Scoping Cross-Border e-id Management and Facilitating International e-trade

Transcription

1 Scoping Cross-Border e-id Management and Facilitating International e-trade Prof. dr. HONG XUE Director of Beijing Normal University Institute for Internet Policy & Law UNCITRAL Colloquium on Identity Management and Trust Services Vienna 21 April Prof. dr. Hong Xue

2 e-id Management and International Trade Law UNCITRAL International legal foundation in digital age Global digital economy e-id/digital ID Nature persons Legal persons and other organizations Devices, digital products or other things Critical information infrastructure Beyond the international trade law 2

3 A Scoping e-id management A set of processes to manage the identification, authentication, and authorization of individuals, legal entities, devices, or other things in an online context. Multi-level Establishment (generation) of e-id Verification (authentication) and authorization Cross-border e-id management 3

4 e-id Management Approaches Self-establishment and management Contracts and mutual trust Federated ID system ID beyond contractual relationship Used by multiple parties and purposes in cross-system and organization environment Third-party trust services Cross-border federated system Establishment of e-ids Authentication and authorization 4

5 Cross-Border e-id Management Establishment Principal IDs: domestically Government-issued documents (e.g., a birth certificate, identity card, social security card, driver s license, and passport) Derivative IDs: cross-border Internationalized schemes, such as ASEAN SW Credentials issued by private sector entities (e.g., an employee badge and credit cards) Alternative IDs Limited credential if not linked up with the principal IDs (Mobile wireless SIM card, domain names, IP addresses) Caveats Limit: e-ids within the State, system or organization Multiple e-ids for the same subject?

6 Cross-Border e-id Management Authentication and authorization in a federated system Third-party trust services Domestic regulation (e.g. licensing) Cross-border operation Private arrangement (alliance or association) International agreements Centralized system Uniform criteria, standards and related legal requirements International mutual recognition Intergovernmental: harmonization of technical standards, operational requirements, and legal rules Service providers: multiple areas of regulations Service-level agreements

7 Cross-border e-id Management Not one-set-fit-for-all solution Market demands Multi-facets and different degrees of trust Regulated industry Banking, insurance or other financial industry Market approach v. legal regulations Private-sector initiatives International soft law: legal harmonization International agreements Existing laws and practices E.g. e-signatures and CAs 7

8 Related Laws (Enabling: essential and supporting) Legal or regulatory framework on cross-border e-id management Data integrity, truthfulness and accuracy E-contracts and e-signatures Cyber security law Privacy and data protection law Confidence (governmental agencies and private sector) Liability of service providers Dispute resolution (arbitration, ODR, e-evidence admission, etc.) International trade law Private International law Others Intellectual property law (copyright, trade secret, database, patent) Competition law 8

9 Legal Gaps No widely accepted multilateral international laws Privacy and personal data protection EU-US Privacy Shield Agreement (Feb. 2016) APEC Internet Economy Project 2004 APEC Privacy Framework 2007 Data Privacy Pathfinder initiative 2010 Cross-border Privacy Enforcement Arrangement (CPEA) OECD Guidelines Liabilities of service providers Limitations and exemptions Safe harbor? Harmonization of domestic laws Regulations of contacts Legal presumptions in e-commerce

10 Cyber Security and Cross-Border Data Flow Concerns Lack of international legal framework for data protection and data flow Lack of uniform standards Intensifying cyber-security concerns Data localization/sovereignty Extraterritorial law enforcement Possible solutions Technically EPP model: verified result rather than data, per se, cross border Legally, removal of legal barriers on cross-border data flow and clarify the ambiguity Internationally, adapting to global digital economy 10

11 Building the Framework of Cross-Border e-id Management Principles Technological neutrality Party autonomy Third-party trust services Future Technical standards Law compliance (privacy, liability, security, contacts) Dispute resolution Internationally interoperable and interconnected legal norms developed to enable the development and application of cross-border e-id management 11

12 THANK YOU! 12