E-legal business

These concerns were addressed by Michael Conradi, of law firm Baker & McKenzie, at a meeting of the Electrical Industry’s Electronic Trading Group (ETG). Sandwiched between speakers explaining the new high-speed data line technology known as ADSL (see box ET: Electronic telecom), developed by BT, and WAP – the wireless Internet service available through mobile phones – Conradi discussed some of the requirements of legislation covering e-commerce.

While in the UK most commercial contracts are enforceable even without being recorded in writing, in the case of on-line contracts the courts are likely, in the event of disputes, to accept an electronic signature as confirming the authenticity of the contract. Technically the scan of a hand-written signature sent over the Internet is an electronic signature. This has the disadvantage, however, of being easily copied. The answer is to have an electronic digital signature based on public key cryptography. This is a form of encryption whereby each person has two unique but mathematically-related strings of numbers or keys – one is private and the other public. Decryption of a message is only possible with the use of the other key – a message encrypted with the sender’s private key can only be decrypted with the corresponding public key and vice versa.

The beauty of the system is that as well authenticating the sender of a message it will identify changes made to the original message in the event of it being intercepted. But how do you know that the message received has come from the person you thought sent it – that the public key you hold is the one that matches that person’s private key? Under the Directive on Electronic Signatures, certification service providers (csps) are to be established that will certificate the public keys. The certificates for these will specify a liability limit. Contracts will automatically be checked to ensure that they fall within the specified limit.

It is further proposed under the Directive, which is due to be implemented in July 2001, that the csps will be themselves subject to accreditation by a national body.

Under the Directive, businesses will be able to negotiate and agree with one another the terms on which they will accept electronically-signed data.

UK legislation concerning encryption has yet to be finalised. The police and other authorities want access to the private keys as they are concerned that encryption techniques will be used to avoid surveillance. Legislation to give them this access is being sought though Parliament – the Regulation of Investigative Powers Bill.

Under English law a contract comes into existence when a contractual offer is accepted. Under the re-drafted E-Commerce Directive (still to be processed), for a contract to become binding, the provider has to acknowledge receipt of an order without delay by electronic means and, “the order and acknowledgement are deemed to be received when the parties to whom they are addressed are able to access them”. Conradi believes this has been drafted in a way to enable countries to interpret it to suit their particular national practices. But provision is made for businesses trading between themselves to negotiate their own systems of accepting contracts.

The E-Commerce Directive also lists contract information that has to be included on the web site of the provider of products. This includes the different steps to follow to conclude a contract, technical steps to take in order to correct errors in the order and codes of conduct. It should also include the contract terms and conditions to allow the recipient to copy and store on his/her computer.

While this information is obligatory for those selling direct to consumers, it is not for businesses that regularly trade with each other and have their own agreements.

Where a business, as part of its Internet transactions, processes information about individuals, then it needs to register with the Data Protection Registrar and include on its website a privacy policy. This will apply to contractors when they carry out Internet transaction with householders etc.

On the question of liability of content on website pages, the directive states that where the service providers play a passive role with no control over the sender or receiver or what is transmitted, then they are not liable in regard of its content.

Finally Conradi drew attention to the Distance Selling Directive. This directive is being implemented through the Consumer Protection (Contracts Concluded by Means of Distance Communications) Regulations, still in draft but due to become law in June 2000. The directive covers mail-order, telephone selling and sales through radio, television or Internet but not classified advertising in print and requires suppliers to provide specified detailed information and withdrawal options.