Vol. 441 Cape Town 1 March 2002 No.
The Minister of Communications intends introducing the Electronic Communications and Transaction Bill in May 2002 in Parliament for consideration this year.
The Bill is hereby published in accordance with Rule 241(l)(c) of the National Assembly.
The Bill can also be found on www.parliament.gov.za.
To provide for the facilitation and regulation of electronic communications and transactions;toprovideforthedevelopment of anationale-strategyforthe Republic; to promote universal access to electronic communications and transac-tions and the use of electronic transactions by SMMEs; to provide for human resource development in electronic transactions; to prevent abuseof information systems; to encourage the to matters use of e-Government services; and provide for connected therewith.
E-GOVERNMENT 25 28.
Establishment and incorporation of.
Regulations 10 72.
Chapter X, means the.
a stored record.
exercising a public power or performing a public function in termsof any legislation; "registrant" means an applicant for or holder of a domain name; "registrar" means an entity which is licensed by the Authority to updatea repository; "registry" means an entity licensed by the Authority to manage and administer a specific sub-domain; "repository" means the primary register of the information maintained by a registry; "second level domain" means the sub-domain or sub-domainsimmediately following the ccTLD, signifying a category or type of domain name; "SMMEs" means Small, Medium and Micro Enterprisescontemplatedinthe Schedules to the Small Business Development Act, 1996 (Act No. 102 of 1996); "sub-domain" means any subdivision of the. za domain name space which begins at the second level domain; "TCP/IP" means the Transmission Control Protocol Internet Protocol used by an information system to connect to the Internet; "TLD" means the top level domain of the domain name system; "third-party", in relation to a service provider, means a subscriber to the service provider's services or any other user of the service provider's services or a user of information systems; "transaction" means a transaction of either acommercial or non-commercial nature, and includes the provision of information and e-Government services; "universalaccess" means access by all citizens of the RepublictoInternet connectivity and electronic transactions; "WAF"' means Wireless Application Protocol, an open international standard developed by the Wireless Application ProtocolForumLimited, acompany incorporated in terms of the laws of the United Kingdom, for applications that use wireless communication and includes Internet access from a mobile phone; "web page" means a data message on the World Wide Web; "web site" means any computer on the Internet containing a home page or web page;"World-Wide Web" means anInternethyperlinkeddistributed information retrieval system and includes all data messages residing on all computers linked to the Internet; and ".za domain name space" means the. za ccTLD assigned to the Republic according to the two-letter codes in the International StandardIS0 3166-1.
GOVERNMENT 1 MARCH 2002 ensure efficient use and management of the. za domain name space; and ensure that the national interest of the Republic is not compromised through the use of electronic communications.
This Act must not be interpreted so as to exclude any statutory law or the common law from being applied to, recognising or accommodating electronic transactions, data messages or any other matter provided for in this Act.
Subject to any contrary provision in this section, this Act applies in respect of any electronic transaction or data message.
requiringanyperson to generate, communicate, produce, process, send, receive, record, retain, store ordisplay anyinformation, document or signature by or in electronic form; or prohibiting a person from establishing requirements in respect of the manner in which that person will accept data messages.
The sections of this Act mentioned in ColumnB of Schedule 1do not apply to the laws mentioned in Column A of that Schedule.
This Act must not be construedas giving validity to any transaction mentioned in Schedule 2.
The Minister must, within24 months after the promulgation of this Act, develop a five-year national e-Strategy for the Republic, which must be submittedto the Cabinet for approval.
TheCabinetmust, onacceptance of the national e-Strategy, declare the implementation of the national e- Strategy as a national priority.
may liaise, consult and cooperate with public bodies, the private sector or any other person; and may, in consultation with the Minister of Finance, appoint experts and other consultants on such conditions as the Minister may determine.
(a)TheMinistermust, in consultation with other members of the Cabinet, determinethesubject matters to be addressed in the nationale-Strategyand the principles that must govern the implementation thereof.
(b)Prior to prescribing any subject matter and principles provided for in paragraph (a),the Minister must invite comments from all interested parties by noticein the Gazette and consider any comments received.
the electronic transactions strategy of the Republic, distinguishing between national, regional.
the resources required to achieve the objectives provided for in the national e-Strategy.
(5)Upon approval by the Cabinet, the Minister must publish the national e-Strategy in the Gazette.
allocate funds for implementation of the national e-Strategy to such institutions and persons as are responsible for delivery in terms of the national e- Strategy and supervise the execution of their mandate; and take any steps reasonably necessary to enable all relevant parties to achieve their respective obligations.
The Minister must annually report to the Cabinet on progress made and objectives achieved or outstanding and may include anyother matter the Minister deems relevant.
The Minister must annually review the national e-Strategy and where necessary make amendments thereto in consultation with all relevant members of the Cabinet.
No amendmentoradaptation of the national e- Strategy is effective unless approved by the Cabinet.
foster the adoption and use of new technologies for attaining universal access; and stimulate public awareness, understanding and acceptance of the benefits of Internet connectivity and electronic transacting.
The Minister, in developing the national e-Strategy, must provide for.
providing or securing support services for such facilities and infrastructure to assist with the efficient execution of electronic transactions; and rendering assistance and advice to such persons and communities on means to efficiently adopt and utilise electronic transactions.
The Minister, in developing national e-strategy, must provide for ways of promoting human resources development set out inthis section within the context of the Government'sintegrated human resource development strategies, having regard to structures and programmes that have been established under existing laws.
(2)The Minister must consult with the Ministers of Labour and Education on existing facilities, programmes and structures foreducation, training and human resource development in the information technology sector relevant to the objects of this Act.
the management of the.
education on the nature, scope, impact, operation, use and benefits of electronic transactions; and any other matter relevant to electronic transactions as the Minister regards as proper.
facilitatethedevelopment of websites orwebsiteportals that will enable SMMEsto transact electronically and obtain information about markets, products and technical assistance; and facilitate the provision of such professional and expert assistance and advice to SMMEs on means to efficiently adopt and utilise electronic transacting for their development.
(1)The Minister must, subject to the provisions of this Act, formulate electronic transactions policy.
existing laws and their administration in the Republic.
(3)The Minister must publish policy guidelines in the Gazette on such issues as he or she deems relevant to electronic transactions in the Republic.
(4)The Minister may not publish policy guidelines that impose obligations on any person.
(1)Information is not without legal force and effect merely on the grounds that it is wholly or partly in the form of a data message.
Information is not without legal force and effect merely on the grounds that it is not contained in the data message purporting to give rise to such legal forceand effect, but is merely referred to in such data message.
referred to in a way in which a reasonable person would have noticed the reference to and incorporation thereof; and accessible in a formin which it may be read, stored and retrieved by the other party, whether electronically oras acomputerprintout: Provided such information is reasonably capable of being reduced to electronic formby the it.
in the form of a data message; and accessible manner usable subsequent reference.
(1)Where the signatureof a person is required by law, that requirement in relation to a data message is met only if an advanced electronic signatureis used.
Subject to subsection (1) an electronic signature is not without legal force and effect merely on the that it is in electronic form.
having regard to all the relevant circumstances at the time the method was used, the method was as reliable as was appropriate for the purposes for which the information was communicated.
(4)Where an advanced electronic signaturehas been used, such signature isregarded as having created a valid electronic signature and to have been applied properly, unless the contrary is proved.
establishing the validity of an advanced electronic signature in any other way; or adducing evidence of the non-validity of an advancedelectronicsignature.
the integrity of the information from the time when it was first generated in its final form as a data message or otherwise has passed assessment in terms of subsection (2): and that information is capable of being displayed or produced to the person to whom it is to be presented.
in the light of the purpose for which the information was generated; and having regard to all other relevant circumstances.
on the mere grounds that it is constituted by a data message; or if it is thebest evidence that the person adducing it could reasonably be expected to obtain, on the grounds that it is not in its original form.
Information in the form of a data message must be given due evidential weight.
the manner in which its originator was identified; and any other relevant factor.
the data message is in the format in which it was generated, sent or received, or in a format which canbe demonstrated to represent accurately the information generated, sent or received; and the origin and destination of that data message and the date and time it was sent or received can be determined.
The obligation to retain information as contemplated in subsection (1) does not extend to any information the sole purpose of which is to enable the message to be sent or received.
theaddition of any endorsement; or any immaterial change, which arises in the normal course of communication, storage or display.
Where a law requires a signature, statement or document to be notarised, acknowledged, verified, or made under oath, that requirement is met if the advanced electronic signature of the person authorised to perform those acts is attached to, incorporated in or logically associated with the electronic signature or data message.
(2)Where a law requires or permits a person to provide a certified copy of a document and the document exists in electronic form, that requirement is met if the person provides a print-out certified to be a true reproduction of the document or information.
A requirement under a law for multiple copies of a document to be submitted to a single addressee at the same time, is satisfied by the submission of a single data message that is capable of being reproduced by that addressee.
Anexpression in a law, whether used as a nounorverb, including the terms "document","record","file","submit","lodge","deliver","issue","publish", "write in", "print" or words or expressions of similar effect must, be interpreted so as to include or permit such form, format or action in relation to a data message unless otherwise provided for in this Act.
ThisAct does not limit the operation of any law that expressly authorizes, prohibits or regulates the use of data messages, including any requirement by or under a law for information to be posted or displayed in a specified manner, orforany information or document to be transmitted by a specified method.
a party using an electronic agent to form an agreement is, subject to paragraph (d),bound by the terms of that agreement irrespective of whether that person reviewed the actions of the electronic agent or the terms of the agreement.
that person has not used or received any material benefit or value from the performance, if any, received from the other person.
This Part only applies if the parties involved in generating, sending, receiving, storing or otherwise processing data messages have not reached agreement on the issues provided for in that part.
An agreement is not without legal force and effect merely because it was concluded partly or in whole by means of data messages.
(2)An agreement concluded between parties by means of data messages is concluded at the time when and place where the acceptance of the offer was received by the offeror.
must be regarded as having been received by the addressee when the complete data message enters an information system designated or used for that purpose by the addressee and is capable of beingretrievedandprocessed by the addressee; and must be regarded as having been sent from the originator'susual place of business and as having been received at the addressee's usual place of business.
it is in the form of a data message; or it is not evidenced by an electronic signature but by other means from which such person's intent or other statement can be inferred.
a person who had authority to act on behalf of the originator in respect of that data message; or an information system programmed by or on behalf of the originator to operate automatically.
An acknowledgement of receipt of a data message is not necessary to give legal effect to that message.
any communication by the addressee, automated or otherwise; or any conduct of the addressee, sufficient to indicate to the originator that the data message has been received.
make or receive payment in electronic form or by electronic means.
If any other required attributes for data messages or payments.
The Director-General must establish and maintain a register of cryptography providers.
a description of the type of cryptography service or cryptography product being provided; and such other particulars as may be prescribed to adequately identifyand locate the cryptography provider or its products or services.
A cryptography provider is not required to disclose confidential information or trade secrets in respect of its cryptography products or services.
No person may provide cryptography services or cryptography products in the Republic until the particulars referred to in section 30 (2) in respectof that person have been recorded thein register contemplated in section 30 (1).
A cryptography provider must in the prescribed manner furnish the Director-General with the information required and pay the prescribed administrative fee.
to a person who is present in the Republic when that person makes use of the service or product; or to a person who uses the service or product for the purposes of a business carried on in the Republic or from premises in the Republic.
Information contained in the register provided for in section 30 must not be disclosed to any person other than to employees of the Department who are responsible 5 for the keeping of the register.
pursuant to sections 11 and 30 of the Promotion of Access to Information Act, 2000; or for the purposes of any civil proceedings which relateto the provision of 15 cryptography services or cryptography products and to which a cryptography provider is a party.
The provisions of this chapter do not apply to the National Intelligence Agency established in terms of section 3 of the Intelligence Services Act, 1994 (Act No. 38 of 20 1994).
A person who contravenes or fails to comply with a provision of this Chapter is guilty of an offence andliable on conviction to a fine or to imprisonment fora period not exceeding two years.
"accreditation" means a recognition of an authentication product or service by the Authority.
For the purposes of this chapter the Director- General must act as the Authority.
The Authority, after consultation with the Minister, may appoint employees ofthe Department as deputy Authorities and officers.
Subject to section 31(1), a person may without the prior authority of any other person sell or provide authentication products or services in the Republic.
(1)The Authority may accredit authentication products and services in support of advanced electronic signatures.
be made to the Authority in the prescribed manner supported by the prescribed 15 information; and be accompanied by a non-refundable prescribed fee.
(3)A person falsely holding its products or services to be accredited by the Authority is guilty of an offence.
is capable of identifying that user; 25 is created using means that can be maintained under the sole control of that user; and will be linked to the data or data message to which it relates in such a manner that any subsequent change of the data or data message is detectible.
any other relevant factor which may be prescribed.
provide a reasonable level of availability, reliability and correct operation; 45 be reasonably suited to performing their intended functions; and adhere to generallyaccepted security procedures.
GOVERNMENT 1 MARCH 2002 requirements as to adequate certificate suspension and revocation procedures; and requirements as to adequate notification procedures relating to certificate suspension and revocation.
The Authority may impose any conditions orrestrictions necessary when accrediting an authentication product or service.
The Authority may suspend or revoke an accreditation if it is satisfiedthat the authentication service provider has failed or ceases to meet any of the requirements, conditions or restrictions subject to which accreditation was granted under section 39 or recognition given in terms of section 41.
respond to the allegations in writing; and remedy the alleged breach within a time.
An authentication service provider whose products orservices have been accredited in terms of this Chapter may terminate such accreditation at any time, subject to such conditions as may be agreed to at the time of accreditation or thereafter.
The Minister may, by notice in the Gazette and subject to such conditionsas may be determined by him or her, recognise the accreditation or similar recognition granted to any authentication service provider or its authentication productsor services in any foreign jurisdiction.
(2)An authentication service provider falsely holding out its products or services to be accredited by the Minister in terms of subsection (l), is guilty of an offence.
information security requirements or guidelines; and cfl any other relevant matter which it is necessary or expedient to prescribe for the proper implementation of this Chapter.
This Chapter applies only to electronic transactions.
for the supply of foodstuffs, beverages or other goods intended for everyday consumption supplied to the home, residence or workplace of the consumer.
or for the provision of accommodation, transport, catering or leisure services and where the supplier undertakes, when the transaction is concluded, to provide these services on a specific date or within a specific period.
whereappropriate, the minimum duration of the agreement inthecase of agreements for the supply of products orservicesto be performed on an ongoing basis or recurrently; and the rights of consumers in terms of section 45, where applicable.
to correct any mistakes;and to withdraw from the transaction, before finally placing any order.
If a supplier fails to comply with the provisions of subsection (1) or (2), the consumer may cancel the transaction within 14 days of receiving the goods or services under the transaction.
the consumermust return theperformance of the supplier or, where applicable, cease using the services performed; and the supplier must refund all payment made by the consumer minus the direct cost of returning the goods.
Thesupplier must utilize a payment system that is sufficiently secure with reference to accepted technological standards at the time of the transaction and the type of transaction concerned.
The supplier is liable for any damage suffered by a consumer due to a failure by the supplier to comply with subsection (5).
of goods within sevendays afterthedate of the receipt of the goods; or of services within seven days after the dateof the conclusion ofthe agreement.
The only charge that may be levied on the consumer is thedirect cost of returning the goods.
If payment for the goodsor serviceshas been effected prior to a consumer exercising a right referred to in subsection (I), the consumer is entitled to a full refund of such payment which refund must be made within30 days of the date of cancellation.
Thissectionmustnotbeconstrued as prejudicing the rights of a consumer provided for by or under any other law.
with the option to cancel his or her subscription to the mailing list of that person; and with the identifying particulars of the source from which that person obtained the consumer's personal information, on of the consumer.
No agreement is concluded where a consumer has failed to respond to an unsolicited communication.
(1)The supplier must execute the order within 30 days after the day on which the supplier received the order, unless the parties agreed.
(2)Where a supplier has failed to execute the order within 30 days, the consumer may cancel the agreement with seven days written notice.
If a supplier is unable to perform in terms of the agreement on the grounds that the goods or services ordered are unavailable, the supplier must notify the consumer of this fact and refund any payments the consumer has made within 30 days after the date of such notification.
The protection provided to consumers under this Chapter, applies irrespective of the legal system applicable to the agreement in question.
Any provision in an agreement which excludes any rights provided for in this Chapter is null and void.
A consumer may lodge a complaint with the Consumer Affairs Committee in respect of any non-compliance with the provisions of this Chapter by a supplier.
This Chapter onlyapplies to personal information that has beenobtained through electronic transactions.
A data controller may voluntarily subscribe to the principles outlined in section 51 recordingby such in any with data fact agreement a subject.
(3)A data controller must subscribe to all the principles outlined in section 5 1 and not merely to parts thereof.
The rights and obligations of the parties in respect of the breach of the principles outlined in section 52 are governed by the terms of any agreement between them.
(1)A data controller must have the express written permission of the data subject for the collection, collation, processing or disclosure of any personal information on that data subject unless he or she is permitted or required to do so by law.
(2)A data controller may not electronically request, collect, collate, process or store personal information on a data subject which is not necessary for the lawful purpose for which the personal information is required.
(3)The data controller must disclose in writing to the data subject the specific purpose for which any personal information is being requested, collected, collated, processed, or stored.
The data controller may not use the personal information for any other purpose than the disclosed purpose without the express written permission of the data subject, unless he or she is permitted or required to do so by law.
(5)The data controller must, for as long as the personal information is used and for a period of at least one year thereafter, keep a record of the personal information and specific purpose for which the personal was information collected.
(6)A data controller may not disclose any of the personal information held by it to a third party, unless required or permitted by law or specifically authorized to do so in writing by the data subject.
The data controller must, for as long as the personal information is used and for a period of at least one year thereafter, keep a record of any third party to whom the personal information was disclosed, the date on which and the purpose for which it was disclosed.
The data controller must delete or destroy all personal information which has become obsolete.
A party controlling personal information may use that personal information to compile profiles for statistical purposes and may freely trade with such profiles and statistical data, provided that the profiles or statistical data cannot be linked to any specific data subject by a third party.
The provisions of this Chapter must only apply to a critical database administrator and critical databases or parts thereof.
procedures to be followed registration; and for any other matter relating to registration.
disaster recovery plans intheevent of loss of critical databasesor parts thereof; and any other matter required forthe adequate protection, management and control of critical databases.
the security of such databases; or the physical safety of a person in control of the critical database.
This Chapter must not be construedso as to prejudice the rightof a public body to perform any function authorised in terms of any other law.
(1)Information contained in the register provided for in section 55 must not be disclosed to any person other than to employees of the Department who are responsible keeping the for of the register.
pursuant to sections 11and 30 of the Promotion of Access to Information Act, 2000; or for the purposes of any civil proceedings which relate to the critical data or parts thereof.
(2)The audit may be performed either by cyber inspectors or an independent auditor.
the finding of the report; audit the action required to remedy the non-compliance; and the period within which the remedial action must be performed.
A critical database administrator that fails to take the remedial action within he period stated in the noticeis guilty of an offence.
A juristic person to be known as the za domain authority is hereby established for the purpose of assuming responsibility for the. za domain name space as from a date determined by the Minister by notice in the Gazette.
(1)The Minister must, within 12 months of the date of commencement of this Act, takeallsteps necessary for theincorporation of theAuthority as a company contemplated in section 21(1) of the Companies Act, 1973 (ActNo. 61 of 1973).
Despite the provisions of the Companies Act, 1973, the State will be the only member and shareholder of the Agency upon its incorporation and at any time thereafter.
The State's rights as member and shareholder of the Agency must be exercised by the Minister.
The memorandum of association and articles of association of the Agency must be consistent with this Chapter.
Notwithstanding the Companies Act, 1973, an amendment to the memorandum of association or articles of association affecting any arrangement made by any provision of this Chapter, does not have any legal forceand effect unless the Minister has consented in writing to such an amendment.
No feeispayablein terms of the Companies Act, 1973, in respect of the reservation of the name of the company, the registration of the said memorandum and articles and the issue of the certificate to commence business.
vary or set aside any decision made under any delegation or in terms of any assignment.
The Authority is managed and controlled by a Board of Directors consisting of no fewer than eight, and no more than 16persons, appointed by the Minister.
(a)The Minister must, by notice in theGazette and in two newspapers which have general circulation throughout the Republic, invite the stakeholders mentioned in paragraph (b) to nominate two persons to serve as directors on the Board of the Authority and one person to act as an alternate director to the Board.
Directorsmustbe personswhoare committed to fairness, openness and accountability and to the objects of this Act.
other than those nominated, if a sufficient number of persons who meet the criteria are not nominated; or if there are insufficient nominations lodged within the period specified in the notice.
the procedures €or the replacement of such directors.
(b)The matters determined by the Minister in termsof paragraph (a)(i)and (ii) must be contained in the letter of appointment to be handed to each director on appointment.
The Minister must by notice in the Gazettepublish the matters determined in terms of paragraph (a)(iii).
All directors serve in a part-time non-executive capacity.
8 is disqualified from being appointed as a director of a company in the Republic.
(2)A person who is subject to a disqualification contemplated in this section may be nominated for appointment, and may be appointed as a director of the Board, if, at the time of such appointment he or she is no longer subject to that disqualification.
The Minister must, in consultation with the Minister of Finance, determine the remuneration and allowances of directors and alternate directors of the Board.
(2)Persons referred to in subsection (1) who are in the service of the State may not receive additional remuneration or allowances for serving on the Board, but may be reimbursed for expenses incurred in the performance of their functions in serving on the Board.
The directors must administer the Authority in accordance with its functions in terms of this Act and have the powers and duties normally accorded to a board of directors in terms of the Companies Act, 1973.
The chief executive officer of the Authority appointed by the Board must perform any work incidental to the functions of the Authority.
The chief executive officer must be assisted by staff appointed by the Board.
The Board must determine the conditions of service, remuneration and service benefits of the chief executive officer and the staff.
If the chief executive officer is for any reason unable to perform his or her functions, the Board may designate a person in the service of the Authority to act as the acting chief executive officer until the chief executive officer is able to resume office.
No person may update a repository or administer a sub-domain unless such person is licensed to do so by the Authority.
(2)An application to be licensed as a registrar or registry must be made in the prescribed manner and subject to the prescribed fees.
The Authority must apply the prescribed conditions and criteria when evaluating an application referred to in subsection (2).
The Authority must- 45 administer and manage the.
comply with the requirements for administration of the.
the maintenance ofand public access to a repository, with due regard to the policy directives which the Minister may make from time to time by notice in theGazette.
The Authority must enhance public awareness on the economic and commercial benefits of domain name registration.
may, from time to time, issue information on the registration of domain names in the Republic.
(4)The Authority may, and must when so requested by the Minister, make recommendations to the Minister in relation topolicy on any matter relating to the.
The Authority must continually evaluate the effectivenessof this Act and things done in terms thereof towards the management of the. za domain name space.
liaise, consult and co-operate with any person or other authority; and appoint experts and other consultants on such conditions as the Authority may determine.
The Authority must respect and uphold the vested rights and interests of parties that were actively involved in the management and administration of the.
after the expiry of the six month period, such parties must duly apply to be licensed registrars and registries as provided for inthis Part.
Act, 1990 (ActNo. 94 of 1990), or a mutual bank established under the Mutual Banks Act, 1993 (ActNo. 124 of 1993).
The financial year of the Authority begins on 1 July and ends on 30 June of the following year.
proper record of all the financial transactions, assets and liabilities of the Authority are kept; and as soon as possible, but not later than three months after the end of a financial year, accounts reflecting the income and expenditure of the Authority and a balance sheet of the assets and liabilities of the Authority asat the end of that financialyearare prepared and submittedtotheBoard and Minister.
money received by way of grant, contribution, donation or inheritance from any source inside or outside the Republic.
(5)The funds of the Authority, must be utilised to meet the expenditure incurred by the Authority in connection with its functioning, business and operations in terms of this Act.
(4), that has been approved by the Minister.
(b)Money received by way of grant, contribution, donation or inheritance in terms of subsection (4)(g), must be utilised in accordance with any conditions imposed by the grantor, contributor, donor or testator concerned.
(a)The Board must in each financial year, at a time determined by the Minister, submit to the Minister for approval a of the Authority's estimated income and statement expenditure for the next financial year.
(b)TheBoard may at any time during the course of a financial year, submit a supplementary statement of estimated income and expenditure of the Authority for that financial year, to the Minister for approval.
The Minister may grant the approvalof the statement referred to in paragraph(a), with the agreement of the Minister of Finance.
The Authority may not incur any expenditure in excess of the total amount approved under paragraph (c).
(8)The Board may establish a reserve fund for any purpose that is connected with the Authority's functions under this Act and has been approved by the Minster, and may allocate to the reserve fund the money thatmay be made available for the purposes in the statement of estimated income and expenditure or supplementary statement contern- plated in subsection (7).
To the extent that the Authority is provided with start-up capital by the State, the Authority may, at the election of the Minister of Finance, be made subject to the Public Finance Management Act, (Act No. 1 of 1999),until such time as the Authority, to the satisfaction of the Minister of Finance, becomes self sustaining through the alternative sources of revenue provided for in subsection(4).
As soon as practicable after the end of every financial year, the Board mustsubmit a report on its activities during that year to the Minister.
procedures for ensuring monitoring of compliance with the provisions of this Act and the regulations provided for in this Chapter, including regular.
such other matters relating to the. za domain name space as it may be necessary to prescribe to achieve the objectives of this Chapter; and policy to be applied by the Authority.
(1)The Minister, in consultation with the Minister for Trade and Industry, must make regulations for an alternative mechanism for the resolution of disputes in respect of the. za domain name space.
The regulations must be made with due regard to existing international precedent.
the limitation of liability of registrars and registries for implementing a determination; and the enforcement and publication of determinations.
In this Chapter, "service provider" means any person providing information system services.
The Minister may, on application by an.
the code of conduct requires continued adherence to adequate standards of conduct; and id the representative body is capable of monitoring and enforcing its code of conduct adequately.
the service provider is a member of the representative body referred to in section 75; and the service provider has adopted and implemented the official code of conduct of that representative body.
cj performs the functions in an automatic, technical manner without selection of the data; and does not modify the data contained in the transmission.
in a manner that makes it ordinarily inaccessible toanyoneother than anticipated recipients; and for a period no longer than is reasonably necessary for the transmission.
Notwithstanding this section, a competent court may order a service provider to terminate or prevent unlawful activity in terms of any other law.
does not interfere with the lawful use of technology, widely recognised and used by industry, to obtain information on the use of the data; and removes or disables access to the data ithas stored upon receiving a take-down notice referred to in section 81.
upon receipt of a take down notification referred to in section 81, acts expeditiously to remove or to disable access to the data.
(2)The limitations on liability established by this section do not apply to a service provider unless it has designated an agent to receive notifications of infringement and has provided through its services, including on its web sites in locations accessible to the public, the name, address, phone number and e-mail address of the agent.
Notwithstanding this section, a competentcourt may order a service provider to terminate or prevent unlawful activity in terms of any other law.
Subsection (1) does not apply when the recipientof the service is acting under the authority or the control of the service provider.
does not receive a financial benefit directly attributable to the infringing activity; and removes, or disables access to, the reference or link to the data message or activity within a reasonable time after being informed that the data message or the activity relating to such data message, infringes the rights of a person.
notification is to his or her knowledge true and correct; and an undertaking given by the complainant to indemnify the service provider from any liability incurred as a result of remedial action taken by it in complying with the notification.
No general obligation to monitor monitor the data which transmits or stores; or it actively seek facts or circumstances indicating an unlawful activity.
informthecompetent public authorities of alleged illegal activities under-taken or information provided by recipients of their service; and to communicate tothecompetentauthorities, at their request, information enabling the identification of recipients of their service.
obligation an theobligation of aservice provider as such under alicensing or other regulatory regime established by or under any law; or any obligation imposed by law or by a court to remove, block or deny access to any data message.
(1)The Director-General may appoint any employee of the Department as a cyber inspectorempowered to perform the functions provided for in this Chapter.
A cyber inspector mustbe provided with a certificate of appointment signed by or on behalf of the Director-General in which it is stated or evidenced that he or she has been appointed as a cyber inspector.
A certificate provided for in subsection (2) may be in the form of an advanced electronic signature.
is subject to an investigation or an employee of that person; or requests to see the certificate.
hinders or obstructs a cyber inspector intheperformance of his or her functions in terms of this Chapter; or falsely holds himself or herself out as a cyber inspector, is guilty of an offence.
investigate the activities of a cryptography service provider in relation to its compliance or non- compliance with the provisionsof this Act; and issue an order in writing to a cryptography service provider to comply with the provisions of this Act.
in respect of a critical database administrator, perform an audit as provided for in section 58.
the Department may authorize such assistance on certain conditions.
require the person by whom or on whose behalf the cyber inspector has reasonable cause to suspect the computer or information system is or been has used, or require any person in control of, or otherwise involved with the operation of the computer or information system to provide him or her with such reasonable technical and other assistance as he or she may require for the purposes of this Chapter; or make such inquiries as may be necessary to ascertain whether the provisions of this Act or any other law on which an investigation is based, have been complied with.
A person who refuses to co-operate or hinders a person conducting a lawful search and seizure in terms of this section is guilty of an offence.
Any court may, upon a request from a cyber- inspector but subject to the provisions of section 25 of the Criminal Procedure Act, 1977(Act No. 51 of 1977),issue a warrant required by a cyber inspector in terms of this Chapter.
present in the Republic at the time when the warrant is applied for; or information pertinent to the investigation is accessible from within the area of jurisdiction of the court.
identify the premises or information system that may be entered and searched; and specify which acts may be performed thereunder by the cyber inspector to whom it is issued.
the purpose for issuing it has lapsed; or the expiry of one month from the date it was issued.
(5)A warrant to enter and search premises may be executed only during the day, unless the judge or magistrate, who issued it, authorises that it may be executed at any other time.
Except for the purpose of this Act or for the prosecution of an offence or pursuant to an order of court, a person who has, pursuant to any powers conferred under this Chapter, obtained access to any information must not disclose such information to any other person.
Any person who contravenes subsection (1) is guilty of an offence and liable on conviction to a fine or to imprisonment for a period not exceeding six months.
In this Chapter, unless the context indicates otherwise- "access" includes the actions of a person who, after takingnote of any data, becomes aware of the fact that he or she is not authorised to access that data and still continues to access that data.
Subject to the hterception and Monitoring Prohibition Act, 1992 (ActNo. 127 of 1992), a person who intentionally accessesor intercepts any data without authority or permission to do so, is guilty of an offence.
A person who intentionally and without authority to do so, interferes with data in a waywhich causes such data to bemodified, destroyedorotherwiserendered ineffective, is guilty of an offence.
A person who unlawfully produces, sells, offers to sell, procures for use, designs, adapts for use, distributes or possesses any device, including a computer program, which isdesigned primarily to overcome security measures for the protection of data, or performs any of these acts with regard to a password, access code or any other similar kind of data with the intent to unlawfully utilize such item to contravenethis section, is offence.
A person who commits any action described in this section with the intent to unlawfully interfere with access to an information system so as to constitute a denial, including a partial denial, of service to legitimate users is guilty of an offence.
A person who performs or threatens to perform any of the acts described in section90,for the purpose of obtaining any unlawful proprietary advantage by undertaking to cease ordesist from such action, orby undertaking to restore any damage caused as a result of those actions, is guilty of an offence.
A person who performs any of the acts describedin section 90 for the purposeof obtaining any unlawful advantage by causing fake data to be produced with the intent that it be considered or acted upon as if it were authentic, is guilty of an offence.
(1)A person who attempts to commit any of the offences referred to in sections 90 and 91 is guilty of an offence and is liable on conviction, to the penalties set out in section 93.
Any person who aids and abets someone to commit any of the offences referredto in sections 90 and 91 is guilty of an offence and is liable on convictionto the penalties set out in section 93.
A person convicted of an offence referred to in sections 33(2), 41(2), 59(2), 84(5) or section 90(1), (2) or (3) is liable to a fine or imprisonment for a period not exceeding 12 months.
A person convicted of an offence referred to in section 90(4) or (5)or Section 92(1) or (2)is liable to a fine or imprisonment for a period not exceeding five years.
The Criminal Procedure Act, 1977 Act No. 51 of19771, applies with the necessarychanges to searches seizuresterms of this Act.
The overall objective of the Bill is to enable and facilitate electronic transactions by creating legal certainty around transactions and communications conducted electroni- cally.
promoting public confidence and trust in electronic transactions; and providing supervision of certain service providers.
Effective management of Internet-related issues-establishment of a proper management regime with regard to domain names in the Republic and the limitation of liability of Internet Service Providers.
Chapter I: Interpretation, Objects and Application lks part of the Act defines critical words and phrases of and sets out the main objects the Act.
The objective is to maximize the benefits the Internet offers by promoting universal and affordable access by all to its possible applications, with a view to bridging the digital divide. The Act requires the development of a national e-Strategy plan by the Minister, in consultation with members of Cabinet. The national e-Strategy plan must includedetailed plans and programmes toaddressthedevelopment of anational e-transactions strategy, the promotion of universalaccessande-readiness, SMMEs development, empowerment of previously disadvantaged persons and communities, human resource development, contain definable objects and timeframes.
This Chapter deals with the removal of legal barriers to electronic transacting. Part1 provides for the legal recognition to data messages and records. Provision is made for the legal recognition of electronic signatures and "advanced electronic signatures"as a secure form of electronic signing. Electronic data will, subject to certain conditions, be permitted to be retained for statutory record retention purposes; regarded as "writing" atruecopy of an "original"record, andprovision is madeforsecuringproper evidentiary weight of electronic evidence.
Part 2 deals with the rights and obligations that follow from the communication of data messages, namely contract formation, the time and place of sending and receiving data messages, as well as the time and place where a contract is deemed to have been formed by means of data messages. The Act also provides for the validity of sending notices and other expressions of intent through data messages.
This Chapter facilitates electronic filing. It lists the requirements for the production of electronic documents and the integrity of information. Provision is made for a Department or Ministry to accept and transmit documents in the form of electronic data messages, to issue permits or licences in the form of a data message or make or receive payment in electronic form.
The Internet presents security challenges which, without an effective regulatory framework, would pose a threat to the security of consumers and the State. This Chapter requires the suppliers of cryptography materials to register in the prescribed manner their names and addresses, the names of their products and a brief description thereof maintained by the Department of Communications. This will allow investigative authorities such as the SAPS, to identify which organisations provide the encryption technologies, intercepted by them in terms of our monitoring and interception laws. This will enable the investigative authorities to approach these service providers to assist with deciphering the encrypted messages.
Identification and authentication of the parties in cyberspace remains a challengeand poses threats to consumers and businesses. The Bill seeks to provideforthe establishment of an Accreditation Authority within the Department, allowing voluntary accreditation of electronic signature technologies in accordancewithminimum standards. Once accredited, these "advanced" electronic signatures will allow a party to rely on their authenticity.
Vendors must provide consumers with a minimum set of information, including the price of the product or service, contact details and the right to withdraw from an electronic transaction before its completion. Consumers are also entitled, under certain circumstances, to a cooling off' period within which they may cancel certain types of transactions concluded electronically without incumng any penalty. Consumers also have the right not to be bound to unsolicited communications (spam) offering goods or services. The Bill also seeks to place the responsibility on businesses trading on-line to make use of sufficiently secure payment systems.
This Chapter establishes a voluntary regime for protection of personal information. Personal information includes any information capable of identifying an individual. Collectors of personal information (data collectors) may subscribe to a set of universally accepted data protection principles. It is envisaged that consumers will prefer to deal with only those data collectors that have subscribed to the recorded data protection principles. The sanction for breach of these provisions is left to the parties themselves to agree on. Subscription to these principles is voluntary due to the fact that the South African Law Commission is currently developing specific data protection or privacy legislation which is expected to be enacted within 24 months.
Interms of its definition, critical data is information which, if compromised, may pose a risk to the national security of the Republic or to the economic or social well being Of its citizens. The Minister may prescribe matters relating to the registration Of Critical databases and require certain procedures and technological methods to be used in their storage and archiving.
A section 21 company will be established, or an existing one approved, to manage the domain name space of the Republic. Its membership and governance structures must be representative of the general South African society, Government and other stakeholders. The objects, powers and functions of the Authority are provided for in the Bill. Provision is also made for disputes involving domain names to be settled by means of alternative dispute resolution methods. The Minister is empowered to formulate national policy on the. za domain name space.
Chapter XI deals with the limitation of the liability of service providers or so-called "intermediaries" and creates a safe harbour for service providers who are currently exposed to a wide variety of potential liability by virtue of merely fulfilling their basic technical functions. The service providers may seek to limit their liability where they have acted as mere conduits for the transmission of data messages. In each situation the Bill seeks to provide for specific requirements that the actions of the service providers must meet before the clause may be invoked to limit his or her liability.
Chapter XI1 of the Bill seeks to provide for the Department of Communications to appoint cyber inspectors. The cyber inspectors may monitor Internet websites in the public domain and investigate whether cryptography service providers and authentica- tion service providers comply with the relevant provisions. The inspectors are granted powers of search and seizure, subject to obtaining a warrant. Inspectors can also assist the police or other investigative bodies, on request.
Chapter XI11 of the Bill seeks to make the first statutory provisions on cyber crime in South African jurisprudence.
fraud; and forgery.
Any person aiding or abetting another in the performance of any of these crimes will be guilty as an accessory. The Bill seeks to prescribe the penalties for those convicted of offences.
The Bill will lead to new responsibilities for the Department of Communications and to the development of new infrastructure and systems. Consequently increased financial resources are needed. It will be necessary to equip the required personnel with new skills and proper training especially for technical staff, enabling them to perform the tasks stipulated in the Bill, such as the development and implementation of a National e-Strategy plan.
It is anticipated that the Bill will result in changes to certain laws, which may require a review of laws by other Departments. However, the Bill does not oblige Government departments to accept or issue documents in electronic form. It merely permits departments to do so. In some instances, such as the establishment of Cyber Inspectors, the Accreditation Authority and Cryptography, the Department will requirere-organisation and restructuring. This would have definite financial implications for the State. However, the Bill will probably effect an increase in the revenue collected by the Department in the form of fees payable for the accreditation of authentication service providers.
The development of the Bill arose out of a lengthy policy- formulationprocess resulting in a Discussion Paper and Green Paper on Electronic Commerce. This process included extensive consultations with Government departments and other stakeholders across the spectrum. Following the conclusion of this consultative process, a legal team comprising of consultants, legal practitioners and academics was appointed. This team, together with officials of the Department, and in consultation with other departments, developed the Bill.
An Interdepartmental Workshop to discuss first draft of the Bill was held on 8 May 2001.
o Department of Labour.
The Department of communications and the State Law Advisers are of the opinion that the Bill must be dealt with in accordance with the procedure established by section 75 of the Constitution of the Republic since it contains no provision to which the procedure set out in section 74 or 76 of the Constitution applies.