Principles of Identity Management under the New Bulgarian e-Governance Act

1. LEFIS REYKJAVIC MEETING JULY 13-14, 2007Principles of identity management under the new Bulgarian e-Governance Act MIROSLAV OGNYANOV LEX.BG BULGARIA

2. Main Topics • E-Governance Act • Main Principles • Identity Management • Future Prospects

3. E-Governance Acts – History 1 • Electronic Document and Electronic Signature Act (EDESA) – April 2001 • Art. 41, Para. 1 – Council of Ministers determines the state authorities, which cannot refuse the receipt of electronic documents, signed with universal electronic signature • Ordinance N 153 from July 2004, determining the state authorities under Art. 41, Para. 1 of the EDESA • Internal Rules for the order and the format for preparation and storage of electronic documents

4. E-Governance Acts – History 2 • E-Government Strategy of the Council of Ministers – December 2002 • Plan for the Implementation of the E-Governmental Strategy in the period 2003-2005 – March 2004 – 20 indicative services for the citizens and the business • E-Governance Act – adopted by the CM in November 2006; by the Parliament in June 2007; in force – 13.06.2008

5. Main Principles of the EGA • Obligatory provision of electronic administrative services • Single collection and creation of data • Ex officio submission • Automated data transmission between the administrative service providers • Obligations arise only if the recipient of the service has provided unique identifier

6. Obligatory provision of electronic administrative services (EAS) • EAS are administrative services that can be requested and/or provided distantly through the usage of electronic means • EAS can be provided by providers of electronic administrative services - administrative bodies; persons, performing public functions and organizations, providing public services • Providers of EAS are legally obliged to provide all the services within the scope of their competence also electronically, unless a law provides special form for performance of specific actions and for issuance of relevant acts

7. Single data collection • Primary Data Administrators (PDA) – administrative bodies that by virtue of the law collect or create data for the citizens and organization for the first time • Providers of electronic administrative services cannot request from citizens and organizations to submit or verify data already collected or created by PDA

8. Ex officio submission • Providers of electronic administrative services shall request the data from the PDA • PDA shall submit ex officio the requested data

9. Automated data transmission • The request and submission of data is accomplished electronically, unless there are technological obstacles • Internal Electronic Administrative Service – an administrative body provides the service through the usage of electronic means to another administrative body (or other provider of EAS) for the purpose of exercising the legal powers of the latter

10. Obligation to specify a UI • Only citizens/organizations that have pointed their unique identifier can benefit from the advantages of the provision of EAS • All the providers of electronic administrative services are obliged to provide the citizens and the organizations with the opportunity to point their unique identifier

11. Unique Identifiers Unique Identifiers/Unique Identity Numbers: • Unified Citizen Number (for Bulgarian citizens); • Personal Number of Foreigner (for foreign citizens); • Unified Identification Code (for merchants); and • BULSTAT code (for other persons registered at BULSTAT register).

12. Electronic Signatures • Providers of EAS cannot refuse to accept electronic documents, issued and signed in accordance with the requirements of the EDESA • ES certify the integrity and the authorship of the electronically submitted statements • The certificates for the ES should contain the precise name of the author and (if applicable) – the titular and the grounds for authorization of the author

13. Identity check by providers • The check is performed in the moment of submission of the application for provision of electronic service • Providers of EAS check if the name from the application is the same as the name of the author, contained in the certificate • Providers of EAS check in the respective electronic registry maintained by the PDA that the unique identifier, specified in the application, corresponds to the name of the applicant from the application and the certificate

14. Future Prospects • 12.06.2007 – publication of the EGA in State Gazette • Until 12.12.2007 – all acts of secondary legislation under the EGA shall be adopted • Until 12.06.2008 – the Chairman of the State Agency for Information Technologies and Communications shall audit the information systems of all administrations and make recommendations • Until 12.06.2008 – the administrative bodies shall bring their IS in compliance with the EGA and the recommendations of the Chairman of SAITC • 13.06.2008 – entry of the EGA in force

15. THANK YOU FOR YOUR ATTENTION! Miroslav Ognyanov LEX.BG JSCo., Bulgaria www.lex.bg miroslav.ognyanov@lex.bg