What is a digital signature – 3 levels

What qualifies as an electronic signature and how legally secure it is is defined in the European Regulation on electronic identification and trust services for electronic transactions (eIDAS Regulation for short).

What is a digital signature

There are three levels of electronic signature with different levels of security:

• the simple electronic signature (SES)

• the advanced electronic signature (AES)

• the qualified electronic signature (QES)

According to the definition in the eIDAS Regulation, electronic signatures are: “data in electronic form which is attached to or logically associated with other electronic data and which is used by the signatory to sign.”

In order to be legally secure, an electronic signature or e-signature must of course comply with the requirements of the eIDAS Regulation. Under eIDAS, the European Union regulates electronic identification and trust service providers (TSPs) for digital transactions for its Member States.

The electronic signature / e-signature must use an electronic certificate and verify the identity of the signatory. Furthermore, there must be no evidence that the document has been altered since it was signed.

A list of TSPs recognised by the official certification authority can be found on the website of the European Commission.

But what is the difference between the three types of e-signatures mentioned above?

The three types differ in the way they implement the criteria mentioned above and consequently in their probative value. Depending on the business transaction or indeed the value of the transaction, it does not always make sense to use a multi-step identification process as in the QES, if the SES or AES also offer an appropriate level of security.

The three levels in detail

Simple Electronic Signature (SES)

The "simple" signature is not just simple in name, but also in practice. Precisely because it works so simply, we already encounter it today in many areas of daily life. Probably the most well-known example is the signature on a terminal for parcel couriers.
The catch is that there are no binding requirements for the SES. Therefore, something can be signed or a signature can be inserted without any identity verification.
The issue with this is obvious. The probative value of a document signed in this way is more than flimsy.

That is why we at tegoly follow a secure path to make even the lowest level of electronic signature as legally robust as possible while remaining as user-friendly as possible.

A non-alterable log file is automatically created for each signature process, which:

1. Is unequivocally assigned to the signed document
2. Stores the personal email address to which the document was sent for signature
3. Captures the date and time of the signature
4. Records the IP address from which the signature was made

The SES can be used without hesitation wherever:

a. the commercial risk - i.e. the contract value - is not too high
b. the signatory has a strong interest in fulfilling the order/contract

such as employment contracts, lease agreements, company insurance policies, etc.
Our customers use the SES for, among other things: letters of engagement, various types of minutes, offers, order confirmations, cost estimates, different types of employment contracts, insurance policies, tenancy agreements, company collective agreements, privacy policies, NDAs, etc.

Advanced Electronic Signature (AES)

The advanced electronic signature is recommended for financial transactions or signing documents where significant legal risks may exist.

Requirements

For the advanced electronic signature (AES), stricter criteria apply for identity verification, giving it higher probative value, which is also laid down in the eIDAS Regulation.

Therefore, the AES must:

– be uniquely linked to the signatory

– enable the signatory to be identified

– be created using means under the sole control of the signatory, such as a telephone, tablet or PC;

– and ensure that the legal act to which it refers cannot be amended

An advanced electronic signature must be created using electronic signature-creation data which the signatory can, with a high level of confidence, use under his sole control. In addition, the advanced electronic signature must be uniquely linked to the signatory, enable their identification, and be linked to the signed data in such a way that any subsequent change of the data can be detected. This is done either via the verification key assigned to the signature creator or, if applicable, by means of biometric signatures captured during the signature creation.

Example documents

– Partnership agreements (GbR, OHG, KG under German law / general partnerships)

– Patent, trademark or copyright agreements

– Social security / pension insurance documents

– Open-ended lease agreements without price indexation clauses

Personal insurance policies, such as life insurance, accident insurance or occupational disability insurance, which do not fall under the Money Laundering Act

Qualified Electronic Signature (QES)

The qualified electronic signature (QES) is the highest form of electronic identification. However, due to its strict requirements, it is only used in certain cases.

Requirements

Only documents with a qualified electronic signature can, in electronic form, replace a legally required written form on paper. In accordance with the European Directive, a qualified electronic signature is an advanced electronic signature that is based on a qualified certificate valid at the time of its creation and created with a secure signature creation device.

Example documents

Official business: registration in the commercial register, advance VAT return to the tax office, annual financial statements, management reports, audit reports

1. Receipts

2. Temporary employment contracts or part-time employment contracts

3. Temporary agency work contracts (employee leasing)

4. Fixed-term tenancy agreements with a term of over one year (real estate)

5. Graduated or indexed lease or rental agreements (real estate)

6. Termination letters for lease or rental agreements (real estate)

7. Capital-forming personal insurance policies with premium refund

8. Life insurance on the death of another person

9. Broker power of attorney

10. Consumer loan agreements

11. SEPA direct debit mandates

12. Bank account opening

13. Activation of SIM cards

14. Electronic patient records

15. e-procurement of public contracts

16. Electronic waste consignment note procedure

Which procedure is the right one for me?

A careful balance must be struck here, as the distinction between a simple and an advanced signature is not sufficiently sharp. It is up to the contracting parties to decide whether security takes precedence over user-friendliness or vice versa.

The following 3 steps serve as a guide for decision-making:

– Consideration of regulations and the law, e.g. what type of contract is to be signed and with whom

– Consideration of risks and opportunities: corporate image, impact on productivity, cost savings, etc.

– Choice of e-signature (SES, AES, QES), balancing user-friendliness and security needs

Click here for the digital signature by tegolySIGN.