digital government innovation Number 2003/02 October 2003 ELECTRONIC SIGNATURES: WHAT RIGHTS AND DUTIES DO NORTH CAROLINA AGENCIES POSSESS UNDER THE CURRENT STATUTORY SCHEME1 Michael T. Champion The rise of electronic commerce affords public agencies new and exciting opportunities to convert their paper-based processes into electronic ones. Many civil servants and citizens alike are convinced that redesigning such processes will increase reliability and efficiency while making government more accessible. 1. This bulletin initiates a series of bulletins intended to dissect many of the legal issues public IT officials must tackle as they face their agencies conversion to electronic processes.
Digital Government Innovation Bulletin Number 2003/02 October 2003 However, as agencies begin to explore the myriad possibilities offered by electronic processing they are faced with a number of daunting legal and policydriven issues. 2 Generally, the law has long accepted the use of signatures for purposes of identification. 3 In fact, under federal and state law, certain types of transactions must be in writing and signed in order for the transaction to have legal effect and full enforceability. 4 This is largely because signatures reflect physical characteristics of individuals that can be applied to the particular document at issue. Once in place, a signature can signify that the individual has agreed to the contents of the documents he signed and therefore intends to be bound to such documents. State and federal agencies that dole out entitlements and provide essential services to their constituents must often prove that a specific individual agreed to a specific transaction with that agency. 5 2. For example: 1. Will the agency s use of electronic methods to maintain, store, receive, and disclose private information comply with applicable laws governing privacy, confidentiality, security, and record-keeping 2. Will the agency s new electronic processes be flexible enough comply with such laws if and when they change, if not what is needed to enhance such adaptability 3. Will the important information regarding a transaction be accessible regardless of changes to system software; what should be considered important; how long should it be kept to satisfy the law 4. Will electronic records withstand scrutiny in the courts and establish the facts necessary for the fact-finder to render a sufficient determination of the record 3. See generally Jones v. New York Life & Annuity Corp., 985 F.2d 503, 508 (10th Cir. 1993); Hill v. A.O. Smith Corp., 801 F.2d 217, 221 (6th Cir. 1986); O Neel v. National Ass n of Sec. Dealers, Inc., 667 F.2d 804, 806 (9th Cir. 1982) (There is considerable dictum in these cases which speaks to the long history of legal acceptance of the signature). 4. The UCC also incorporates a Statute of Frauds in several of its articles. The UCC requires a writing defined as any intentional reduction to tangible form, UCC 1-201(46) that is signed. See UCC 2-201, 8-319, 9-203(1)(a). A signature includes any symbol executed or adopted by a party with present intention to authenticate a writing. UCC 1-201(39). 5. See Legal Considerations in Designing and Implementing Electronic Processes, Department of Justice While this is fairly straightforward in a paper-based world, it becomes more complex when taken into the electronic transaction arena. There is no question that an electronic signature, when produced by a properly designed process, is capable of providing the agency with a reliable means of identifying the name, position, and location of the specific individual who submitted the document. However, unlike traditional signatures, electronic alternatives do not enjoy the long history of use and precedent. Rather, an important legal question arises as to whether electronic writings and signatures can even satisfy signature requirement laws at all and, if so, under what circumstances? This Electronic Government Bulletin addresses this legal issue. The bulletin is broken into three parts. Part I will briefly examine the relevant statutory law dealing with the acceptance and use of electronic signatures by public agencies. Part II addresses several key questions and legal issues concerning the use of electronic signatures. Part III discusses additional legal considerations associated with the concept of electronic signatures as agencies make the transition to electronic processes. Online (2003) at http://www.cybercrime.gov/eprocess.htm (last visited May 31, 2003). An agency operates a direct loan program. Formerly, the agency received loan applications on paper, but now receives them electronically through its web site. Four applicants (Abel, Baker, Company and Donald) submit loan applications that contain materially false and misleading information. When challenged by the agency, Abel, Baker, Company and Donald offer the following excuses: o Abel claims that he sent his application along with an explanatory electronic note that concerned key information on his application. o Baker claims that he submitted truthful information, and that someone must have altered it after he sent it. o Company, a large corporation, claims that no employee was authorized to apply for a loan, so a rogue employee (identity unknown) must have sent the application without the company s knowledge. The agency s electronic process does not show who or even what office at Company submitted the application. o Donald claims he was only working on a draft application with only preliminary information that he never meant to send, and that he must have pushed the enter button by accident, thus unwittingly transmitting his draft as though it were a real application. Does the agency s electronic process provide adequate safeguards, just as paper processes must, to refute the arguments raised by Abel, Baker, Company and Donald? 2
October 2003 Digital Government Innovation Bulletin No. 2003/02 Statutory Examination Both federal and state lawmakers have recently passed legislation that generally gives electronic signatures the same legal force as traditional paper and ink-based signatures. As a result, there are three relevant statutes governing public agency use of electronic signatures in North Carolina. The relevant federal law is known as the Electronic Signatures in Global Commerce Act ( ESIGN ). 6 ESIGN was enacted in 2000 in order to validate the use of most electronic records, transactions, and signatures. 7 The purpose of ESIGN is to provide a nationwide, federal rule that governs all electronic transactions in or affecting interstate or foreign commerce. 8 In a nutshell, while ESIGN does not actually repeal any law that requires a paper-based record, it does state that where the requirements of ESIGN are met, legal records of most transactions can be electronic. Thus, ESIGN is merely superimposed onto existing law with the purpose of giving equivalent legal weight to the use of electronic records, including signatures, in most transactions. 9 ESIGN is broad federal law and imposes requirements on states and citizens alike regarding electronic transactions as long as such transactions affect interstate or foreign commerce. 10 Therefore, ESIGN generally preempts states laws regarding electronic records and electronic signatures. However, it is important to note two major exceptions to preemption. First, ESIGN permits states to regulate the same 6. Electronic Signatures in Global and National Commerce Act of 2000 (E- Sign), Pub. L. No. 106-229, 114 Stat. 464 15 U.S.C. 7001-7031. 7. ESIGN defines an electronic signature as an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record. 15 U.S.C. 7006 (2003). This definition is purposefully broad so as to include many types of signature processes into the law. 8. It is important to remember that while this bulletin seeks to examine the law concerning electronic signatures, ESIGN is much larger in scope and regulates all electronic transactions. 9. Much of the impetus for the federal act to give equivalency to the use and maintenance of electronic records, transactions, and signatures comes from the mandates set forth in the Government Paperwork Elimination Act (GPEA), Pub. L. No. 105-277, 1701-1710 (1998) (codified as 44 U.S.C.A. 3504 n. (West Supp. 1999)). 10. The Act is of course limited by the Commerce Clause of the United States Constitution. U.S. CONST. art. I, 8, cl.3. subjects (electronic transactions), without preemption, as long as the state law is consistent with the federal law. States can show consistency by adopting some form of the Uniform Electronic Transactions Act ( UETA ). 11 Additionally, ESIGN provides a carve out for states which allows them to accord greater legal status or effect to the alternative implementation or application of technical specifications when the state is a party to the transaction. 12 In other words, a state can enact special regulations regarding specific requirements it deems necessary to govern electronic transactions in which the state itself is a market participant. 13 The two exceptions to ESIGN s preemptive capabilities allow states to regulate electronic transactions (and therefore signatures) in two separate but important ways. First, states can adopt legislation regarding electronic transactions in general commerce as long as such legislation is consistent with ESIGN. Second, states can create additional parallel legislation regarding electronic transactions in commerce to which the state is a party. Many states have passed a version of UETA which regulates electronic transactions in both areas of general commerce and commerce to which the state is a party. However, North Carolina is one of a minority of states that has chosen both to adopt the UETA legislation for electronic transactions in commerce generally and to take advantage of the specific carve out for state transactions offered by ESIGN. 14 North Carolina s version of the UETA ( UETA- NC ) is substantially similar to the UETA with a few key exceptions. 15 Since ESIGN does not preempt state law where it has adopted UETA, it is generally accepted that North Carolina law regarding electronic transactions is not preempted by ESIGN. 16 UETA-NC, 11. 15 U.S.C. 7002 (2003). The UETA was approved and recommended for enactment in all the states by the National Conference of Commissioners on Uniform State Laws in 1999. Presently, over forty states have adopted a version of the UETA which is substantially similar to the original. 12. Id. 13. Id. 14. To date only nine other states have a similar statutory scheme. 15. Uniform Electronic Transactions Act, 66 N.C. GEN. STAT. 311-330 (2003). 16. There is some debate about this. Some attorneys have argued that since the North Carolina version of UETA does not track the uniform code in several areas, there is room for discussion as to whether North Carolina Law is preempted by ESIGN. The question has not come before any 3
Digital Government Innovation Bulletin Number 2003/02 October 2003 like its federal counterpart ESIGN, seeks to generally provide that records and signatures cannot be denied legal effect or enforceability solely because they are in electronic form and that electronic signatures will generally satisfy any legal requirements that documents bear signatures. 17 Further, UETA-NC, like ESIGN does not require parties to use electronic records, signatures, or conduct transactions electronically. It merely superimposes itself over any existing North Carolina law that requires transactions to be in writing and gives effect to those writings that are carried out electronically. The parties must agree to conduct transactions electronically and such agreement will be determined, as in basic contract law, from the context of the surrounding circumstances, including the parties conduct. 18 UETA-NC did not adopt Sections 17 through 19 of UETA which provide rules for, among other things, the acceptance and distribution of electronic records (including electronic signatures) by governmental agencies. Instead, as mentioned above, North Carolina specifically relies on an earlier enacted law entitled the Electronic Commerce Act (ECA) to govern electronic transactions, records, and signatures to which the state is a party. 19 Since ESIGN provides a carve out for states that wish to regulate more vigorously electronic transactions where the state is an party, ECA is consistent with ESIGN and not preempted. 20 ECA generally allows public agencies to accept electronic signatures. The Act provides for the legal validity and enforceability of electronic signatures as well as their admissibility for evidentiary purposes. ECA like its counterparts does not impose mandatory requirements on agencies to use electronic signatures. It merely gives such signatures legal effect if used. Public agencies must decide, as a matter of agency policy, if they wish to establish such electronic processes. If an agency decides to accept electronic signatures, it must do so under the guidelines established by the ECA. However, what makes ECA distinct from both ESIGN and UETA-NC is that ECA actually makes it harder for public agencies to accept electronic signatures because it establishes minimum requirements to ensure the security and authenticity of signatures used for government contracts and other legal court. See Ed Winslow, Federal and State Statutes Authorize Electronic Signatures and Contracts, NOTES BEARING INTEREST, November 2000, at 1. 17. 313-317. 18. 313. 19. Electronic Commerce in Government Act, 66 N.C. GEN. STAT. 58.1-58.19 (2003). 20. 15 U.S.C. 7002 (2003). documents. Though this was not likely the intent behind the Act, the result is that such requirements impose additional limitations on agencies using electronic signatures. Therefore, it is more burdensome for electronic transactions to take place between two state agencies or between a state agency and a citizen or business. Key Questions 1. May a public agency accept and use electronic signatures to carry out its transactions under the statutory scheme in North Carolina? Yes. An electronic signature contained in a transaction between a person and a public agency, or between public agencies, shall have the same force and effect as a manual signature. 21 Provided the requirements set forth in the various statutes are met (see below question number 3), state agencies may validly accept electronic signatures and such signatures will operate with the same legal effectiveness as traditional paper-based signatures. The one exception to the general rule of permissibility arises with the use of signatures that, by law, require attestation by a notary public. Such signatures may not currently be made electronically when the state is a party to the transaction. 22 2. Is a public agency in North Carolina required to use electronic signatures to carry out its transactional relationships? No. ECA, was enacted to facilitate electronic commerce with public agencies and to regulate the application of electronic signatures when used in commerce with public agencies. The Act was not meant to require agencies to use such signatures as a matter of policy. 23 A public agency must be careful to remember that once it chooses to accept electronic signatures, a number of requirements attach and the agency must meet these requirements or risk liability. 3. What constitutes a valid electronic signature for purposes of statutory compliance in North Carolina? In order for an electronic signature to have the same force and effect as a manual signature under ECA, the following elements must be present: The public agency involved in the transaction must have requested or required the use of 21. 58.5 (a). 22. 58.4 (b). 23. 58.1. 4
October 2003 Digital Government Innovation Bulletin No. 2003/02 electronic signatures. 24 Unlike the requirements set forth in UETA-NC and ESIGN, only the agency has to agree to the use of electronic signatures for the electronic signature to be valid. Once the agency holds itself out as accepting such signatures, this element is met. The electronic signature must be unique to the person using it. 25 The electronic signature must be capable of certification. 26 This process is described in detail in the ECA. An electronic signature is only capable of certification if it can be certified by the proper certification authority, as authorized by the Secretary of State, to vouch for the relationship between a person or public agency and that person s or public agency s electronic signature. 27 The electronic signature is in the sole control of the person using it. The electronic signature is linked to data in such a manner that if the data were changed, the electronic signature would be invalidated The electronic signature must conform to any and all rules promulgated by the Secretary of State pursuant to the ECA Any electronic signatures or facsimile signatures that are otherwise allowed by law are not subject to the above requirements in order to be valid under the ECA. However, such signatures would still be subject to the general guidelines established by the UETA-NC. 4. Are there situations where UETA-NC would apply over the ECA regarding electronic signatures made while the state is a party to the transaction? Aside from the facsimile exception noted above, the UETA-NC rarely applies over the ECA. In fact, UETA-NC expressly states This Article does not apply to a transaction to the extent it is governed by (3) Article 11A of Chapter 66 of the General Statutes. 28 5. What is the penalty, if any, for noncompliance with the ECA? As noted earlier, ECA in effect makes it more difficult for persons and businesses to conduct 24. Unlike ESIGN and UETA where both parties generally have to agree to conduct transactions electronically, ECA requires that the public agency either request or require the use of electronic signatures. 25. 58.5. 26. Id. 27. 58.3. 28. 313(b)(3). electronic transactions with public agencies because of the additional requirements necessary for validation of electronic signatures. Further, the ECA imposes both civil and criminal penalties on individuals or businesses that violate provisions of the Act. 29 The relevant passages read as follows: 66-58.7. Civil penalty The Secretary may assess a civil penalty of not more than five thousand dollars ($5,000) per violation against any certification authority that violates a provision of this Article or any rule promulgated thereunder. In determining the amount of a penalty under this section, the Secretary shall give due consideration to each of the following factors: (1) The organizational size of the certification authority cited; (2) The good faith of the certification authority cited; (3) The gravity of the violation; (4) The prior record of the violator in complying or failing to comply with this Article or a rule adopted pursuant to this Article; and (5) The risk of harm caused by the violation. Chapter 150B of the General Statutes governs the imposition of a civil penalty under this section. A civil penalty owed under this section may be recovered in a civil action brought by the Secretary or the Attorney General. 66-58.8. Criminal penalty (a) Any person who willfully violates any provision of this Article, or who willfully violates any rule or order under this Article, with intent to defraud, is guilty of a Class I felony. (b) The Secretary shall provide such evidence as is available concerning criminal violations of this Article or of any rule or order promulgated hereunder to the proper district attorney, who may, with or without such a reference, institute appropriate criminal proceedings under this Article. (c) Nothing in this Article limits the power of the State to punish any person for any conduct which constitutes a crime by statute or common law. 29. 58.7-58.8. 5
Digital Government Innovation Bulletin Number 2003/02 October 2003 Additional Legal Considerations There are other legal issues related to electronic signatures which a public agency must take into consideration when choosing to implement electronic transactional processes. The following bullets provide a partial list of some of the larger issues: Electronic signatures and records must still meet formal legal requirements for paper documents Notwithstanding their general permissibility, ESIGN, UETA-NC, and ECA require that, in order to be valid, electronic signatures and records must also contain all of the features required by law for paper signatures and records. In connection with the development of information technology systems supporting the use of electronic signatures or records, agency counsel must identify and inform their clients of the formal legal requirements for the signatures or records, and ensure that they are built into the system. Statutes, regulations, common law and custom in the local legal community dictate the form of many agency signatures and records. Agencies must ensure that the electronic signature or records and all relevant information will be available as needed Important information regarding electronic signatures, records and transactions must be collected, retained and accessible whenever needed despite changes to hardware and software. Important information includes (1) the content or substance of the record (i.e. text of contract); (2) information regarding the processing of a transaction (when and from where a communication was sent, and when and where received); (3) the identities of the parties and individuals involved in transaction (i.e. parties to contract) and (4) the intent of the parties (i.e. did parties intend to enter binding contract?). In short, sufficient context must be preserved to make electronic records usable. Ensure that the Electronic Signature or Record Complies with Laws other than ESIGN, UETA-NC and ECA Public Agencies must also ensure that the electronic signature and record systems they use satisfy other state and Federal laws, including but not limited to those governing privacy and security, accessibility, records conservation, and public records law. 30 30. These issues will be addressed individually in future Bulletins. 6
October 2003 Digital Government Innovation Bulletin No. 2003/02 This bulletin is published by the School of Government to address issues of interest to government officials. Public officials may print out or photocopy the bulletin under the following conditions: (1) it is copied in its entirety; (2) it is copied solely for distribution to other public officials, employees, or staff members; and (3) copies are not sold or used for commercial purposes. Additional printed copies of this bulletin may be purchased from the School of Government. To place an order or browse a catalog of School of Government publications, please visit the School s Web site at http://www.sog.unc.edu, or contact the Publications Sales Office, School of Government, CB# 3330 Knapp Building, UNC Chapel Hill, Chapel Hill, NC 27599-3330; e-mail sales@iogmail.iog.unc.edu; telephone (919) 966-4119; or fax (919) 962-2707. 2003 School of Government. The University of North Carolina at Chapel Hill Printed in the United States of America This publication is printed on permanent, acid-free paper in compliance with the North Carolina General Statutes 7