What you need to know about the legality of e-signatures
There has never been a better time for European businesses to switch to digital signatures and associated document management workflows. The EU Electronic Identification and Trust Services Regulation, introduced in 2014 and known as eIDAS, has made the legal framework for e-signatures more consistent and reduced the risks for adopters.
However, as is the case with any technology, some services adhere to extremely stringent regulations while others consider compliance as a less important consideration. Understanding the differences between each type of e-signature and the associated legal certainty is critical when choosing a solution.
Examples that are available today include:
- Basic e-signatures — including mouse squiggles and basic e-marks, signatures drawn on a touch screen and typed names at the end of an email, these are very easy to copy and, unlike ‘wet’ signatures, provide no legal certainty. They can be admitted as evidence in EU jurisdictions, but will easily be disputed in court.
- Biometric e-signatures — these gather information unique to the user before attaching it to a document - for example, the speed and pressure of their signature. Unlike hand-written signatures, they can only be applied and verified using expensive hardware and proprietary software, and, like basic e-signatures, are susceptible to spoofing and hacking.
- E-signatures with witness digital signatures — combining basic e-signature marks applied by the user and digital signatures applied by the service provider, these are verified using the service provider’s logs. They offer an improved level of trust and security, but not necessarily in the medium and long term. What happens if the service provider goes out of business? Without the corresponding logs, there will be no hard evidence that the user in question actually signed the document.
Advanced Electronic Signatures
All businesses require legal certainty when signing documents. To ensure documentation is legally valid, businesses should opt for Advanced Electronic Signatures (AES). This special subset of e-signatures requires each user to have their own unique cryptographic signing key based on PKI (Public Key Infrastructure) technology, which provides firm proof of the signer’s identity.
Solutions can embed not only the e-signature into the document, but also additional information such as the user’s e-ID, reason for signing and trusted timestamp to prove time of signing. Provided they conform to the PDF document signing standard PAdES, set by the European standards body ETSI, AES signatures will be legally recognised across Europe.
AES solutions, which can be easily integrated into existing software by a service provider, are the middle ground between basic and top-end EU qualified signatures - the latter requires face-to-face registration with a digital Certificate Authority (CA) and investment in special tamper-resistant hardware which, though more expensive, provides increased security that businesses dealing in sensitive data require.
AES solutions are cost-effective, easy to use and crucially provide users with the evidence needed to prove their identity or that a signature has been compromised. Where even stronger levels of non-repudiation are required, EU qualified signatures are recommended.
The benefits of switching to e-signing can be considerable. They include reduced costs, increased speed and efficiency and improved customer experience. Return on investment is rapid since relatively little capital outlay is usually required.
That said, without a solution that complies with long-term validation standards, the risks of adoption will outweigh any advantages. Businesses must conduct due diligence when assessing which e-signature is right for them. There is no value in a solution that easily integrates into employee workflows, only to fail to hold up in court when contested.
By Liaquat Khan, Technical Director, SigningHub
GfK and VMware: Innovating together on hybrid cloud
GfK has been the global leader in data and analytics for more than 85 years, supplying its clients with optimised decision inputs.
In its capacity as a strategic and technical partner, VMware has been walking GfK along its digital transformation path for over a decade.
“We are a demanding and singularly dynamic customer, which is why a close partnership with VMware is integral to the success of everyone involved,” said Joerg Hesselink, Global Head of Infrastructure, GfK IT Services.
Four years ago, the Nuremberg-based researcher expanded its on-premises infrastructure by introducing VMware vRealize Automation. In doing so, it laid a solid foundation, resulting in a self-service hybrid-cloud environment.
By expanding on the basis of VMware Cloud on AWS and VMware Cloud Foundation with vRealize Cloud Management, GfK has given itself a secure infrastructure and reliable operations by efficiently operating processes, policies, people and tools in both private and public cloud environments.
One important step for GfK involved migrating from multiple cloud providers to just a single one. The team chose VMware.
“VMware is the market leader for on-premises virtualisation and hybrid-cloud solutions, so it was only logical to tackle the next project for the future together,” says Hesselink.
Migration to the VMware-based environment was integrated into existing hardware simply and smoothly in April 2020. Going forward, GfK’s new hybrid cloud model will establish a harmonised core system complete with VMware Cloud on AWS, VMware Cloud Foundation with vRealize Cloud Management and a volume rising from an initial 500 VMs to a total of 4,000 VMs.
“We are modernising, protecting and scaling our applications with the world’s leading hybrid cloud solution: VMware Cloud on AWS, following VMware on Google Cloud Platform,” adds Hesselink.
The hybrid cloud-based infrastructure also empowers GfK to respond to new and future projects with astonishing agility: Resources can now be shifted quickly and easily from the private to the public cloud – without modifying the nature of interaction with the environment.
The gfknewron project is a good example – the company’s latest AI-powered product is based exclusively on public cloud technology. The consistency guaranteed by VMware Cloud on AWS eases the burden on both regular staff and the IT team. Better still, since the teams are already familiar with the VMware environment, the learning curve for upskilling is short.
One very important factor for the GfK was that VMware Cloud on AWS constituted an investment in future-proof technology that will stay relevant.
“The new cloud-based infrastructure comprising VMware Cloud on AWS and VMware Cloud Foundation forges a successful link between on-premises and cloud-based solutions,” says Hesselink. “That in turn enables GfK to efficiently develop its own modern applications and solutions.
“In market research, everything is data-driven. So, we need the best technological basis to efficiently process large volumes of data and consistently distill them into logical insights that genuinely benefit the client.
“We transform data and information into actionable knowledge that serves as a sustainable driver of business growth. VMware Cloud on AWS is an investment in a platform that helps us be well prepared for whatever the future may hold.”