion of their official publication. The methods of making such reference shall be laid down by the Member States. Member States shall communicate to the Commission the text of the main provisions 2. of domestic law which they adopt in the field governed by this Directive. ** *** Three years and six months after the date of entry into force of this Directive. One year and six months after the date of entry into force of this Directive. 16 Article 14 Entry into force This Directive shall enter into force on the day of its publication in the Official Journal of the European Communities. Article 15 Addressees This Directive is addressed to the Member States. Done at Brussels, […] For the European Parliament The President […] For the Council The President […] 17 ANNEX I REQUIREMENTS FOR QUALIFIED CERTIFICATES Qualified certificates must contain: (a) (b) (c) (d) (e) (f) (g) (h) (i) (j) an indication that the certificate is issued as a qualified certificate; the identification of the certification-service-provider and the State in which it is established; the name of the signatory or a pseudonym, which shall be identified as such; provision for a specific attribute of the signatory to be included if relevant, depending on the purpose for which the certificate is intended; signature-verification data which correspond to signature-creation data under the control of the signatory; an indication of the beginning and end of the period of validity of the certificate; the identity code of the certificate; the advanced electronic signature of the certification-service-provider issuing it; limitations on the scope of use of the certificate, if applicable; and limits on the value of transactions for which the certificate can be used, if applicable. 18 ANNEX II REQUIREMENTS FOR CERTIFICATION-SERVICE-PROVIDERS ISSUING QUALIFIED CERTIFICATES Certification-service-providers must: (a) (b) (c) (d) (e) (f) (g) (h) (i) (j) (k) demonstrate the reliability necessary for providing certification services; ensure the operation of a prompt and secure directory and a secure and immediate revocation service; ensure that the date and time when a certificate is issued or revoked can be determined precisely; verify, by appropriate means in accordance with national law, the identity and, if applicable, any specific attributes of the person to which a qualified certificate is issued; employ personnel who possess the expert knowledge, experience, and qualifications necessary for the services provided, in particular competence at managerial level, expertise in electronic signature technology and familiarity with proper security procedures; they must also apply administrative and management procedures which are adequate and correspond to recognised standards; use trustworthy systems and products which are protected against modification and ensure the technical and cryptographic security of the processes supported by them; take measures against certification-service-provider confidentiality during the process of generating such data; forgery of certificates, and, generates signature-creation in cases where the guarantee data, maintain sufficient financial resources to operate in conformity with the requirements laid down in the Directive, in particular to bear the risk of liability for damages, for example, by obtaining appropriate insurance; record all relevant information concerning a qualified certificate for an appropriate period of time, in particular for the purpose of providing evidence of certification for the purposes of legal proceedings. Such recording may be done electronically; not store or copy signature-creation data of certification-service-provider provided key management services; the person to whom the before entering into a contractual relationship with a person seeking a certificate to support his electronic signature, inform that person by a durable means of communication of the precise terms and conditions regarding the use of the certificate, including any limitations on its use, the existence of a voluntary accreditation scheme and procedures for complaints and dispute settlement. Such information, which may be transmitted electronically, must be in writing and in readily understandable language. Relevant parts of this information must also be made available on request to third-parties relying on the certificate; 19 (l) use trustworthy systems to store certificates in a verifiable form so that: – – – – only authorised persons can make entries and changes, information can be checked for authenticity, certificates are publicly available for retrieval in only those cases for which the certificate-holder's consent has been obtained, and any technical changes compromising these security requirements are apparent to the operator. 20 REQUIREMENTS FOR SECURE SIGNATURE-CREATION DEVICES ANNEX III 1. Secure-signature-creation devices must, by appropriate technical and procedural means, ensure at the least that: (a) the signature-creation-data used for signature generation can practically occur only once, and that their secrecy is reasonably assured; (b) the signature creation data used for signature generation cannot, with reasonable assurance, be derived and the signature is protected against forgery using currently available technology; (c) the signature-creation-data used for signature generation can be reliably protected by the legitimate signatory against the use of others. 2. Secure signature creation devices must not alter the data to be signed or prevent such data from being presented to the signatory prior to the signature process. 21 ANNEX IV RECOMMENDATIONS FOR SECURE SIGNATURE VERIFICATION During the signature-verification process it should be ensured with reasonable certainty that: (a) (b) (c) (d) (e) (f) (g) the data used for verifying the signature correspond to the data displayed to the verifier; the signature is reliably verified and the result of that verification is correctly displayed; the verifier can, as necessary, reliably establish the contents of the signed data; the authenticity and validity of the certificate required at the time of signature verification are reliably verified; the result of verification and the signatory's identity are correctly displayed; the use of a pseudonym is clearly indicated; and any security-relevant changes can be detected. 22