Source: http://kuner.com/historical-materials-on/german-draft-digital-signat.html
Timestamp: 2017-09-19 18:59:17
Document Index: 224588350

Matched Legal Cases: ['§ 15', '§ 4', '§ 15', '§ 66', '§ 15', '§ 15', '§ 13', '§ 5', '§ 13', '§ 7', '§ 12', '§ 15', '§ 9', '§ 383', '§ 5', '§ 3', '§ 4']

German Draft Digital Signature Law (SigG), Reporter's Draft, Version of September 19, 1996 | kuner.com
German Draft Digital Signature Law (SigG), Reporter's Draft, Version of September 19, 1996
« German Draft Digital Signature Ordinance (SigV), Reporter's Draft, Version of September 19, 1996
Remarks of the German Government on the EU Draft Directive concerning Electronic and Digital Signatures (1996) »
Commentary: This translation is of a semi-final version of the Law, which is expected to be approved by the German cabinet in late 1996 or early 1997 and to be enacted into law in the spring of 1997. While some minor changes may be made following comments from the German public and German industry, the text translated here is likely to reflect the final law very closely. It should be noted that the German law, which will be the first digital signature law in Europe, mainly deals with the technical requirements for digital signatures, so that legal problems relating to the use of digital signatures in Germany will not be completely solved by the new law. The Reporter's Draft of the Legal Ordinance referred to in § 15 has also been released, and a translation thereof will be posted here shortly. It is hoped eventually to also provide translations of the voluminous commentary to the Law and the Ordinance.
(2) A certifier within the meaning of this law is a natural or legal person which attests to the attribution of signature keys to natural persons and holds a license therefor under § 4.
The granting of licenses and the issuance of signature key certificates for certifiers, as well as supervision of compliance with this law and with the Legal Ordinance under § 15, rests with the Authority under § 66 of the Telecommunications Act.
(3) An applicant possesses the necessary reliability if it can guarantee that it will comply as license holder with the relevant legal requirements for the operation of a certifier. The necessary expert knowledge is present if those persons working in the certifier possess the necessary knowledge, experience, and qualifications. The further requirements for the operation of the certifier are present if the measures for fulfilling the security requirements of this law and the Legal Ordinance under § 15 are recorded in a security plan, the implementation of which has been examined and verified by an instance recognized by the Authority.
(4) The license may contain subsidiary provisions, insofar as these are necessary to ensure that the certifier fulfills the requirements of this law and the Legal Ordinance under § 15 upon commencing operations and during operations.
(5) The Authority issues the certificates for signature keys that are used to sign signature key certificates. The provisions for the issuance of signature key certificate by certifiers apply correspondingly for the Authority, which shall maintain access to the signature key certificates which it has issued at all times and for everyone over publicly-accessible telecommunications connections. This also applies to information concerning the addresses and telephone numbers of certifiers, the blocking of signature key certificates which it has issued, the termination of and the prohibition against performing licensed activities, as well as the revocation of licenses.
(6) Fees shall be imposed for the granting of licenses and the issuance of signature key certificates by the Authority.
(1) The certifier shall reliably identify persons who apply for a signature key certificates. It shall confirm the attribution of a public signature key to an identified person by a signature key certificate and shall maintain access to this, as well as to associated certificates (para. 2), at all times and for everyone over publicly-accessible telecommunications connections in a verifiable manner and with the agreement of the signature key owner.
(2) Upon request of an applicant, it shall record information concerning the power of representation for a third party or other information concerning a third party in the signature key certificate or in a associated certificate, insofar as sufficient authority therefore is presented to it. It shall maintain access to the certificates relating to a signature key certificate in accordance with para. 1, sentence 2.
(3) Upon request of an applicant, it shall record a pseudonym in the signature key certificate in place of the applicant's name, and it shall mark digital data upon request with a time stamp.
(4) It shall take measures so that data for signature key certificates cannot be forged or falsified in a way which is not visible. It shall furthermore take steps so that the confidentiality of a private signature key is guaranteed. Private signature keys may not be stored by a certifier.
(5) It shall use reliable personnel for the exercise of licensed activities, and shall use technical components in accordance with § 13 for making signature keys accessible and creating signature key certificates and time stamps. This also applies to technical components which make possible the verification of signature key certificates under para. 1, sentence 2.
The certifier shall instruct the applicant under § 5 para. 1 concerning the measures necessary to contribute to secure digital signatures and their reliable verification. It shall inform the applicant which technical components fulfill the requirements of § 13, paras. 1 and 2, as well as concerning the attribution of digital signatures created with a private signature key. It shall point out to the applicant that data with digital signatures may need to be re-signed before the security value of an available signature decreases with time.
A signature key certificate shall contain at least the following:
1. The name of the signature key owner, which much be marked with an additional notation if there is the possibility of confusion, or with an unmistakable pseudonym attributable to the signature key owner, which shall be identified as such;
Information concerning the power of representation for a third party may in particular be recorded in the signature key certificate or associated certificates.
(1) A certifier shall block a signature key certificate or a associated certificate upon request of a signature key owner or his representative if the certificate was issued based on false information under § 7, if the certifier ends its activities and they are not continued by another certifier, or if the Authority orders blocking under § 12, para. 5, sentence 2. The blocking shall indicate the time from which it applies. Retroactive blocking is not permitted.
(2) If a certificate contains information about a third party, such party as well may demand blocking of the certificate if the information is no longer valid.
A certifier shall document the security measures taken to comply with this law and the Legal Ordinance under § 15 as well as the issued signature key certificates in such a way that the data and its unfalsified condition may be verified at any time.
Termination of Licensed Activities
(1) Upon termination of its activities, a certifier shall notify this to the Authority as soon as possible and shall ensure that valid signature key certificates are taken over by another certifier or are blocked upon termination of such activity.
(2) It shall transfer documentation under § 9 to the certifier that takes over its certificates, or otherwise to the Authority.
(2) In the case of a signature key owner using a pseudonym, the certifier shall transmit data concerning his identity in individual cases only upon request of the proper authorities, insofar as this is necessary to prosecute crimes or misdemeanors, to protect against dangers for the public safety, or to fulfill the legal duties of the constitutional protection authorities of the federal government and the federal states, the federal security service, the military security service or the criminal customs authorities. Such information shall be documented.
(3) Section 38 of the Federal Data Protection Act shall apply, with the proviso that an examination may also be made if there are no grounds for a violation of data protection provisions.
(2) Certifiers shall allow the Authority to enter their business and operational premises during normal business hours for the purpose of supervision under para. 1, sentence 1, and upon request shall present any relevant books, records, receipts, writings, and other records for inspection, and shall provide information and necessary assistance. The person required to provide the information may refuse to provide it with regard to questions, the answering of which would subject him or one of his family members mentioned in § 383 paras. 1 through 3 of the Civil Procedure Code to the danger of criminal prosecution or to a procedure under the Law on Misdemeanors.
(4) In case of revocation of a license or the termination of activities of a certifier, the Authority shall see to it that such activity is taken over by another certifier or that contracts with signature key owners are wound up. This also applies with regard to an application for the opening of bankruptcy or composition proceedings, if the licensed activity is not being continued.
(1) Technical components shall use security procedures for the creation and storage of signature keys, as well for the creation and checking of digital signatures, which make forgery of digital signatures and falsification of signed data reliably visible and protect against the unauthorized use of private signature keys.
(2) For the representation of data which is to be signed, technical components with security measures shall be used which show unmistakably and in advance the creation of a digital signature and allow a determination of the data to which the digital signature refers. For the checking of signed data, technical components shall be used which have security features that allow it to be determined whether the signed data are unchanged, to which data the digital signature refers, and to which signature key owner the digital signature is to be attributed.
(3) With regard to technical components with which signature key certificates are maintained in a verifiable way in accordance with § 5, para. 1, sentence 2, measures shall be taken in order to protect the certificates from unauthorized alteration and access.
Digital signatures which may be checked with a public signature key for which a foreign signature key certificate exists are deemed to be equivalent, insofar as supranational or international agreements concerning the recognition of signature key certificates have been concluded.
The federal government is empowered to promulgate by Legal Ordinance the provisions necessary to implement §§ 3 through 14, with regard to:
2. The circumstances giving rise to fees under § 4, para. 4, the amount of fees, and the reimbursement of expenses under the Act on Administrative Costs;