November 16, 2022

ECJ with new interpretations on the concept of ‘qualified electronic signature’ with reference to a Bulgarian case

At the end of October 2022, the European Court of Justice (ECJ) issued a curious new judgment (case C-362/21) on several issues relating to electronic signatures, and this was initiated upon request for a preliminary ruling from a Bulgarian court (Veliko Tarnovo Administrative Court).

The reason for the request to the ECJ is a pending case between a Bulgarian company and the director of the Directorate of Appeal and Tax and Insurance  Practice – Veliko Tarnovo (ATIP – VT). The Bulgarian company appealed in court against a VAT audit report confirmed by ATIP – VT. The report was issued in connection with an audit where all documents were created as electronic documents and signed with electronic signatures. The Bulgarian company disputes the validity of the electronic documents issued, including that they were not signed with a qualified electronic signature (QES). The Bulgarian court decided to refer certain issues concerning the interpretation of the European rules on e-signatures to the ECJ. Here are some of the most important findings of the ECJ:        

  • The Regulation on e-signatures 910/2014 (the Regulation) allows an act issued by an administrative authority as an e-document to be declared null and void by a court if it is signed with an e-signature that does not comply with the requirements laid down in the Regulation to be considered a QES. The ECJ emphasises that an act should not be declared null and void simply because the signature on it is in electronic form. The essential point here is that at this stage Bulgarian law requires the use of a QES (and not advanced or ordinary) for e-signing of administrative act.
  • The consequences of the e-signature being indicated by the trust service provider as a ‘professional electronic signature’ have also been considered. The ECJ is explicit that indicating an e-signature in one way or another by a provider, including by means of terms which do not appear in the Regulation, such as ‘professional electronic signature’, cannot affect whether or not a signature is considered a QES. The only thing that matters is whether the signature meets the requirements of the QES Regulation: (i) whether it is an advanced electronic signature within the meaning of the Regulation, (ii) whether it was created  by a qualified electronic signature creation device, (iii) whether it is based on a qualified electronic signature certificate issued by a qualified trust service provider. The absence of any of these cumulative requirements  means that there is no QES, and it is their presence that a national court  must verify when the validity of a QES is challenged. The ECJ’s conclusions  also confirm the position defended by our experts, namely that a ‘professional’ QES does not exist as a concept and a special type of electronic signature within the meaning of the Regulation.
  • Another interesting issue considered by the European Court is whether the fact that the electronic signature holder’s names, which he/she would normally write in Cyrillic letters, are transliterated in Latin ones would prevent the signature from being considered a QES. The ECJ notes that this is not an obstacle as long as the electronic signature is uniquely linked to the signature holder and can identify him/her.

This judgment is important for the caselaw as it provides useful guidance to law enforcement authorities in Bulgaria and other EU countries on the concept of electronic signatures and more specifically QES. It also makes it clear that an answer to the question whether an electronic document (including an administrative act) is valid must be given by national law. These clarifications will become increasingly important due to the trend towards digitalisation in both the private and public sector.

 

Radoslava Makshutova
Associate

Аn epitome of the next-generation, tech-savvy lawyer, Radoslava is in her element when it comes to finding solutions to complex information technologies and data protection law problems.

Related insights

Innovative solutions and customer care.
Get in touch