The preparatory work on new legislation concerning reliable electronic identification is well under way. In addition to fine-tuning the legal provisions, this preparatory work should devote serious attention to establishing a level of costs which consumers would bear at their own risk in cases of expenses arising from the unauthorised use of means of identification.
The Ministry of Transport and Communications is currently preparing a legislative proposal on reliable electronic identification and electronic signatures. The proposed law is intended to increase the supply of identification services and create a framework for this activity by establishing basic provisions for it. Reliable identification is required for all electronic transactions where protection of the consumer's legal rights is crucial. For example, identification systems are currently under development for mobile devices such as phones.
Progress on the legislative front is a welcome step forward from the consumer's viewpoint. Secure identification of customers is in the interest of both the business and the consumer, and the use of electronic services can be expected to grow as systems become increasingly reliable. The Consumer Agency has, however, noted that the preamble of the legislative proposal does not take into consideration a company's responsibility to establish systems for reliable identification of the parties to an agreement even before they commence their activities. In business activities such as online retailing it must be possible, for example, to ensure that minors are not able to make purchases that would otherwise be illegal for them to make.
The regulations pertaining to the provision of information are also still somewhat unclear. The legislative proposal states that businesses offering identification services must take active steps to ensure that the consumer is provided the necessary information regarding the terms of use and any possible limitations of the means of identification in question. These active steps are not given any practical definition, however.
The reliability of initial identification is essential - a fact that is fortunately also recognised in the legislative proposal. According to the proposal, businesses offering identification services should ensure that their personnel have sufficient knowledge and expertise regarding the technical aspects of electronic identification and related data security issues. As this juristic act is significant from the viewpoint of the consumer's legal protection, businesses must truly recognise their accountability and responsibility in the matter.
Own risk set at 150 euros for improper use of electronic ID?
While work continues on the law on identification, the Ministry of Justice is engaged with the implementation of the Payment Services Directive. In the Directive, the consumer's liability for unauthorised use of a means of payment is, in most cases, limited to a maximum of 150 euros. The point of departure is that the consumer's liability for unauthorised use of e.g. a stolen payment card would only exceed that amount if the consumer has acted wilfully or with gross negligence. At present, the consumer's liability for unauthorised use of a payment or credit instrument has no set maximum in cases where the consumer is found to have acted negligently. This new limitation of liability is a significant improvement in consumer protection.
Such limitation of liability is not, however, mentioned in the legislative proposal on identification - despite the fact that unauthorised use of means of identification involves an equally significant risk of financial losses. The consumer's own risk in such circumstances could easily be limited to 150 euros by law. Further preparatory work on the matter should take the approach that regulations on the consumer's liability would fully correspond with the principles evident in the Payment Services Directive and the provisions proposed for the Act on Payment Services. Consumer protection should be at the same level regardless of whether the unauthorised use pertains to a payment card, credit card, communications device or a means of electronic identification.