Digital signatures are two main definitions depending on the legal or technical concept being discussed.
Legally, the electronic signature is the digital equivalent of the handwritten signature and is intended to certify the wishes of the signer.
Technically, as specified in Regulation 910/2014, known as the eIDAS Regulation, the electronic signature is a set of data in electronic format that is attached to or logically associated with other electronic data and that the signer uses to sign. It includes a series of basic functions, among which are defined:
- Identification feature: Uniquely identifies the signer.
Authentication feature: Helps guarantee the integrity of the signed document.
Non-repudiation characteristic: Helps provide evidence of the signer’s involvement in signing the document. - In this sense, it is important to be aware that the terms electronic signature and digital signature are often used interchangeably, although their precise meanings can differ depending on the legal and technical context.
- In general, the electronic signature includes methods used to sign or validate an electronic file and identify a person.
On the other hand, the digital signature refers not only to the digital signing method but also to the technical process used to validate the signer’s signature. That is, it includes the act of signing itself and the technical mechanisms that support it. For example, these mechanisms may help verify the signer’s identity, the date and time of signing, the certificates used, and whether the signed document has been altered.
Digital signatures are also relevant to broader data protection and privacy practices because they can help organizations maintain the integrity and authenticity of electronic records.
Table of Contents
Types Of Digital Signatures
The eIDAS Regulation distinguishes three main types of electronic signatures:
- Simple electronic signature.
- Advanced electronic signature.
- Qualified electronic signature.
Essentially, these three types of signatures differ from each other by:
- Security level.
- Ability to help guarantee the integrity of the document.
- Identification capacity of the signer.
Simple Or Basic Digital Signature (SES)
Taking into account the definition of the eIDAS Regulation, these signatures consist of data in an electronic format that is logically attached to or associated with other electronic data and that the signer uses to sign.
A simple digital signature could be a scan of a person’s handwritten signature. Its simplicity does not automatically mean that it has no legal effect. However, its legal value and evidential weight depend on the applicable law and the circumstances. Additional evidence may be needed to establish the authenticity of the signature.
Advanced Digital Signature (AES)
According to the eIDAS Regulation, an advanced electronic signature incorporates additional characteristics, including:
- Identification of the signer and a link to the signer.
- The ability to detect subsequent changes to the signed document.
In short, it helps establish the identity of the signer and whether the signed document has been modified after signing.
Qualified Digital Signature (QES)
A qualified electronic signature is an advanced electronic signature that is created using a qualified signature creation device and is based on a qualified certificate for electronic signatures.
To create this type of signature, a person needs a qualified electronic signature certificate and a qualified signature creation device, meeting the requirements established by the eIDAS Regulation.
In this type of digital signature, the element of trust in the electronic signature is particularly important. A trusted third party or certification authority may provide the certificate used to verify the signer’s identity and support the validation of the signature.
Digital Signatures And Confidentiality
Digital signatures offer useful possibilities for confidentiality-related workflows and data protection, particularly when individuals provide consent for the processing of their personal data. However, a digital signature primarily supports authenticity and integrity; it does not, by itself, encrypt a document or guarantee confidentiality.
Digital signature systems can help organizations record consent and establish evidence of a person’s agreement to the processing of personal data. Depending on the signature method used, they can also provide information about the signer’s identity and the signing process. These capabilities can make consent collection more efficient and easier to document.
When consent is obtained electronically, organizations should ensure that it is freely given, specific, informed, and unambiguous wherever required by applicable privacy laws. They should also store consent records securely and make sure that the data is processed for appropriate purposes.
These practices can improve the user experience and support privacy compliance by reducing manual steps in the consent and signing process.
Data security also requires organizations to maintain reliable copies of important records. Following business data backup practices can help preserve signed documents and related records if information is accidentally deleted, corrupted, or lost.
In addition, organizations that store large volumes of signed electronic documents should consider appropriate database protection measures to reduce the risk of unauthorized access, data loss, and tampering.
At Letslaw, we have a team of highly specialized lawyers in Digital Law and New Technologies. If you have any questions or need more information, do not hesitate to contact us.