Business | Press release
Date : 11/09/2018
Victor Buck Services, moves the digital transformation forward with its PSDC certification
In July 2017, Victor Buck Services achieved PSDC status (Prestataire de Services de Dématérialisation ou de Conservation), which designates the company as a certified provider of digitisation and e-archiving services with probative value. Yet PSDC is more than a certification; it pushes the limits of digital a little further. It is another string to the bow of Victor Buck Services, which aims to be a trusted partner in the digital transformation of its clients.
What does PSDC status represent?
Manu Ribeiro: When Luxembourg introduced the law of 25 July 2015 on electronic archiving three years ago, it positioned itself as a forerunner in this area. This unprecedented legal framework ascribes a digital copy the same probative value as the original document, providing this copy was made by a provider of digitisation or e-archiving services with PSDC status as the status is defined by the law. There are three PSDC statuses: PSDC-D, which only permits the digitisation of documents; PSDC-C status, which only concerns document retention – in other words, electronic archiving; and PSDC-DC status, which allows a provider to offer both. It is this third status that Victor Buck Services has obtained.
Hélène Tovagliaro: Let's be clear: the law of 25 July 2015 specifies the conditions for the digitisation of original documents and the procedures for archiving copies and originals in digital form; it establishes the conditions in which copies may benefit from a presumption of conformity with the original, and finally, it also sets out the rules that apply to the activities of providers of digitisation or e-archiving services. However, be careful with the interpretation of "legal archiving", as PSDC does not mean legalisation. PSDC procedures do not ascribe legal value to an original document that has none. What it does is guarantee that a copy conforms to the original that has been digitised. By virtue of the process used, this copy then has the same probative value as the original.
What are the foundations of this law?
M. R.: This law (which was a first!) is founded upon ISO/IEC 27001 and ISO/IEC 27002, two core information security standards which are unanimously recognised. What's more, there is no other law like it in the world, which in effect reinforces the position Luxembourg has adopted as the "European fortress of digital data".
H. T.: We should also note that this law to a certain extent operates in tandem with the EU's eIDAS regulation, which has brought about increased recognition of electronic documents. Luxembourg's framework of legislation and regulations on electronic archiving strengthens both trust in digital technology and the legal recognition of electronic documents that have been digitised and archived according to the PSDC technical rules and procedures. Its scope of application is limited to the Grand Duchy of Luxembourg (although the possibility cannot be excluded that other European judges presiding over legal disputes may be convinced by the probative value of documents digitised according to the terms of this law).
There are few Luxembourg providers with PSDC status, with some preferring to focus on archiving rather than digitisation. Why is this?
M. R.: While a large number of companies were attracted by PSDC status at the outset, only a small number are actually certified today because the selection criteria are so stringent. For a company such as Victor Buck Services, obtaining PSDC status fits perfectly into our strategy as a global provider, and it is now an important component in our value chain, which is intended to be complete. Certification has reinforced our expertise in information life cycle management within companies, and it has affirmed our status as a partner in the digital transformation of our clients.
What new guarantees does PSDC status offer customers?
H. T.: In the past, the original was always the reference standard. The law of 25 July 2015 places electronic documents on an equal footing with originals, taking away the need to present the original document. In other words: in a dispute, it is for the other side to prove that the PSDC copy does not conform to the original. Digitisation performed by a PSDC-certified organisation therefore brings greater legal security insofar as copies digitised using these procedures carry a guarantee of integrity and reliability vis-à-vis the original document. Even if paper still plays an important role and is not about to disappear, the PSDC law has created a favourable legal framework for the increasing digitisation of companies and society in general.
M. R.: I would add that this guarantee of reliability and integrity is made possible by an extremely rigorous process. The conditions for obtaining and then retaining PSDC status are very strict, and they require significant human and material investment. Indeed, the high level of security required for certification relies on a number of specific obligations that are applied to the IT infrastructure and procedures involved in PSDC processing. These are also audited annually, in order to ensure that the strict requirements of the PSDC process are maintained.
In addition, the legal framework encourages and extends the digital transformation of companies through significant competitive advantages. For example, these include improved operational efficiency, a reduction in the risks associated with lost or deteriorated physical originals, as well as a reduction in the use of paper – while remaining aware that it still plays an important role.
So it's difficult to eliminate paper – at least entirely... What's the solution?
H. T.: The application of PSDC certification to particular digital copies must be part of a much broader strategic approach. As a certified service provider, Victor Buck Services handles the entire process of digitising and/or archiving the documents provided by its clients; however, we are not authorised to determine which documents should or should not be subject to PSDC processing. And the law clearly specifies for which types of documents digital copies can possess a probative value. It is therefore for the customer, with the help of its legal department, to decide what it feels ought to be retained, digitised and/or destroyed, taking into account its business activities and its own particular constraints.
What are the advantages for organisations of using PSDC processing?
M. R.: Firstly, organisations save time because they can access their digital archives immediately – whenever and wherever they choose. Secondly, they save money by reducing or even eliminating the costs associated with physical archives. The result is greater operational efficiency and enhanced security.
Our PSDC solution meets the highly stringent security requirements of the framework for its application, and is hosted in two Tier IV-certified data centres in Luxembourg. These two data centres are interconnected and use cutting-edge technology designed to maximise the security and availability of critical information. We should also note that in our PSDC procedure, we have intentionally exceeded the security standards required as a prerequisite for certification. We have done this by using two different encryption functions instead of one, for example.
Our solution is designed to meet the particularities of each customer, whatever its business sector. This includes in the financial sector, in view of our status as "Support PSF" (Professional du Secteur Financier – financial sector professional acting in a support role). The digital copies with probative value that we generate via our PSDC solution are archived in accordance with each company's requirements, organisational constraints and implementation conditions, while adhering to the legal framework at all times. In addition, our clients have access to round-the-clock support, wherever they are.
Has the introduction of the GDPR affected the perception of the market in relation to archiving? Might some organisations be tempted to undertake both these projects simultaneously?
M. R.: Archiving with a PSDC provider is a choice, whereas the GDPR is a compulsory regulation; non-compliance is an offence. So they are two separate topics. That said, operational fulfilment of the ISO/IEC standards – which form the foundation of PSDC status – may to a certain extent contribute towards compliance with the GDPR, but it would not signify compliance in itself. PSDC processing only concerns a certain number of information flows, whereas the GDPR applies to all information flows of an enterprise.
Interview by Soluxions Magazine.
Please click here to read the original interview in French.
Watch the video below to learn more about our PSDC solution.