The certification-service-provider shall not be liable for damage resulting from this maximum limit being exceeded.

a certification-service-provider established within the Community which fulfils the requirements laid down in this Directive guarantees the certificate;

The certification-service-provider shall not be liable for damage arising from use of a qualified certificate which exceeds the limitations placed on it.

the certification-service-provider fulfils the requirements laid down in this Directive and has been accredited under a voluntary accreditation scheme established in a Member State;

Certification-service-providers must:

the verifier can, as necessary, reliably establish the contents of the signed data;

Member States shall ensure that certificates which are issued as qualified certificates to the public by a certification-service-provider established in a third country are recognised as legally equivalent to certificates issued by a certification-service-provider established within the Community if:

for assurance that the signature-creation data and the signature-verification data can be used in a complementary manner in cases where the certification-service-provider generates them both, unless the certification-service-provider proves that he has not acted negligently.

"certification-service-provider" means an entity or a legal or natural person who issues certificates or provides other services related to electronic signatures;

not store or copy signature-creation data of the person to whom the certification-service-provider provided key management services;

"qualified certificate" means a certificate which meets the requirements laid down in Annex I and is provided by a certification-service-provider who fulfils the requirements laid down in Annex II;

Member States shall ensure that a certification-service-provider may indicate in a qualified certificate limitations on the use of that certificate. provided that the limitations are recognisable to third parties.

the certificate or the certification-service-provider is recognised under a bilateral or multilateral agreement between the Community and third countries or international organisations.

As a minimum Member States shall ensure that a certification-service-provider who has issued a certificate as a qualified certificate to the public is liable for damage caused to any entity or legal or natural person who reasonably relies on the certificate for failure to register revocation of the certificate unless the certification-service-provider proves that he has not acted negligently.

Member States shall ensure that a certification-service-provider may indicate in the qualified certificate a limit on the value of transactions for which the certificate can be used, provided that the limit is recognisable to third parties.

Requirements for certification-service-providers issuing qualified certificates

the identification of the certification-service-provider and the State in which it is established;

take measures against forgery of certificates, and, in cases where the certification-service-provider generates signature-creation data, guarantee confidentiality during the process of generating such data;

the advanced electronic signature of the certification-service-provider issuing it;

the names and addresses of all accredited national certification service providers.

prior authorisation means not only any permission whereby the certification-service-provider concerned has to obtain a decision by national authorities before being allowed to provide its certification services, but also any other measures having the same effect;

not based upon a qualified certificate, or - not based upon a qualified certificate issued by an accredited certification-service-provider, or - not created by a secure signature-creation device.

such schemes should encourage the development of best practice among certification-service-providers;

Member States shall ensure that a certification-service-provider which issues certificates to the public may collect personal data only directly from the data subject, or after the explicit consent of the data subject, and only insofar as it is necessary for the purposes of issuing and maintaining the certificate.

As a minimum, Member States shall ensure that by issuing a certificate as a qualified certificate to the public or by guaranteeing such a certificate to the public a certification-service-provider is liable for damage caused to any entity or legal or natural person who reasonably relies on that certificate:

"electronic-signature product" means hardware or software, or relevant components thereof, which are intended to be used by a certification-service-provider for the provision of electronic-signature services or are intended to be used for the creation or verification of electronic signatures;

the data used for verifying the signature correspond to the data displayed to the verifier;

certification-service-providers should be left free to adhere to and benefit from such accreditation schemes;

whereas Member States should not prohibit certification-service-providers from operating outside voluntary accreditation schemes;

this Directive does not oblige certification-service-providers to apply to be supervised under any applicable accreditation scheme;

"voluntary accreditation" means any permission, setting out rights and obligations specific to the provision of certification services, to be granted upon request by the certification-service-provider concerned, by the public or private body charged with the elaboration of, and supervision of compliance with, such rights and obligations, where the certification-service-provider is not entitled to exercise the rights stemming from the permission until it has received the decision by the body.

Member States may not limit the number of accredited certification-service-providers for reasons which fall within the scope of this Directive.

Certification-service-providers providing certification-services to the public are subject to national rules regarding liability;

the legal recognition of electronic signatures should be based upon objective criteria and not be linked to authorisation of the certification-service-provider involved;

Each Member State shall ensure the establishment of an appropriate system that allows for supervision of certification-service-providers which are established on its territory and issue qualified certificates to the public.

Each Member State shall apply the national provisions which it adopts pursuant to this Directive to certification-service-providers established on its territory and to the services which they provide.

In order to increase user confidence in electronic communication and electronic commerce, certification-service-providers must observe data protection legislation and individual privacy;

Without prejudice to the legal effect given to pseudonyms under national law, Member States shall not prevent certification service providers from indicating in the certificate a pseudonym instead of the signatory's name.

in order to stimulate the Community-wide provision of certification services over open networks, certification-service-providers should be free to provide their services without prior authorisation;

divergent rules with respect to legal recognition of electronic signatures and the accreditation of certification-service providers in the Member States may create a significant barrier to the use of electronic communications and electronic commerce;

the approach based on the following Austrian legislation: 622nd Federal Law of 1995 - Environmental Verifiers and List of Sites Act, 549th Ordinance of 1996 - Ordinance on assessment of competence, EAC Guide 5 of June 1996;

Voluntary accreditation schemes aiming at an enhanced level of service-provision may offer certification-service-providers the appropriate framework for developing further their services towards the levels of trust, security and quality demanded by the evolving market;

The internal market enables certification-service-providers to develop their cross-border activities with a view to increasing their competitiveness, and thus to offer consumers and businesses new opportunities to exchange information and trade electronically in a secure way, regardless of frontiers;

Member States shall ensure that certification-service-providers and national bodies responsible for accreditation or supervision comply with the requirements laid down in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on tile protection of individuals with regard to the processing of personal data and on the free movement of such data(9).