The Corn Laws go digital

Eager student: I’m in­­ search of a tasty legal nugget to drop into my next essay. Any thoughts?

Scholarly Lawyer: I have just the thing for you: clause 122 of the Data Protection and Digital Information Bill. Post-Brexit geopolitics meets digital signatures, a strange mixture if ever there was one.

ES: I’m guessing that this is about eIDAS.

SL: Correct. What do you know about it?

ES: An EU Regulation, domesticated following Brexit, which defines three categories of electronic signature: ordinary, advanced and qualified (QES). eIDAS has been a pet project of the European Commission for years, and some EU countries require a QES to be used for some transactions. However, English law hardly ever requires anything more than an ordinary signature: something as informal as a name typed at the end of an e-mail can suffice. So for most purposes we can ignore advanced and qualified signatures.

SL: Right again. The main point of a QES is that the identity of the signatory is certified by a third party Qualified Trust Service Provider (QTSP) approved by a national supervisory body. Conceptually that is closer to notarisation than to a manuscript signature. If you think about it, even a witnessed wet ink signature does not require the witness to verify the identity of the signatory. It would be a radical departure from the long-standing flexible English law approach to signatures if we were to start encumbering electronic signatures with those kinds of legal formality requirements.

ES: But isn’t it quite useful for a signature to have that degree of assurance attached to it? Anyone could type a name at the end of an email.

SL: For sure, there is a broad spectrum of electronic and digital signatures. They offer differing degrees of assurance of identity or document integrity, ranging from none to highly probative. Those features may go to the evidential weight that a court gives to a contested signature, but just as with manuscript (for which even a pencilled ‘X’ can count as a signature) we don’t generally impose a bright line rule invalidating signatures below a specified level of reliability or assurance. Absent compulsion by law, there has been little demand for the full-blown QES. Indeed, in the UK the Information Commissioner’s Office (the designated supervisory body) has still approved only one QTSP.

ES: So qualified signatures are a red herring?

SL: They cannot be completely ignored. In Scotland there are real estate transaction rules based on QES; and in England the Land Registry is running a QES pilot. So QES are significant in that limited sphere. In the future there may be a move to allow deeds generally to be executed by means of a digital signature instead of witnessing. There would no doubt be suggestions that the full panoply of a QES should be required for that.

ES: That’s all by way of background. What does this Bill do?

SL: Within the EU, a QTSP approved in one EU country counts as a QTSP throughout the EU. Following Brexit, the UK unilaterally retained recognition of EU QTSPs. So an EU QTSP can still certify a QES for UK law purposes. The EU, on the other hand, ceased to recognise UK QTSPs (such as exist) post-Brexit.

Clause 122 of the Bill would give the Secretary of State power to lay regulations withdrawing UK recognition of EU QTSPs. Conversely, the SoS could extend recognition to foreign QTSPs (or equivalent) on a country by country basis, including countries outside the EU.

ES: So if the UK were to withdraw EU-wide recognition on Day 1, that would radically diminish the pool of available QTSPs that could certify a QES under UK law?

SL: Indeed so, unless automatic recognition were simultaneously extended to every EU country individually, or if EU QTSPs en masse applied for UK ICO approval. Clause 121 smooths the path for EU QTSPs to obtain approval, by deeming an EU conformity assessment report under eIDAS to have equivalent status to one issued by a UK conformity assessment body.

ES: So instead of recognising an EU QTSP itself, we could end up recognising a QTSP’s EU conformity assessment, wave it through and arrive in much the same place?

SL: It looks that way.

ES: So what really is the point of this legislation?

SL: It is difficult to be sure. Perhaps the UK government is miffed that the EU won’t mutually recognise UK-approved QTSPs, and wants to try to exert negotiating pressure on Brussels by taking power to withdraw recognition. (But one has to wonder whether withdrawing automatic recognition of EU QTSPs would merely shoot ourselves in the foot by cutting off the supply of qualified trust services in the UK.)

Perhaps there is an undercurrent of post-Brexit jingoism: what we really need to make the UK the best place in the world to transact online is a sturdy, copper-bottomed, certifiably British digital signature.

ES: What does the government say?

SL: The official answer that the Minister gave in the House of Commons last year was that the power enables revocation if continued unilateral recognition “no longer meet[s] the needs of the UK market”. The version in the Bill’s Explanatory Notes is: “should the continued unilateral recognition of EU qualified trust services no longer be appropriate”.

Various DSIT memoranda to Parliamentary Committees contain a third, more illuminating version: “either because the EU changes its current trust service standards, and/or the UK qualified trust service market matures to an extent that it is no longer appropriate to unilaterally recognise EU qualified trust services.”

None of these criteria is stated in the legislation itself, which places no constraints or conditions on the exercise of the power.

ES: I can see that the government might not want to be tied to possible future changes in EU law. But how would maturity of a UK market determine whether it is still appropriate to continue unilateral recognition?

SL: It sounds like: “Are there now enough UK QTSPs that we can afford to cut off QTSP services supplied from the EU?”. You could call that 21st century digital mercantilism. Go back to 1684 and we find, in Philipp Wilhelm von Hornick’s tenets of mercantilism: “That no importation be allowed if such goods are sufficiently and suitably supplied at home.”

ES: Digital Corn Laws?

SL: Very apposite. A feature of the protectionist mindset is to look at the issue solely from the perspective of producers, at the expense of consumers and the general public. How, we might ask, would the general public benefit from taking what is already a prescriptive, complex technology specification (albeit one rarely required by UK law) and grafting a narrower geographic restriction on to it?

In short, the public would not benefit. On the contrary, in the shape of the unwary user the public is put at risk. Austria provides a vivid example: a €3bn contract to supply double-decker trains to Austrian Federal Railways was invalidated by a judge who noticed that the contract was signed with a QES supported by a Swiss, rather than an EU, TSP.

It is for this kind of reason that the UK (or at least English law) is traditionally chary of imposing formalities. Requiring a particular kind of defined signature for a transaction to be valid is a more technically obscure, 21st century version of the Statute of Frauds, of which an official committee report of 1937 said:

“ 'The Act', in the words of Lord Campbell . . . 'promotes more frauds than it prevents'. True it shuts out perjury; but it also and more frequently shuts out the truth. It strikes impartially at the perjurer and at the honest man who has omitted a precaution, sealing the lips of both. Mr Justice FitzJames Stephen ... went so far as to assert that 'in the vast majority of cases its operation is simply to enable a man to break a promise with impunity, because he did not write it down with sufficient formality.’ ”

Where UK law does require a QES (which it is to be hoped will remain the exception) it would be doubly unwise to introduce a regime that would invalidate an otherwise perfectly satisfactory QES simply because the certifying QTSP was on the wrong side of the Channel.

ES: Weren’t many of the Statute of Frauds formalities abolished in 1954? 

SL: Indeed so. It would be beyond ironic if irritation at EU unwillingness to reciprocate recognition of QTSPs, or perceived national interest in fostering a self-sufficient UK trust service provider industry, resulted in the UK heading down the road of the kind of prescriptive formalities associated with civil law jurisdictions and which England and Wales, as a common law jurisdiction, long ago rolled back.

ES: Thank you. My essay awaits. 

On the Dotted Line

The topic of electronic signatures seems cursed to eternal life. In the blue corner we have the established liberal English law approach to signatures, which eschews formality and emphasises intention to authenticate. In the red corner we have preoccupation with verifying identity of the signatory, with technically engineered digital signatures and with the EU’s eIDAS hierarchy of qualified, advanced and ordinary electronic signatures.

In the English courts the blues have it. Judges have upheld the validity of electronic signatures as informal as signing a name at the end of an e-mail or even, in one case, clicking an ‘I accept’ button on an electronic form. They have been able to do this partly because, with very few exceptions, the England and Wales legislature has refrained from stipulating use of an eIDAS-compliant qualified or advanced signature as a condition of validity. The EIDAS hierarchy does form part of our law, but – rather like the Interpretation Act - in the guise of a toolkit that is available to be used or not as the legislature wishes. The toolkit has for the most part remained on the legislative shelf.

The potential consequences of stipulating eIDAS-style formalities in legislation are graphically illustrated by the Austrian case of the Wrong Kind of Signature. A €3bn contract to supply double-decker trains to Austrian Federal Railways was invalidated because the contract was signed with a qualified electronic signature supported by a Swiss, rather than an EU, Trusted Service Provider.

The modern English law aversion to imposition of formalities was pithily encapsulated in an official committee report of 1937, describing the Statute of Frauds:

““'The Act', in the words of Lord Campbell . . . 'promotes more frauds than it prevents'. True it shuts out perjury; but it also and more frequently shuts out the truth. It strikes impartially at the perjurer and at the honest man who has omitted a precaution, sealing the lips of both. Mr Justice FitzJames Stephen ... went so far as to assert that 'in the vast majority of cases its operation is simply to enable a man to break a promise with impunity, because he did not write it down with sufficient formality.’ ”

For its part eIDAS continues to complicate and confound. February’s Interim Report of the Industry Working Group on the Electronic Execution of Documents, running to 94 pages of discussion, stated that ‘only’ qualified electronic signatures have equivalent legal status to handwritten signatures (meaning, according to the Report, that they carry a presumption of authenticity). Yet while eIDAS does require equivalent legal effect (whatever that may mean) to be accorded to qualified signatures, it does not require other kinds of electronic signature to be denied that status; nor has English domestic law done so.

Back in the courts, a recent decision of Senior Costs Judge Gordon-Saker in Elias v Wallace LLP [2022] EWHC 2574 (SCCO) continues down the road of upholding the validity of informal electronic signatures. Under the Solicitors Act 1974 (as amended) a solicitor’s bill cannot be enforced by legal proceedings unless it complies with certain formalities, including that it has to be:

“(a) signed by the solicitor or on his behalf by an employee of the solicitor authorised by him to sign, or

(b) enclosed in, or accompanied by, a letter which is signed as mentioned in paragraph (a) and refers to the bill.”

The Act states that the signature may be an electronic signature. It takes its definition of electronic signature from s.7(2) of the Electronic Communications Act 2000[1], as amended:  

“… so much of anything in electronic form as –

(a)   is incorporated into or otherwise logically associated with any electronic communication or electronic data; and

(b)   purports to be used by the individual creating it to sign.”

This is an unusual example of English legislation stipulating compliance with a defined kind of signature (albeit that S.7(2) is framed in very broad terms) as a condition of validity. Most legislation requiring a signature goes no further than a generally stated requirement that the document must be signed[2].

The bills in question were sent to the solicitor’s client as e-mail attachments. The bills themselves were not signed, but the covering e-mails concluded with the words:

“Best regards,

Alex

[first name and surname]

Partner

[telephone numbers, firm name and physical and website addresses]”.

The judge held:

1. The printed name of the firm incorporated in the invoice, like a letterheading, was not a signature. This unsurprising conclusion is reminiscent of Mehta v J Pereira Fernandes SA [2006] EWHC 813 in which the same was held for an e-mail address appearing at the top of an e-mail.
2. If the name ‘Alex’ was not generated automatically, clearly it purported to be used as a signature.
3. If the name ‘Alex’ was auto-generated, then on the authority of Neocleous v Rees that would constitute a signature. The e-mail footer was clearly applied with authenticating intent, even if it was the product of a rule.

The judge also held that ‘letter’ should be interpreted to include e-mail. That is a salutary reminder that the ability to conduct a transaction electronically may not be only a question of whether electronic signatures are permissible. Other requirements of form and process can also come into play.

[1] Note that the role of S.7 was to make explicit (almost certainly unnecessarily) that electronic signatures as defined by the section were admissible as evidence, whereas the Solicitors Act provision concerns substantive validity.

[2] As to which, see the England and Wales Law Commission’s Statement of the Law in its Report on Electronic Execution of Documents (2019).