THE NETHERLANDS: EU DIGITAL SIGNATURE DIRECTIVE

UNCLAS THE HAGUE 001937

SIPDIS


E.O. 12958: N/A
TAGS: ECPS EINT ETRD EUN
SUBJECT: THE NETHERLANDS: EU DIGITAL SIGNATURE DIRECTIVE


REF: STATE 84614



1. Summary. Emboff met with Ministry of Economic Affairs
official Martin Buys to discuss Dutch implementation of the
directive. The GON is drafting legislation, therefore no
public version is available. Buys said that the GON wishes
to limit government involvement in electronic signatures,
allowing market forces to be the largest determinant. End
summary. Responses follow in the same order as the questions
in paragraph 9 of Reftel.



2. The GON is drafting legislation, therefore no public
version is available. Principle drafters include a judicial
advisory board, the Council of State (Raad van State),the
Ministry of Transportation, Public Works and Water
Management, and the Ministry of Justice. The main concern of
the Ministry of Transport (which deals with
telecommunication) is the implementation of Article 3(3).
This article requires member states to establish a system for
supervision of certification-service-providers. According to
Buys, the GON finds it difficult to implement Article 3(3)
because Article 3(1) states that provision of certification
services requires proper authorization. The GON is unsure of
its legal authority, therefore it is attempting to implement
Article 3(3) on a lower level, only requiring supervision of
certification-service-providers offering advanced digital
signatures.



3. The Ministry of Justice is working to implement Article
5(1),concerning the legality of electronic signatures.
Digital signatures are already admissible in Dutch courts,
due to previous legislation and what the Dutch term "freedom
of evidence," giving wide scope to what is admissible in a
court of law. The GON is more concerned with making digital
signatures legally equal to handwritten signatures.



4. Recital 16 sets forth basic guidelines for the regulatory
framework needed on intranet and internet. In the
Netherlands, the discussion surrounding Recital 16 centers
around the ability of the GON to place higher standards on
government use than the directive requires. The GON
determined that the private sector may choose to go beyond
guidelines given in the directive, but that the government
should not.



5. The Netherlands already has a voluntary non-licensing
scheme through Trusted Third Party Group, TTP, a nationally
operating IT service provider managed by the Dutch
association for electronic commerce, ECPN (Electronic
Commerce Platform Netherlands). This can be accessed via the
website ecp.nl. The GON is concerned with keeping
accreditation of certification-service-providers
market-based, and is attempting to limit government
involvement to the registration of certification service
providers.



6. Article 9 committee members include Martin Buys, Ministry
of Economic Affairs, and Ronald van der Luit, Ministry of
Transportation, Public Works and Water Management. Buys said
that the meeting of the Article 9 Committee in March was
mostly "window dressing," and said that nothing substantive
was discussed. The GON believes more important discussions
are taking place in the standards environment, particularly
EESSI.



7. Buys said that at the initiative of the UK
representatives, representatives from Sweden, Germany, France
and the Netherlands have agreed to meet the evening before
the next Article 9 Committee meeting in June.



8. Most active participation in ETSI and CEN stems from
private companies involved in the standardization process.
Currently, advisory companies such as KPMG, Price
Waterhouse-Coopers and others are involved.



9. The GON is considering implementing internationally
recognized guidelines contained in Common Criteria (CC),
developed by the Information Security Systems Organization.
However, the GON is concerned with enforcement of Article
3(4). The Article deals with the conformity of secure
signature-creation devices. Buys said that the GON remains
uncertain regarding its ability to adequately address
enforcement on this issue because it requires enforcement on
a user-level.


TOKOLA