A whitepaper prepared by Michalsons Attorneys concerning the benefits of using the impression

Transcription

1 + Guide to Legal Electronic Signatures A whitepaper prepared by Michalsons Attorneys concerning the benefits of using the impression electronic signature solution, the laws in South Africa and how to apply impression generally to specific transactions based on these laws.

2 + South African Electronic Signature Laws Three sets of laws regulate electronic signatures for any given transaction under South African law: South African common law; ECT Act (Electronic Communications and Transactions Act 25 of 2002); and Legislation specific to that type of transaction impression s electronic signatures are valid signatures as is for all transactions where ordinary electronic signatures are valid in terms of South African law and together with a digital certificate from an accredited certificate authority, are valid signatures where an advanced electronic signature is required in terms of South African law. Common Law The South African common law is made up of Roman- Dutch law and past court decisions. Definition The common law definition of a word or term is its plain English meaning. Courts generally use dictionary definitions to determine the plain English meaning of a word or term. Signature means the name of a person written with his or her own hand as an authentication of some document or writing (Shorter Oxford English dictionary). The important aspects of this definition are that: It must be the name or mark of the person signing; The person signing must have applied it themselves; and The person signing must have intended it to authenticate them. Our courts used to follow a formalistic approach to signatures where they focused on whether specific factual circumstances existed to decide whether something counted as a signature. Now they follow a functional approach where they focus on the intention behind the factual circumstances to decide whether the person signing intended something to be their signature. Applicability South African lawmakers are presumed not to have changed the common law unless they do so explicitly. Our lawmakers haven t explicitly excluded electronic signatures from the common law of signatures. This means that the common law applies to electronic signatures. Court Decisions Unfortunately, there are no court decisions about electronic signatures in South Africa. No one has brought a matter involving an electronic signature before a South African judge and had a binding decision made on it. But, there are many cases about what form a signature can take. This is useful when considering new forms of signature, like electronic signatures. impression Satisfies Common Law Requirements impression can be used to create electronic signatures that are valid in terms of South African common law. The electronic signature it creates meets the common law definition of a Signature, because: The signee s signature on the signature device contains their name or initials; The person signing applies it themselves by writing it on the signature device; and The person signing intended it to authenticate them because they followed the onscreen signature process, entered their personal information, signed on the signature device aware of the context in which they were signing, and possibly also authenticated themselves with a fingerprint reader or one- time- pin. The electronic signatures that impression creates would also be considered valid signatures in terms of the functional approach, because South African courts would focus on the intention behind using impression to create an electronic signature on a document to decide that the signee providing the electronic signature intended it to be their signature. 2

3 + ECT Act Electronic Communications and Transactions Act 25 of 2002 The ECT Act became law in South Africa on Friday 30 August Section 2 of the ECT Act says that The objects of this Act are to enable and facilitate electronic communications and transactions in the public interest [...] impression's electronic signatures are an effective way of facilitating electronic communications and transactions. Confirms Common Law The ECT Act confirms the common law rules regarding signatures. Section 13(2) of the ECT Act says that Subject to subsection (1), an electronic signature is not without legal force and effect merely on the grounds that it is in electronic form. The important aspects of this provision are that: Electronic signatures are valid signatures; Despite being in electronic form. This provision enables the use of electronic signatures without forcing it. Therefore, impression's electronic signatures are valid signatures despite being in the electronic form of electronic signature data associated with an electronic document; in terms of section 13(2) of the ECT Act. Minimalist Approach The ECT Act takes a minimalist approach to electronic signatures. This means that it provides a definition consisting of certain requirements and anything that meets those requirements is an electronic signature. The most important thing about this approach is that it is technology agnostic. The ECT Act doesn t contain a list of technologies that count as electronic signatures it only contains a list of requirements. This is good because it means new electronic signature technologies will automatically become electronic signatures in terms of the ECT Act without South African lawmakers having to update the legislation. impression's electronic signatures are electronic signatures in terms of the ECT Act because they meet the requirements in the definition of an electronic signature as we will explain below. Signature Definition Requirements The ECT Act sets out the requirements for an electronic signature in its definitions. Section 1 of the ECT Act says that electronic signature means data attached to, incorporated in, or logically associated with other data and which is intended by the user to serve as a signature; The important aspects of this definition are that: An electronic signature must involve two sets of data; The two sets of data must have a relationship where they are attached to, incorporated in, or logically associated with each other; and The person signing must have had the intention that one of the sets of data be their signature. Section 1 of the ECT Act says that data means electronic representations of information in any form; impression's electronic signatures are electronic signatures in terms of the ECT Act because: They involve electronic signature data and electronic document data; The electronic signature data has a relationship with the electronic document data because it is incorporated in it when the person signing applies their signature to the electronic document; and There is a strong argument that the person signing had the intention that the electronic signature data be their signature, because they followed the onscreen messages prompting them to sign the document, signed on the signature device 3

4 4 aware of the context in which they were signing, and possibly authenticated themselves using their personal biometrics on a fingerprint sensor or with a one- time- PIN. Data Message Restrictions The ECT Act has certain restrictions that a data message must comply with to be an electronic signature. Section 13(3) of the ECT Act says that Where an electronic signature is required by the parties to an electronic transaction and the parties have not agreed on the type of electronic signature to be used, that requirement is met in relation to a data message if (a) a method is used to identify the person and to indicate the person s approval of the information communicated; and (b) having regard to all the relevant circumstances at the time the method was used, the method was as reliable as was appropriate for the purposes for which the information was communicated. The important aspects of this provision are that: You cannot use an electronic signature if you have agreed to use another type of signature, for example in a contract; The electronic signature technology must somehow authenticate the signatory and show that they approved the signature; and This method must be sufficiently reliable in the circumstances. Section 1 of the ECT Act says that data message means data generated, sent, received or stored by electronic means [...] This definition applies to almost all forms of electronic signature, because they all involve electronic communication of data. All electronic signatures must comply with these restrictions. impression's electronic signatures comply with the ECT Act s restrictions for data messages to be electronic signatures, because: Most of the time, the parties will not have agreed to use another type of signature; impression asks the person signing for their personal information, records it and presents it to them, and then prompts them to sign in the context of their personal information which allows them to authenticate themselves and shows that they approved their signature by recording all the data of how they applied it; impression also allows the use of additional optional authentication mechanisms like a one- time- pin or personal biometrics in the form of a fingerprint; These methods are sufficiently reliable for most circumstances in our opinion, although a court may decide that a more reliable method is required in certain circumstances but no South African court has made such a decision at this time. Signify Agreement Section 13(5) of the ECT Act says that Where an electronic signature is not required by the parties to an electronic transaction, an expression of intent or other statement is not without legal force and effect merely on the grounds that (a) it is in the form of a data message; or (b) it is not evidenced by an electronic signature but is evidenced by other means from which such person s intent or other statement can be inferred. The important aspects of this provision are that: Where the parties to an electronic transaction have not agreed to use an electronic signature; An electronic expression of intention is valid; Despite not being an electronic signature. impression's electronic signatures are also electronic expressions of intention as well as being electronic signatures, which means that a person can also use them when an expression of intention is sufficient and a signature is not required. Advanced Electronic Signatures Advanced electronic signatures are legally different from ordinary electronic signatures. They were created by the ECT Act and do not exist in common law. Section 1 of the ECT Act says that advanced electronic signature means an electronic signature which results from a process which has been accredited by the Authority as provided for in section 37; The important aspects of this definition are that: An advanced electronic signature must meet the signature definition requirements of an ordinary electronic signature; and It must be from a process accredited by the Department of Communications (who is the relevant Authority). Section 37(1) of the ECT Act says that The Accreditation Authority may accredit authentication products and services in support of advanced electronic signatures. The Department of Communications has accredited certain organisations as certificate authorities to provide advanced electronic signatures in the form of a digital certificate product based on a face- to- face authentication procedure of the person wishing to get the advanced electronic signature. Section 38(1)(e) of the ECT Act says that The Accreditation Authority may not accredit authentication products or services unless the Accreditation Authority is satisfied that an electronic signature to which such authentication products or services

5 relate [...] is based on the face- to- face identification of the user. [...] These organisations were accredited on the basis of the ECT Act Accreditation Regulations, which became law on Wednesday 20 June 2007 in terms of sections 41 and 94 of the ECT Act. Both sections 41 and 94 of the ECT Act empower the Minister of Communications to make these regulations. Regulation 13 of the ECT Act Accreditation Regulations contains the technical requirements for a certificate authority to issue a digital certificate that can be used for advanced electronic signatures. Combining the impression electronic signature solution with a digital certificate provided by an accredited certificate authority allows the user to apply valid advanced electronic signatures. By performing advanced digital certificate checks, impression is able to enforce the long term validation of advanced electronic signatures ensuring that documents and their signatures are always valid. Law Requires Signature You must use an advanced electronic signature when a law requires a signature. Section 13(1) of the ECT Act says that Where the signature of a person is required by law and such law does not specify the type of signature, that requirement in relation to a data message is met only if an advanced electronic signature is used. The important aspects of this provision are that: When a law requires a signature; and A law doesn t specify a particular type of signature; Then you must use an advanced electronic signature. This means that: You need not use an advanced electronic signature; When a law doesn t require signature; or A law specifies a particular type of signature. Therefore, you can use impression as an ordinary electronic signature where an ordinary electronic signature is sufficient or you can combine impression with a digital certificate from an accredited certificate authority as an advanced electronic signature where an advanced electronic signature is required by law. Law Specifies Type The Income Tax Act 58 of 1962 is an example of where a South African law specifies the type of electronic signature you must use. Section 66(7B) of the Income Tax Act says that The Minister may make rules and regulations prescribing the procedures for submitting any return in electronic format and the requirements for an electronic or digital signature contemplated in subsection (7A). The Minister made a rule in terms of this provision that a taxpayer s User ID is deemed their electronic signature for the purposes of efiling. This overruled the provision enabling advanced electronic signatures in terms of the ECT Act and requires a specific type of signature. You cannot use any electronic signature solution to sign a document in a scenario like this where the law specifies the type of signature. Counts as Law The Interpretation Act 33 of 1957 is very old legislation that helps us work out whether something counts as law. We need to work out whether something counts as law to decide whether it is a law that requires signature. Section 18 of the Interpretation Act says that In the interpretation of any Act of Parliament, government notice, government advertisement, ordinance, placaat, proclamation, regulation or by- law made under the authority of any law, rule of court, or any enactment having the force of law, which came into operation in the colony of the Cape of Good Hope prior to the thirty- first day of May, 1910, the following expressions shall [...] have the meanings hereby assigned to them [...] We can work out from this very broad provision that laws includes both: Primary legislation like proclamations, ordinances, and Acts; and Delegated legislation like regulations in terms of promulgated law and forms in regulations. Therefore, you will need to use impression as an advanced electronic signature with a digital certificate from an accredited certifying authority when primary or delegated legislation requires a signature. 5

6 + Transaction Specific Legislation Michalsons Attorneys have taken all steps to ensure the validity and accuracy of this document however it is important to understand that this guidance is based on their interpretation of the principles of South African law at the time of publication. The law may change due to future legislative enactments and court decisions. It is recommended that companies interested in implementing an electronic signature solution seek individual advice from a suitably qualified professional adviser. Commercial Transactions Commercial transactions include contracts of sale and lease. These are generally regulated by the common law in South Africa. This means that you can generally use ordinary electronic signatures to conclude valid contracts of sale and lease in South Africa. However, there are specific laws that override the common law of sale and lease under certain circumstances when it comes to signatures. For example, section 2(1) of the Alienation of Land Act says that No alienation of land after the commencement of this section shall, subject to the provisions of section 28, be of any force or effect unless it is contained in a deed of alienation signed by the parties thereto or by their agents acting on their written authority. This provision means that a contract for the sale of land or buildings is invalid in South Africa, unless: There is a physical deed of alienation; Signed by the seller and the purchaser with a handwritten signature. You are generally free to sign any documents supporting the sale of land or buildings electronically, like offers to purchase or bond documents. Therefore, you can use impression for any contract of sale and lease in South Africa, unless there is a specific law that overrides the common law like the Alienation of Land Act. Insurance Services Insurance services involve applications for insurance and insurance claims. They are regulated by the Long Term Insurance Act 52 of 1998 and the Short Terms Insurance Act 53 of 1998 in South Africa. Neither of these pieces of legislation mentions the words sign, signature, or written in relation to any transactions based on documents being valid. Financial Services FAIS means the Financial Advisory and Intermediary Services Act 37 of Its purpose is To regulate the rendering of certain financial advisory and intermediary services to clients. To this end, section 5.1 of the FAIS Code says that An administrative FSP must obtain a signed mandate from a client, before rendering any intermediary service to that client: Provided that the parties may agree to complete an electronic mandate in respect of which appropriate controls and personal identification procedures have been put in place that ensures security of information. This provision means that you can use an ordinary electronic signature or electronic consent to validly conclude an electronic mandate in terms of FAIS. Therefore, you can use impression as is to conclude FAIS mandates. Company Administration Company administration involves directors and shareholders signing documents necessary to run companies, including board resolutions, shareholders agreements, and share certificates. Section 6(12)(a) of the Companies Act says that If a provision of this Act requires a document to be signed or initialled- [...] by or on behalf of a person, that signing or initialling may be effected in any manner provided for in the Electronic Communications and Transactions Act; [...] This provision means that you can use an ordinary electronic signature or electronic consent to validly sign any of the documents regulated by the Companies Act. Therefore, you can use impression for signing any company administration documents in South Africa. You can use ordinary electronic signature to conclude valid transactions in terms of the Short or Long Term Insurance Acts. Therefore, you can use impression as is to conclude valid transactions for insurance services. 6

7 Credit Agreements The NCA (National Credit Act 34 of 2005) regulates credit agreements, which include things like vehicle financing and cash loans. It contains specific provisions dealing with electronic signatures. Section 2(3)(a) of the National Credit Act says that If a provision of this Act requires a document to be signed or initialled by a party to a credit agreement, that signing or initialling may be effected by use of [...] an advanced electronic signature, as defined in the Electronic Communications Act, 2002 (Act No. 25 of 2002); This provision makes it clear that you can use advanced electronic signatures for credit agreements without having to meet any additional requirements. Section 2(3)(b) of the National Credit Act says that If a provision of this Act requires a document to be signed or initialled by a party to a credit agreement, that signing or initialling may be effected by use of [...] an electronic signature as defined in the Electronic Communications Act, 2002 (Act No. 25 of 2002), provided that (i) the electronic signature is applied by each party in the physical presence of the other party or an agent of the party; and (ii) the credit provider must take reasonable measures to prevent the use of the consumer s electronic signature for any purpose other than the signing or initialling of the particular document that the consumer intended to sign or initial. This provision allows you to use an ordinary electronic signature to sign credit agreements provided that you meet the following requirements: The credit consumer is in the physical presence of the credit provider when they use the electronic signature; and The credit provider secures the credit consumer s electronic signature against being used to sign documents related to any other transaction. Therefore you can use impression to conclude valid credit agreements in terms of the NCA, provided that you either: Use it together with a digital certificate provider accredited as an advanced electronic signature in terms of South African law; or Use it as is in your physical presence, or the physical presence of your personnel (impression secures the consumer s electronic signature against being used to sign documents related to any other transaction by requiring them to enter their personal information, recording it and presenting it to them, and asking them to sign in the context of this interaction to authenticate themselves each time they wish to sign a document). Pension Fund Administration Pension fund administration involves the signature of various documents necessary to run a pension fund by the principal officer of the fund. It is regulated the Pension Funds Act 24 of 1956 in South Africa. Section 20(1) of the Pension Funds Act says that A registered fund shall be deemed not to have complied with any provision of this Act, which imposes upon such fund the obligation to furnish to the registrar a document prepared by the fund, unless such document is signed by the principal officer and one other person authorized in accordance with the rules of the fund to sign documents. It is unclear from this provision whether a signature is required for the transaction to be valid. The word shall can mean either may or must there is no way to decide conclusively one way or the other. You don t know whether you have to use an advanced electronic signature or not to make the transactions valid. It is therefore best to use an advanced electronic signature if the risks of the underlying transactions being invalid are great, which they usually are. You can still use an ordinary electronic signature and might get away with it, but it is risky. You can use impression as an advanced electronic signature together with a digital certificate from an accredited certificate authority in terms of South African law to conclude transactions necessary for pension fund administration in South Africa. Copyright Assignment and Exclusive Licensing Intellectual property agreements often involve the assignment or licensing of copyright. Licensing can be exclusive or non- exclusive. Section 22(3) of the Copyright Act says that No assignment of copyright and no exclusive licence to do an act which is subject to copyright shall have effect unless it is in writing signed by or on behalf of the assignor, the licenser or, in the case of an exclusive sublicence, the exclusive sublicenser, as the case may be. It is unclear from this provision whether a signature is required for the transaction to be valid for the same reason that it is unclear in the case of pension fund administration. The word shall can mean either may or must there is no way to decide conclusively one way or the other. This is exactly the same situation we see with pension funds. It is therefore best to use an advanced electronic signature if the risks of the underlying transactions being invalid are great, which they usually are. Therefore, you can use impression as an advanced electronic signature together with a digital certificate from an accredited certificate authority in terms of South African law to conclude transactions for assignment or exclusive licensing of copyrighted material. You can use Impression as is to conclude transactions for the non- exclusive licensing of copyrighted material. 7

8 VAT Invoices Paragraph 11.7 of the VAT 404 Guide for Vendors on Electronic Tax Invoices says that the requirements for physical VAT invoices set out in the VAT Act apply equally to electronic invoices. Section 20(4) of the VAT Act sets out certain formalities for a VAT invoice to be valid, but none of them involve any kind of signature. VAT News 20 (September 2002) under the heading Electronic Tax Invoices extends these requirements and says that: Tax invoices must be sent in encrypted format (at least 128 bytes), over a secure line or contain an electronic signature. On the face of it, this means that a valid electronic VAT invoice must either: Be transmitted with 128 bit encryption; or Over a secure line; or Signed with an ordinary electronic signature. But, these extended requirements are not found in the VAT Act or ECT Act. It is therefore not clear whether this is a law requiring an electronic signature. SARS previously said that it would provide clarity on these extended requirements, but has yet to do so. We submit that whether the extended requirements are law or not, an electronic VAT invoice signed with an ordinary electronic signature would be valid. Therefore, you can use impression as is to sign valid VAT invoices under South African law, but you must be careful to also comply with all the other requirements for a valid electronic VAT invoice. Credit Card Transactions Section 94 of the National Credit Act regulates liability for lost or stolen credit cards and other identification devices. Subsection (1) says that if a consumer uses a something like a card, password, or PIN to identify themselves in order to access a credit facility, then the document recording that credit agreement must contain a phone number where the consumer can report the loss or theft of that thing. Subsection (2)(a) says that a consumer is not liable for their use of a credit facility after they have reported the loss or theft of the associated device, unless they have signed a document proving the use of the credit facility, like a till slip. Because the National Credit Act defines signature as either being an advanced electronic signature or ordinary electronic signature (see Credit Agreements earlier), you could use impression together with a digital certificate from an accredited certificate authority as an advanced electronic signature or without a digital certificate as an ordinary electronic signature to have the consumer sign a till slip in terms of this subsection. Further, subsection (2)(b) says that a consumer can also be held liable if the credit provider has enough other evidence to prove that the consumer authorised or was responsible for that particular use of the credit facility. This means that you could also use impression as- is as an ordinary electronic signature to prove that the consumer authorised or was responsible for that particular use of their credit facility. General Application Guidelines impression can be used as an ordinary electronic signature whenever an ordinary electronic signature is sufficient in terms of South African law. impression can also be used together with a digital certificate from an accredited certifying authority as an advanced electronic signature whenever an advanced electronic signature is required in terms of South African law. You cannot use impression or any other electronic signature solution whenever a handwritten signature is required in terms of South African law. Please consult an attorney specialising in electronic signatures if you need help working out whether you can use impression as an ordinary electronic signature, whether you must use it to apply an advanced electronic signature, or whether you need to use a handwritten signature for your particular transaction. 8

9 + About the Author David joined Michalsons Attorneys in 2011 and is a practical and effective law- of- technology attorney, a POPI professional, electronic signature expert, and online business aficionado. He works closely with corporates, SMEs, and entrepreneurs to provide them with: Presentations to give them practical information about the law that relates to them. Customised commercial contracts to stop problems before they happen. Written opinions to advise clients on the risks associated with their business and how to manage them. He is knowledgeable about how the law applies to data privacy, electronic signatures, websites, software development and licencing, and company regulation. Education University of Cape Town Bachelor of Arts (Law and English with Distinction), University of Cape Town Bachelor of Laws, Michalsons is a leading specialist law firm. We don t try to do everything. We focus on a few areas and do them well. This means you will not have to educate us, which will save you time. For example, areas like ICT law, the legal aspects of IT Governance, Risk and Compliance, privacy and the protection of personal information (POPI), the memoranda and shareholders agreements of companies, consumer protection, and plain language. Michalsons and its attorneys have received several international accolades, which means you have the comfort of knowing that you are dealing with some of the best lawyers in the world. Our Expertise We have been involved in the drafting of legislation (e.g. the ECT Act) and corporate governance codes (e.g. the IT Governance section of King III). We are especially strong on ICT law or IT law. Many of our lawyers have over 12 years experience in the field of IT law. We have the highest concentration of ICT lawyers in one firm in South Africa, covering all areas of ICT law. We advise on technology transactions in all industry sectors, ranging from financial services to utilities. We ensure that our knowledge of both local and international content is at all times current. Contact Us (Johannesburg) david@michalsons.com (Cape Town) info@michalsons.co.za 9

10 Contact the impression team for a demo or to discuss a signing solution: Signature Plugin for Adobe Reader Web: signatures.com Mail: impression@prosense.co.za Phone: +27 (0) (Office Hours SAST) Address: 1 st Floor, Building B Cambridge Office Park 5 Bauhinia Drive Highveld Technopark Centurion impression is a product of Prosense Technology (Pty) Ltd. This document has been prepared for Prosense Technology and licensed from us by them for distribution to you. This means that we own it and you may only use it on terms that are acceptable to us. In particular, this document may only be disseminated to relevant personnel within your organisation and your affiliates. Your use of this document is subject to our terms of service located at of- service/4649, which are incorporated by this reference. 1. The content is provided for the jurisdiction of South Africa and is not suitable for other jurisdictions. 2. We give no warranty about it, and none may be implied. We are not responsible for any mistake in the information or any direct or indirect loss that may follow from it. 3. The guidance has been prepared for Prosense Technology and is based on our interpretation of the principles of South African law at the time of publication. The law may change due to future legislative enactments and court decisions. 4. It is a summary or opinion on general principles of law and is published for general guidance purposes only. The content does not constitute specific legal, tax, investment, accountancy or other professional advice. 5. Seek individual advice from a suitably qualified professional adviser before dealing with any specific situation. 6. Whilst we have taken all steps to identify legal issues in this document, you are ultimately responsible for ensuring that all the legal issues have been identified. You accept full responsibility for the reliance that you place on this document and you remain responsible for any commercial decisions that you make. Copyright Michalsons Attorneys, Prosense Technology. All rights reserved. Copyright subsists in this work under the Copyright Act 98 of Any unauthorised act infringes copyright. We trust you to respect our copyright.