Legal regulation of the qualified electronic signature

These formal requirements include simple written form (Art. 12 OR), qualified written form and public certification. The basis of the formal requirement is the signing with a handwritten signature (Art. 13 para. 1 and 14 para. 1 CO) on a physical object.

An alternative to this is the qualified electronic signature. According to Art. 14 Para. 2bis OR, the qualified electronic signature associated with a qualified time stamp is equivalent to the handwritten signature within the meaning of the Federal Act on Certification Services in the Field of Electronic Signature and other Applications of Digital Certificates of 18 March 2016 (ZertES, SR 943.03). However, public authentication cannot be replaced by the qualified electronic signature.The following explains how a qualified electronic signature works and how it is structured.

With a qualified electronic signature, electronic documents can be checked for authenticity and the identity of the signatory can be clearly established. The requirements and conditions for electronic signatures are regulated in the ZertES and the associated ordinance of 23 November 2016 (VZertES, SR 943.032).

The technical procedure of the electronic signature is based on the Public Key Infrastructure, which is managed by trustworthy third parties (providers of certification services). A cryptographic key pair is assigned to a person and his identity. Certification service providers certify this assignment by means of a digital certificate. The cryptographic key pair consists of a private key and a public key. The public key may be made known to others, whereas the private key should remain secret. The sender signs electronic documents, messages or other electronic data with the private key. The public key then allows the recipient to verify the integrity and authenticity.

There are three levels of digital certificates: digital certificate, regulated certificate and qualified certificate. The described certificates form the basis for electronic signatures.

The highest level, i.e. the qualified certificate is a regulated certificate which must fulfil Art. 7 CertES and the requirements in Art. 8 CertES. Accordingly, qualified certificates may only be issued by recognised providers of certification services.

Based on the certificates, 5 electronic signatures can be defined. These are:

• the electronic signature;
• the advanced electronic signature;
• the regulated electronic signature and the regulated electronic seal; and
• the qualified electronic signature.

The qualified electronic signature consists of a regulated electronic signature based on a qualified certificate (Art. 2 lit. e ZertES). A regulated electronic signature is an advanced electronic signature created with a secure signature-creation device pursuant to Article 6 ZertES and based on a regulated certificate issued to a natural person and valid at the time the electronic signature was created. An advanced electronic signature is an electronic signature which must meet the following requirements:

• assigned exclusively to the holder,
• Identification of the holder by the signature,
• signature is produced by means which the holder can keep under his sole control, and
• By linking the data, any subsequent change in the data can be detected.

According to Art. 9 ZertES, a certificate can only be issued if the applicant appears in person and provides proof of his identity. Due to the COVID 19 pandemic, the Federal Council felt compelled to waive the requirement to appear in person and has therefore introduced Art. 7a VZertES. This will make it possible to establish identification by means of audiovisual communication, which was previously only possible for the financial sector. Art. 7a VZertES applies for a limited period of six months only, i.e. until the end of September 2020.

The regulated and qualified electronic signature is reserved for natural persons.In addition to the qualified electronic signature, an electronic time stamp is required. With the electronic time stamp, the certification providers confirm the existence of the qualified electronic signature and thus the integrity and authenticity of an electronic document at a certain point in time. The electronic time stamp can be qualified as a qualified electronic time stamp if it has been issued by one of the recognised providers in accordance with ZertES. It must also be provided with the electronic seal.The electronic signature is based on a certification infrastructure managed by trusted third parties (providers of certification services). Certification services recognised in Switzerland are QuoVaids Trustlink Schweiz AG, SwissSign AG, the Federal Office of Information Technology, Systems and Telecommunication BIT and Swisscom (Switzerland) AG. The latter has begun to transfer the distribution of electronic signatures and their registration to third parties. These so-called registration authorities can distribute qualified electronic signatures via Swisscom. For example, Skribble does this for the Swiss market. In international situations, qualified electronic signatures are offered by DocuSign.

HÄRTING Rechtsanwälte AG has also become a Registration Authority agency (see our article) and can advise you on the choice, introduction and implementation of the qualified signature in your company and register you.

For questions and further information please contact Nicole Beranek Zanon.