Biometric FES: How signature pads capture data

Key points at a glance: A signotec signature pad captures dynamic characteristics such as pressure, writing speed, time progression and acceleration, thereby uniquely attributing the signature to a specific individual. This unique attribution is one of several requirements that an advanced electronic signature (AES) must fulfil under Article 26 of the eIDAS Regulation. It is the cryptographic signature within the document, not the biometrics themselves, that ensures the detection of subsequent document alterations. For transactions requiring the statutory written form, the qualified electronic signature (QES) remains necessary.

A biometric signature does not refer to facial recognition or a fingerprint. What is captured is a person’s individual writing style: the way in which they hold the pen. A scanned image of a signature contains only the static end result – the lines drawn. A signature pad, on the other hand, records the entire dynamic process. It is precisely this sequence of movements that is difficult to imitate and provides a unique link to the individual – something a scanned image of a signature cannot achieve. It only becomes an advanced electronic signature when combined with cryptographic embedding within the document.

A signotec signature pad measures several parameters simultaneously whilst writing. The pressure level indicates how firmly the pen is pressed down at any given moment. The writing speed records how quickly individual strokes are made. The time sequence records the order in which the signature is formed and the pauses involved. Acceleration describes how quickly the pen’s movement changes – for example, in curves and at turning points. The interplay of these values creates a unique movement profile that is virtually impossible to imitate, as it reflects a person’s unconscious, ingrained writing rhythm.

Once captured, the biometric data is encrypted. An important technical point to note: it is not the PDF document itself that is encrypted, but the raw biometric data. This encrypted data is then embedded in the document in a tamper-proof manner, together with a cryptographic signature. The cryptographic signature firmly links the signature to the specific content of the document. If the document is subsequently altered, the signature will no longer match and the tampering will become apparent. The biometric data itself remains encrypted and can only be decrypted by an expert in the event of a legitimate dispute – for example, to compare it with a reference signature.

Under Article 26 of the eIDAS Regulation (Regulation (EU) No 910/2014), an advanced electronic signature must be uniquely linked to a signatory, be capable of identifying that signatory, be created under the signatory’s sole control, and be linked to the document in such a way that any subsequent changes are detectable. Biometric capture fulfils the requirements for attribution and identification, whilst cryptographic anchoring fulfils the requirement for linking to the document. A scanned image of a signature fulfils none of these requirements and therefore remains a simple electronic signature with limited evidential value. The biometric FES is thus significantly more robust in the event of a dispute than a mere image signature.

Banks use biometric FES for opening accounts and credit agreements where no specific formal requirements apply; insurance companies use it for application and claims documents; the healthcare sector uses it for consent forms; and the retail sector uses it at the point of sale for sales contracts. In all these cases, biometric capture provides a reliable link to the person signing, without the hassle of a qualified electronic signature requiring prior identity verification. For transactions where the law requires the written form, the QES remains necessary; for the vast majority of day-to-day business, the biometric FES is sufficient.

Is a biometric signature the same as a fingerprint?

No. It records dynamic writing behaviour – pressure, speed, time and acceleration – rather than physical characteristics such as a fingerprint or face.

Who can view the biometric data?

The data is stored in encrypted form within the document and can only be decrypted by an expert in the event of a legitimate dispute.

Does biometrics protect the document from alterations?

No, that is the role of the cryptographic signature. Biometrics serves to uniquely identify the individual.

Is the biometric FES GDPR-compliant?

Yes, provided that encryption, access controls and a data erasure policy in accordance with Articles 5 and 32 of the GDPR are implemented. Signotec’s solutions are designed for this purpose.

Do I need special hardware for the biometric FES?

A signature pad or a suitable signature display is recommended for the reliable capture of dynamic characteristics; a signature created using only a mouse or touchscreen does not achieve the same data quality.

Biometric capture is at the heart of advanced electronic signatures using a signature pad. It ensures that the signature can be uniquely attributed to the signatory and is admissible in court in the event of a dispute, whilst the cryptographic signature safeguards the integrity of the document. Together, this creates a legally compliant, cost-effective signing process for day-to-day business – without the complexity of a QES. signotec has been developing the necessary hardware and software for this purpose for over 25 years.