eHerkenning: not easier, but safer nonetheless
eHerkenning (eRecognition) is an important tool for companies to log in to all electronic services of Dutch government organisations. And that includes Customs. “Are you an economic operator and do you want to continue to use these services? If so, you really need to make sure you have eHerkenning,” Edwin Platier, a customs officer, says. “And if you’re sensible, you make the necessary arrangement in time.”
Customs has been working with digital services for the business community for years. Yet some processes, such as objections and refunds, are still mainly on paper. Soon, that paper will disappear almost completely. If everything goes according to plan, by the end of 2022, economic operators will only be able to share and view messages and data in two ways: system-to-system and human-to-system. The declarations towards AGS (soon DMS) and NCTS, among other things, will become system-to-system. Human-to-system is already offered via the European customs portals, as well as in the ‘old’ Mijn Belastingdienst portal, which will soon be replaced by the Mijn Douane portal*. (More about this elsewhere in this issue, eds.).
To access Customs’ online services in human-to-system portals, users must log in in a way that meets European security requirements. In the Netherlands, eHerkenning has been developed for companies for that purpose. Private individuals and sole proprietorship can use DigiD. Both methods provide access to Mijn Douane. Logging into European customs portals is only possible with eHerkenning. Logging in with a username and password, as is still the case with the Mijn Belastingdienst portal for excise duty returns, among other things, will no longer be possible.
Limiting the set of digital keys
“Ultimately, almost 500 government services in the Netherlands will be using eHerkenning,” Platier, a customs officer, says. “Previously, they all controlled access to their service channels in their own way. This was often a combination of username and password, as was the case in the Mijn Belastingdienst portal offered by the Dutch Tax and Customs Administration. European regulations deem this combination as a weak way to establish the identity of users. In addition, in the Netherlands we aim to keep the set of digital keys for private individuals and companies as small as possible. We want to prevent them from having to rely on a different login method for every government organisation. The Dutch Ministry of the Interior is at the forefront of implementing the European login rules. eHerkenning has been developed under the responsibility of this department and previously Economic Affairs. It serves as a standard that companies can use to log into government services at different levels of assurance. As such, it is comparable to DigiD, which citizens in the Netherlands use to communicate with the government. The difference being is that eHerkenning is offered by six private companies. And users have to pay for it.”
Businesses have to get used to it
eHerkenning does not make it easier for companies from an administrative point of view, Platier explains. “In the old situation, you simply requested a username and password. Employees could easily share these, so that several people could log in. This was practised on a large scale. With eHerkenning, everything is strictly personal. When issuing the authenticator at higher levels of assurance, the user’s ID is checked extensively, according to international standards. Companies must regulate internally who is authorised to handle which matters with the authorities. And accurately record all of this. All these agreements must be entered in the eHerkenning authorisation register. This clarifies at a personal level who has access to which services. By the way, authorisations can also be issued to third parties, to arrange and organise matters on behalf of a company. Examples include consultants or customs brokers. Arranging and recording all this takes time and effort. This creates what we call ‘complex authorisation structures’, with frameworks and strict conditions. The business community will have to get used to that.”
“Even though things become more complicated for companies, practice regularly reminds us that we are in dire need of increased data access security,” Platier continues. “The secure exchange of information is an absolute precondition for the policy that Brussels envisages for communication between public and private sectors: shifting from digital acceptance to digital requirement.”
Customs is forerunner
European customs legislation prescribes that Customs may only supply services electronically, whereas previously, these services were offered either fully or partially on paper. The European customs portals have been made available for this, among other things. They can be used to apply for European permits and Binding Tariff Information (BTI). Logging into these portals must be in accordance with European security requirements. That is why Customs has already switched to eHerkenning. The Dutch Digital Government Act prescribes eHerkenning as a login tool for companies. The exact implementation date is not yet known, because the law still needs to go through the Dutch Senate. Meanwhile, all government services are working on providing fully digital services. And eHerkenning is being rolled out in phases. Many organisations are already using it, such as the Employee Insurance Agency (UWV) and now Customs. And the Dutch Tax Administration, with more than 140,000 unique users of the Mijn Belastingdienst portal.
Research shows that Customs customers who already use eHerkenning often have difficulty applying for and setting up the tool in their own organisations. This is mainly because companies often work with authorisations for customs-related matters. In many companies, several persons have different powers to deal with Customs on behalf of the company. In addition, companies often have one or more representatives. They are third parties who make declarations or apply for permits on their behalf. “It’s difficult for those representatives that eHerkenning doesn’t allow you to pass on authorisations informally,” Platier explains. “But again, if companies organise the authorisations properly internally, the effort involved is reasonable. And most companies state that once it’s up and running, it works well.”
Another thing that economic operators notice when using eHerkenning is that so-called cross-border delegation is not possible. Platier: “I previously touched upon authorising people. eHerkenning only allows authorisations between organisations that are registered in the Dutch Commercial Register. Suppose a German company has no branch or other permanent establishment in the Netherlands. And that company wants to authorise a Dutch company to, for example, apply for a permit or Binding Tariff Information at Customs. Then that’s not possible. As an organisation with a strong international orientation, we know that these kinds of national restrictions in technology can seriously impede the business community. We are therefore working hard on a solution to this bottleneck.”
* From 1 June this year, declarations and requests for a refund of excise duty and consumption tax will run via Mijn Douane. For the time being, other processes still need to go through the ‘old’ Mijn Belastingdienst portal.