21 mar 2017
¿Qué son las firmas electrónicas y cómo debo elegir la más adecuada para mi empresa?
Es probable que la mayoría de personas que esté leyendo este post hayan oído hablar del enfoque "sin papel" y, posiblemente, ya habrán comenzado a adoptarlo en su organización. Entre las muchas razones que existen para hacerlo (o simplemente planteárselo) se incluyen:
- Reducir los costes asociados con los documentos en formato físico
- Aumentar el ROI mejorando la colaboración
- Ahorrar tiempo en la ejecución de procesos
- Incrementar la movilidad e interacción entre documentos
Ya sea por las razones anteriores o por otras por las que las organizaciones adoptan el enfoque "sin papel", todas suelen encontrarse con diversos obstáculos en lo que se refiere a las firmas. Imprimir y firmar físicamente cada vez que se requiere una rúbrica resulta poco práctico e ineficiente e interrumpe un proceso electrónico que, por definición, debería ser eficaz.
Esta es la razón de ser de las firmas electrónicas. Al sustituir la tinta por este proceso electrónico, las organizaciones pueden garantizar que sus flujos de documentos son verdaderamente electrónicos y sin papel, y así poder beneficiarse de las ventajas que mencionamos anteriormente.
¿Qué es una firma electrónica (o firma digital)?
De forma resumida, puede decirse que una firma digital es la versión electrónica de la firma manuscrita. Desde una perspectiva más "oficial", la Ley Federal de Firmas Digitales de los Estados Unidos propone la siguiente definición: "un sonido, símbolo o proceso electrónico que se adjunta o asocia por medios lógicos a un contrato u otro registro y que una persona ejecuta o adopta con el objetivo de firmar dicho contrato o registro".
Si está pensando que dicha definición suena ligeramente confusa, está en lo cierto. La definición de "firma electrónica" es poco específica y el término puede aplicarse a una amplia variedad de "actos de firma" (es decir, la acción que adopta al mostrar su intención de firmar), los cuales van desde simplemente marcar una casilla, introducir sus iniciales, escribir su nombre o insertar una imagen de su firma manuscrita, hasta usar una firma electrónica criptográfica.
No todas las firmas electrónicas son iguales
Como se imaginará, el nivel de garantía y legitimidad de estos diferentes tipos de firmas electrónicas puede variar mucho, y su validez legal suele venir determinada por el cumplimiento de una serie de normativas. La Ley Federal de Firmas Digitales de los Estados Unidos, el Reglamento relativo a la identificación electrónica y los servicios de confianza (eIDAS) en la UE y otras normativas específicas del sector definen claramente los criterios que una firma electrónica debe reunir para poder aceptarse como una alternativa viable a las firmas físicas.
En cualquier caso, la validez legal de las firmas electrónicas, y su aceptación por las propias empresas, pasa en gran medida por su nivel de confianza. ¿Tiene la certeza de que la persona que ha firmado es realmente quien dice ser? ¿Está seguro de que el documento que se ha firmado no ha sido alterado? ¿Puede fiarse de que la fecha en la que se aplicó la firma es correcta? Lo cierto es que no todas las firmas electrónicas permite contestar afirmativamente a estas preguntas.
Imagine que el departamento de finanzas de su empresa va a enviar una factura a un cliente y la persona responsable ha insertado en ella una imagen de la firma del director financiero para indicar que la factura ha sido autorizada y aprobada por la compañía. Entonces, un hacker intercepta la factura y la altera antes de que esta se remita a su destinatario. Posteriormente, el destinatario abona la factura pero su empresa nunca llega a recibir el pago. Cuando va a reclamar el pago, su cliente se queda petrificado al descubrir que han abonado la factura en la cuenta bancaria incorrecta. Aunque en el anterior escenario se aplicó una firma electrónica, esta no proporcionó garantía alguna sobre la exactitud de los contenidos del documento. Por tanto, su empresa no puede confiar en que su cliente vaya a recibir la factura correcta.
Las firmas electrónicas ofrecen un mayor nivel de confianza que cualquier otro tipo de firma electrónica y constituyen un método de eficacia comprobada y demostrada para garantizar que los documentos que se envían y firman electrónicamente no han sido alterados de ningún modo, que es posible identificar al remitente fácilmente y que este es realmente quien dice ser.
Sin una firma electrónica, es imposible estar seguro de que un hacker no ha interceptado y alterado sus documentos. Por tanto, si prescinde del uso de firmas electrónicas, nunca podrá tener la certeza de que sus clientes van a pagar sus facturas a su empresa y no a un tal Vladimir en Moscú o un Craig en Londres.
Al añadir una firma digital, su departamento de finanzas podrá garantizar a sus clientes que el dinero que le envían le llega REALMENTE a usted.
Le invitamos a que lea nuestro post relacionado para obtener más información sobre en qué se diferencian las firmas digitales de otras firmas electrónicas.
La importancia de las firmas de confianza pública
Desgraciadamente, las situaciones de facturas abonadas a la persona incorrecta como la descrita en el ejemplo anterior se repiten a diario. Sin embargo, la confianza en la integridad del documento no es el único tipo de confianza que debe considerar a la hora de elegir una firma electrónica.
La confianza pública es esencial si envía documentos a terceros o utiliza determinados programas de software para el procesamiento de documentos. De hecho, si no dispone de ella, sus destinatarios se encontrarán con mensajes alarmantes de advertencia para que no confíen en su firma cuando abran sus documentos en programas de software como los desarrollados por Microsoft o Adobe. Estas empresas establecen requisitos técnicos sobre el uso de sus productos que implican que debe disponer de una firma digital para acceder a todas las funcionalidades de los servicios que ofrecen.
La confianza pública es también un aspecto importante para muchos requisitos normativos, como por ejemplo los establecidos en virtud del Reglamento eIDAS. En futuros posts de nuestro blog analizaremos las normativas relativas a la regulación de las firmas electrónicas, su legislación aplicable y algunos de los sectores que se ven más afectados por la confianza pública.
¿Qué tipo de firma electrónica necesito?
La confianza de una firma electrónica es exactamente la misma que proporcionan los procesos empresariales y las tecnologías que se utilizaron para crearla. Por tanto, además de confianza pública, las operaciones de alto valor exigen también firmas electrónicas de mayor calidad. Las firmas utilizadas para estas operaciones deben estar ligadas al propietario con el fin de proporcionar el nivel de garantía necesario y asegurar la confianza en el sistema subyacente.
A la luz de lo anterior, la mayoría de empresas necesitarán firmas electrónicas con un nivel añadido de confianza pública, o podrían beneficiarse de utilizarlas.
Las firmas electrónicas de mayor calidad pueden ofrecer:
- Autenticación – que vincula al signatario con la información.
- Integridad – que permite detectar más fácilmente cualquier cambio en la información proporcionada y reducir así la probabilidad de que un hacker como el que mencionamos al comienzo de este post la intercepte.
- No repudiación – que garantiza (jurídicamente hablando) la procedencia de la firma electrónica y, por tanto, la dota de confianza pública, por ejemplo en un contexto legal.
Dar con la firma electrónica más adecuada para usted pasará principalmente por esclarecer las razones por las cuales desea adoptar un enfoque "sin papel".
Una posibilidad es que esté intentando agilizar sus procesos, en cuyo caso el cumplimiento y la confianza no constituirán un aspecto relevante. También es posible que necesite enviar documentos fuera de su red interna, y en este supuesto la confianza pública sí será un factor importante para que los diferentes programas de software de documentos acepten su firma automáticamente. En cualquier caso, cada organización posee su propio proceso de trabajo, y esta es la razón por la cual todas las soluciones deben ajustarse y adaptarse a las necesidades individuales.
En nuestro siguiente post hablaremos de cómo seleccionar la solución más adecuada. Si desea mantenerse informado sobre las firmas electrónicas, no dude en suscribirse a nuestro blog para recibir los artículos más recientes directamente en su buzón.
También puede comentarnos sus requisitos de firmas electrónicas para que podamos determinar si contamos con una solución adecuada para usted, poniéndose en contacto con nosotros hoy mismo.
Share this Post
Envie tu blog
ParticipeSubscribe to our Blog
Connect with us
To download a version of this privacy policy, Click Here.
GlobalSign Privacy Policy Version 3.0
Updated April 1, 2018
GlobalSign respects your right to privacy.This privacy policy has been developed to inform you about the privacy practices followed by GlobalSign in connection with its websites, products and services. This privacy policy does not apply to GlobalSign services offered by or through our partners, resellers or other third parties, or other third party services or websites, and we encourage you to read the privacy policies of those parties.
This privacy policy will inform you about what data is collected, how we use such data, where data is processed, how you may opt out of your data being used, the security provisions around storing your data and how to correct or update your data.
1. Data Controller
In order to communicate with you and to provide our products and services and related support, it is necessary for GlobalSign to transfer your personal data outside of the European Union. In such case, the data controller for this data for EU residents is GMO GlobalSign, Ltd., having its registered offices at Springfield House, Sandling Road, Maidstone, Kent, ME14 2LP, United Kingdom. All questions or requests regarding the processing of data may be addressed to: dpo@globalsign.com.
2. Collection of Personal Information
We collect information from you when you (i) place an order for a GlobalSign digital certificate product or other product or service, (ii) scan your servers for digital certificates using our Certificate Inventory Tool (CIT), (iii) apply for access to our managed service platforms, (iv) subscribe to our newsletter, (v) use our online chat service, (vi) download a white paper, (vii) register for a webinar, (viii) respond to a survey, (ix) fill out a form for pre/post sales assistance, (x) open a support ticket, or (xi) your use of social media.
GlobalSign is a Certification Authority and trusted third party. To fulfill requests for digital certificates or other products or services, you may be asked to enter your name, email address, physical address, phone number, credit card information and/or organizational details or other personal information.
We may develop and acquire additional information about you using third-party sources, browsing, and purchasing history, and so on in order to process certificate requests and to improve our services.
GlobalSign treats personal information as confidential, except for the information included in an issued digital certificate. Such information may be verified using third party commercial and government resources, and as such, is deemed to be public information.
3. Use of Personal Information
Your information, whether public or private, will not be sold, exchanged, transferred outside of our group company, or given to any other company for any reason without your consent, other than for the purposes specified in below:
3.1 To process applications for GlobalSign products and services
Your information is used to provide our products and services and order processing as well as to conduct business transactions such as billing.
3.2 To improve customer service
Your information helps us to more effectively respond to your pre/post sales requests and provide technical support.
3.3 To send renewal notices
The email address you provide for order processing may be used to send you renewal notices for your expiring digital certificate.
3.4 To send periodic emails
In addition, we may send you periodic company newsletters, new service updates, security updates, related product or service information, and status updates on maintenance windows or service availability.
3.5 To tell you about our products and services
We may send you information about our products and services that may be of interest to you based on your use of other GlobalSign products and services, your attendance at GlobalSign sponsored marketing events such as webinars, your requests for information about similar products and services, or your sharing of data with social media sites such as LinkedIn or Facebook.
4. Processing of Data and Consent
We will process your data for the purpose of performance of our contract with you or the legitimate interest of our business. In other cases, we will request your consent for the processing of the personal data you may submit.
Your refusal to provide personal data to us for certain products and services may hinder us from fulfilling your order for those products or services. Also, if you deny or withdraw your consent to use personal data or opt out of receiving information about GlobalSign products and services this may result in you not being made aware of sales promotions, renewal notices, periodic company newsletters, new service updates, security updates, related product or service information, and status updates on maintenance windows or service availability.
5. Use of Cookies and web beacons
The GlobalSign Certificate Center (GCC) uses cookies to enable the fulfillment of services. Cookies may be used when you log into the GCC, purchase products or use certain GCC functions.
In addition, like most online businesses, GlobalSign uses cookies and web beacons on our websites and through marketing related emails to gather and analyze some personal data such as the visitor’s IP address, browser type, ISP, referring page, operating system, date/time and basic geographical information.
We use cookies and web beacons to compile aggregate data about site traffic and site interaction so that we can gauge the effectiveness of our communications and offer better site experiences and tools in the future. We may contract with third-party service providers to assist us in better understanding our site visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business.
First time visitors may choose to not have any activity monitoring cookies set in their browser. We use an opt-out identification cookie to tag these users as having made this decision. Those cookies that pertain to site performance, experience improvement and marketing are programmed not to execute when an opt-out cookie is present in a visitor’s browser. Opt-out cookies persist until a visitor clears their browser cookies, or until their expiration one year after the set date. A visitor is required to opt out again after one year in order to disable any activity monitoring cookies.
More details of GlobalSign’s use of cookies can be found on our website at https://www.globalsign.com/en/repository/cookie-policy/
6. Use of application logs for diagnostics or to gather statistical information
Our servers automatically record information ("Application Log Data") created by your use of our services. Application Log Data may include information such as your IP address, browser type, operating system, the referring web page, pages visited, location, your mobile carrier, device and application IDs, search terms, and cookie information. We use this information to diagnose and improve our services. Except as stated in section 8 (Data Retention), we will either delete the Application Log Data or remove any account identifiers, such as your username, full IP address, or email address, after 12 months.
7. Sharing of Information and Transfers of Data
We do not sell or trade your personal information to outside parties.
GlobalSign is a global organization with business processes and technical systems in various countries. As such, we may share information about you within our group company and transfer it to countries in the world where we do business in connection with the uses identified in section 3 above and in accordance with this Privacy Policy. In these cases, personal data will be transferred to countries that do not provide an adequate level of protection under European law so we ensure your data is protected by entering into agreements containing standard contract clauses with each of our group companies a copy of which may be obtained by contacting us as outlined in section 15 below.
We may also transfer your personal data to trusted third parties in order to serve purposes that are specified in section 3 above. In circumstances where data is shared with such third parties, they are required to agree to confidentiality terms. This prohibits such third parties from selling, trading, using, marketing or otherwise distributing GlobalSign customer data.
We may also release your information when we believe release is appropriate to comply with the law or protect our rights, property, or safety.
It is our policy to notify customers of requests for their data from law enforcement unless we are prohibited from doing so by statute or court order. Law enforcement officials who believe that notification would jeopardize an investigation should obtain an appropriate court order or other process that specifically precludes member notification, such as an order issued pursuant to 18 U.S.C. §2705(b).
We may also disclose your personal information to third parties who may take over the operation of our site or who may purchase any or all of our assets, including your personal information. We will contact you using the details you provide if there is any change in the person controlling your information.
8. Data retention
The personal information we collect is retained for no longer than necessary to fulfil the stated purposes in section 2 above or for a period specifically required by law or regulation that GlobalSign is obligated to follow.
To meet public CA audit requirements as detailed in the GlobalSign Certification Practice Statement, personal data used to fulfill verification of certain types of digital certificate applications will be retained for a minimum of 10 years depending on the class of product or service and may be retained in either a physical or electronic format. Please refer to the GlobalSign Certification Practice Statement for full details.
Even if you request deletion or erasure of your data, we may retain your personal data to the extent necessary and for so long as necessary for our legitimate business interests or performance of contractual obligations.
After the retention period is over, GlobalSign securely disposes or anonymizes your personal information in order to prevent loss, theft, misuse, or unauthorized access.
9. Opting out; withdrawing consent
If at any time you would like to unsubscribe from receiving future emails, we include unsubscribe instructions at the bottom of each email.
Renewal notices may be cancelled on a per digital certificate basis by logging into your GlobalSign Certificate Center (GCC) account and disabling renewal notices.
Email preferences for CIT related/collected information can be updated and changed within CIT.
If GlobalSign is processing your personal data based on your consent, you may withdraw your consent at any time by contacting us at one of the addresses shown in section 15 below.
10. Acess to your personal data
You are responsible for providing Globalsign with true, accurate, current and complete personal information. Also you are responsible to maintain and promptly update the information to keep it true, accurate, current and complete.
You have the right to access and modify your personal data stored on GlobalSign systems.
You can request to access or modify your personal information by contacting us in writing. We will require you to provide identification in order to verify the authenticity as the data subject. We will make reasonable effort to respond to and process your request in a timely manner.
If you provide any information that is untrue, inaccurate, not current or incomplete, or if we have reasonable grounds to suspect that such information is untrue, inaccurate, not current or incomplete, we have the right to suspend or terminate your account and refuse any and all current or future services.
11. How we protect your information
We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL).
After a transaction, your transaction-related information will be kept on file to meet audit requirements and facilitate renewals. We do not retain any credit card details.
GlobalSign uses a reputable third party to process credit card payments and needs to provide credit card numbers and identifying financial data directly to the third party credit card processor. Such information is shared securely.
12. Follow relevant laws
GlobalSign commits itself to protect the personal information submitted by applicants and subscribers for its public certification services. GlobalSign declares to fully respect all rights established and laid out in European laws and operates within the limits of the:
- European Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; and
- Provisions of the GlobalSign CPS.
13. Your rights
In compliance with the European Union rules on privacy, you have the following rights established by law:
- We use the data you submit only for purposes identified in section 3 of this privacy policy.
- You have the right to review your personal data that GlobalSign holds and check it for accuracy.
- You have the right to correct data in the case that errors may be found in our records.
- You have the right to request that any of your personal data be erased. i.e. right to be forgotten.
- You have the right to obtain and reuse use your personal data for your own purposes
- You have the right to request that GlobalSign restrict the processing of your personal data under certain circumstances.
- You have the right to object to our processing of your personal data.
14. Changes to our Privacy Policy
If we make material changes to our privacy policy, we will inform customers by emailing a notice of the availability of a new version with a link to the new version.
15. Contact Us
If you have any inquires, or questions regarding our privacy policy, please contact us at:
https://support.globalsign.com/
https://www.globalsign.com/en/company/contact/support/
https://jp.globalsign.com/support/
or
Deputy Data Protection Officer
GMO GlobalSign, Ltd.
Springfield House Sandling Road
Maidstone, Kent ME 14 2LP
United Kingdom
dpo@globalsign.com
16. Our Office Locations
GMO GlobalSign K.K., Tokyo, Japan
GMO GlobalSign Ltd., Maidstone, Kent, UK
GMO GlobalSign N/V, Leuven, Belgium
GMO GlobalSign, Inc., Portsmouth, NH, USA
GMO GlobalSign Russia LLC , Moskva, Russia
GMO GlobalSign Pte. Ltd, Anson, Singapore
GMO GlobalSign Certificate Services Pvt. Ltd., Delhi, India
GlobalSign China Co., Ltd., Shanghai, China
GMO GlobalSign Inc., Manila, Philippines
GMO GlobalSign FZ-LLC, Dubai, UAE
