Electronic Signatures Regulations 2002
2002 No. 318
ELECTRONIC COMMUNICATIONS
The Electronic Signatures Regulations 2002
Made 13th February 2002
Laid before Parliament 14th February 2002
Coming into force 8th March 2002
The Secretary of State, being designated1for the purpose of section 2(2) of the European Communities Act 19722in relation to electronic signatures, in exercise of the powers conferred on her by the said section 2(2), hereby makes the following Regulations:
Citation and commencement
1. These Regulations may be cited as the Electronic Signatures Regulations 2002 and shall come into force on 8th March 2002.
Interpretation
2. In these Regulations—
“advanced electronic signature” means an electronic signature—
(a) which is uniquely linked to the signatory,
(b) which is capable of identifying the signatory,
(c) which is created using means that the signatory can maintain under his sole control, and
(d) which is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable;
“certificate” means an electronic attestation which links signature-verification data to a person and confirms the identity of that person;
“certification-service-provider” means a person who issues certificates or provides other services related to electronic signatures;
“Directive” means Directive 1999/93/ECof the European Parliament and of the Council on a Community framework for electronic signatures3;
“electronic signature” means data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication;
“qualified certificate” means a certificate which meets the requirements in Schedule 1 and is provided by a certification-service-provider who fulfils the requirements in Schedule 2;
“signatory” means a person who holds a signature-creation device and acts either on his own behalf or on behalf of the person he represents;
“signature-creation data” means unique data (including, but not limited to, codes or private cryptographic keys) which are used by the signatory to create an electronic signature;
“signature-creation device” means configured software or hardware used to implement the signature-creation data;
“signature-vertification data” means data (including, but not limited to, codes or public cryptographic keys) which are used for the purpose of verifying an electronic signature;
“signature-vertification device” means configured software or hardware used to implement the signature-verification data;
“voluntary accreditation” means any permission, setting out rights and obligations specific to the provision of certification services, to be granted upon request by the certification-service-provider concerned by the person charged with the elaboration of, and supervision of compliance with, such rights and obligations, where the certification-service-provider is not entitled to exercise the rights stemming from the permission until he has received the decision of that person.
Supervision of certification-service-providers
3.—(1) It shall be the duty of the Secretary of State to keep under review the carrying on of activities of certification-service-providers who are established in the United Kingdom and who issue qualified certificates to the public and the persons by whom they are carried on with a view to her becoming aware of the identity of those persons and the circumstances relating to the carrying on of those activities.
(2) It shall also be the duty of the Secretary of State to establish and maintain a register of certification-service-providers who are established in the United Kingdom and who issue qualified certificates to the public.
(3) The Secretary of State shall record in the register the names and addresses of those certification-service-providers of whom she is aware who are established in the United Kingdom and who issue qualified certificates to the public.
(4) The Secretary of State shall publish the register in such manner as she considers appropriate.
(5) The Secretary of State shall have regard to evidence becoming available to her with respect to any course of conduct of a certification-service-provider who is established in the United Kingdom and who issues qualified certificates to the public and which appears to her to be conduct detrimental to the interests of those persons who use or rely on those certificates with a view to making any of this evidence as she considers expedient available to the public in such manner as she considers appropriate.
Liability of certification-service-providers
4.—(1) Where—
(a)
(a) a certification-service-provider either—
(i) issues a certificate as a qualified certificate to the public, or
(ii) guarantees a qualified certificate to the public,
(b)
(b) a person reasonably relies on that certificate for any of the following matters—
(i) the accuracy of any of the information contained in the qualified certificate at the time of issue,
(ii) the inclusion in the qualified certificate of all the details referred to in Schedule 1,
(iii) the holding by the signatory identified in the qualified certificate at the time of its issue of the signature-creation data corresponding to the signature-verification data given or identified in the certificate, or
(iv) the ability of the signature-creation data and the signature-verification data to be used in a complementary manner in cases where the certification-service-provider generates them both,
(c)
(c) that person suffers loss as a result of such reliance, and
(d)
(d) the certification-service-provider would be liable in damages in respect of any extent of the...
To continue reading
Request your trial