Conference 8–9 October 2018 📍 Portland, Oregon, USA

PDF Days North America 2018 — Portland: PDF 2.0 for Enterprise, PDF/A-3 E-Invoicing, and US Accessibility Law

PDF Days North America 2018 was held in Portland, Oregon, covering the enterprise implications of PDF 2.0 publication, the rapid adoption of ZUGFeRD/Factur-X PDF/A-3 e-invoicing in Europe and what it meant for North American multinational businesses, US Section 508 refresh implementation, and the legal landscape for PDF digital signatures under ESIGN and UETA.

Official event page →

Key takeaways

GDPR's May 2018 entry into force made PDF metadata scrubbing and compliant redaction critical GDPR hygiene practices — personal data in PDF metadata was widely unrecognised.
US Section 508 refresh (2018) referencing WCAG 2.0 was driving PDF/UA adoption in federal agency procurement and vendor development.
PDF remediation economics — USD 50–200 per complex document — was driving organisations to prioritise accessible workflows over mass retroactive remediation.
Cloud signing services were dramatically simplifying signature deployment at scale by eliminating hardware token distribution.
eIDAS qualified signatures (EU) and US ESIGN/UETA had different frameworks; cross-border signing required specific attention to the governing legal jurisdiction.

PDF Days North America 2018 was held in Washington D.C. in October 2018, organised by the PDF Association. The timing was significant: the EU General Data Protection Regulation (GDPR) had come into force on 25 May 2018, five months before the conference. GDPR's requirements for the right to erasure, data minimisation, and processing transparency were directly relevant to PDF workflows in enterprise document management — documents containing personal data, scanned forms, signed contracts, and correspondence were central to GDPR compliance obligations. The Washington D.C. location reflected the conference's strong US government and legal sector attendance. The capital's proximity to major federal agencies, law firms, and compliance-focused organisations made it a natural venue for a conference addressing data privacy and document security alongside continuing PDF/UA progress.

GDPR and PDF: the data privacy implications

GDPR's entry into force made privacy and personal data handling the dominant cross-industry discussion in the second half of 2018. PDF Days North America 2018 addressed several dimensions of the GDPR/PDF intersection: The right to erasure and PDF archives — GDPR Article 17 grants EU data subjects the right to have their personal data erased. For organisations with large PDF archives containing personal data — customer correspondence, application forms, employee records — this created a practical problem: how do you find and delete personal data embedded in PDF documents at scale? PDF documents can contain personal data in multiple locations: visible page content, XMP and DocInfo metadata, embedded file attachments, digital signature certificates (which contain the signer's name and email), JavaScript, annotations, and bookmarks. A naive "delete the file" approach is often insufficient — if the document is part of a larger composite document or a PDF Portfolio, the deletion must be complete. Redaction as a GDPR compliance tool — PDF redaction (permanent removal of content from a PDF) was directly relevant to GDPR data minimisation and right to erasure. Sessions covered the technical requirements for compliant redaction — the distinction between visual redaction (covering text with a black box) and actual content removal, and why visual-only redaction is not compliant. PDF metadata as personal data — A significant number of organisations were unaware that PDF metadata could contain personal data. The /Author, /Creator, and revision history fields in DocInfo and XMP metadata frequently contained employee names and email addresses. For PDFs shared externally, this constituted unintended personal data disclosure. Metadata scrubbing before external distribution was identified as a basic GDPR hygiene practice. US CCPA anticipation — California's Consumer Privacy Act (CCPA, effective January 2020) was in its legislative process. For US organisations, the GDPR discussion was partly preparatory for CCPA and anticipated US federal privacy legislation. The parallels with GDPR's data subject rights were significant.

PDF/UA: progress and practical deployment

PDF/UA-1 (ISO 14289-1) had been published in 2012. By 2018 — six years later — the question was less "what does the standard say?" and more "what does enterprise deployment actually look like?" Procurement mandates gaining traction — US federal accessibility requirements (Section 508 of the Rehabilitation Act, refreshed in 2018) specifically referenced WCAG 2.0 for electronic documents. Several federal agencies and state governments were including PDF/UA in their procurement requirements for document management systems and document creation tools. This was driving tool vendor investment in PDF/UA output. The attorney-client PDF dilemma — Legal document workflows were a major discussion area. Law firms produce enormous volumes of PDF correspondence, pleadings, and contracts. Making every PDF PDF/UA-compliant from a firm of hundreds of attorneys was operationally very different from a centrally managed government publishing workflow. Sessions discussed pragmatic approaches: which document types to prioritise, how to structure accessible PDF workflows without requiring attorney-level technical training. Auto-tagging progress — Automatic document tagging tools had improved. Word-to-PDF conversion with reasonable tag output was increasingly reliable for standard document structures. The remaining challenges were footnotes, tables, figures without alt text, and documents with complex column layouts. Tools from Axes4, CommonLook, and PDF Net were being compared in terms of auto-tagging accuracy. Remediation economics — For organisations with large existing PDF archives that needed to be made accessible, the per-document remediation cost was a significant concern. Typical professional PDF/UA remediation rates for complex legal documents were USD 50–200 per document; a firm with 100,000 archived documents had a potential remediation liability of USD 5M–20M. Prioritising active/frequently accessed documents over archival content was the pragmatic approach.

Digital signatures in 2018: PKI maturity and cloud signing

By 2018, digital signatures in PDF were a mature technology — the underlying standards (PAdES, CAdES) were stable, major certificate authorities had issued millions of signing certificates, and Adobe's trust list (AATL) provided a reliable mechanism for viewer trust chain validation. The discussion at PDF Days 2018 had shifted to deployment scale and new delivery models: Cloud signing services — Traditional on-premises PKI signing required certificates on hardware tokens (smart cards, USB tokens) distributed to each user. Cloud signing services (DocuSign, Adobe Sign, and emerging qualified trust service providers under eIDAS) moved the private key storage to secure cloud HSMs, with authentication via username/password plus second factor. This dramatically simplified deployment at scale — no hardware to distribute, no driver management. eIDAS and US legal equivalence — The EU eIDAS Regulation (effective 2016) had created qualified electronic signatures with the legal equivalence of handwritten signatures across EU member states. US attendees were comparing eIDAS to the ESIGN Act and UETA — which provided legal validity for electronic signatures in the US but without the qualified signature concept or trust service provider framework. Cross-border document signing between EU and US parties in 2018 required attention to which legal framework governed. Long-term validation (LTV) signatures — For documents that needed to be validatable years after signing (legal contracts, regulatory filings), Long-Term Validation (LTV) signatures embed the certificate chain, OCSP responses, and CRL data needed to validate the signature without network access. Sessions covered how to correctly create LTV-enabled signatures and the common errors (missing OCSP responses, incomplete certificate chains) that caused validation failure.

Frequently asked questions

How does GDPR apply to personal data in PDF documents?

GDPR applies to personal data wherever it is stored, including in PDF files. Personal data in PDFs can be: (1) visible page content (names, addresses, photos, financial data); (2) metadata — /Author, /Creator, /Keywords fields often contain names and email addresses; (3) embedded content — annotation author fields, digital signature certificates contain signer names and email addresses, embedded spreadsheets in PDF Portfolios; (4) form field data containing personal information. Under GDPR, organisations must be able to respond to data subject access requests (providing copies of personal data) and erasure requests (deleting personal data). For PDF archives, this requires the ability to search PDFs for personal data (which requires good text extraction) and redact or delete content permanently. The key technical requirement is that "redaction" must be actual content removal, not just visual obscuring — PDF black-box overlays that don't remove the underlying content are not GDPR-compliant erasure.

What is LTV (Long-Term Validation) for PDF signatures?

Long-Term Validation (LTV) is a mechanism for PDF digital signatures that embeds all the information needed to validate the signature in the future, without requiring network access to certificate status services. A standard PDF signature validates by checking the certificate chain back to a trusted root CA, and checking the certificate status (not revoked) via OCSP or CRL — both require network access at validation time. If the CA or OCSP service is unavailable years later, or if the signer's certificate has expired or been revoked after signing, validation may fail. LTV signatures embed: the complete certificate chain (including intermediate CAs), current OCSP responses (with timestamps), and CRL data at the time of signing. A PDF/A-compatible LTV signature (using a Document Security Store/DSS in PDF 2.0, or VRI dictionaries in older formats) allows validation years later using only the embedded data. LTV is required for PAdES-LTV (PAdES Baseline-LT) signatures.

What is the difference between GDPR and the US CCPA for PDF document workflows?

GDPR (EU) and CCPA (California) both give individuals rights over their personal data, but the frameworks differ in several ways relevant to document workflows. GDPR applies to all EU data subjects regardless of the organisation's location — a US company processing EU citizen data is subject to GDPR. CCPA applies to California residents' data processed by businesses meeting certain thresholds (revenue, data volume). GDPR has broader data subject rights: the right to erasure, the right to portability, the right to object to processing. CCPA has the right to opt-out of sale of personal information and the right to deletion (similar to but not identical to GDPR's right to erasure). For PDF workflows, the practical obligations are similar: the ability to find, provide, and delete personal data from documents. The key difference is GDPR's stricter legal basis for processing and the broader territorial reach.

Try it in your browser

The PDF tools and standards discussed at this event are available free — no account needed.

Redact PDF Sign PDF Protect PDF Open editor