Chương 3 Luật Giao dịch điện tử 2005: Chữ ký điện tử và chứng thực chữ ký điện tử

Chapter III

E-SIGNATURES AND CERTIFICATION OF E-SIGNATURES

Section 1. LEGAL VALIDITY OF E-SIGNATURES

Article 21. E-signatures

1. An e-signature is established in the form of words, letters, numerals, symbols, sounds or other forms by electronic means, logically attached or associated with a data message and capable of certifying the person who has signed the data message as well as the approval of such person to the content of the signed data message.

2. An e-signature shall be considered secured if it satisfies the conditions stipulated in Clause 1, Article 22 of this Law.

3. E-signatures may be certified by e-signature certification service providing organizations.

Article 22. Conditions to ensure security of e-signatures

1. An e-signature is considered secured if it is verified by a security verifying process agreed upon by transacting parties and satisfying the following conditions:

a) E-signature creation data are attached only to the signatory in the context that such data are used;

b) E-signature creation data are under the control of only the signatory at the time of signing;

c) All changes to the e-signature after the time of signing are detectable;

d) All changes to the contents of the data message after the time of signing are detectable.

2. E-signatures certified by e-signature certification service-providing organizations shall be considered having satisfied the security conditions mentioned in Clause 1 of this Article.

Article 23. Principles of using e-signatures

1. Unless otherwise provided for by law, the parties to a transaction have rights to reach agreement:

a) To use or not to use e-signatures to sign data message in the transaction process;

b) To use or not to use the certified e-signature;

c) To select an e-signature certification service-providing organization in cases where there is an agreement on the use of the certified e-signature.

2. E-signatures of state agencies must certified by e-signature certification service providing organizations defined by competent state agencies.

Article 24. Legal validity of e-signatures

1. Where the law requires a document to be signed, such requirement with respect to a data message shall be considered having been met if an e-signature used for signing such data message satisfies the following conditions:

a) The method of creating the e-signature permits of identifying the signatory and indicating his/her approval of the contents of the data message;

b) Such method is sufficiently reliable and appropriate to the purpose for which the data message was originated and sent.

2. Where the law requires a document to be stamped with seal of the concerned agency or organization, such requirement with respect to a data message shall be considered having been met if the data message has an e-signature of the agency or organization that satisfies the conditions stipulated in Clause 1, Article 22 of this Law and the e-signature is certified.

3. The Government shall specify the management and use of e-signatures by agencies and organizations.

Article 25. Obligations of the signatory of an e-signature

1. A signatory of an e-signature or his/her legal representative is the person who controls the electronic signing program and uses such equipment to certify his/her will regarding the signed data message.

2. A signatory of an e-signature shall have the following obligations:

a) To take measures to avoid unauthorized use of his/her e-signature-creating data;

b) To promptly use appropriate means to notify parties that accept the e-signature and the e-signature certification service-providing organization in case the e-signature is certified, when discovering that the e-signature may no longer be under his/her control;

c) To apply necessary measures to ensure the accuracy and integrity of information included in the e-certificate in case such certificate is used to certify the e-signature.

3. A signatory shall take responsibility before law for all consequences of his/her failure to comply with the provisions of Clause 2 of this Article.

Article 26. Obligations of the party accepting e-signatures

1. A party accepting e-signatures is the one that has implemented the contents in the received data messages based on the reliability of such e-signatures and e-certificates of the sender.

2. A party accepting e-signatures shall have the following obligations:

a) To take necessary measures to verify the reliability of an e-signature before accepting it;

b) To take necessary measures to verify legal validity of an e-certificate and limitations with respect to the e-certificate in case such e-certificate is used to certify an e-signature.

3. The party accepting e-signatures shall take responsibility before law for consequences of non-compliance with the provisions of Clause 2 of this Article.

Article 27. Recognition of foreign e-signatures and e-certificates

1. The Government recognizes the legal validity of foreign e-signatures and e-certificates if such e-signatures or e-certificates have the same level of reliability as those provided for by law. The determination of the reliability of foreign e-signatures and e-certificates must be based on recognized international standards, on treaties to which the Socialist Republic of Vietnam is a contracting party and on other relevant factors.

2. The Government shall specify the recognition of foreign e-signatures and e-certificates.

Section 2. E-SIGNATURE CERTIFICATION SERVICES

Article 28. E-signature certification service activities

1. Issuing, extending, suspending, restoring and revoking e-certificates.

2. Providing necessary information to assist the certification of e-signatures of persons who sign data messages.

3. Providing other services related to e-signatures and e-signature certification in accordance with the provisions of law.

Article 29. Contents of an e-certificate

1. Information on the e-signature certification service-providing organization.

2. Information on the agency, organization or individual to whom the e-certificate is issued.

3. The identification number of the e-certificate.

4. The valid term of the e-certificate.

5. The data for examining the e-signature of the person who is granted the e-certificate.

6. The e-signature of e-signature certification service-providing organization.

7. Limitations on the purpose or scope of using the e-certificate.

8. Limitations on legal liabilities of the e-signature certification service-providing organization.

9. Other contents as provided for by the Government.

Article 30. E-signature certification service-providing organizations

1. E-signature certification service-providing organizations include public e-signature certification service-providing organizations and specialized e-signature certification service-providing organizations which are authorized to carry out e-signature certification activities in accordance with the provisions of law.

2. A public e-signature certification service-providing organization is an organization providing e-signature certifications services to agencies, organizations or individuals for use in public activities. Activities of providing public e-signature certification services are conditional business activities as provided for by law.

3. A specialized e-signature certification service-providing organization is an organization providing e-signature certification services to agencies, organizations or individuals for use in specialized activities or domains. Activities of providing specialized e-signature certification services must be registered with state management bodies in charge of e-signature certification services.

4. The Government shall specify the establishment, organization, business registration, operation and mutual recognition of e-signature certification service-providing organizations defined in Clauses 2 and 3 of this Article.

Article 31. Rights and obligations of e-signature certification service-providing organizations

1. E-signature certification service-providing organizations shall have the following rights and obligations:

a) To carry out the e-signature certification service activities specified in Article 28 of this Law;

b) To comply with the provisions of law on e-signature certification service-providing organizations;

c) To use reliable technical equipment systems, processes and resources to perform their tasks;

d) To guarantee the accuracy and integrity of fundamental contents of e-certificates they have issued;

e) To publicize information on e-certificates, which have been issued, extended, suspended, restored or revoked;

f) To provide appropriate facilities to enable the e-signature-accepting parties and competent state agencies to rely on e-certificates to ascertain the origin of data messages and e-signatures;

g) To notify the relevant parties of incidents which affect the certification of e-signatures.

h) To publicize and notify the e-certificate grantees, and relevant management agencies of the suspension or termination of their operation within 90 days prior thereto.

i) To archive information related to e-certificates they have issued for at least five years after such e-certificates become invalid.

j) Other rights and obligations as provided for by law.

2. The Government shall specify the rights and obligations of e-signature certification service-providing organizations defined in Clause 1 of this Article.

Section 3. MANAGEMENT OF E-SIGNATURE CERTIFICANON SERVICES

Article 32. Conditions for providing e-signature certification services

1. E-signature certification service-providing organizations must fully meet the following conditions:

a) Having adequate professional technical and managerial staff to provide e-signature certification services.

b) Having adequate technical means and equipment suitable to national security and safety standards;

c) Registering the provision of e-signature certification services with the state management bodies.

2. The Government shall specify the following contents:

a) Order and procedures for registration of e-signature certification service-providing activities.

b) Technical standards, processes, human resources and other conditions necessary for e-signature certification service-providing activities.

c) Contents and forms of e-certificates.

d) Procedures for issuance, extension, suspension, restoration and revocation of e-certificates.

e) Regulations on storage and disclosure of information related to e-certificates issued by e-certification service-providing organizations.

f) Conditions and procedures for foreign e-signature certification service-providing organizations to provide e-signature certification services in Vietnam.

g) Other contents necessary for e-signature certification service-providing activities.