### Electronic Transactions Ordinance 《電子交易條例》

20. Certification authority may apply to Government Chief Information Officer for recognition
(1) A certification authority may apply to the Government Chief Information Officer to become a recognized certification authority for the purposes of this Ordinance.
(2) Subject to subsection (4) and section 21(3), an application under subsection (1) must be made in the prescribed manner and in a form specified by the Government Chief Information Officer and the applicant must pay the prescribed fee in respect of the application.
(3) An applicant must furnish to the Government Chief Information Officer— (Amended L.N. 131 of 2004)
(a) the relevant particulars and documents specified under section 30; (Amended 14 of 2004 s. 12)
(b) a report which—
(i) contains an assessment as to whether the applicant is capable of complying with such provisions of this Ordinance and of the code of practice as are specified in the code of practice for the purposes of this subparagraph; and
(ii) is made by a person approved by the Government Chief Information Officer as being qualified to make such a report; and (Replaced 14 of 2004 s. 12)
(c) a statutory declaration which—
(i) states whether the applicant is capable of complying with such provisions of this Ordinance and of the code of practice as are specified in the code of practice for the purposes of this subparagraph; and
(ii) is made by a responsible officer of the applicant. (Added 14 of 2004 s. 12)
(3A) Any report or statutory declaration required to be furnished under subsection (3) must be made at the expense of the applicant. (Added 14 of 2004 s. 12)
(4) The Government Chief Information Officer may waive— (Amended L.N. 131 of 2004)
(a) the requirements as to manner and form of making the application in subsection (2); or
(b) the requirement of a report or statutory declaration under subsection (3), (Amended 14 of 2004 s. 12)
in relation to a certification authority, in the circumstances specified in subsection (5).
(5) The Government Chief Information Officer may waive the requirements referred to in subsection (4) only if— (Amended L.N. 131 of 2004)
(a) the applicant is a certification authority with a status in a place outside Hong Kong comparable to that of a recognized certification authority (comparable status

### Electronic Transactions Ordinance 《電子交易條例》

22. Government Chief Information Officer may recognize certificates
(1) The Government Chief Information Officer may recognize certificates issued by a recognized certification authority as recognized certificates, upon application by that authority.
(2) An applicant under subsection (1) must make the application in the prescribed manner and in a form specified by the Government Chief Information Officer and furnish to the Government Chief Information Officer the relevant particulars and documents specified under section 30.
(3) A recognition under subsection (1) may relate to—
(a) all certificates issued by the recognized certification authority;
(b) certificates of a type, class or description; or
(c) particular certificates.
(4) An applicant must pay the prescribed fee (if any) in respect of an application under subsection (1) unless the Government Chief Information Officer waives it in whole or in part.
(5) In recognizing certificates under this section, the Government Chief Information Officer shall in addition to any other matter the Government Chief Information Officer considers relevant take into account the following— (Amended L.N. 131 of 2004)
(a) whether the certificates are issued in accordance with the certification practice statement;
(b) whether the certificates are issued in accordance with the code of practice;
(c) the reliance limit set or proposed to be set for that type, class or description or the particular certificate, as the case may require; and
(d) the arrangements put in place or proposed to be put in place by the certification authority to cover any liability that may arise from the issue of that type, class or description or the particular certificate, as the case may be.
(6) The Government Chief Information Officer may refuse an application under subsection (1).
(7) The Government Chief Information Officer must give reasons in writing to the applicant for refusing an application under subsection (6).
(8) The Government Chief Information Officer may specify a period of validity for a recognition under this section.
(9) The Government Chief Information Officer may upon application renew a recognition under this section.
(10) Subsections (2), (3), (4), (5), (6), (7) and (8) apply to a renewal under subsection (9) as they apply to an application for recognition, subject to necessary modifications. (Amended 14 of 2004 s. 14)
(Amended L.N. 131 of 2004)

### Electronic Transactions Ordinance 《電子交易條例》

23. Government Chief Information Officer may revoke recognition
(1) The Government Chief Information Officer may revoke a recognition granted under section 21 or 22 or renewed under section 22 or 27.
(2) Before revoking a recognition, the Government Chief Information Officer must give the certification authority a notice of intention to revoke the recognition specifying the reasons for the intended revocation.
(3) In a notice under subsection (2), the Government Chief Information Officer must invite the certification authority to make representations as to why the recognition should not be revoked and specify a period for making the representations.
(4) If the Government Chief Information Officer decides to revoke a recognition, the Government Chief Information Officer must immediately give the certification authority notice in writing of the decision specifying the reasons for the decision and the date on which the decision was made.
(5) A revocation of recognition in relation to certificates may relate to all certificates issued by a recognized certification authority or to a type, class or description of certificates or a particular certificate.
(6) Subject to subsection (7), a revocation takes effect on the expiry of 7 days from the date on which the decision to revoke the recognition is made.
(7) If the certification authority appeals under section 28 against the revocation, the revocation does not take effect until the expiry of 7 days from the date on which the Secretary confirms the revocation on appeal.
(Amended L.N. 131 of 2004)

24. Government Chief Information Officer may suspend recognition
(1) The Government Chief Information Officer may suspend a recognition granted under section 21 or 22 or renewed under section 22 or 27 for a period not exceeding 14 days. (Amended L.N. 131 of 2004)
(2) If the Government Chief Information Officer decides to suspend a recognition, the Government Chief Information Officer must immediately give the certification authority notice in writing of the decision specifying the reasons for the decision and the date on which the decision was made. (Amended L.N. 131 of 2004)
(3) A suspension of recognition in relation to certificates may relate to all certificates issued by a recognized certification authority or to a type, class or description of certificates or a particular certificate.
(4) Subject to subsection (5), a suspension takes effect on the expiry of 7 days from the date on which the decision to suspend the recognition is made.
(5) If the certification authority appeals under section 28 against the suspension, the suspension does not take effect until the expiry of 7 days from the date on which the Secretary confirms the suspension on appeal.
(6) If the period of suspension expires during the validity of a recognition and the recognition is not revoked, the recognition is taken to be reinstated.

### Electronic Transactions Ordinance 《電子交易條例》

25. Matters Government Chief Information Officer may take into account in revoking or suspending a recognition
The Government Chief Information Officer may, in revoking or suspending a recognition under section 23 or 24, in addition to any other matter that the Government Chief Information Officer considers relevant, take into account the following— (Amended L.N. 131 of 2004)
(a) any matter set out in section 21(4);
(b) whether the certification authority has failed—
(i) to operate in accordance with the certification practice statement;
(ii) to comply with the code of practice;
(iii) to use a trustworthy system; or
(iv) to comply with any provision of this Ordinance; and
(c) any report or statutory declaration furnished by the certification authority under section 43(1) or 43A(1). (Replaced 14 of 2004 s. 15)