### Electronic Transactions Ordinance 《電子交易條例》

33. Government Chief Information Officer may publish code of practice
(1) The Government Chief Information Officer may publish in the Gazette a code of practice— (Amended L.N. 131 of 2004)
(a) specifying standards and procedures for carrying out the functions of recognized certification authorities;
(b) specifying the provisions of this Ordinance and of the code of practice for the purposes of—
(i) section 20(3)(b)(i) and (c)(i);
(ii) section 27(5A)(b)(i) and (c)(i);
(iii) section 43(1)(a)(i) and (b)(i); and
(iv) section 43A(1)(c)(i) and (d)(i).
(2) The code of practice published under subsection (1) may make different provisions for different circumstances and provide for different cases or classes of cases.
(3) The Government Chief Information Officer may from time to time amend the whole or any part of the code of practice published under subsection (1) in a manner consistent with the power to publish the code under subsection (1), and any reference in this Ordinance to the code shall, unless the context otherwise requires, be construed as a reference to the code as so amended. (Amended L.N. 131 of 2004)
(4) Any code of practice published under subsection (1) is not subsidiary legislation.
(Replaced 14 of 2004 s. 18)

34. The Postmaster General as recognized certification authority
(1) The Postmaster General is a recognized certification authority for the purposes of this Ordinance.
(2) Part VII does not apply to the Postmaster General as a certification authority.

35. Postmaster General may perform functions and provide services of certification authority
(1) For the purposes of section 34, the Postmaster General may by himself or by the officers of the Post Office—
(a) perform the functions and provide the services of a certification authority and services incidental or related to the functions or services of a certification authority; and
(b) do anything that is necessary or expedient for the purposes of paragraph (a) and for complying with any provision of this Ordinance relating to a recognized certification authority.
(2) The Postmaster General may determine and charge fees for providing the services of a certification authority or services incidental or related to the functions or services of a certification authority.
(3) The fees determined and charged under subsection (2) shall not be limited by reference to the administrative or other costs incurred or likely to be incurred or recovery of expenditure in the provision of the services of a certification authority or services incidental or related to the functions or services of a certification authority.
(4) The Postmaster General may give particulars of any fees determined under subsection (2) in such manner as the Postmaster General thinks fit.

### Electronic Transactions Ordinance 《電子交易條例》

36. Publication of issued and accepted certificates
Where a person named or identified, or to be named or identified, in a recognized certificate as the person to whom the certificate is issued—
(a) accepts the certificate, the recognized certification authority concerned must publish the certificate in a repository as soon as reasonably practicable after it issues the certificate;
(b) does not accept the certificate, the recognized certification authority concerned must not publish the certificate.
(Replaced 14 of 2004 s. 19)

37. Recognized certification authority to use trustworthy system
A recognized certification authority must use a trustworthy system in performing its services—
(a) to issue, revoke or suspend a recognized certificate; or
(b) to publish in a repository or give notice of the issue, revocation or suspension of a recognized certificate.
(Amended 14 of 2004 s. 20)

38. Presumption as to correctness of information
It shall be presumed, unless there is evidence to the contrary, that the information contained in a recognized certificate issued by a recognized certification authority (except information identified as subscriber’s information which has not been verified by the recognized certification authority) is correct if the certificate was published in a repository.

39. Representations upon issuance of recognized certificate
By issuing a recognized certificate, a recognized certification authority represents to any person who reasonably relies on the information contained in the certificate or a digital signature verifiable by the public key listed in the certificate, that the recognized certification authority has issued the certificate in accordance with any applicable certification practice statement incorporated by reference in the certificate, or of which the relying person has notice.

40. Representations upon publication of recognized certificate
By publishing a recognized certificate, a recognized certification authority represents to any person who reasonably relies on the information contained in the certificate, that the recognized certification authority has issued the certificate to the subscriber concerned.

41. Reliance limit
(1) A recognized certification authority may, in issuing a recognized certificate, specify a reliance limit in the certificate.
(2) The recognized certification authority may specify different limits in different recognized certificates or in different types, classes or description of certificates.

### Electronic Transactions Ordinance 《電子交易條例》

42. Liability limits for recognized certification authorities
(1) Unless a recognized certification authority waives the application of this subsection, the recognized certification authority is not liable for any loss caused by reliance on a false or forged digital signature of a subscriber supported by a recognized certificate issued by that certification authority, if the recognized certification authority has complied with the requirements of this Ordinance and the code of practice with respect to that certificate.
(2) Unless a recognized certification authority waives the application of this subsection, the recognized certification authority is not liable in excess of the amount specified in the certificate as its reliance limit, for a loss caused by reliance on any information—
(a) that the recognized certification authority is required to confirm according to the certification practice statement and the code of practice; and
(b) which is misrepresented on that recognized certificate or in a repository,
if the recognized certification authority has, in relation to that certificate, complied with the requirements of this Ordinance and the code of practice.
(3) The limitation of liability under subsection (2) does not apply if the fact was misrepresented due to the negligence of the recognized certification authority or it was intentionally or recklessly misrepresented by the recognized certification authority.

### Electronic Transactions Ordinance 《電子交易條例》

45. Recognized certification authority to maintain repository
(1) A recognized certification authority must maintain or cause to be maintained an on-line and publicly accessible repository.
(2) The Government Chief Information Officer must publish in the Gazette a list of the repositories maintained under subsection (1). (Amended L.N. 131 of 2004)
(3) Any list of repositories published under subsection (2) is not subsidiary legislation. (Added 14 of 2004 s. 23)

46. Obligation of secrecy
(1) Subject to subsection (2), a person who has access to any record, book, register, correspondence, information, document or other material in the course of performing a function under or for the purposes of this Ordinance shall not disclose or permit or suffer to be disclosed any information relating to another person as contained in such record, book, register, correspondence, information, document or other material to any other person. (Amended 14 of 2004 s. 24)
(2) Subsection (1) does not apply to disclosure—
(a) which is necessary for performing or assisting in the performance of a function under or for the purposes of this Ordinance;
(b) for the purpose of any criminal proceedings in Hong Kong;
(c) for the purpose of complying with a requirement made under a rule of law with a view to instituting a criminal proceeding in Hong Kong; or
(d) under the direction or order of a magistrate or court.
(3) A person who contravenes subsection (1) commits an offence and is liable to a fine at level 6 and in the case of an individual also to imprisonment for 6 months.

47. False information
A person who knowingly or recklessly makes, orally or in writing, signs or furnishes any declaration, return, certificate or other document or information required under this Ordinance which is untrue, inaccurate or misleading commits an offence and is liable in the case of an individual to a fine at level 6 and to imprisonment for 6 months and in any other case, to a fine at level 6.

48. Other offences
A person who makes a false claim that a person is a recognized certification authority commits an offence and is liable in the case of an individual to a fine at level 6 and to imprisonment for 6 months and in any other case, to a fine at level 6.