The Digital Administration Code (CAD): promises we’ve kept and targets we’ve missed
After the ratification by the Council of Ministers: here’s what the amendments (Corrective Decree) to the CAD mean
by Guido Scorza and Diego Piacentini
Questo articolo è disponibile anche in italiano
“We will be open and transparent; we will publish documents that illustrate what we’ve built, the decisions we’ve made, the mistakes we’ve made and the benefits we’ve observed.” This is one of the promises that were made in the Digital Transformation Team’s Manifesto written at the beginning of our mandate last year. Today, we want to keep this promise by explaining the steps we’ve taken so far to improve the Digital Administration Code (CAD) – as discussed in this post of January 2017 – and the steps that are still left for us to take.
But why today? The news of the Cabinet’s final approval of the legislative decree amending the CAD (corrective decree) is still fresh. We wish to inform citizens, businesses, administrations and professionals about the implications of these changes.
The CAD amendment is one of the pillars of Public Administration reform, as was pursued and steered by Marianna Madia, the Minister of Public Administration and Simplification. The new text is the result of an essential and valuable collaboration between the Minister’s cabinet, the Digital Transformation Team of the Presidency of the Council of Ministers and the Agency for Digital Italy (AgID).
The new regulation is the result of a joint effort between specialists from different fields – lawyers and computer scientists – bound together by one common goal indeed almost an obsession: simplifying the rules to simplify the life of citizens.
Such an effort, shared by people with different professional skills and experiences in computer science and law was the result of a constant, intense, and sometimes harsh scrutiny from different perspectives and interests. Yet, the effort was animated by a vision of the entire Public Administration ecosystem and with the future in mind (in the certainty that it’s not always true that those who copy don’t make mistakes): all this made it possible the CAD revision.
In addition to being one of the foundational elements of the Public Administration Reform, the Code also constitutes an essential part of the Three-Year Plan for Information Technology in the Public Administration, the strategic document designed to guide the digital transformation of the Country and approved by the Presidency of the Council of Ministers in May 2017. The CAD t lays the legal groundwork for many of the digital services set out by the Plan. Some of these services are already being implemented, like, for example, the Digital Citizenship, the Data & Analytics Framework (DAF), and the citizens’ “digital residency”.
In short, we’ve been able to keep many of the promises that we made in our Manifesto. Yet, for different reasons, we’ve missed the mark on some and had to to simply postpone others. Let’s go through them, one at a time.
First Pledge: laws that contain only principles
The first pledge, as announced in January 2017 post , was to make the CAD more accessible and easier to read by deleting provisions that reaffirm just the obvious. For example, we no longer wished to read into law sentences such as: in order for a wheel to be a wheel, it must be round. Our ambition is that laws – starting with the CAD – contain only principles. to do otherwise, especially in the case of laws concerning the digital transformation, may hamper the future with unnecessary regulatory constraints.
This is why we promised to make the CAD as technologically neutral as possible as it has already happened in countries more digitized than ours. More advanced countries are guided by technological principles rather than technical standards carved in stone.
Mostly, we’ve been able to keep this promise, while there is alway room for improvement . Here is an example.
The Digital Signature
Previously, the CAD stipulated that administrations and private citizens may use either a digital signature, an advanced electronic signature or a simple electronic signature in order to fulfil the formal obligations of the written form.
In the case of the first two, the signed document is considered equivalent to a paper document with a written signature. In the third case, however, a judge decides, on a case by case basis, whether or not the electronic signature should be considered equivalent to the written signature.
More precisely, the law often requires that a document – such as a contract, privacy notice, a form for requesting a public service – must be signed in the traditional way, with paper and ink. The prior version of the CAD required that in order to satisfy this obligation, one should use an advanced digital or electronic signature or, alternatively, a simple electronic signature. However, in the case of the simple electronic signature, the validity of this signature would have to be decided by a judge on a case by case basis.
Basically, the prior version of the Code established a principle but it then required a specific technological solution as the only means to its full implementation.
Why? It’s hard to say. Digital signatures and advanced electronic signatures are valuable, versatile and secure legal IT tools. Despite having been available on the market for years, they have never been adopted on a wide scale. They aren’t available for use on the smartphones of the millions of citizens who might need to sign a digital document rather than a piece of paper with pen and ink.
Nevertheless, this situation did not stop us from proceeding with the digital transformation of the country. Strong in our conviction that a digital document can produce the same legal benefits as a paper document , even without its signatories being in possession of a digital or advanced signature, we introduced an amendment that would consider the innovative solutions in addition to the traditional ones.
But, the biggest change (and possibly the first time this has happened in our country) is that the amendments to the CAD do not establish by law which these other solutions are but delegate the task of analyzing, identifying and updating them to the Agency for Digital Italy (AgID) in accordance to the solutions offered by the evolution of technology.
Second pledge: fewer technical regulations and more guidelines
Another of the propositions that we put forth in January 2017 post was the deregulation of digital transformation so that digital policies are able to evolve alongside technology and keep up with the changes.
Fewer technical regulations (adopted as the outcome of complex, articulated and cumbersome administrative procedures, and reviewed by dozens of different bodies) and more guidelines (adopted with agility as the result of a public online consultation and constantly updated).
This is another promise we’ve been able to keep.
The technical rules that have been prescribed in the prior CAD will eventually sunset or, at least, undergo a change. They will turn into guidelines for adoption by the Agency for Digital Italy, after the necessary revision by the relevant entities and authorities, and scrutinized by professionals through an online public consultation. The new guidelines will come into effect simply as a result of their online publication.
What does this mean? It means that, finally, the law will no longer be static and will truly be able to keep up with technology. And when technology offers new solutions for solving a problem more effectively, the only change that needs to be made is an update of the guidelines followed by a one-month online consultation. It will finally be possible to avoid clashing with years-old processes that are too difficult to modify: the new processes will be more agile and efficient.
Third Pledge: the citizen is central
When we started planning for the Digital Administration Code of our dreams, we made it clear, from the very beginning, that we wanted to put the citizens at the center of our structure and build a sustainable regulatory and technological ecosystem around them. The idea is to establish a principle, recognize a right, and guarantee the immediate (or almost immediate) possibility for exercising it through a simple technological solution, just one click away.
The Digital Residency
In January’s 2017 post, we illustrated our intention of building a “digital residency” with the following example: “the creation of a digital home for every business, professional or citizen is an “indispensable presupposition” for the country digital transformation. Instead of limiting ourselves to principles – already provided for in the current code – we are going to put forth a clear, modern solution that is technologically neutral and open, easy to use and designed to withstand the passage of time.”
This promise has also been kept.
Without waiting for the completion of the National Registry of the Resident Population – another project on which the Team is working hard in its role of program office on behalf of the Ministry of the Interior -the new CAD provides that every citizen, association and entity shall have the right to elect a digital residency located at any email address or qualified European address and the right to receive only at that address any communication of legal value from either the Public Administration or private parties.
If the administrations adapt and change the existing processes, the green postcards and rolled up white receipts, which often go unnoticed at the bottom of the postbox, will no longer be necessary. Most importantly, citizens will no longer have to queue up to pick up registered mail inviting them to collect further communications at the municipal house” as if they were on a treasure hunt.
The savings in costs are enormous. Yet, thanks to digital, equally important achievements are more efficiency for the Public Administration and the possibility of living a simpler life for citizens.
Digital Citizenship
Along a similar vein, the CAD introduced the new Digital Citizenship service that is intended to be used as a dashboard for every citizen. It is a “place non-place” where all citizens can choose to equip themselves with their own, personal and digital citizenship tools. These include identity, home, digital signatures, the ability to receive notices and communications from the Public Administration regarding deadlines and obligations, as well as access to all acts, documents and proceedings that concern them.
The Digital Citizenship service will, for the first time, transform the idea of Italia Login, the “online home of the citizen” into reality. The project was conceived during the previous government and aimed at putting finally citizens at the center as it allows them to engage in simple, immediate, and accessible dialogue with the administration.
A Single Digital Ombudsman
Obviously, we want to be careful not to harbor illusions or promise miracles. Everything we’re talking about isn’t going to happen right away. A long phase of execution and an unrelenting determination to implement the legislative dictate will be required for all Public Administrations to successfully connect themselves to these new components of the Operating System of the Country.
Nevertheless, the regulatory foundations have been laid and we are working on the beginning of a service that will soon be able to offer citizens some initial functionalities and allow the most exemplary administrations to start heading towards the future.
Building a sustainable regulatory ecosystem that features the citizen at its center requires, above all, the provision of simple, accessible and immediate solutions through which citizens can assert their rights to Digital Citizenship, when things go wrong.
This is why the amendments to the CAD require the establishment of a single office of the Digital Ombudsman at the Agency for Digital Italy, in place of the many digital ombudsman that should have been instituted in all administrations but which, in reality, only ever existed on paper.
We want a Digital Ombudsman that is truly authoritative, independent and modern, that stands on the side of citizens and businesses and is capable of ensuring that the rights of digital citizenship don’t remain trapped in the pages of the CAD but are effective and within reach of those who must interact with an often difficult Administration that’s reluctant to change pace.
It’s important to take up the challenge that digital poses now. The Ombudsman will intervene at the request of a diligent Public Administration employee or perhaps at that of an attentive citizen and, with authority and moral suasion, persuade the Administration to do its part and to recognize the rights of the reporting party.
To this point, we’ve discussed the promises that we were able to keep. But there are many, even better things that can happen with the new CAD.
Next steps: software “recycling”
The reuse of software that was either developed by or on behalf of the Administration is, for example, a valuable practice, capable of making improvements in efficiency and saving millions of euros.
In theory, the CAD has always provided for it but in practice, unfortunately, it’s an obligation that has gone nowhere, mostly because neither the tools nor a culture of sharing were in place to do it.
With this new version of teh CAD, an attempt was made to go from mere words to action by stating that the software intended for reuse should be published on one or more platforms. So, before buying or commissioning the development of new software, each administration will always have to check that another administration hasn’t already developed a product capable of responding to its specific needs.
But good intentions aren’t enough. Mechanisms and processes are also important. Therefore, prior to this last summer, the Digital Transformation Team launched the site, developers.italia.it, a platform that hosts the community of developers of Italian public services. This site has started to work on enabling platforms and many other software applications belonging to the Public Administrations will be added over time. It’s an innovative platform, an important step towards the creation of a culture of sharing.
Future projects: improving services through the use of public information assets
Many issues are still left to be addressed. For example, Public Administrations are powered by a genuine goldmine of data and information, products and contracts that exist to provide citizens and businesses with the proper services. In the context of continuous improvement, this goldmine could be extremely useful for orienting the action of the individual administrations (and of the State itself) towards satisfying the needs of citizens and businesses.
From this perspective and, in view of achieving this result, the amendments to the CAD stipulates the establishment of a national platform for public data, the Data & Analytics Framework (DAF), designed and developed by the Team for Digital Transformation and possibly managed by ISTAT (the Italian National Institute of Statistics).
It’s only a first step towards the sustainable exploitation of the public information that Administrations have access to. It will be up to the Presidency of the Council of Ministers and the Data Protection Authority to establish, respectively, which data will flow into the platform and what guarantees will be necessary to protect the privacy of citizens.
There’s still a lot to do: the challenges we haven’t overcome yet
Despite our successes, no story is complete without both light and shadow. The principle of transparency requires us to refrain from dazzling citizens with the good stuff while hiding the bad stuff.
We have not succeeded in all our resolutions.
The CAD isn’t necessarily more readable than it was before, even if some serious effort has been made in this direction. For now, unfortunately, we’ve lost the battle against legislative inflation: the number of CAD articles has remained the same. We eliminated many but had to insert new ones.
In part, the blame lies with a system that makes it difficult to delete a regulation without risking the creation of more problems than benefits. We amended and corrected an already existing piece of legislation without introducing a whole new reform; the dense network of references in which the new regulation is stuck was a huge limitation. The possibility to propose revolutionary solutions for rewriting legislature has certainly been limited.
We predict, however, that the machine learning algorithms of Artificial Intelligence will also be able to help legislators “clean up” the regulatory jungle which we are subject to and simplify the system of rules.
Much has been done, or better yet, is being done, but there’s so much left to do. There are no magic wands, alchemies or miraculous potions that can do the job for us.
Furthermore, the laws – even the ones that can be considered model of clarity – are not enough to digitalize the Public Administration. To implement the Digital Citizenship rights,old and new, recognized by the CAD, we need not only significant investments but also an Agency for Digital Italy that is well-organized, equipped with innovative digital tools and spending budget, and manned by qualified and capable people with long-term vision. In addition to a great determination and a desire for teamwork, these are the necessary ingredients. Without these ingredients, even the most comprehensive law to promote digital citizenship rights will remain a good intention only ink marks on paper while we will be condemned to forfeit the goal that inspired the entire reform: truly improving the lives of citizens.
The digital transformation is a path that the State – even with the most efficient of its organizations and administrations – cannot reach on its own.
Ideas, proposals, openness to forms of cooperation between the private and public sectors are important aspects of digital transformation, but it will never be possible if the administration cannot acquire the technologically competent human resources capable of carrying out the digital transformation of the Country.
Naturally, there will be much doubt, curiosity, confusion and criticism. This is as it should be. We’ve tried to anticipate some questions by providing a few answers in the FAQs below.
FAQ
1. The current text of the Digital Administration Code was reviewed only a year ago. Why correct it? Were there any mistakes?
The opportunity to correct the Code within twelve months of its reform was planned from the outset; it’s a practice of good regulation. Writing a law on a “desk”, after having conceived of it in a “laboratory”, is very different from seeing it in action and being able to measure its effectiveness and ineffectiveness, it’s limitations and potential.
However, in this case there’s more to consider. The Office of the High Commissioner for Digital Transformation was established with the same legislative decree that implemented the last reform of the CAD. The office has, in the last twelve months, begun to work, revising the country’s strategy for digital transformation and launched, along with the Agency for Digital Italy, the Three Year Plan for Information Technology in the Public Administration.
These important innovations have made it necessary to adjust the legislative infrastructure so that it becomes consistent with the new strategy and, thus, able to support the digital transformation of the country.
2. Why have we gone from a digital residency elected to the National Population Registry (ANRP) to a digital residency elected to a register created ad hoc?
ANPR is one of the infrastructures that enables digital transformation. It’s an ambitious, valuable and complex process. It will take some time to complete.
Postponing the citizens’ right to elect a digital residency until the completion of the Registry would have delayed by at least two years the time by which the administrations may be able to send digital communications of legal value to citizens. Starting immediately will save tens of millions of euros in postal expenditures, earn gains in efficiency and make the right to digital citizenship more effective and exercisable.
This is why it was decided to “decouple” the digital residency from the National Population Registry.
Moreover, the directory of digital residencies, which is established by the CAD amendments, will be merged with ANPR as soon as ANPR is completed.
3. Why are we switching from a mandatory digital residency for all citizens to an optional digital residency “until further notice”?
Since its initial release in 2005, the Digital Administration Code states a series of deadlines regarding the obligations and rights of digital citizenship. In most cases, the deadlines are either useless, or worse, rescheduled each year.
The decision to make the amendments to the Digital Administration Code was based on two principles: (a) good digitization is not imposed by law — especially onto citizens – but comes into effect because it works, because it makes life easier and the rights of citizens more effective; (b) Italy is still characterized by a severe digital divide and there are still significant sections of the population that, through no fault of their own, are not able to successfully use legal technology tools like the digital residency. Digital transformation is only good if it’s inclusive.
This is why, instead of establishing that all citizens must have a digital home by a certain date, the new version indicates a switch off date, which will be established by Government decree, once everybody is ready.
4. Why do the amendments extend the Code’s scope to providers of public services?
A great number of public services are directly provided to citizens through public service providers rather than through the Administration.
In order to ensure that users of these services can be recognized as having digital rights under the CAD, it was decided that the scope of the Code should also cover those who deal in these services. The CAD is written with the objective of always putting the citizen at the center so, when it comes to the rights of digital citizenship, what matters is the service that a citizen needs to be able to use and not the entity providing it.
5. Why was it decided to repeal the obligation that all State Administrations establish a digital ombudsman office and instead, institute a single office within the Agency for Digital Italy?
The goal we gave ourselves in the previous reform proved itself to be too ambitious. In twelve months, the administrations that had successfully established a digital ombudsman office are very few. That’s without taking into account how difficult it would have been for the manager of a public office – especially a small office where everybody knows each other – to punish colleagues for not abiding to the Code or for not recognizing users their digital citizenship rights. In other words, too many burdens for the Public Administrations, little hope for the actual implementation of the law and, above all, for its real effectiveness.
On this basis, we decided to move to a single, independent and modern ombudsman. The ombudsman will be capable – at last!- of taking up the digital challenge, guaranteeing that the rights of digital citizenship don’t remain hidden within the shadows of the Code but are effective, real and accessible even for those who must communicate with an administration that is often reluctant to change pace. At the request of a diligent Public Administration employee or of an attentive citizen, the ombudsman will intervene and, with authority and moral suasion, work to convince the Administration to do its part and to recognize the right of the reporting party.
6. Why have you intervened in the practice of digital signatures and digital documents? Doesn’t this choice imply too many compromises on security and certainty of legal rights?
The premise of digital transformation is as simple as it is essential: the usability of the solutions is determined by their passage from paper to bit.
As long as it’s easier to file an application on a piece of paper than it is to file it digitally, there is no law, obligation, penalty or deadline that will convince administrations, citizens and businesses to become truly digital.
Administrations and businesses need simple and straightforward rules to digitize their activities. They can’t wait for judges to decide everything on a case by case basis.
This is why the new rules eliminate the principle that a judge must determine, case by case, the validity of electronic documents lacking a digital signature or those that have a “weak” signature. The new rules also establish that solutions “approved” by AgID be used in the creation of electronic documents. This solution guarantees that documents, even those lacking a digital signature, will always and in all cases be given the same validity as the private documents of the past and without sacrificing security and certainty of legal rights.
The requirements necessary for a digital document to have the same legal effects as a digital signature (or worse, an autograph on a piece of paper) are established directly by the Code.
7. What’s the difference between an electronic signature, an advanced electronic signature and a digital signature?
The electronic signature is a set of electronic data attached or connected, through logical association, to other electronic data and used as a method of technological identification. For example, when withdrawing money from an ATM, the PIN entered after inserting the card is a form of electronic signature.
The Advanced Electronic Signature (Italian acronym, FEA) is a particular kind of electronic signature. It is represented by a set of electronic data attached or connected to an electronic document and allows for the identification of the person signing the document. The FEA guarantees a unique connection to the signatory, is created by means upon which the signer can maintain exclusive control, and is linked to the data to which the signature refers to in order to allow for detection of subsequent data changes. For example, the graphometric used in a bank to open a current account or to sign a transfer request with a plastic pen on a touch screen, is an example of an advanced electronic signature.
The Digital Signature is a special type of advanced electronic signature. It is based on a qualified certificate and a system of interacting cryptographic keys, a public one and a private one, which allow the owner (through the private key) and the recipient (through the public key) to request and verify the origin and integrity of an electronic document or a set of electronic documents. The signature used to sign company financial statements to be deposited with the Chamber of Commerce or to sign the notifications to be transmitted to the Guarantor for the protection of personal data using a smartcard specifically issued by a certified supplier is an example of a digital signature.
8. What changes for digital identity providers and qualified service providers?
The new rules establish a single accreditation procedure and/or qualification through which providers of digital identity, digital signatures, certified email addresses and storage can gain the right to start operating on the market.
In the new procedure, the minimum capital requirement gives way to the ability to offer, whether they’re large or small, adequate guarantees of organization, efficiency and the possibility to compensate users, if something goes wrong.
When it comes to providing technological services, being good is more important than being big. The new rules make this principle very clear.
9. Are the guidelines signed by AgID worth less than the technical rules signed by the President of the Council of Ministers or by the Minister in charge of innovation? Why are we weakening such a tool?
In the transition from technical rules to guidelines, there is no “weakening” and no “downgrade.” The only real change is in the adoption and updating process.
Recalling this or that technical rule from the CAD can sometimes take years. We found ourselves forced to think long and hard before making modifications that would better adapt it to technological progress because every change would have taken years to make.
This process is incompatible with the speed of the digital revolution and has frequently forced the Administration to continue solving this or that problem using old solutions only because so much was imposed by technical rules.
The new guidelines – which, in substance, will contain the technical rules of yesterday – will be adopted at the end of a simple public online consultation and not before having collected the opinions of the relevant administrations. And, most importantly, it will be possible to continuously update them so they can keep up with the times.
Things are changing, but there’s no need to be scared. The technical rules currently in force will remain active until their substitution. There will be no regulatory hole, no problem of application.
10. The corrective decree often gives the impression that minimal risk was taken in its writing. Despite promises, few articles have been repealed and some interventions were cut in half. It’s difficult, for example, to understand why the system of digital residency should be strewn across three different directories: one for the Administrations, one for professionals and one for citizens. Is this a correct impression? What is the reason for this?
The impression is correct. More could have been done in terms of form and content. There are a few reasons for why it wasn’t.
First of all, it’s worthwhile to remember that this is “only” a corrective decree of a recently implemented reform. It’s not a second reform. The consequence of this is that while it is legally permissible to return to issues already dealt with, it isn’t, unfortunately, permissible to start from scratch and make completely new regulations.
In terms of repealing CAD provisions and simplying its structure, it must be kept in mind that many of the CAD’s provisions are now referenced in dozens of other laws. Repealing one provision comes with the risk of creating ruinous domino effects that aren’t always easy to manage.
The CAD needs to be rewritten and transformed into a digital citizenship charter; however, the idea of drafting a new Code has been for the time being postponed.
As for the three separate registers, this is unfortunately a mandatory choice: the two existing registers are managed by different bodies and financed by different resources. The new registry is provisional in the sense that its data is destined to merge into the ANPR. The goal of unifying all registers would have compromised the most desirable result: t recognizing all citizens the right to elect a digital residency as soon as possible.
11. What is the national digital data platform that appears for the first time in the corrective decree just approved by the Council of Ministers? Isn’t it risky, in terms of privacy, to plan for such a high concentration of data, including personal data, in one place?
We’re talking about the system that has been identified as DAF (Data & Analytics Framework) in the Three-Year Plan. It’s one of the key projects of the digital transformation program.
Like other countries, our country produces an extraordinary amount of data and information that, if organized and analyzed correctly, could help to better guide the Administrations towards the achievement of their institutional goals. However, Italy is missing the policies necessary for the development of public information assets.
The data from the various administrations are stored in vertical silos and are only rarely shared with the goal of increasing their value and meaning. The national platform has this main objective. It will converge a series of data and information to be identified by a Decree of the President of the Council of Ministers and ISTAT, to which the management of the platform is entrusted, and will use these data to carry out analyses and identify solutions that will allow individual administrations to work better and more efficiently.
In terms of privacy, the risks are categorized differently.
First of all, the platform will significantly reduce the number of data copies (including personal data) created by Public Administrations when they exchange personal data.
In fact, it’s the platform that allows an administration to access the data of which another administration by simply requesting the necessary authorization and gaining access to data within the same platform, without having to extract a copy every time.
The platform’s rules of operation, moreover, will be dictated by the Data Protection Authority which will establish principles suitable for reconciling the need to enhance public information assets with the necessary respect for privacy.
Last,, we must not forget that the transfer of data, even personal data, within a platform does not change the ownership of the data itself. The data in question will always and only belong to the administration that already keeps them and manages them.
12. What relationship does the new digital citizenship service have with Italia Login, the project that has been talked a lot about in the past and is still evoked in many of the activities AgID is putting into place?
“Italia Login” was the name of the strategic vision of Paolo Barberis, former Advisor for Innovation to the President of the Council of Ministers. “Italia Login” was based on the idea that digital technologies may help to reshape the relation and interaction between the Public Administration and its citizens, and to finally put the needs and interests of citizens at the heart of digital services.
Over time, this vision inspired many projects. However, they had only been outlined in very abstract terms, and, progressively, “Italia Login” has become an all-encompassing title for indicating more of a government program for digital transformation than a specific project.
The digital citizenship service described in the CAD corrective decree and to which the Digital Transformation Team is dedicating much effort, represents a concrete element -one might also call it an embryo- of the the country’s operating system that will be implemented in the coming years.
Join Us| Follow us on Twitter and LinkedIn | Visit our Website | GitHub
