Electronic Signature

An electronic signature is any data in electronic form that a person attaches to other electronic data, or associates with it, in order to sign. That is the definition in Article 3(10) of the eIDAS Regulation. The person who signs is called the signatory, and Article 3(9) says a signatory is a natural person.

The definition turns on what the data is used for. It names no technology, no certificate and no identity check. A name typed at the foot of an email can be an electronic signature. So can a signature created with a cryptographic key on a certified device. Both sit under the same heading in the regulation, which is why the term on its own says little about how strong a signature is.

People often say "digital signature" when they mean an electronic signature. The two are not the same. A digital signature is a cryptographic technique. The stronger kinds of electronic signature are built on it, but the legal term is wider.

There are three, and each sits inside the one before. Article 3 defines an electronic signature in point (10), an advanced electronic signature in point (11) and a qualified electronic signature in point (12).

The first level is the bare definition. The market calls it a simple electronic signature, a word the regulation does not use. An advanced electronic signature is an electronic signature that also meets the four requirements of Article 26: it is uniquely linked to the signatory, can identify them, is created with data under their sole control, and shows any later change to the signed data. A qualified electronic signature is an advanced one with two additions: it is created by a qualified electronic signature creation device, and it is based on a qualified certificate.

Every qualified signature is therefore also an advanced signature, and every advanced signature is also an electronic signature. The reverse does not hold. A contract clause or a policy that says "electronic signature" without naming a level lets in all three. The differences in identity checks, evidence and legal effect are set out in simple, advanced and qualified signatures compared.

Yes, in the sense that it cannot be refused for being electronic. Article 25(1) says an electronic signature shall not be denied legal effect or admissibility as evidence in legal proceedings solely because it is in electronic form, or because it does not meet the requirements for qualified electronic signatures. The rule covers all three levels.

Only one level gets more than that. Under Article 25(2), a qualified electronic signature has the equivalent legal effect of a handwritten signature. Article 24a(1) adds that a qualified electronic signature based on a qualified certificate issued in one member state is recognised as qualified in all the others.

Article 25 sets no presumption, at any level, about who signed or whether the document is intact. For signatures below the qualified level it stops at the rule against refusal. A party that relies on such a signature in a dispute must be ready to prove both, and the court weighs that proof under its national rules of evidence.

When a rule about the form of the document says so. Article 2(3) states that eIDAS does not affect Union or national law on the conclusion and validity of contracts, or other legal or procedural obligations relating to form. The regulation decides what an electronic signature is. Other law still decides which documents need a signature at all, of what kind, and whether anything more is needed.

A firm can ask three questions about a document. Does any law prescribe a form for it? If so, does that form accept an electronic signature, and at which level? Does the form require something that no signature supplies, such as a notary or a witness? Where no form is prescribed, the choice of level is a question of evidence. How likely is it that the signer's identity will be disputed, and how much is at stake if it is?

Public bodies follow a rule of their own. Where a member state requires an advanced electronic signature for an online public service, it must also recognise qualified ones. For cross-border use of such a service, it may not ask for a higher security level than the qualified electronic signature (Article 27).