In the era of the coronavirus pandemic, most institutions are opting to work remotely and the circulation of paper documents is becoming increasingly difficult and dangerous. The current situation has therefore imposed the rational solution of introducing an electronic documentation workflow.
Electronic document circulation is a structured system allowing for the exchange of information and documentation. The system is intended to facilitate the flow of documentation and allow for full monitoring of conducted cases while maintaining the relevant rules for storing and collecting data. However, this circulation must comply with previously developed procedures and security policy.
In the first stage, technological limitations must be overcome. Using IT tools for effective communication - e.g. document scanning - is a way to ensure efficient document circulation, improving work efficiency and streamlining the exchange of information both inside and outside the institution. An institution may use ready-made IT tools (a rather costly solution) or develop schemes for dealing with electronic documents on its own, but what remains the same is to determine what goals we set when introducing a given solution.
The system should ensure that letters are easy to find, reconcile and archive. However, it is important that the workflow itself is strictly prescribed, in line with the organisation's security policy, to ensure maximum data protection (systemisation of information, protected directories and password security systems come into play here).
With a large influx of documents, it is important that the following rules are adhered to by the employees/ representatives of the organisation:
- saving documents according to a fixed method of naming them in a single destination on disk,
- proper organisation of documents,
- electronic backup of documents, e.g. in the so-called cloud.
Archiving of data should be based on simple procedures, such as uniform description and numbering of documents followed by their segregation into appropriate folders, e.g. according to chronological arrangement or other generally accepted key. Both external and internal documents should be dealt with in this way.
In order to develop an efficient documentation workflow in the unit, there is a person who is responsible for following the established procedures.
Electronic conclusion of the contract
The most common form of contracting is in writing. In the current situation in the country, the most common practice used by organisations is to print out a document (contract), have it signed by an authorised person and then scan and send the scan to the other party. However, a document signed and transmitted in this way does not meet the requirements of written form.
In light of the applicable law, it is sufficient for a legal transaction to be in writing if a handwritten signature is affixed to a document covering the content of a declaration of intent. On the other hand, in order to conclude a contract, it is sufficient to exchange documents covering the content of the declaration of will, each of which is signed by one of the parties, or documents, each of which covers the content of the declaration of will of one of the parties and is signed by him. A qualified electronic signature has been equated with a handwritten signature.
In view of the above, it should be recognised that a signature affixed to a document which was subsequently scanned or sent by fax does not meet the requirements of a handwritten signature, which makes it necessary to acknowledge that the written form has not been observed. Such a stance was expressed, inter alia, in the resolution of the Supreme Court of 2 October 2002 (III PZP 17/02), in which it was held that the transmission by fax (telefax) of a document containing a declaration of intent, on which a handwritten signature was affixed, does not fulfil the condition of a handwritten signature within the meaning of the first sentence of Article 78 of the Civil Code. (...) In fact, a fax is only a copy of a letter and therefore also a copy of the handwritten signature affixed to it.
This does not mean, however, that all legal transactions made without the required written form will be invalid. This will only apply to those acts for which the regulations provide for the rigour of nullity in the event that the written form is not observed. In other words - whether a contract requires a special form results from the provisions of law or from the agreement of the parties themselves.
However, on the other hand, sending two copies by post and waiting for one copy to be returned is time-consuming and expensive.
As mentioned earlier, under civil law it is also possible to conclude a contract in electronic form by making a declaration of intent in electronic form and affixing it with a qualified electronic signature. This means affixing a file in a suitable non-editable format (e.g. pdf) with a qualified e-signature. This signature is regarded as a substitute for the person's own handwriting.
A qualified electronic signature is a tool that facilitates the remote exchange of documents. For the highest level of security, ideally all contracts should bear a qualified electronic signature. A qualified electronic signature is one that has been issued using appropriate procedures to verify the identity of its user, and an individual key is required for its use.
Signing a contract electronically, i.e. with a qualified e-signature, is equivalent in effect to signing a contract in writing. If a written form is required for the validity of a contract, it is sufficient to conclude this contract electronically using a qualified e-signature. According to the applicable regulations, the use of a qualified signature has the same meaning as a handwritten signature.
Documentary form of contracts
A much simpler and cheaper way of concluding contracts is, according to Article 77(2) of the Civil Code, the documentary form of a contract. In order to maintain the documentary form of a legal transaction, it is sufficient to make a declaration of intent in the form of a document in a manner which makes it possible to identify the person making the declaration. On the other hand, a document is a carrier of information making it possible to learn its content. Therefore, statements made in the documentary form may be deemed to be, inter alia, messages sent by e-mail and documents signed with the use of a non-qualified electronic signature.
Thus, we will be dealing with a contract concluded in documentary form when the parties to the contract agree the terms of the contract through an exchange of e-mails.
Thus, compliance with the requirement to maintain the documentary form of contracts is just as effective as concluding contracts in writing, provided that the type of contract being concluded does not require the written form to be valid. However, it should be borne in mind that contracts concluded in the aforementioned form should not contain standard provisions:
The agreement was concluded in writing under pain of nullity.
Any changes to the contract must be made in writing under pain of nullity.
The above contract provisions can be replaced by the following equivalents:
The agreement was concluded in documentary form under pain of nullity.
Any changes to the contract must be made in documentary form under pain of nullity.
Data protection
At this point, reference should also be made to the principles of personal data protection. Only authorised persons may process personal data. In view of the above, the controller is obliged to authorise all necessary employees to process personal data.
Each employee should be given a login and password (separate for each employee) by the controller to access IT resources before processing data. Each computer should be equipped with a program forcing a password change every 30 days. Passwords should consist of at least 8 characters (lower case, upper case, at least one number or special character). Each computer should be equipped with a legitimate, licensed anti-virus programme. Each computer should have an automatic screen saver in case of temporary downtime so that, at least in the event of a short absence of an employee, an unauthorised person will not be able to access data. Electronically transmitted personal data files should be encrypted.
According to a report by the Association of Data Protection Companies (ZFODO), as many as 92 per cent of RODO breach incidents are unintentional. Since their cause is most often human error, it is often said that employees are allegedly the weakest link in the data protection security chain. The introduction of internal procedures is therefore intended to make the employee aware of the principles of compliance with personal data protection and the consequences of a breach. In addition, it is necessary to control on an ongoing basis the implementation of the above principles by the employee, through direct control by the controller or an authorised person.
It is also necessary to improve the knowledge of employees about the principles of personal data protection through systematic training. The key to creating an effective personal data protection system is to continuously improve the knowledge and awareness of those processing personal data.
Summary
The current pandemic period is forcing institutions to use technology for contracting. In most cases, the use of a document-based form enables effective online contracting. However, if an organisation has the technical and financial capacity, it should use another form, i.e. a qualified electronic signature. Documentary form allows for an easier and faster way of concluding contracts. However, it is worth ensuring that appropriate safeguards are in place for the contracting process.
Material for the Institute for Patients' Rights and Health Education was prepared by Monika Stemplewska, advocate, and Lawyer Aleksandra Sobisz (Grupa Prawnicza Stemplewska, Rytel Adwokaci i Radcowie Prawni sp. p.) as part of the 'Network for Health' project.
The 'Network for Health' project is implemented with a grant from the Active Citizens - National Fund programme funded by Iceland, Liechtenstein and Norway under the EEA Funds.