WHITEPAPER Ultimate Guide About Electronic Signatures

Transcription

1Ultimate guideabout electronicsignaturesUpdate 2021Everything you want to know about electronic signatures.Including a straight-forward checklist which will helpyou choose the best solution for your company.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SWHIT EPA P E R

201Introduction0405How do electronic signatures work?2402What is an electronic signature?06Examples of electronic signature methods26Difference between an electronic and digital signature070607Integration with systems and software3208The use cases are endless3409Checklist for choosing an electronic360304Are electronic signatures legally binding?eIDAS10UETA & eSIGN Act12ZertES14Advantages of electronic signatures16Efficiency16User Experience17Legal Compliance18Security19Positive impact on sustainability20Summary of advantages22signature solutionU LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E STable of contents

IntroductionU LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E S013

4aiming to deal with daily processes in a digital andtherefore much more efficient and secure way. Yetoddly enough, when it comes down to concludingimportant and legally binding agreements or sharingtrusted information, many companies remainedreliant on paper.That is why 2020 has become a real turning point.At a rapid pace they had to change their digitalThe spread of COVID-19, the continuation of socialhabits and adopt new ones. The legislation anddistancing and the continuously increasing numberregulations concerning electronic transactions/of employees working from home, have inevitablysignatures become key to respond to businesses’impacted the way people conduct their businesses,changing needs. If they had not already, businessesincluding operations as essential as signingall over the world are adding electronic signaturesagreements and contracts. The Covid-19 pandemicto their toolkits or expanding the use of it. A quitehas forced companies, consumers, employees tological evolution as electronic signatures workflowsdigitize fully and quickly to be able to maintainare indispensable when it comes to keep businessbusiness continuity.moving in a remote world.In this whitepaper we guide you through everythingElectronic signatures workflows areindispensable when it comes to keepbusiness moving in a remote world.you need to know about electronic signatures. Wewill help you evaluate, choose, and deploy the bestelectronic signature solution for your business.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SSince the digital age, many organizations are

What is anelectronic signature?U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E S025

6the handwritten version in the offline world.Technically, it is a mathematical code that ensuresthe document cannot be changed after signing.This also goes for elements related to theidentity of the person. Legally, it captures aperson’s intent to agree to the content of a(n)electronic document, contract or a set of data.D E CUOL MT IPMLAETTEE GGUI DI DS EOAVBE OR UDTI GE ILTEACLTER HOANNI CD ST IEGKNEAN TI NUGR EE NSA digital signature is the digital counterpart of

7You may have noticed that the terms electronicsignatures and digital signatures are used interchangeably. However, there is a difference. A digitalsignature is always an electronic signature while anelectronic signature is not always a digital signature.Digital signatures are thus the most advanced and securetype of electronic signatures. They use the standardsThe difference is that a digital signature relies on acryptography-based technology which provides anand procedures of Public Key Infrastructure (PKI) to signelectronic data with a cryptographic key. The contentsextra level of security and integrity of the document.of the message cannot be modified or tampered with,An electronic signature, on the other hand, can bewithout breaking the validity of the digital signature.merely the image of your signature pasted in a Worddocument. It can even be your mail signature.You can use digital signatures to comply with the mostdemanding regulatory requirements as they provide thehighest levels of assurance about each signer’s identityand the authenticity/integrity of the documents they sign.In this whitepaper we will use the term 'electronic signature'instead of 'digital signature' for the sake of convenience andbecause it is the most commonly used term.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E STHE DI FFERENCE BE T WE EN A NELE CTRONI C AND D I GI TAL S IG NAT URE

Are electronic signatureslegally binding?U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E S038

9To learn the details, we encourage you to downloadAn electronic signature is legally recognized andour legal whitepaper with an assessmentenforceable in almost every part of the world.conducted by DLA Piper. For now, in the followingpages, you can read what you should know about:Since 2016, eIDAS, the European legal frameworkon electronic signatures, has become directlyy eIDASapplicable to all member states of the Europeany UETA & eSIGN ACT (United States)Union. In the United States you have similary FAES (“ZertES” in German) (Switzerland)regulations called UETA and eSign Act which isapplicable since 2002.Other countries have enacted similar laws as well.Even less-developed countries are beginningto enact electronic signature laws, which havepotentially been left unexploited in the past. Todaythey are becoming a key element to respond tobusinesses’ changing needs.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SYes.

10On July 1 2016, the electronic IDentification,The differences between these types are mainlyAuthentication and trust Services for electronicbased on 4 key items:transactions regulation(eIDAS) established a(eIDAS) established a new legal structure forelectronic identification, signatures, seals anddocuments throughout the EU. This EU regulationclassifies electronic signatures by the level ofassurance they offer. We will explain what thisy AuthenticityIs the signature uniquely linked to the signer?y IdentityAre you capable to identify the signer?y Integritymeans in the table below. But first you need toIs the signature linked to the data signedknow there are three types of electronic signatures:in such a way that any subsequentchange in the data is detectable?Basic or Simple Electronic Signature (SES)y AuthenticationHow confident are you that the signature isAdvanced Electronic SignatureQualified electronic signature (QES)created under the sole control of the signer?U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E Se IDAS

11S I M P L E O R BAS I C ( S ES)DefinitionADVAN CED (AES)QUALIFIED (QES)All electronic forms of signatures that prove acceptance orThis signature must meet specific requirements providing aA qualified or non-repudiation signature is the only electronicapproval by the signer. This can be a scanned image of ahigher level of signer ID verification, security, and tamper-signature type to have special legal status in EU. Unlike thesignature, a signature manually drawn on a desktop screensealing (meaning the document cannot be changed once itother signatures, the burden of proof lies with the party that(& digitally saved), a click on an “I accept” button, etc.is signed).disputes the signature(s), not with the initiator.This makes is legally equivalent to a written signature. It isbacked by a certificate issued by a trust service providerthat is on the EU Trusted List (ETL) and certified by an EUmember state.IntegrityContent cannot be changed after signature.Content cannot be changed after signature.Content cannot be changed after signature.Identity of signerIdentity of signer is not checked.High probability of identifying the signer.100% Capable of identifying the signer. Initial face-to-faceverification or another equivalent process is required.AuthenticityNot certain that the signature is uniquely linked to the signer.Certain that the signature is uniquely linked to the signer.Certain that the signature is uniquely linked to the signer.AuthenticationNot certain that the signature is created under the soleCertain that the signature is created under the sole controlCertain that the signature is created under the sole controlcontrol of the signatory.of the signatory. Multi-factor authentication is optional.of the signatory. Multi-factor authentication is required.HardwareNot needed.Secure Signature Creation Device (SSCD) needed.Qualified Signature Creation Device (QSCD) needed.Legal validityLegally irrefutable. Burden of proof lies with the party thatLegally irrefutable. Burden of proof lies with the party thatLegally irrefutable. Burden of proof lies with the party thatinitiated the signature.initiated the signature.disputes the signature.Following signing methods can be either a basic or advancedFollowing signing methods can be either a basic or advancedThe qualified electronic signature always comes with anelectronic signature depending on the process: Manual,electronic signature depending on the process: Manual,e-identity and a card reader or token, or another specificBiometric, Banking card / iDIN, SMS or mail a One TimeBiometric, Banking card / iDIN, SMS or mail a One Timecertificate.Password (OTP)Password (OTP)ExamplesU LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SIn this table we will explain how the three types differ in these aspects:

12The United States has a two-tier structure of lawsIt means that ESIGN is directly applicable to each- federal and state. Federal applies to the entireof the U.S. states. While that each state of the U.S.nation and to transactions involving parties ofmay choose to enact UETA, in full or in part, or indifferent states; while state laws apply only to themodified form, as state law. Forty-seven (47) of thespecific state and transactions conducted withinU.S. states have adopted UETA in some form.that state. With respect to the U.S. eCommerceLaws, Electronic Signatures in Global and NationalCommerce Act (ESIGN) was enacted at the federallevel while Uniform Electronic Transactions Act(UETA) is enacted at the state level.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SU E TA & ESI GN ACT (UNI TE D STAT ES )

13standards for compliance. There are four major3Clear signature associationIn order to qualify as an electronic signaturerequirements for an electronic signature tounder the ESIGN Act and UETA, the electronicbe recognized as valid under U.S. law. Thosesignature must be linked or logicallyrequirements are:associated with the record and the signer.41Record retentionU.S. laws on eSignatures and electronicIntent to signtransactions require that each electronic recordJust like traditional wet ink signatures,accurately reflects the information in theelectronic signatures are valid only if eachdocument the electronic record should remainparty demonstrates a clear intent to sign.accessible to all persons entitled by law toaccess for the period of time required by law2Consent to do business electronicallyEach party to the transaction must agreeand the electronic record should be in a formcapable of being accurately reproduced forto use electronic records and electroniclater reference.signatures in place of written documents and(Source: https://www.dlapiper.com/en/us/insights/manual o-you-This agreement may be express, or impliedwant-to-go-digital/)from the circumstances, except for consumertransactions, where the ESIGN ConsumerConsent Process must be followed. Signersalso have the option to opt-out.(Source: DLA Piper)U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SBoth ESIGN and UETA clearly define certain

14U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SFAES ( “ Z ERT ES” IN G ERM AN)(SW ITZ ERLAND)On December 19, 2003 electronic signatures werelegalized in Switzerland when the Federal Law onElectronic Signatures (further referred to as ZertES)came into effect.The Swiss Federal Act on Electronic Signatures(the FAES) regulates the conditions under whichservice providers may use certification serviceswith electronic signatures. Additionally, the FAESThe FAES' tiered structure and standards of legalprovides a framework outlining the provider'svalue are similar to those of European Union'sobligations and rights applicable to the provisioneIDAS Regulation. In the FAES regulations, nextof certification services. The law promotes the useto the general notion and concept of "electronicof secure services for electronic certification tosignatures", there are three additional variants,facilitate the use of qualified electronic signatures.namely simple, advanced and qualified electronicUnder FAES, the electronic signature is equal to asignatures just like eIDAS.handwritten signature.It means that Qualified Electronic Signatures arefully court-admissible, while the other electronicSignatures require more evidence to be validated.

Advantages ofelectronic signaturesU LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E S0415

16Within the office you no longer need to:many advantages of which efficiency, userexperience, legal compliance, security, positiveimpact on sustainability are the most important.y Wait for the signatory to be available for awet signature;y Sign, print, scan and manually post adocument;y Manually archive documents;y Manually verify if the documents have beensigned by the right (mandated person)Towards your customers you can speed up yourEF FIC IENCYentire business lifecycle. Electronic signatures will:Too often, finalizing a commercial or any othery Allow you to save time on contract creationbusiness process can turn into a time-consumingy Enable everyone inside and outside thenightmare full of tedious paperwork. Time isspent conducting repetitive administrative tasksrather than achieving effective goals. That is whyeverybody is trying to optimize the process time byworking digitally. Introducing electronic signaturescan be another step to accelerate your business.organisation to sign any time from any devicey Streamline the whole approval and signatureprocess and make it error proofy Enable the same level of security and trust aswith conventional documentsy Help you close deals fasterU LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SThe use of electronic signatures brings along

17User experience is a customer’s perception of theirMoreover, all kind of devices can be used, whichinteraction with your organisation. It is shapedmakes electronic signing extremely user friendly.by the contact moments they have with yourNo more piles of paper to initial or paper workcompany. By leveraging electronic signatures youto archive. Just send the contract by e-mailcan improve these interactions. These signatures(automatically or manually) and get the deal closedprovide the convenience that documents can bewithin minutes.signed everywhere: while they are on holiday, a loancan be made definitive; deals can be closed quickly.Think about a one-time-offer at a fair. Even at yourdoorstep you can easily confirm the delivery of anorder.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SUSER EXPE RI E NCE

18In recent years, most countries worldwide haveadopted legislation and regulations that recognisethe legality of electronic signatures and deem it abinding signature. In Europe, thanks to the eIDASregulation, we have a legal platform, that allowsthe cross border usage and validation of electronicsignatures. Under this regulation all signature typesare treated equally in court.Electronic signatures provide authenticity andensure that the signer s identity is verified. This canstand in any court of law like any other signed paperdocument. By choosing a solution that is compliantto the relevant regulation, you ensure yourself to becompliant to these legal requirements.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SLE GAL COM PLI ANCE

169When it comes to signatures, authenticity andElectronic signatures are also efficient in a way thatsecurity are priorities. Each type of electronicthey are less error prone. Manual checks are a highersignature is already more secure than a manualrisk than automated processes. Another advantagesignature on paper. Certainly in case of anwith regards to security, is that electronic signatureselectronic signature. Thanks to the encryption ofallow you to set up an administration of consents,the document, you have the guarantee that thewhich is mandatory under GDPR law.document remained unchanged after signing. Withan electronic signature you also always sign theDepending on the type of security required, you canwhole lot of documents. There is no risk that someadjust the level. Do you need somebody to sign inpages have been added or removed afterwards.for a newsletter or for a 100.000 contract? In thelast case you want to be sure about the identity ofthe mandated person.The technical transfer of signatures differ in securitylevel. When high security is needed, you can includeencryption. By applying the right level, you can findthe right balance between user friendliness andsecurity.L A S IUGLNTAI MTUART EE ÉGLUEI CD TE RAOBNOI QUUT EE DLEACNTS RLOE NS IPC RSOI CGENSASTUUS RREHSS E C URIT Y

20Electronic signatures also come with a great positive impacton our environment and sustainability in general.1Signing remotely, no need to travelBeing able to sign documents electronically eliminatesthe need to travel. Signing can be done remotely, at anyplace in the world by simply using your computer ormobile phone. No business trips required which results ina positive impact on our environment, but also time- andcost savings and a much more pragmatic approach fordoing business in general.2Signing electronically, no need for paper documentsBesides not having to travel for placing handwrittensignatures, electronic signing also contributes to apaperless office. No need for printing, copying, scanningor physically archiving your signed contracts anymoreas the entire process will be digitized. Your company’sfootprint on our environment will be reduced as fromday one you start using electronic signatures. It leadsto less usage of paper, preserving our woods and yourcompany’s CO2 emission will be lowered as from the firstelectronic signature.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SPOS IT IV E IM PACT O N S U STA I N A B I L I T Y

21Signing electronically, no need for physical archivingIn many cases, documents to be signed can be uploadedwithin the electronic signatures tool for electronic signingand subsequently be stored within your companiesdocument management system. The entire process isautomated, meaning the risk of human error throughoutthe signing process is less.Some signing tools even offer the possibility to store andarchive those documents in a secure and safe way byincorporating an archiving component within their signingsolutions.Having not to print these documents (often in multiplecopies), drastically reduces the amount of paper used inyour offices. Additionally, documents are available onlineat any time and accessible from anywhere.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E S3

22E F F IC IE N CYElectronic signatures simplify processes and stronglyCOMPLIANCEWhen choosing an eIDAS compliant solution, thereduce document management time. The signingsignatures are legally valid across European borders.process can be automated, leaving out all manualUnder eIDAS, there are three signature types. All threetasks such as obtaining a signature, printing, scanning,can be legally effective. The difference between them isposting, archiving and verifying.the evidence needed to prove in court that the signatureis genuine and intentionally applied to a particularE N HAN C E C U STOMERRELATION S HIP Sdocument.Your customers expect businesses to provide onlineservices nowadays. Introducing electronic signatureswill provide you with the necessary tools to delight andFUTURE PROOFsatisfy your customers, avoiding customer churn.More and more countries work with a digital ID. This willincrease in the future, as from September 29th 2018, allEuropean citizens and companies must be able to logCOST RE DU CTIONin to organisations in the public sector in other memberElectronic signatures can be incorporated in anystates with their national ID. This will enhance the usebusiness process. It increases employee productivity andof electronic signatures as your national ID can serve asreduces many hours of man power, so employees cana digital identity backing an electronic signature, acrossperform other types of tasks that provide better value.borders.At the same time it drastically reduces administrativecosts. You’ll have a lower consumption of paper, no needSCALABILIT Yfor stamps, and ink, nor physical archive or scanningAs manual actions diminish, more documents can beprocessed and more customers served.facilities.TRAC K YOU R P ROGR ESSNo more losing time chasing signatures ever again.It can be frustrating and time consuming to wonder:“Has he signed yet?” or “Where is my document at?”.Electronic signature software makes it easy to track yourdocuments in an online dashboard, while some softwaresolutions will even give the possibility to send signers areminder email.SE CURIT YWith electronic signatures, you can safeguard yourdocuments with a high level of security and evidence.Each signature is protected with a tamper-proof seal,which alerts you if any part of the document is changedafter signing. Depending on the confidentiality, securitycan be adjusted. For the highest level of confidentiality,stronger types of authentication can be used. Signeddocuments thus come with a highly detailed evidence ofthe signer’s identity which gives you a strong guaranteeMO B IL IT YDocuments can be signed everywhere and on alldevices. This comes in handy for travelling managers butis also convenient for signatures at the door step.on document integrity and the signer’s identity.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SSU MMARY OF ADVANTAGES

How do electronicsignatures work?U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E S0523

24Before signing, a cryptographic function is usedprotocol, called Public Key Infrastructure (PKI). Thisto create a message digest (comparable withprotocol uses cryptographic algorithms to createsome data), called a hash. Afterwards this hash istwo long numbers. These are called keys. One of theencrypted (signed) with the private key of the signerkeys is public, the other one is private.and included in the electronic signature.As electronic signatures are unique to a signer, eachWhen the document arrives at the receiver, anothertime a signer signs the document, the signature ishash will be created. By decrypting the hash thatcreated using the signer’s private key. This privatewas included in the signature you will be able tokey is always securely kept by the signer and iscompare it with the hash that was created for theincluded in the signature when he signs. Basically,document. If they don t match, the receiver of thethe electronic signature securely associates a signerdocument will see that the document is tamperedwith a document in the form of a coded message.with, resulting in an invalid electronic signature.Next to this key, the signature also contains thecertificate of the signer including the public key andother information, like date and time at which thedocument was signed.001011011001010O R I GIN ALDO C U MEN TH ASH CALC ULAT IONEN CRY PTIO NPRIVATE110100101101101PUBLICS I GN EDDO C U MEN TH ASH CALC ULAT ION001011011001010D E CRY PTIO N 001011011001010WHOSEPUB L IC K E YIS TH IS?U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SElectronic signatures are based on a specific

Examples of electronicsignature methodsU LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E S0625

26U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SMany different signing methods exist. It variesfrom simple methods like an approval button ora handwritten signature to more advanced oreven qualified and therefore very secure signingmethods like for example signing with a nationalelectronic ID card.What you need to know is that, depending onthe signing method, a signing process is oftenpreceded by user authentication. This is theprocess of verifying someone s credentials priorto giving access to a system – in this case, signingelectronically.Although authentication doesn't necessarily meanAuthentication contributes to the enforceabilitya more cumbersome user experience it is still moreof signed documents as it validates with whom acomplex and demands more from the user than acompany, organization or institution is transactingsimple scribble with the finger on a smartphone orwith. Whether or not a company decides to askdesktop.for an authentication during the signing processwill depend on the value of the transaction and theIn this section, we want to give you more insights intrade-off with user experience.which signing methods exist today.DISCLAIMER: The information in this section is for general informational purposes only and is not intended to constitute legal advice. Connective does notguarantee the information contained herein is up-to-date or accurate nor we make any statements on the legal validity of signing methods. Please notelegislation governing electronic signatures is changing quickly and can differ in each jurisdiction. If you have questions about the content or statements madein this section, or about whether Connective's solutions fit the needs of your organization, please reach out to a legal professional in your region.

27Manual scribbleA basic, manual signature can be drawn on-screenby simply using your mouse or touchpad or usingyour fingers or a stylus on a touchscreen. This is alsoconsidered as an electronic signature.AaHandwritten signatureWith this signing method you type in your name usingyour keyboard. You will then be able to choose fromdifferent preconfigured handwritten fonts to representyour signature.Approval ButtonA simple click with your mouse on an approval button.This results in an approval signature.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SW ITHOUT AUTH ENTI CATI O N

28Biometric SignatureSigning with a smartcard or token (USB)To sign with a biometric signature a biometric signatureThe most commonly known kind of smartcard that canpad or biometric pen is required. The signature padbe used for electronic signing is the (national) electronicand biometric pen allow to capture the biometricalidentity card of a country like for example LuxID, Estoniancharacteristics of a signature, like where the pen isID, .beID,. Other specific examples of smartcards are thelocated, when the pen tip is pressed down, and how hardBelgian Lawyer ID, the Common Access Card (CAC) orit is pressed down. These biometric data are added to thethe Personal Identity Verification Card (PIV) in the USA,signature, creating a unique biometric signature profile,and many more.which would allow the signature pad manufacturer toverify the authenticity of the signature when required.This smart card contains a personal certificate with aprivate key which is issued by a qualified provider. In orderto sign documents, the signer has to put the smartcardin the card reader or insert the token in the USB port andenter his or her personal PIN code to authenticate him orherself.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SW ITH AUTH ENTI CATI ON

29With a one-time password (OTP) via sms or emaily In some onboarding processes a user identifies himselfWhen signing with an SMT OTP the mobile phone numberby choosing his username (often email address)of the signers must be known. In the signing process theyand password and sometimes by filling in somewill need to enter the last four digits of their phone number.extra information. These credentials can be usedIn return, they'll receive a one-time password via SMS whichto authenticate himself when signing documentsis needed to authenticate themselves.electronically.In case of an Email OTP, the email address of the signer isy If you want to go for a more secure login and passwordneeded. The signer needs to complete the email address.solution for signing, solutions like Swisscom enforce aIn return, a password will be sent to that address which isone-time identification via Face2Face or video to ensureneeded for the authentication.the signers identity. Afterwards the signer can choose toeither create a login and password combination to reusefor authentication purposes or on the signer can chooseto authenticate himself via a mobile application. Thanksto the previous identification, a personal certificate will belinked to the identity, which makes it much more secureresulting in advanced and qualified electronic signatures.y Also, the SSO (Single-Sign-On) principle is an exampleof signing with the login and password signing method.A person can use their credentials that are used to loginto a company’s platform to sign documents. This is oftencombined with a multifactor authentication.U LT I M AT E G U I D E A B O U T E L E C T R O N I C S I G N AT U R E SLogin and password (including SSO)

30Bank Authentication (sometimes in combination withA Mobile identity refers to a person’s digital identity, andMNO s mobile Network operators)the technology used to manage it, meaning an applicationIn some coun

ELECTRONIC AND DIGITAL SIGNATURE You may have noticed that the terms electronic signatures and digital signatures are used inter-changeably. However, there is a difference. A digital signature is always an electronic signature while an electronic signature is not always a digital signature. The difference is that a digital signature relies on a