PART III

Certification Services

29. —(1) A person or public body is not required to obtain the prior authority of any other person or public body to provide certification or other services relating to electronic signatures.

(2) (a) The Minister, after consultation with the Minister for Enterprise, Trade and Employment, may by regulations made under section 3 establish a scheme of voluntary accreditation of certification service providers for the purpose of the Directive and to enhance levels of certification service provision in the State, and may designate accreditation authorities and prescribe such matters relating to their designation as the Minister thinks appropriate for the purpose.

(b) A person or public body who or which provides certification or other services in the State relating to electronic signatures may apply as prescribed to the accreditation authority designated under paragraph (a) to participate in any scheme of voluntary accreditation established pursuant to that paragraph.

(c) The regulations may prescribe—

(i) the rights and obligations specific to the provision of certification services of participants in a scheme of voluntary accreditation, and

(ii) the manner in which the accreditation authority designated under paragraph (a) shall elaborate and supervise compliance with those rights and obligations in accordance with the Directive and, in particular, Annex II.

(d) A participant in a scheme referred to in paragraph (a) shall not exercise a right under the scheme without the prior permission of the accreditation authority.

(3) The Minister shall prescribe a scheme of supervision of certification service providers established in the State who issue qualified certificates to the public.

(4) (a) The Minister may, after consultation with the Minister for Enterprise, Trade and Employment, by order, designate persons or public bodies for the purposes of determining whether secure signature creation devices conform with the requirements of Annex III.

(b) The Minister may, by order, amend or revoke an order under this subsection, including an order under this paragraph.

(5) No civil action shall lie or be maintained against a person or public body designated under or for the purposes of subsection (2), (3) or (4) in respect of any determination made or thing done by the person or public body, in good faith, in the performance or purported performance of a function under a scheme referred to in subsection (2) or (3) or for which he, she or it is designated under subsection (4).

30. —(1) A certification service provider who provides a service to the public of issuing certificates and who as a part of that service issues a certificate as a qualified certificate or guarantees such a certificate, shall be liable for any damage caused to a person who, or public body which, reasonably relies on the certificate unless the certification service provider proves that he, she or it has not acted negligently.

(2) It shall be the duty of every certification service provider who provides to the public a service of issuing certificates and who issues a certificate as a qualified certificate or guarantees such a certificate, to take reasonable steps to ensure—

(a) the accuracy of all information in the qualified certificate as at the time of issue and that the certificate contains all the details required by Annex I to be so contained in a qualified certificate,

(b) that, at the time of the issue of the certificate, the signatory identified in the certificate held the signature creation device corresponding to the signature verification device given or identified in the certificate, and

(c) that the signature creation device and the signature verification device act together in a complementary manner, in cases where the certification service provider generates both.

(3) A certification service provider who provides a service to the public of issuing certificates and who as a part of that service issues a certificate as a qualified certificate, or guarantees such a certificate, is liable for any damage caused to a person who, or public body which, reasonably relies on the certificate, for the certification service provider's failure to register or publish notice of the revocation or suspension of the certificate as prescribed, unless the certification service provider proves that he, she or it has not acted negligently.

(4) A certification service provider who provides a service to the public of issuing certificates and who as a part of that service issues a certificate as a qualified certificate, or guarantees such a certificate, may indicate in the qualified certificate limits on the uses of the certificate (including a limit on the value of transactions for which the certificate can be used) and, if the limits are clear and readily identifiable as limitations, the certification service provider shall not be liable for damages arising from a contrary use of a qualified certificate which includes such limits on its uses.