Hong KongElectronic Transactions Ordinance, sections 41 and 42, reliance limit and liability limits for a recognized certification authority
Cap. 553, Electronic Transactions Ordinance, ss. 41 and 42
In force since .
A liability safe harbors rule binding public and private bodies.
As of .
What it requires
- If you issue recognized certificates as a recognized certification authority, you may specify a reliance limit in a certificate, and different limits in different certificates or in different types, classes or descriptions of certificate (s. 41).
- Comply with the Ordinance and the code of practice with respect to each recognized certificate you issue; only then are you not liable for loss caused by reliance on a false or forged digital signature of a subscriber supported by that certificate, unless you waive that protection (s. 42(1)).
- Comply with the Ordinance and the code of practice in relation to each certificate; only then is your liability for loss caused by reliance on information you are required to confirm under the certification practice statement and the code of practice, and which is misrepresented on the certificate or in a repository, limited to the reliance limit specified in the certificate, unless you waive that limit (s. 42(2)).
- Do not count on the reliance limit where the fact was misrepresented through your negligence or intentionally or recklessly; the limit does not apply then (s. 42(3)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 41 of the Electronic Transactions Ordinance allows a recognized certification authority to specify a reliance limit in a recognized certificate, and different limits in different certificates or in different types, classes or descriptions of certificate.
Under section 42(1), unless the authority waives the subsection, it is not liable for any loss caused by reliance on a false or forged digital signature of a subscriber supported by a recognized certificate it issued, if it has complied with the Ordinance and the code of practice with respect to that certificate.
Under section 42(2), unless it waives the subsection, it is not liable in excess of the reliance limit for a loss caused by reliance on information that it is required to confirm under the certification practice statement and the code of practice and that is misrepresented on the certificate or in a repository, if it has complied with the Ordinance and the code of practice in relation to that certificate.
Section 42(3) removes that limit if the fact was misrepresented through the authority's negligence or intentionally or recklessly. A recognized certification authority is one recognized under section 21 or the certification authority referred to in section 34.
When LexLint raises it
When your app profile says your app collects electronic signatures or relies on a digital identity.