Volume 14 Number 3 (July to September 2003) - University of the ...

1426
National Administrative Register Volume 14/3
SECTION 8. Liability for unauthorized use of secure electronic signatures - Where
the use of a secure electronic signature was unauthorized and the purported signer did not
exercise reasonable care to avoid the unauthorized use of the signature or to prevent the
addressee from relying on such a signature, the signature shall nevertheless be regarded as
that of the purported signer, unless the relying party knew or should have known that the
signature was not that of the purported signer.
SECTION 9. Responsibilities of an information certifier - An information certifier
shall:
a. act in accordance with the representations it makes with respect to its practices;
b. excercise due diligence to ensure the accuracy and completeness of all material representations
it makes that are relevant to the life-cycle of its certificates or which are included
in its certificates;
c. provide reasonably accessible means which enable a relying party to ascertain:
i. the identity of the information certifier;
ii. that the person who is identified in the certificate holds, at the relevant time, the
signature device referred to in the certificate;
iii. the method used to identify the signer, provided however the information certifier
shall not be required to reveal any of its trade or industrial secrets;
iv. any limitations on the purposes or value for which the signature device may be
used; and
v. whether the signature device is valid and has not been compromised;
d. Provide reasonably accessible means for signer to give notice that a signature device has
been compromised and ensure the operation of a timely and secure revocation service; and
e. Utilize trustworthy systems, and procedures in performing its services.
f. Engage trustworthly personnel who possess the expert knowledge, experience and qualifications
necessary for its services, in particular, but not limited to, expertise in electronic
signature technology and familiarity with proper security procedures;
g. Maintain sufficient financial resources to operate as an information certifier and to bear
the risk of potential liability for damages;
h. Record, whether electronically or not, for an appropriate period of time all relevant information
concerning issued certificates for, but not limited to, the purpose of providing evidence
of certification in legal proceedings;
i. For purposes of issuing and maintaining a certificate, collect and utilize personal data only
insofar as it is necessary for the purpose of issuing and maintaining the certificate. Such