INFORMATION TECHNOLOGY LAW LECTURE 3- ELECTRONIC SIGNATURE Dr. Kadir Bas

E-Signature As a result of the increasing use of the Internet for commercial and public purposes, it has become necessary to provide means that increase the legal credibility of electronic transactions. E-signatures generally serves for this purpose by being a way of the authentication of the transaction.

Different Methods of E-Signature E-signatures may be made in different methods such as: -Biometric methods based on the biometric features of persons, such as voice, eye retina or finger prints. -PIN codes used in credit cards - a scanned image of the signatory’s handwritten signature to the document -to make a handwritten signature by using a computer tool which automatically transfer it to the computer. -E-signature made with public key (asymmetric) encryption (digital signature)

E-Signature Regulations Many countries including the US, Germany, Singapore have e- signature laws. The EU regulates e-signature with a directive (99/93/EC). In Turkey, there are two legal instruments regarding e-signature: - Electronic Signature Law (Elektronik Imza Kanunu) No: Directive on the Implementation of Electronic Signature Law (Elektronik Imza Kanunun Uygulanmasina iliskin Usul ve Esaslar Hakkinda Yonetmelik)

The Definition of E-Signature Law No 5070 defines electronic signature as ‘data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication’. This definition does not choose any method of e-signature over others. This is called technology neutrality. Technology neutrality enables the Law to cover the technological developments in relation to e-signature, without any legal amendment. The Law attributes the legal consequences of handwritten signatures only to secure e-signatures.

Secure Electronic Signature In order to be classified as a secure e-signature, a signature must: be exclusively assigned to the signature owner, be generated with the secure electronic signature creation device which is kept under the sole control of the signature owner, enable the identification of the signature owner based on the qualified electronic certificate, enable detection as to whether signed electronic data has or has not been altered or not subsequent to the signature being applied.

The Legal Effects of A Secure E-Signature General Rule: A secure e-signature normally have the same legal effect as that of a handwritten signature. This means: -where the Law requires a contract to be concluded in written format, electronic document signed with e- signature will satisfy this requirement. -Electronic document signed by e-signature will be considered as a senet, i.e. conclusive evidence (kesin delil).

The Legal Effects of A Secured E-Signature Exception: contracts which are subject to a special ceremony or an official form pursuant to laws and warranty contracts cannot be made with e-signature. Examples: -Sales of immovable goods : must be made at the registry of title deed (Tapu sicili) -Sales of motor vehicles: must be made at the notary. -Warranty contracts (teminat sozlesmeleri)

Electronic Certificate Service Providers (ECSPs) ECSPs are public or private persons or entities who provide electronic certificates, time-stamp and other services related to electronic signatures. ECSPs can start its operation after two months following to that they notify the BTK (Information and Communications Technologies Authority- Bilgi Teknolojileri ve Iletisim Kurumu). Electronic certificates which are provided by ECSPs must be Qualified Electronic Certificate (Nitelikli Elektronik Sertifika) which includes certain features described in Article 9 of Law No 5070.

Cancellation of a Qualified Electronic Certificate The ECSP will cancel a qualified electronic certificate if: -the certificate holder requests cancellation -If information given by the holder in relation to the certificate appears to be false or these information change -If the legal capacity of the owner is restricted or he dies or bankrupts.

Data Protection The ECSP: must not request from the certificate holder to give personal data, other than those necessary for the purpose of issuing the certificate must not collect any data without the explicit consent of the holder. must not place the certificate to the reaching of third parties, without the written consent of the holder must not use the certificate for other purposes

Criminal Provisions Unauthorised use of certificate creation data From 1 year to 3 years imprisonment plus fine Forgery in electronic certificates (elektronik sertifikada sahtecilik) From 2 years to 5 years imprisonment plus fine These penalties will be increased by 50 %, if the crimes are committed by the employees of the ECSPs Besides these criminal penalties, the perpetrator of these crimes should compensate for any damages made to third parties

THANK YOU!