'The new EU regulation on electronic identification and trust services for electronic transactions - An overview'

Transcription

1 Business and Economics 'The new EU regulation on electronic identification and trust services for electronic transactions - An overview' Dr. Aashish Srivastava Senior. Lecturer Dept of Business Law and Taxation Monash University, Clayton Campus, Melbourne, Australia Osijek Conference October 2014

2 Why EU Regulation is important for Croatia Croatia became the 28th EU country on 1 July Croatia is expected to join the Schengen area by 2015, Croatia may also change the kuna for the euro as soon as its economy meets the criteria on inflation, public finances, exchange-rate stability and interest rates. Like other EU countries, Croatia must implement laws agreed at EU level. This includes the new EU Regulation 910/

3 New EU Regulation REGULATION (EU) No 910/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC Came into force on 17 September 2014 Regulation shall apply from 1 July 2016 (with certain exceptions) 3

4 Why a New EU Regulation? Europe 2020 Initiative Digital Agenda for Europe Seven Pillars Pillar I Digital Single Market within EU Borders Remove current existing barriers for the free flow of online services, including e-commerce and e-government within EU borders. (within EU member country egovernment is appx 72% but across borders is only 42%. An EU-level Law for Digital Single Market does not exists. There is EU Directive 1999/93/EC on a Community framework for electronic signature BUT is INADEQUATE 4

5 Why EU Directive on e-signatures 1999 is INADEQUATE? Focuses only on e-signatures and not on other forms of electronic transactions (e.g. e-identification and e- authentication). Does not cover new technologies that emerged since 1999( e.g. mobile and cloud signing) - Directive has not been properly adopted by member states - resulting in (M. Imp)- Different member states having different e-signature laws» Interoperability issues in e-signature law» Mutual recognition issues» Additional burden (cost) on member states to asses the validation of an e-signature arising from another member state and vice-versa.» Directive repealed w.e.f 1 July

6 REGULATION (EU) No 910/2014 Legal certainty with regard to electronic transactions within EU Public Procurement (E-Procurement): A company in country X (e.g. Croatia) can participate electronically to a public call for tender launched by a govt institution in country Y (e.g. Germany) without worrying about national requirements and interoperability problems. Just one per cent cut in cost in public procurement will result in the saving of 20 billion euros a year. B2B Contracts: Contracts can be formed within minutes using electronic documents, electronic signature, company seal (eseal) and time stamp. (e.g. in Estonia time to form a company 20 minutes) 6

7 REGULATION (EU) No 910/2014 E-health - A doctor in country X (e.g. France) can access health records of a patient from country Y (e.g. Croatia) who is in country X on work or holiday. E-Tax - Citizens and companies can submit tax returns online to a tax office in another member state saving them time, hassle and money. University Admission A prospective university student in Croatia can enrol electronically in a foreign university without requiring to submit any paper documents. 7

8 8

9 REGULATION (EU) No 910/2014 The Regulation aims to offer convenience and confidence to every consumer, every government and every business within EU by providing clear rules that add trust to E-identification Trust Services Electronic signatures Electronic Seals (legal person) Time Stamping Electronic Registered Delivery Service Website authentication 9

10 Electronic Identification (e-id) [Chapter II-Art 6-Art 12] To date - most EU member states have introduced some form of e-id scheme - however they differ in many aspects with each other (Legal barrier). Mutual recognition and acceptance of e-id schemes falling under a notified scheme under the Regulation thus removing the legal barrier. So, the regulation aims for a (voluntary) notified e-id scheme 10

11 Electronic Identification (e-id) [Chapter II-Art 6-Art 12] Does not oblige member states to introduce or notify e-id schemes BUT to recognise and accept notified e-ids for those online services where e-id is required to get access at national level. 11

12 National e-id Scheme issued by Member States or under their mandate or approval to be notified (voluntary) to the European Commission to be published in the Notification List (Croatia) (Portugal) e-id Means (N-eidM) (Austria) (Germany) (France) (Italy) (Spain) PIN - Card CHIP+ PIN CHIP + BIOMETRIC LOW Substantial HIGH 12

13 e-id Means (N-eidM) PIN - Card CHIP+ PIN PUBLIC SECTOR BODY CHIP + BIOMETRIC Germany s N-eidM SHALL be recognised as a valid eidm to access Croatia s public sector body provided: 1.The N-eidS has been notified by Germany to the European Commission and is in the Notification List of the Commission AND 2. The e-idm has an assurance level similar or higher than required by the public sector body 13

14 Notification List to the Commission (Croatia) (Portugal) (Austria) e-id Means (N-eidM) PIN - Card LOW (France) CHIP+ PIN CHIP + BIOMETRIC Substantial HIGH (Italy) (Spain) National e-id Scheme (NeidS) (Germany) 14

15 By 18 Sept 2015 the Commission by means of implementing Act shall mention technical standards/procedures for assurance levels low, Substantial, High. {Art 8(3)} 15

16 TRUST SERVICES Chapter III (Art 13 Art 45) Trust Services Electronic signatures Electronic Seals Time Stamping Electronic Registered Delivery Service Website authentication trust service means an electronic service normally provided for remuneration by a trust service provider which consists of: (a) the creation, verification, and validation of electronic signatures, electronic seals or electronic time stamps, electronic registered delivery services and certificates related to those services, or (b) the creation, verification and validation of certificates for website authentication; or (c) the preservation of electronic signatures, seals or certificates related to those services; 16

17 SUPERVISORY BODY (CCA) To supervise TSPs that they follow the Regulation and take necessary actions if they don t. TSP TSP TSP TSP TSP TSP- also referred as Certification Authority (CA-e.g. India) or Certification Service Provider (CSP e.g. Croatia) Qualified TSP Non-Qualified TSP 1. Electronic Signature 2. Electronic Seal 3. Time Stamp 4. Registered Delivery Service 17

18 Supervisory body in two different countries in the EU. Mutual Assistance SUPERVISORY BODY To supervise TSPs that they follow the Regulation and take necessary actions if they don t. SUPERVISORY BODY To supervise TSPs that they follow the Regulation and take necessary actions if they don t. 18

19 Audit atleast every 24 months audit 1 Conformity Assessment Body Qualified TSP Check that they are following the Regulation and any standards and procedures mentioned in the implementing Act. SUPERVISORY BODY. 19

20 Outside eu e.g. Australia Qualified Trust Service Provider (CA/CSP) Trust Service Provider (CA/CSP) Qualified Trust Service Through an Agreement between EU and Australia or EU and an Int Org e.g. APEC Two Require ments Trust Service 1. Similar requirements in third country as EU for QTS AND 2. Third country recognises QTS as equivalent to their Trust Service 20

21 Website Authentication website you entered is genuine and not fake. e.g. website is linked to the tax office E-id Identify yourself (authenticate) using an eid means Creation of tax declaration E-Registered delivery: Tax authority sends Acknowledgement Of receipt Time Stamp Proof of submission of tax declaration in due time E-Signature/E- Seal Signing or sealing the tax declaration Preservation: Storage of the tax declaration And acknowledgement of receipt Evidence Source: Andrea Servida, DG Connect, European Commission 21

22 RECAP- EFFECT OF THE NEW REGULATION MAY notify the e-id scheme in their country for access to its public services. MUST recognise notified e-id scheme for cross-border access to its online services when its national laws mandate e- identification. 22

23 TIMELINE Entry into force of the regulation: Sept 2014 Voluntary recognition of eids: 2015 Date of application for rules for trust services: 2016 Mandatory recognition of eids:

24 24

25 THANK YOU 25

26 Electronic Signature Electronic signature is a technology-neutral term and described as data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign. Electronic Signatures Digital Signature eg, PIN, password, scanned manuscript signature, typed name at the bottom of and even an header. 26

27 Digital Signature Electronic Signatures Digital Signature A technologically specific mechanism based on the technology of public key cryptography (PKC). In PKC a digital signature subscriber has two cryptography keys: a private key and a public key. Both keys are unique to the subscriber and work as a functioning key pair. Key pairs and digital signature certificates are issued by bodies known as Certification Authorities (CAs). 27