In tijden van big data, analyseren en gebruiken we gegevens meer en meer. Maar hoe kunnen we gegevens op de lange termijn die gegevens bewaren? We gaan in op het regelgevend kader en de verplichtingen die gelden voor overheden, bedrijven en providers van archiveringsdiensten. Zowel de context als inhoud van de regelgeving over eArchiving komen aan bod in deze samenvattende slides, inclusief de verhouding tussen eArchiving en GDPR. Contacteer ons gerust bij verdere vragen over dit onderwerp.
2. Overview
1. Definition
2. Advantages
3. Statutory regime
i. Scope and Context
ii. Actors and QSP status
iii. Duty to use eArchiving
iv. Standardization and the EU
v. Liability
vi. Burden of Proof
vii. Evidential value
4. Public Authorities
5. Privacy and GDPR
6. Glossary
7. Team
2
3. Definition of eArchiving
• Electronic archiving is understood as:
1. Saving originally electronic documents (saving);
2. Digitizing paper documents (scanning);
3. Both saving and scanning;
4. By yourself or by an external service provider.
• Does eArchiving mean:
• The original document may be destroyed?
• There is a transfer of burden of proof?
• Documents have different legal value in other
jurisdictions?
• There is a duty to use eArchiving?
Multiple points of view
3
4. Advantages
• Multiple risks: example of “opening a
bank account”
• Interaction between branch and central
office
• Documents are sent from the branch to
the central office
• Risk of loss of original paper (operational
risk)
• Time to transport to central office
(inefficiency)
• Time to retrieve documents from the
central archive
• Cost of transporting and storing hard
copies
Comparison to usual archiving
4
5. Belgian eArchiving Regime
• Lex generalis in Code Economic Law (CEL)
• Qualified eArchiving is specific for Belgium
• A trust service
• Implemented by the law of 21 July 2016
• ≠ from PKI-related services as in the eIDAS-regulation*
• eIDAS regulation does in principle not apply to BE-specific
eArchiving
• Broad scope
• saving documents or data in electronic form
• e-mail, videos, databases, text files
• archiving, saving files on PC, cloudproviders
• Regime in force since 28 October 2016
Context and scope
*cf. infra on Liability
Trust Services
eIDAS
trust
services
BE-
qualified
eArchiving
QSP Compliance
requirements
5
6. BE-eArchiving Regime
• Qualified archiving: distinction made between
• Service providers: offer eArchiving services to market
• Governments, legal or natural persons: eArchiving for its
own account
• If eArchiving for own account
• Certain compliance exemptions apply
• No need for a confirmity report
• No need for bi-annual audit
• However “for own account” is not defined by law
Actors
6
7. BE-eArchiving Regime
1. eArchiving provders acting as a trusted third
party have to :
i. comply with the requirements of the eIDAS regulation
ii. prepare a confirmity report and provide it to the
supervisory authorities (FOD Economie)
2. FOD Financiën then adds them to a trusted list
3. QSPs can start to offer qualified e-archiving
services
• Caveat: the exact standards to obtain qualified
status remain unclear
• New royal decree would be published in February 2019
How to obtain QSP status
7
8. BE-qualified eArchiving
• Duty to use qualified archiving if 2 conditions
are fulfilled
1. Documents are created electronically
2. Storage of documents or data is imposed by law (implicitly or
explicitly)
• Article XII.25 §5, 3 CEL
• However this duty is not yet in force:
• Date of entry into force to be determined by royal decree
• Beltug and FOD Financien mentioned this requires enough
active providers
• Timeline:
• eIDAS regulation on trust services was EU law was published in
2014
• BE implementation in 2016
• 2019: a royal decree with standards is in progress
• European Union likely to take a leading and harmonizing role
• Interim Conclusion:
• It will take at least a few years before this duty enter into force
• Therefore: Principle of free choice
• Choice between qualified archiving or non-qualified
• Choice between paper archiving or electronic archiving
Duty to use
8
9. eArchiving in the EU
• Every EU MS has it’s own regime for
eArchiving
• Currently MS set applicable standards on
records management and metadata.
• Standards are important for accreditation
as QSP
• E.g. ISO 154489-1/2 (Records Management )
• E.g. ISO 23081 (metadata)
• Belgium and Luxemburg are first to create
eArchiving legislation
• However: potential fragmentation of the
EU internal market
• EU is expected to play a major role in
harmonizing legislation, standardization
and conceptual frameworks
• E.g. OAIS Reference Model
9
10. Liability
• Liability: ≠ burden of proof
• Article XII.29 CEL refers to eIDAS liability regime
• Service providers are liable for intentionally or negligently
caused damage if the damage is due to failure to comply with
the obligations in the eIDAS regulation.
• Non-qualified archiving: intention or negligence must
be proven
• Qualified archiving: intention or negligence is assumed
eArchiving in Belgium
10
11. Evidential Value
• Article 1334 Civil Code: when the original title ceased
to exist, the digital copy has the same evidential
value as the private deed (onderhandse akte)
• Conditions: qualified eArchiving
• Consequences:
• presumption that digital copy is presumed to be a faithful and
true copy
• Presumption is rebutable by all legal means
• In practice some uncertainty due to distinction
between:
• Documents with a signature (contracts and other deeds)
• Documents without signature (invoices, salary documents,
forms,…)
• Conclusion: qualified eArchiving high evidential
value
Qualified eArchiving
11
12. Evidential Value
• Non-qualified copy does not have the same
evidential value as the original by default
• No presumption of faithful and true copy needs
to be proven
• Can still be used in Court (Art. XII.25. CEL)
• Evidential value depends on circumstances
• Uncontested same evidential value
• Contested presumption (at most)
• Prima facie evidence (begin van bewijs door geschrift)
if:
• Invoked against the person who provided the original
• If original was lost due to force majeure
• Requires additional evidence (witnesses, presumptions)
• Conclusion: non-qualified eArchiving copy
low evidential value
Non-Qualified eArchiving
12
13. eArchiving
• Article Art. XII.25 §6 CEL refers to the
Archiving Act of 12 August 1955
• Public authorities have no free choice to keep
or destroy archive documents (Art. 5 and 6
Archiving Act)
• Scope of “administrative documents” is broad
• However: Archiving act dates from 1955 and does
not treat digital documents
• Approval by the national archivist is still required
prior to destruction
• Specific Acts may allow the minister to
determine conditions for digital preservation
of documents
Public Authorities
13
14. eArchiving
• Distinction between documents
• Only paper original exists
• Only digital original exist (and no paper version)
• Only paper:
• Destruction of originals requires permission
from the national archivist
• not likely to permit destruction until the Archival
Act is updated to include eArchiving
• Only digital:
• Lack of procedure in Archival Act of 1955
• Risk of neglect of digital archives
• Conclusion: Archival Act is an obstacle for
eArchiving but it does not make eArchiving
unlawful
Public Authorities
14
15. eArchiving & Privacy
• MS may create GDPR exceptions archiving
purposes in the public interest
• Article 89 §3 GDPR
• For example: right to access and right to erasure
• Condition: technical and organisational
measures
• data minimisation, Pseudonymisation,…
• However such measures are not always required
• Qulified eArchiving service providers should
refrain from using personal data unless
processing is necessary for certain purposes:
• For example: performance of an agreement or to
comply with statutory obligations
• See Annex 1 of Title II of Book XII CEL, Art. XII.N1, b)
GDPR
15
16. Glossary
o MS: Member State of the European Union
o QSP: Qualified Service Provider
o CEL: Code Economic Law (Wetboek Economisch Recht)
o GDPR: General Data Protection Regulation
o EIRA: European Interoperability Reference Architecture
o eIDAS regulation: regulation on electronic identification and
trust services for electronic transactions in the internal
market
o OAIS reference model: Open Archival Information System
reference model
16
17. Digital Team
At deJuristen our team members specialize
in digital, IT and IP related legal matters.
We provide hands on legal advisory
services for businesses, governments,
individuals and startups.
For specific advice on eArchiving, eServices
or identification services such as electronic
signatures please contact the team
members of our Digital Team on the right.
Mathias Baert
Partner – deJuristen
mobile: +32 495 52 42 02
email: mathiasbaert@dejuristen.be
Ivan Verstraeten
IT/IP-jurist - deJuristen
mobile: +32 493 75 11 11
email: ivan@dejuristen.be
17