Legality of eSignatures in Luxembourg

Background

Digital signatures have made document verification more efficient, benefiting operations in Luxembourg and globally. These electronic solutions enable quick and eco-friendly document signing, reducing paper use and accelerating business transactions. However, when adopting electronic signatures in the Grand Duchy of Luxembourg, it's crucial to understand key considerations.

It's recommended to select an electronic signature provider that complies with the specific laws of Luxembourg, notably the Electronic Commerce Law of August 14, 2000¹, as revised on July 17, 2020², and the European Union's electronic signature regulations,³ which grant electronic signatures the same legal weight as traditional handwritten signatures for internal transactions⁴. Although certain documents may still require a wet-ink signature and local regulations can differ, it's wise to seek legal counsel.

Security is of the utmost importance. Your electronic signature service should offer robust security features, including encryption, authentication protocols, and audit trails, to deter unauthorized access and confirm the integrity of the document. BoldSign offers these security safeguards to fulfill compliance and safety requirements.

In conclusion, electronic signatures provide substantial benefits and are generally accepted. However, it is essential to comply with legal standards, guarantee security, and opt for an intuitive service to integrate them effectively in Luxembourg.

What is an electronic signature?

As defined by Luxembourg's regulations, an electronic signature is any electronic data attached to or logically associated with other electronic data used by the signatory to sign⁵. In Luxembourg and the European Union, such signatures are deemed legally binding on most documents, provided they can be traced back to the signer, and there is evidence to confirm their validity, ensuring the document has not been altered or forged. Moreover, the signatory's intention to sign must be evident, signifying their deliberate agreement to the terms in the document. When these conditions are met, electronic signatures are recognized as having equivalent legal status to traditional handwritten signatures.

The Civil Code provides that an electronic signature consists of a set of data, linked in an inseparable manner to the act, which guarantees its integrity and demonstrates his or her adherence to the content of the deed.⁶

Overview of the regulation on electronic signatures

Operations entailing the use of electronic signatures in the Republic of Luxembourg are regulated by the:

1. Electronic Commerce Law of August 14, 2000, as amended by law of July 17, 2020
2. Electronic Identification and Trust Services Regulation [eIDAS].

As a rule, the regulation deems electronic signatures legal when completing transactions. Luxembourg Code of Commerce provides that a document may not be rejected by the court merely because it is in electronic form⁷.

eSignatures under the regulation are categorized into⁸:

1. Simple electronic signature
2. Advanced electronic signature
3. Qualified electronic signature

An advanced electronic signature is an electronic signature that meets the requirements set out in Article 26⁹. It decrees that an advanced electronic signature must be:

1. Uniquely linked to the signer
2. Capable of identifying the signatories
3. Developed through means that the signatory can maintain their control.
4. Linked to the data it relates to so that any subsequent change to the data is detectable.

Uniquely linked to a person

A secure electronic signature must be uniquely connected to the person using it. The signature must be created using methods only the signer can access, like a private key and confidential information, to verify their identity.

Use and incorporation remain in their sole control

The person using the secure electronic signature must have sole control over the means of creating it. Typically, this requires managing a key pair or two-factor authentication, with the signer exclusively holding the private key to prevent signature forgery.

Able to identify the person using the technological process

The process used to create the signature must be capable of identifying the person signing. This may include using a biometric signature, a personal identification number (PIN), an email address, or a company registration number.

Easy to track down any alterations made after signing

It is essential to preserve the authenticity of the signed document. Modifications made to the document post-signature should be identifiable. This is commonly accomplished through an audit trail. Audit trails record the signer's IP address, timestamps of key signing events, and location, providing proof of identity, timing, and signature place.

A qualified electronic signature is an advanced electronic signature that is generated using a certified device for creating electronic signatures and relying on an accredited certificate specific to electronic signatures¹⁰. Article 32¹¹ sets out a validation standards to be met by one for a qualified e-Signature. These are:

1. A statutory compliant certificate at the time of signing.
2. A qualified trust service provider issued a certificate that was valid when signing.
3. Signature validation data aligns with the data provided to the relying party.
4. The unique set of data representing the signer in the certificate was correctly provided to the relying party.
5. The use of any pseudonym is indicated to the relying party if one was used at signing.
6. The electronic signature is created using a qualified electronic signature creation device.
7. The integrity of the data has not been altered.
8. Meets the validity standards of an advanced eSignature.

Summary

Under the Electronic Commerce Law of August 14, 2000, as amended by the law of July 17, 2020, and Regulation (E.U.) 910/2014

Scope and limitations of eSignature transactions

Electronic signature transactions and their utilization do not have universal legal acceptance for document finalization. Consequently, there are specific types of transactions and uses for which electronic signatures are suitable, and others for which they are not. Below is an analysis of this matter, accompanied by a summarized table of the transactions.

Documents that can be signed

Electronic signatures can be employed to affix signatures and provide countersignatures on a diverse array of documents, such as:

1. Human resources
2. Procurement
3. Non-disclosure agreements (assuming they are contracts, not formal deeds)
4. Software license agreements
5. Public petitions
6. Insurance industry
7. Undertaking to pay a given sum¹²
8. Educational field, etc.

Exempted transactions

In limiting the scope of electronic signatures, Luxembourg E-Commerce law, under Article 50¹³ exempts the following transactions from electronic completion:

1. Contracts that create or transfer rights in real estate, except for rental rights.
2. Contracts for which the law requires the intervention of courts, public authorities or professions exercising public authority.
3. Security contracts and guarantees provided by persons acting for purposes which do not fall within the scope of their professional or commercial activity.
4. Contracts relating to family law or inheritance law.

Summary scope

To ensure the authenticity of an electronic signature, it's advisable to follow these best practices in addition to complying with all applicable legal requirements:

• Confirm the signer's identity and, in business dealings, verify that the individual is duly authorized to act on behalf of the company in affixing their signature.
• Secure explicit agreement from the individual signing, which may be incorporated in the contract itself or into a separate accord, to signify their intention to use the specified electronic signature for the document in question.
• Safeguard the document to prevent any modifications after the signature is applied.
• Keep an exhaustive log of the signing process, recording each step the signer performs.

How does BoldSign help

The following elements of compliance available in BoldSign can be used to comply with Luxembourg eSignature laws:

• Secure and unique signing link: A secure and unique link to sign a document is sent directly to the signer's email address. This ensures that the document is only accessed by the intended signer and cannot be tampered with.
• Password protection: Senders can specify a password that needs to be entered before viewing and signing a document. This adds another layer of security to the signing process.
• Audit trail: The IP address of the signer and timestamps for all significant events in the signing process are recorded in an audit trail. This provides a record of who signed the document, when, and where.
• Digital signature: The final document is digitally signed with an AATL-compliant certificate. This ensures that the document cannot be tampered with without invalidating the signature.
• Consent: Signers are asked to confirm their intent to sign electronically and are informed that they could opt out. This ensures that the signer is aware of the implications of signing electronically and has given their consent.
• Custom terms: Get your signers to agree to a custom set of terms. This can be useful to ensure additional security or that the signer understands the terms of the document.
• QES compliance: BoldSign offers fully compliant qualified electronic signatures (QES) that are simple, secure, and legally binding across Luxembourg. QES guarantees that your essential documents are protected with the highest level of eSignature security, giving you peace of mind in your digital transactions. With BoldSign, you can confidently manage your important documents while ensuring compliance with Luxembourg’s regulations.

Disclaimer: The information on this page is intended to help businesses understand the legal framework of electronic signatures for this particular country.

However, Syncfusion’s officers, directors, stockholders, affiliates, attorneys, accountants, employees, or agents cannot provide legal advice. You should consult your personal attorney regarding your specific legal questions. Laws and regulations are subject to frequent changes, and the information may not be current or accurate. To the maximum extent permitted by law, Syncfusion provides this material on an “as-is” basis. Syncfusion disclaims and makes no representation or warranty of any kind with respect to this material, express, implied, or statutory, including representations, guarantees, warranties of merchantability, fitness for a particular purpose, or accuracy.

Syncfusion makes no warranties of any kind, including but not limited to the information or the product, whether express, implied, statutory, or otherwise. To the maximum extent permitted by law, Syncfusion disclaims all conditions, representations, and warranties, whether express, implied, or statutory, with respect to this information, without limitation of any implied warranty of merchantability, fitness for a particular purpose, accuracy, or currentness of this information.

Syncfusion nor its officers, directors, stockholders, employees, affiliates, attorneys, accountants, or agents shall be liable for indemnification, nor does this create an express or implied, contractual or statutory, equitable or otherwise, under this agreement. The officers, directors, stockholders, affiliates, attorneys, accountants, or agents will not have any liability in any form.