@eLaw.com.hk by yip tse & tang, solicitors + notaries 葉謝鄧律師行

Number of CAs and Recognition

By the HKSAR Government's policy, there is no exclusivity in CA services Number of CAs to be determined by the market. Presently, the Postmaster General is a CA statutorily recognized by the Ordinance. The Postmaster General is a recognised certification authority by virtue of the Electronic Transactions Ordinance. Digi-Sign is an example of a private recognised CA.

Recognised CA's Code of Practice

In accordance with section 33 of the Electronic Transactions Ordinance, the Director of Information Technology Services (the Director) may issue a code of practice specifying standards and procedures for carrying out the functions of recognized certification authorities.

The Code of Practice for Recognized Certification Authorities published in January 2000.

Supplementary Note to the Code of Practice for Recognized Certification Authorities on 28 March 2001.

Period of recognition of CA

The validity period for recognition of a CA will normally be two years. The recognized CA may apply to the Director for renewal of the recognition. In accordance with section 27(2) of the Ordinance, an application for renewal must be made at least 30 days before but not earlier than 60 days before the expiry of the period of validity of the recognition.

Assessment Report on CA

S.20(3)(b) states that a CA applying for recognition must furnish to the Director a report containing an assessment as to whether the CA is capable of complying with provisions of the Ordinance applicable to a recognized CA and the Code of Practice.

The report shall be prepared by a person acceptable to the Director as being qualified to give such a report. Qualifications of the person are set out in section 12 of the Code of Practice.

Basis of CA's Recognition

Recognition shall only be granted to those CAs that have achieved a standard acceptable to the Government. Section 21(4) of the Ordinance states that in determining whether the applicant is suitable for recognition, the Director shall, in addition to any other matter the Director considers relevant, take into account the following :

1. whether the applicant has the appropriate financial status for operating as a recognized CA in accordance with the Ordinance and the Code of Practice;

2. the arrangements put in place or proposed to be put in place by the applicant to cover any liability that may arise from its activities relevant for the purposes of the Ordinance;

3. the system, procedure, security arrangements and standards used or proposed to be used by the applicant to issue certificates to subscribers;

4. the report, referred to in section 20(3)(b) of the Ordinance, which contains an assessment as to whether the applicant is capable of complying with provisions of the Ordinance applicable to a recognized CA and the Code of Practice;

5. whether the applicant and its responsible officers are fit and proper persons; and the reliance limits set or proposed to be set by the applicant for its certificates.

The CA Recognition Scheme

s.20 (1) of the Ordinance, certification authorities (CAs) may seek recognition from the Director of Information Technology Services (the Director). On application by a CA, the Director may grant recognition under the Ordinance to the CA and/or to all certificates, or a particular type, class or description of certificates or a particular certificate issued or to be issued by the CA.

Recognition Scheme for Certification Authorities (CAs)

The recognition scheme for Certification Authorities (CA) is entirely voluntary to CA. A CA can carry on the business as a CA without getting a recognition status. For instance, Tradelink has been practising as a CA since 1997. In some countries like Malaysia, CA must be licensed by the Government and persons carrying on CA business without a licence is an offence in law.

The benefit of having a recognition status is a recognised CA can have the benefits of the protections given by the Ordinance regarding its liabilities. Besides, a recognised digital signature generated by a recognised CA can have the legal status of a manual signature. Government services obtained under the ESD Scheme requires the use of digital signature given by a recognised CA for the purpose of authenticating the individual's or organisation's identity and to bind their legal commitment.

The recognition scheme is monitored and serviced by the Director of Information Technology Service (DITS) through the Recognition Office of its department.

Electronic contracts are valid

This is under section 17 of the Ordinance.

In the context of the formation of contracts, unless otherwise agreed by the parties, an offer and the acceptance of an offer may be in whole or in part expressed by means of electronic records.

Where an electronic record is used in the formation of a contract, that contract shall not be denied validity or enforceability on the sole ground that an electronic record was used for that purpose.

Admissibility of electronic records

This is under section 9 of the Ordinance.

An electronic record shall not be denied admissibility in evidence in any legal proceeding on the sole ground that it is an electronic record.

Electronic Record can be Original Records

This is under section 7 of the Ordinance.

Where a rule of law requires that certain information be presented or retained in its original form, the requirement is satisfied by presenting or retaining the information in the form of electronic records if:

(a) there exists a reliable assurance as to the integrity of the information from the time when it was first generated in its final form; and

(b) where it is required that information be presented, the information is capable of being displayed in a legible form to the person to whom it is to be presented.