The European Forum on Electronic Signature (EFPE) is one of largest international conferences in Europe devoted to electronic signatures and PKI. This year, 15th edition of EFPE 2015 with the leading topic being “New legal and technological order in international electronic economy: eIDAS Regulation – from electronic signatures to trust services”, was held on 10-12 June 2015 in Międzyzdroje (Poland).
EFPE 2015 was attended by over 130 participants from 27 countries. Among them were representatives of European Commission, ETSI, large institutions using trust services (including government offices and agencies), producers of software or hardware solutions or trust service providers related to electronic signature and electronic identification.
The eIDAS Regulation on electronic identification and trusted services requires service providers and supervisors bodies to make meaningful efforts to adopt new requirements for solutions and IT systems existing on the market. According to Art. 52 eIDAS Regulation shall be applied (except some cases counted in Art. 52 (2)) from 1 July 2016. Furthermore, a certification-service-provider issuing before 1 July 2016 qualified certificates under Directive 1999/93/EC should submit a conformity assessment report to the national supervisory body not later than 1 July 2017. After this date such a certification-service-provider shall not be considered as qualified trust service provider under eIDAS Regulation. Hence, trust service providers and developers are essentially interested for publishing of implementation acts and standard documents that allow them to adopt existing and new trust services according with the requirements stated there.
Participants to the Conference pointed to the need for a comprehensive approach to implementing legislative changes in national legal framework. eIDAS Regulation requires careful harmonization with national law, while preserving the letter and spirit of Regulation.
Trust services legal effects defined in eIDAS Regulation must be explicit for users regardless of the fact where the EU member come from.
Participants to the Conference pointed out that it is important to identify not only many challenges in implementing eIDAS in certain EU member States, but also to evaluate what is the impact of eIDAS outside the EU. This is important practical problem because there is no common legal ground between the EU and other countries, although legal systems may be similar and trust services can be provided under the same conditions. The participants stressed that at EU level would be good practice to determine the recommendation for implementation of Art. 14 concerning international aspects of electronic identification and trust services recognition that are provided to or by third parties (non-EU Member States).
A large number of dedicated trust services would be too difficult to use for relying parties and will be not compatible with the postulate cited, for example in Preamble (57), which states that the validation of qualified electronic signature should be made easy and convenient for all parties at Union level. For this reason the trust services should be aggregated according to rules prepared by the normalization body (for example ETSI) as a standard on Trusted List (TL).
Public administration that intends to provide trust services to the public should do it on equal and competitive rules with commercial subjects. Participants to the conference reiterate the belief expressed in last years’ conferences that the public administration should increasingly rely on commercial solutions offered by service providers operating on the digital market.
In the internal instruments, it would be also worth recommending to include areas not covered directly by eIDAS regulation, for example trusted services and identification. International aspects of trust services and ID-escrow are examples of such challenges.
This final document has been prepared by international experts and participants during the EFPE 2015. This document has been translated into English, Polish and Russian and presented for acceptance by participants of the conference. We ask policy makers and lawmakers to consider this modest contribution to the European discussion in their future efforts.KEEP READING
The Controller of your personal data is Asseco Data Systems S.A. seated in Gdynia, ul. Podolska 21, 81-321 Gdynia, KRS No: 0000421310.
You can contact us:
Data Protection Officer
We have appointed a Data Protection Officer whom you can contact:
Objectives and legal basis of the processing
We will process your personal data to:
Data retention period
Your personal data will be stored until you withdraw your consent to receive marketing information.
Recipients of personal data.
In accordance with applicable data protection laws, we provide your personal data:
Your rights in relation to the processing of personal data
You have the following rights related to the processing of personal data:
Right to lodge a complaint
You have the right to lodge a complaint with the President of the Office for Personal Data Protection (to the address: Stawki 2, 00-193 Warsaw), if you think that the processing of your personal data concerning you violates the provisions of the Regulation.
Transfers of personal data to third countries
Your personal data will be stored on servers located in the European Union; however, in connection with Asseco Data Systems S.A.‘s use of cloud solutions provided by Microsoft, they may be transferred — on the basis of standard data protection clauses — to a third country. Microsoft’s standard contractual clauses in line with the templates approved by the European Commission are available at the following address: https://www.microsoft.com/en-us/licensing/product-licensing/products.aspx in the Online Services Terms (OST) section.
Requirement to provide personal data
The provision of your data is voluntary, but it is necessary for us to send information, including marketing information, by electronic means of communication.
Automatic data processing and profiling
Your data will be processed automatically, including in the form of profiling. Automated decision making will be carried out on the basis of processing of personal data provided when completing the form and data concerning activity in the Services and activity connected with our e-mail communication with you, the consequence of such processing will be to match marketing information concerning our products and services which may be of interest to you.