ORGANISATION

ISSUE/CHAPTER

COMMENTS RECEIVED

RECOMMENDATIONS

1. DTI

Generic terms

Due to cross cutting nature of these terms in various laws, the terms such as post/mail etc, requirements for "seal", certification, stamp duty, instrument and inspection, search and seizure.

Section 15

Electronic evidence to be considered by Department of Justice.

Section 17

Consideration should be given to whether Sec 17 will be interpreted by courts as giving blanket authorization to use electronic form.

Section 19(2)

Consider expanding this section in Chapter III with guidelines, exceptions, qualifications and ability to issue notices in the gazette.

Chapter IV

This chapter does not cover the full range of transaction and interactions, and a public body like registrar of companies is involved in this chapter and not wide enough.

Definitions

Definitions of advanced electronic signature, data subject, consumer, automated transactions and electronic personal information should be amended so as to be consistent with international trends.

Sphere of Application

Improve definition of "retention" in Sec 16, as it is inadequate for law enforcement purposes especially including traffic data.

Facilitating electronic transactions

Belief that the draft Bill creates a regulatory regime that will discourage the use of technology for electronic signatures. Imposition of government accreditation scheme freezes use of digital signatures especially when focus is on UNCITRAL Model Law on electronic signatures.

E-Govt.

Sec 28 provides government agencies with discretion to accept electronic filling. It is suggested that this should be an imposed general mandate to allow constituents to transact with government electronically.

Cryptography Providers

Reconsider the definitions of what constitute cryptography product or service.

Authentication Service Providers

It is suggested that UNCITRAL Model Law on e-commerce be adopted.

Consumer protection

Overly detailed – page 8 of submission

Fraud

Fraud to be both civil and criminal offence. (page 10)

Personal information and privacy protection

Adverse effect on domain name system as it will prevent use of WHO IS database in the TLDs and ccTLD.

Chapter IX Protection of Critical Data

Section 57(2)(b) is overbroad in that it may include virtually every government agency and no legal standard or procedure created for such request.

Chapter X DNS

What about UDRP (page 14)

Chapter XI Limitation of Liability

Chapter XII Cyber Inspectors

Possibility of abuse of such orders as there is no judicial supervision.

Cyber Crime

Section 93 South Africa signatory of Council of Europe Cyber crime – use same such provisions (page 20)

South African Post Office

Sec 13 Requirements for Advanced Digital Signatures

Preferred Authentication Service Providers

Post Office be named as a preferred Authentication Service Provider whilst allowing others to apply for such designation (page 10/11)

Sec 18 Certification of documents as true copies

Gap in the Bill – significantly reduces ability to convert paper based documents into electronic documents and provide certified copies of such in electronic format (page 14)

Section 19 Sending by registered post

Amend clause 19 – for provision of electronic registration of a data message (page 2) by post office (page 15)

Media 24 and Kalahari.Net

Section 43(2)(c)

That the word "seal" should be given a broader definition to include any indication that the consumer opened or used the goods in question.

Media 24

This should apply to electronic / digital newspapers, magazines and periodicals.

Kalahari.net

Section 43(h)

Why are books not included?

Section 45 Cooling Off period

Off line and online traders are to be treated equally.

E-Bucks.com

Section 11(3)(b)

Does this mean that a customer has to be able to retrieve his original terms and conditions despite the fact that new versions have been created in the interim which is posted on the website?

Section 14(1)(a)

The words "or otherwise" create confusion and uncertainty and should be deleted.

Section 15

Will this Bill repeal the Computer Evidence Act? If not, evidentiary issues relating to computer evidence will not be simplified.

Section 16

Section 18(1)

How will notaries compile their protocol if a hard copy document does not exist and if the notarial seal is attached electronically?

Section 21(a)

Section 3 should be interpreted so as not to exclude the common law. In terms of the common law, intent is required to conclude an agreement. Is an electronic agent able to express intent on behalf of its principal?

Section 21(d)

This section removes certainty a to when and how an agreement is concluded.

Section 21(e)

*Should the words "that person" with "the intended recipient"? as the third party benefits and not the bank.

Section 44(3)

How will Section 44(4) be applicable to cancelled transactions in terms of subsection (3)

Steinhoff Africa Group Services (Pty) Ltd

Definitions

Clarification of electronic transactions, as there is no definition for it, especially the meaning of the phrase "other intangible form".

Section 11(3)

Section 12

Furthermore, suggest that subsection (b) be deleted entirely.

Section 13, 14 and 15

Should be amended to refer specifically to "electronically transactions".

Section 21(e)

What is meant by "material error"? Should it not be defined in the definitions section?

Section 22

Be more specific as to which part of the Bill is applicable when the parties have themselves specified it.

Section 24(b) and Section 27(1)

Suggest an acknowledgement of receipt of a data message to give legal effect to an agreement.

Chapter V Cryptography Providers

Why should government instead of the private sector be entrusted herewith? In terms of Section 32 government officials will be allowed to "guard" over very sensitive and valuable information.

Section 36 and Section 31(1)

43(2)(a)-(j)

This section, which excludes the "cooling off period" seems to be couched in too wide terms. The type of transactions that are excluded may well be the very ones that consumers need protection for.

Section 51

This section seems to be too limited and should also extend to "data messages"

Critical Databases

Chapter X Protection of Domain Names

Also, why limit the regulation and use of domain names exclusively to the .za domain name?

Section 60

How will the juristic person, who will oversee the regulation of the .za domain name, be financed?

Cyber Inspectors

Highly qualified and specialized police unit instead of creating another "elite police force" and/or "monitoring authority" should undertake these duties.

Section 85(1)(a)

Section 87

It appears as if a warrant is available simply upon request. It should rather be granted after an ex parte application to a competent court, with provision for a return date.

Section 93

Alternatively, the fines should be specified in the Bill.

Section 97

The wording of the exclusion clause should be amended to provide for liability for mere negligence and not be limited to gross negligence.

Department of Arts, Culture, Science and Technology

Retention Generation of Information (E-Government) Chapter IV

Basically the proposed Bill must comply with the Acts format and medium that information should be kept

The Life Offices Association of South Africa

* The word "accessible" is used in various sections in this Act. Therefore, there should be a definition for this word.

Objects of the Act

Section 2(1)(l) is unclear

Interpretation

This section is tautologous because there is a presumption in law that the Legislature does not want to change existing law.

Sphere of Application

Section 4(2): The present definition "person" applies only to public and natural persons. This cannot have been the intention of the Act to limit to these two classes only.

Due to the time lapse for implementation of this strategy, it would be better that the e-Strategy be contained in a living document that keeps pace with the ever-changing electronic commerce environment.

Sections 7 to 9

An Act regulates the relationship between the State and its subjects. These sections contain provisions addressed to the Minister and not to the subjects of the Act. It should be amended to provide that the Minister might make regulations aimed at achieving the goals reflected in these sections.

Section 9(b)

The term "website portal" is used here, yet it is not defined in the definitions.

Electronic Transactions Policy

Regard being had to the provision of section 10(4), the purpose of the policy guidelines is not clear.

Sections 12, 13, 14, 16, 18 and 19 must be qualified with reference to Section 4(4). There are other statutes not specified in Schedule 2, which require documents to be in writing. Therefore, Section 4(4) should be amended to: "This Act must not be construed as giving validity to any transactions which a Statute requires to be recorded in writing"

Legal recognition of data messages

Writing

It is also not clear whether the information must be accessible to all parties or only one of the parties involved in the electronic communication or transaction.

Signature

Section 13(4): create a presumption that where an advanced electronic signature is attached to an electronic document, there should be a prima facie presumption that the electronic document has not been altered and that the contents are valid and reliable.

Original

It may be necessary to lead expert evidence relating to integrity and reliability. Therefore, it should be presumed to be prima facie reliable, unless evidence to the contrary is shown. If not, it unfairly retains the onus of proof on the party relying on the data message, and will mean that there will be no legal or commercial certainty.

Admissibility

Section 15(1)(b): the best evidence rule does not apply here as the data message is in its original form.

Retention

A suggestion has already been made that "accessibility" needs to be defined, as the word on its own is very vague.

Notarization

Variation by agreement

"that part" at the end of the sentence should read "this part"

Time and place of communication

Section 24(c) is far-reaching, as agreements are often not entered into at "the usual place of business". Also, natural persons are not generally referred to as having a "usual place of business"

Attribution of data messages

It is necessary to build in a presumption to provide that the ostensible originator of a data message will be deemed to be the originator of the data message under specified circumstances, unless the contrary is proved.

Section29: Requirements may be specified

"…Where a public body performs…"

Identification and authentication of identity is not appropriate to the general objectives of the present Act. Instead, introduce a new national identity system technologically connected with electronic signatures in al holistic and integrated solution to the problem.

Accreditation of authentication products and services

This section deals with the accreditation of "products and services" while the definition of an "advanced electronic signature" deals with the authentication of a "process".

Revocation or termination of accreditation

Section 40(3): The public should be notified of any periods of suspension if there is a likelihood of harm to them.

Section 43: Scope of Application

Long-term insurers should also be included in the list of exclusions found in Section 45, as they are already subject Policy Holder Protection Rules. Also the pending Financial Advisory and Intermediary Services Bill have provisions regarding disclosures to be made before and after conclusion of any transaction.

Information to be provided

Section 44(1)(f) refers to a "legal person" whereas it should be a "juristic person".

Unsolicited goods, services or communications

Non-compliance with Section 46 should constitute an offence.

Applicability of Foreign Law

The Act cannot have extra-territorial effect on suppliers situated on suppliers situated outside the borders of the RSA, nor can it impose SA law on international contracts unless the parties have agreed or there are specific treaties in place.

Scope and principles of protection

As the Law Commission is charged with drafting Data Privacy Legislation, it is premature to introduce this subject at this stage

Sections 53 to 58

The words " the economic and social well-being of its citizens" are extremely wide. It may infringe on the right to freedom of economic activity and Section 58 may be a contravention of the right to privacy.

That the application of this chapter be limited to national security and that minimum criteria are set out.

Section 60

Thus far, the domain naming system has worked perfectly adequate in the South African private sector, and it is doubtful that regulating would bring any benefits.

Sections 74 to 77

" Nothing in this Act shall prevent service providers from liability for their intentional or negligent actions or omissions or the intentional or negligent action or omission of their agent or representative."

Section 81

The requirement that a complainant furnish indemnity in Section 81(i) will discourage people from notifying service providers of unlawful activities.

Appointment of Cyber Inspectors

Section 85

Section 85(1)(b) refers to "cryptography service providers", yet the definition in Section 1 refers to a "cryptography provider"

Unauthorized access to , interception of or interference with data

Section 90(3) : It should be noted that organizations use experts who use devices to test the robustness of their data security. Therefore the Act should provide for a permit or registration system for purpose of the lawful use of such devices.

Computer-related extortion, fraud and forgery

Limitation of Liability

This section is vague, capable of more than one interpretation. One interpretation is that the State contracts out of both gross negligence and bad faith.

Telkom

General Observations

Where the word "Authority" has been used, it should be amended to say "relevant authority" because the Bill creates two authorities.

Preamble

With regard to the objective stated in Section 2(p) SMME’s, regard should be had to Telkom’s existing obligations in terms of the Telecommunications Act.

Definitions

Objects of the Act

Telkom supports and welcomes the Objects of this Act

Interpretation

This section is also welcomed as it reduces uncertainty and inconsistency.

National e-strategy

This section is also welcomed, but a substantive strategy is required to maximize its benefits to many people as possible.

Universal Access

All service providers should bear equal obligations in this regard.

Electronic transactions policy

A timeline in which the Minister will formulate the policy must be included in the Bill.

Legal recognition of data messages

Recomm: "shall be considered with legal force and effect"

Writing

The equation of data to paper is very important in removing uncertainty.

Signature

The Act does not recognise that the Internet is borderless. It must take care so as not to stifle International Trade through electronic means.

Admissibility and evidential weight of data messages

Section 15(1)(a) is supported as it does not preclude electronic data as being produced as evidence.

Automated transactions

Therefore, it should be deleted to avoid inconsistency with Section 45 and common law contract principles.

Variation by agreement between parties

Telkom supports this section as it promotes and encourages the use of electronic commerce.

Formation and validity of agreements

It is unclear what constitutes an offer here. The Bill should clearly specify whether or not the invitation to trade is an offer. We submit that it should not be regarded as the offer.

Time and place of communications, dispatch and receipt

Section 24(c): the phrase "usual place of business" should be "domicillium citandi et executandi"

Attribution of data messages to originator

This section imposes a non-rebuttable presumption as to who the originator of a data message is.

Insert " deemed to be" after the phrase "A data message". This will create a rebuttable presumption

Cooling-off period

Therefore, Section 45 should be deleted.

Applicability of foreign law

It provides that the protection provided to consumers here, be applicable to foreign agreements. This may be impossible to enforce, due to the global nature of the Internet.

Section 54: Identification of critical data and critical databases

"Where information is commercial in nature and divulgence of this information could be commercially detrimental to the entity providing the information, the Minister must not declare public or make this information which has been placed under the category of "critical data" available to any other party.

Cyber Inspectors

Noted

International Intellectual Property Alliance

Cyber Crime

Whether a device has only a limited commercially significant purpose other than to circumvent, or whether the device is marketed in such a way as to reveal its circumvention purpose.

Cyber Crime

In section 89 the actual knowledge requirement is misplaced in this draft.

Limitation of Liability of Service Providers

To delete the phase and amending the language so that service provider is not liable for damages, except as provided in subsection (3), transmitting, routing or providing connections for material through a server or network.

Limitation of Liability of Service Providers

GENERAL

Cyber Crime

Criminal penalties imposed in copyright infringement cases have been inadequate to deter piracy.

South Africa additionally should include protection against unauthorized parallel imports.

National e-Strategy

It is essential that government becomes a model user. The body should be formed which will be tasked with e- government and should engage private sector wherever appropriate. The people who will be trading e-commerce should form part of the body mentioned above.

Electronic transactions policy

Facilitating Electronic Transactions

The Bill should not seek to have standard embodied in the legislation which is difficult and cumbersome to amend

Facilitating Electronic Transactions

The use of the words ‘usual place of business ‘ requires further consideration.

Cryptography Providers

Accreditation

Accredited signatures may create problems for South Africa, since most of the countries do not have similar accreditation requirements.

Consumer Protection

Wording in subsection 44(5) and (6) is open to interpretation.

Free Market Foundation of Southern Africa

Chapter IX & X

Section 60- Government might not have the capacity to run this and it might prove costly and not efficient if run by government. Very little power is being given to the authority.

Cyber Crime

Penalties for cyber crimes are inadequate.

Other crimes need to be addressed in future legislation e.g. cooperate and child protection

Maximizing benefits and policy framework

National e-Strategy

Who can bring and what legal actions can be taken against the Minister if she does not develop the national e- strategy?

The e -strategy should be managed at cabinet level through a formal inter-departmental structure.

Domain Name Authority and Administration

include government.

Cryptography Providers

Cyber Crime

Not clear why the Dept of Communications is legislating on cyber crime

Protection of Critical Database

Protection of database is unlikely to withstand constitutional scrutiny due to loose definitions of national security, economic and social well being of its citizens.

MIH

Protection of personal information

1. Protection of personal data of which that is covered by the act.
2. Trust chapter 7 of the bill covers marks. The bill focuses more on consumers whereas this MIH doc is providing guidelines to the merchants, as what they should when dealing with consumers and that is where the difference lies.

COUNCIL SOUTH AFRICA

Person should include a juristic person, legal entity and trust

The Minister "Must"

This should be amended to read that this should impose obligations on any person.

11(2) Issue of Electronic fine print

S 48

The Banking Council says that it should 1 million Rands or 5 year imprisonment (prevention of organized crime Act or the Financial Intelligence Act)

S 45 Cooling off

The recommendation is that anyone from outside can be employed for such a post as long as the dept can offer training to that person.

There should be regulations to be made until the submissions of the S.A. Law commission have been enacted.

COMMITTEE FOR PRIVATE DATABASE USERS

Chapter IX

Protection of Critical Databases

VERSVELD NKOSI INCORPORATED

There is no such, because before this bill there has been no law that has been regulating the internet.

Cyber Inspectors

Who should be the Inspectors

They are of the view that SAPS should police the cyber crime.

Chapter VII Consumer Protection

e-commerce.

Chapter VIII Protection of personal information

Chapter IX Protection of critical database

The legislation provides the Minister with excessive powers to infringe on people’s rights of privacy. The chapter is also very vague

DNA

Onerous licensing provisions may also impact negatively on e-commerce and e-transactions

Cyber Crime

Penalties for cyber crime are relatively light and may be inadequate. Penalties are light

CELL C

Maximizing benefits and policy framework

The removal of this provision will deny the notion universal access, which has always been the intention of the legislature.

Remove

Legal Certainty. Overlooking of rules towards jurisdiction

Facilitating electronic transactions

Data Message. Evidence.

The information must be proved to be unaltered and complete. The fact that it is received, sent or opened must be related with the fact that the message must be proved to be complete.

Limitation of liability of service providers

SANLAM

General

Regulation and too much control will have a negative effect; will be too expensive and loose power.

Domain Name Authority and Administration

Important issues like privacy protection, consumer protection, accreditation and DNA are dealt with superficially

Separate legislative instruments needed

- Cost of auditing and looking after critical databases and additional info

The cost will be passed on to the users (Public and Private) who will then pass it on to consumers

Chapter VI Accreditation

CHAPTER 1: Interpretation, Objects and Application:

When the public sector issues authentication information to individuals, will this be regarded as personal information?

"Third Party" – It appears like the definition of a client. Is this not too restrictive for the purposes of this Bill?

CHAPTER II

Wording. Content of the two Parts are not divided well.

Sections 7, 8 and 9 of Part 1 belong to Part 2. Section 10 is unnecessary and should be deleted.

Section 14, 15 and 16:

What information will be required to prove these sections?

Section 18(2)

How would the average Commissioner of Oaths be able to certify that the document presented to him/her is a true reproduction that exists in electronic form?

This section does not provide for the borderless nature of cryptography services

Section 32:

Why keep the register secrete? Should it not be accessible to the public?

Accreditation (Sections 34 to 42)

No provision is made for the handling of disputes between the Authority and service providers.

Accreditation process and regulations seem unclear and open-ended. This should be revisited with the private sector involvement.

CHAPTER VII: Consumer Protection:

Irrespective of the legal system applicable to the agreement the consumer protection provisions still apply

CHAPTER VIII: Protection of Personal Information: Section 53(3)

The word ‘must’ be replaced by ‘may’ as subscription to these principles is voluntary.

The word ‘express’ should be deleted and replaced with ‘prior’.

Can the written permission be obtained electronically and if so does it require an advanced electronic signature?

Who will decide whether the data has become obsolete? What will the criteria be?

Section 54 (a)

What are the criteria for determining when data will be critical and when it will not?

CHAPTER X: Domain Name Administration Sections 60 to 73

Registrars of domain names are not obliged to verify that a domain name is protected by a trademark.

The system is open to abuse by cyber squatters. There is a clear need for stricter regulation of the domain name space.

CHAPTER XII: Cyber Inspectors: Cyber Force (Sections 84 to 88)

These provisions may constitute a potential violation of constitutional rights to privacy, to not be dispossessed of property and to bodily integrity.

MR. R VAN DER WALT

Section 1: Definitions

Consumer is limited to consumers making electronic transactions. This definition does not provide enough scope to include users of ‘authenticating products or services’ or cryptography products

Add: "or users of products or services used in order to make an electronic transaction.

Section 11: Legal recognition of data messages

What is a reasonable person?

[reasonable] person reasonably would…’

Section 30: Register of cryptography providers:

Chapter V: Key-escrow and backdoors

The Act seem to avoid the issue of legal pitfall of key-escrow management

Uniforum SA

Domain Names-The ZA authority

There appears to be an unintentional error in section 51(2), where it is refers to….’outlined in section 51…."This should surely read "…outlined in section 52

The board of directors should appoint by the internet community at large

Chapter VIII

Chapter IX Protection of Critical Databases

The minister may prescribe certain minimum standard after consultation with the Database Administrator

The Ministers wide discretionary powers are inappropriate and should be curtailed through set polices and procedures

Cape Telecommunication Users FORUM

Chapter I Definitions

The definition of critical database. DOC is not appropriate to deal with issues national security

WAP to be deleted from the definitions

Chapter II

Inclusion of SMMEs in the objects of the act is not necessary. National interests is out the scope of the bill

Chapter X

The management of the .Za domain name must be between the governments working in partnership with the private sector.

National e-Strategy

Doc should not work alone on the strategy but involve other government departments

Chapter V

It will over regulate the industry and criminals will not comply the legislation and it will cause more administrative burdens and additional costs. The chapter does not make any distinction between cryptography service provider who is located in the country and outside the country.

To be deleted

Chapter VI

The industry should regulate itself .The private sector to be self-regulated.

To be deleted

Chapter VII

That the consumer has previously indicated his/her willingness to receive unsolicited messages from that person.

Chapter VIII

The section creates a situation where a data controller has to make an effort to identify possible absolute information on regular basis.

The data controller must upon receiving notification that the personal information has become absolute, delete or destroy that information.

Chapter IX

Existing laws already address the issue of protection of data base

To be deleted

Chapter X

Section 61(2) provides that the state will only be member and share holder of the domain name authority

Redraft

Chapter XII

Alternatively specify what skills or qualifications are required for someone to be appointed as cyber inspector and elaborate further on this issue

To be deleted

Bridges.org

Critical data

Definition of critical data is broad

Definition should be tightened

Data

Section 21(e)

Grammatical error

Need for rephrase on that section so as to be clear and understandable.

Chapter V Cryptography

The section creates a regulatory regime for cryptography services that may well be unenforceable

If there is any form of regulation Government must encourage the industry to regulate itself and must include a legislation to allow Government to impose moderate level of regulation if none is forthcoming from the industry.

Cryptography

No definition of cryptography in the Bill

Cryptography is defined.

Cryptography

S31 (3)(c) includes the use of encryption by a business visitor to S.A who has an encryption software in his laptop

Visitors should not be required to register cryptography products and the provision should be clarified.

Chapter VII Consumer protection

Unsolicited communication

Chapter IX Protection of personal information

Subscription to the principle should be mandatory and not voluntary

Data controllers

S52 be amended to state that data controllers must not only disclose the purpose for which any personal information is being requested but must also provide the information itself to the data subject if requested to do so in writing.

Chapter IX Protection of critical databases

The definition of critical database is wide

It should be less broad and for the protection of "social well being" to be removed. The protection of national security and the economic well being of the Republic are outside the remit of the Department of Communications.

Domain Name Authority

Much work has been undertaken to achieve the current position in relation to ". za". Transferring of this power would require an additional, and expensive layer of bureaucracy is created.

Inappropriate to transfer the responsibility to the Department of Communications. It should be administered in a way, which allows all of those who use to have voice.

Chapter XI Limitation of liability of service providers

Clear definition of unlawful activity should be included

Take down

Take down procedure is one sided and could infringe freedom of speech and/ or of other civil rights

Consideration is given to this section , and fairer procedure be established that would protect the needs of society and rights of the individual.

Cyber Inspectors

No need for cyber inspectors. If a person is breaking the law it is the matter of the police.

Consideration to provide training and resources to existing law enforcement agencies.

Vodacom

Chapter I Definitions

Definition of intermediary be amended so as to specifically exclude an agent who had authority to act on behalf of the addressee and /or originator.

Chapter III Facilitating electronic transactions

Transaction concluded between an agent, acting on behalf of the addressee and/ or originator would be excluded from s24 but s26 (b) appears to rectify the situation in respect of originators but not in respect of the addressees

Critical Data

Words "economic and social well being’ is too wide and could include any database that impacts on the economic and social well being of S.A citizens

The phrases "economic and social well being of its citizens" should be deleted.

Data

Words "in any form" are too wide.

They should be deleted.

Electronic

"or other intangible" is too wide.

It should be restricted by the words, "other functionally equivalent intangible form".

World Wide Web

Too wide

Change the definition in the following manner: delete the phrase, "and includes all data messages residing on all computers linked to the internet" and add the phrase : based on protocols developed by the World Wide Web Consortium

Section 2(1) (r)

Refers to functions that already dealt with in the existing legislation.

Should be deleted

National E- strategy

Consultation and coordination of the process with all stakeholders.

Chapter II Universal Access

Phrase " within commercially reasonable limits" be added after the words universal access in s6 (b).

Section 11(3)

Words "incorporated into an agreement and" restrict the applicability to agreements only

The words should be deleted

Sections 12, 14, 16, 17

When read together, do not compliment each other

Higher standards should be required where "retention and production" of documents are concerned, and higher standards should be required with regard to ‘original" documents.

Chapter III

There are more stringent requirements for retention of documents provided in s16 than in respect of requirements for a document to be original as provided in s14

Section 14 do not require that the data message be "accessible as to be usable for subsequent reference" that is imposed in s12. Lack of uniformity Between sections 16 and 17.

Section 14(1)(a)

"Final form" in relation to information is vague and will create confusion

Proposed that the phrase "from time when it was first generated in its final form as a data message or otherwise" be deleted from s14(1)(a)

Section 14(2)(a) and s17 (2)(a)

Endorsements and changes be restricted by insertion of the word "immaterial" immediately prior to the reference to any endorsement of change.

Statement under oath

How a statement under oath in electronic format will be done?

Section 21© and s21 (d)

They contradict each other?

Section 21(e) (i)(ii)(iii)(iv)

Not clear whether the sections are required to exist contemporaneously, or whether simply one of the provisions will be adequate before the provisions of s21 (e) become applicable

Section 21(e)(ii)

No time limitation is set in regard to the notification of an error.

Should take regard of the cooling period provided for in s45, and the notification of an error should be specified to take place within 7 days.

Section 24

Provisions of the entire section to be applicable to data messages, then the words "used in the conclusion or performance of an agreement" should be removed from s24(a) and inserted to the main part of s24, immediately after the words, "data message".

Section 24(a)

Section 24(a)

It is irrelevant when a data message that is used in the conclusion of an agreement is sent, because in terms of our common law principles of contract, what is relevant is when the message is received by the addressee.

It is superfluous and should be deleted.

Section 24(b)

Contradict with the principles of common law, which provides that the offer or acceptance must have been communicated to the addressee.

Section 24(b)

"Enters an information system designated or used for that purpose by", should be deleted and substituted with the words" come to the attention of".

Section 24©

Word "usual" is vague.

Should be substituted with the word "principle".

Section 26(b) and (c)

Word "is" imposes a strict type of liability on the originator of a message who authorizes someone to act on his/her behalf or programs an information system to operate automatically, and thus leaves no space for the originator to prove otherwise.

These provisions should rather be phrased as deeming provisions.

Authentication service providers

S37 (1)(a) provides the authority with powers that are too extensive.

S37 (1)© are sufficient to ensure compliance and s37 (1)(a) should therefore be deleted.

Section 37(1)(b)

No provision as to under what circumstances the authority may temporarily suspend or revoke the accreditation.

This is the repetition of s40 (1) and should therefore be deleted.

Section 38(1) and

Section 39(1)

Should be amended to read as follows: "the Authority shall accredit authentication products or services if it is satisfied that an electronic signature to which authentication products or service relate.

Section 39(4)(e)

It does not seem appropriate that the authority may stipulate the liability of the certification service provider.

This section should be deleted.

Section 40(1)

It should commence with the words, "subject to the provisions of subsection 2

Section 43(1)© Consumer protection

Words home, residence or work place are superfluous.

They should be deleted.

Section 43(1)(i)

"Undertakes" should be substituted with the words "is obliged".

Section 44(5)

The provisions of this section are too vague.

Should be deleted.

Section 45(2)

Clause should read as follows: "cost of returning the goods shall be for the consumer’s account.

Section 46

Provisions of this section make spamming lawful which are undesirable.

Section 47(1)(2)

"execute" is vague

It should be replaced with the word "dispatched".

Section 48

The provisions of this section will discourage international suppliers from offering their services.

Should be deleted.

Section 49

Should commence with the words "except as provided for in s47 (1)".

Section 52(7)

Requirement that data electronically collected must be stored for a period of one year will create unnecessary administrative burden and entail significant costs to a supplier if the data is no longer used.

Period for which data should be stored must not be excessive and focus on the purpose at hand and should be changed to "and for a period of at least six months thereafter".

Section 52(8)

Amendment should be as follows: " the data controller must, upon receiving notification that personal information has become obsolete, delete or destroy that information as notified".

Protection of critical database

Without some checks and balances, this will give rise to serious violations of privacy.

The whole chapter be deleted as there is legislation that exists that deals with the issues of national security.

Section 56(1)(a)(b)

Too onerous and make inroads into the right of self -autonomy by corporations.

Should be deleted.

Section 57(2)(e)

Should be made applicable only to those civil proceedings that already have commenced.

Section 77(3),78(2), 79(3)

How would a service provider prevent a customer from an unlawful activity whilst she/ he accessing the World Wide Web by using WAP over CSD or GPRS?

Words "or prevent" be deleted.

Sections 79, 80,81

No details have been provided in terms who can issue a take down notification, who will decide whether it is justified, or not and what the procedure of appeal would be for owners of websites or that services that are taken down in terms of s81.

Cyber Inspectors

No mentioned is made of skills, training and qualifications that are required for someone to become a cyber inspector.

Section 85

The word "service’ used in the "cryptography service provider" should be deleted so as to correspond with the phrase "cryptography provider".

Section 90(2)

Should be rephrased.

Section 94 and 95

The attempt to extend the jurisdiction of South African courts to offences by foreign citizens that was committed overseas might be difficult to enforce.

Obsidian Systems

Definition of the Authority

There is confusion between the Director General and the za Domain name, in relation to chapter vi and x

Definition of Cache

Definition of Cryptography products

They say Cryptography products is very wide.

Cryptography provider

The definition is too flawed

Internet

Definition is very poor

IP

Its definition needs to be redefined

Definition of a person

It needs must include a private body

E- strategy

24 months is to much to be reduced to 12 months and the involvement of the private sector in the strategy

Chapter 3

An addition to public domain

Original

The originality of the document or data message

Production of document or information

Acknowledgment and certification

Electronic agency

Electronic intermediary

Attribution of data message to originator

Chapter 5

Confused with number of issues and the continuation of substantive laws

Chapter 6

Director General as the authority and the private sector be involved in the strategy and advanced signature be voluntary

Chapter 7

The cooling off period should be considered and the chapter didn’t cover the SMMEs

Existing consumer protection laws and legislation

Chapter 8

Concern is given to personal information on electronic format and the protection of critical database is too wide and seems to unconstitutional

ECASA

.za domain name

Powers granted to the agencies with regard to the bill –they undermines constitutional rights of the individuals

National e- strategy

Time frame for strategy two years is not enough. They recommend five years

Cryptography

Cryptography providers should regulate themselves

Authentication Service providers

Doc is not recommended the service providers should the ones to determine the products and services rather than government doing that.

Protection of critical database

Powers granted to the minister with regard to the issue critical database

Protection of personal information

The issue is neglected. The individual rights to privacy are ignored

Domain name authority and administration

Control of the domain by the government, which has existed –therefore no need for government to control it.

Chapter 12

Wits

World Wide Web

Definition is wide and it can impact on the ability of an organization to develop its own internal system

"that can be accessed from outside the organization" after the words "residing on all computers linked to the internet".

Section 6

E- strategy must outline strategies and programmes to previously disadvantaged persons and communities.

Sections 5 to 8

Not sure why they appear in legislation aimed at managing electronic communications and business

They should be deleted.

Section 21

Relationship between contracting parties and possible review by natural person in terms of S21 (d) is not defined.

It should be rectified and suggested that it should read, "a party using an electronic agent to form an agreement is not bound by the terms of that agreement unless those terms were capable of being reviewed by a natural person prior to the agreement formation to the satisfaction of the contracting parties.

Section 29

Public bodies wishing to perform some of its functions electronically should specify in the gazette.

The word "may" in, "such body specify by notice in the gazette" be replaced by "must".

Section 48

Is this provision enforceable when the perpetrators of violations of consumer protection sections do not maintain presence in South Africa? This section has not received enough consideration in the context of the international nature of electronic business.

Section 51

Why not all information held electronically?

Section 51(2)

What happens if the data controller doesn’t subscribe to section 52? Are the individual rights to protection of their personal data ignored?

It should be replaced with one reading: "no data controller may elect to ignore or avoid the principles contained in s52.

Section 53

The whole chapter ix be deleted.

Section 54

There is no definition as to what is meant by "of importance to the protection of the national security of the Republic or the economic and social well being of its citizens.

Additional paragraph be as follows: such procedures must make provision to enable the database owner to object to the declaration and for any disputes that might arise to be arbitrated by a duly appointed and suitably qualified arbitrator who is acceptable to both parties.

Section 55(1)

No provision has been made for deregistration of database no longer believed to be critical.

Section 56

It is onerous and potentially expensive for the owner of the critical database.

Section 59(2)

This section makes an individual responsible for the actions of his employer in that should the employer fail to make adequate resources available to enable critical database administrator to meet the requirements of section 56, the individual will be subject to sanction.

Critical database administrator be replaced by critical database owner.

Section 60

To nationalize such existing arrangement seems contrary to current government thinking which appears to favour de-nationalization and commercialization wherever possible.

Section 61through 73 be amended or deleted to reflect the change.

Section 84

No mention of skills and technical expertise

Section 84(1) be amended

Section 85

It appears to give cyber inspectors the right to investigate activities based on their individual whim. This may give rise to accusations of spying and vindictiveness.

It should be amended to read as follows: " a cyber inspector may , if given reasonable cause,

Section 90

The wording of this section could impact on legitimate academic and research work done at universities, technikons or research institutions into data security.

Should be amended to ensure that there will be not negative impact on the institutions.

WESTERN CAPE PROVINCIAL GOVERNMENT

it is unclear and requires amendment

"electronic transactions"

". za domain name space"

za is not assigned to the Republic but reserved for a certain geographic region, being the Republic.

Paragraph (m): it is empty and, if those technical standard are to be adhered to, it may stifle adoption and development of new standards

Paragraph (n) and (o) are to be commended

Paragraph (q) should not be a function of government only

I

Ad Clause 3

It is unclear which piece of legislation will superceded in the event of a conflict between this Bill and another Act.

Ad Clause 5

Department of Communications should not be the only body responsible for developing an e-Strategy

There is a risk of duplicating work done by SAITIS

The CTUF says that the Department of Communications gives the impression is attempting to do everything in relation to electronic transactions

S5 clearly states the whole of Cabinet to be involved see S5 (4)

There should be a clause that stipulates that the Minister is to report back.

Ad Clause 6

.

S5 (4)(vi) provides the role of the private sector. The national e-strategy is going to be a governed policy

Ad. clause 7,8 and 9

These clauses are supported.

Ad clause 10

Section 10(4) does not impose any obligation on persons it means that the policy cannot really be enforced.

We suggest that this section be amended or deleted.

Ad Chapter III

They agree with chapter (iii)

Ad clause 13

Ad clause 14

It is implied that if it retains its integrity it is reliable. There is no change in the meaning, in article8 is expressed as Section 14 is implied.

Ad clause 20

Ad clause 23

The general rule is that in advertising it is an invitation to trade not an offer. However it will depend on the wording of the advertisement. If it is unclear the general rule well apply.

Ad Chapter V

They recommend that Chapter V be removed

Ad Chapter VI

They are concerned that the requirements are too stringent

S2 (h) also requires that international standards be met. This and (m) and (n) make it impossible not to include it. To do otherwise will be to defeat the Object of the Act

Ad Clause 43 to 50

Mention the importance of electronic transactions and that consumers should be protected against spamming. Recommend that S46 be amended to include an "opt-in" system and a penalty clause for failure to comply.

We recommend that their suggestion be adopted

Ad Chapter IX

They support protection of critical databases

Ad Chapter X

Ad Chapter XI

Ad Chapter XII

They are also of the view that many of the powers given to cyber inspectors are not capable of being enforced against many of the international service providers.

DZINET

Section 5(4)

Section 6

They say government should address the issue of affordability of Internet

Section 9(b)

Section 16

They say the maximum duration of storing data messages needs to specified

Section 17

Section 21

They recommend that the two types of agents, that is automated and autonomous agents be included and be clearly differentiated from one another.

Section 26

They say that this section be amended as to include autonomous

Section 61

They say Section 72(a) be revisited to address cyber squatting

CHAPTER XII

They recommend that the role, legality and power of the human cyber inspector be clearly be stipulated.

CHAPTER XIII

They recommend that there is a need to classify cyber crimes

COMPAREX

Also, each section deals with a specific issue and the specific test applies to that specific issue

S15 Evidential weight to data Messages

S16(c) Retention

S17Production of Document of information

S21 Automated transactions

To do so would be defeating the objects of the Bill as set out in S2 (j).

S24(c) Usual place of Business

S26(c) Attribution of data message to originator

Chapter IV E-Government

Also, S5, which deals with National e-Strategy, provides for this implementation strategy

Chapter IX Critical Data Bases

ISOC .ZA

DEFINIITIONS

CRYPTOGRAPHY

DATA INTERGRITY

AUTHENTICITY

ENCRYPTION

COMBINING THESE FUNCTIONS

DOMAIN NAME

ELECTRONIC

IP ADDRESS

WORLD WIDE WEB

MAXIMISING BENEFITS

•This Bill lacks any specific provisions to benefit the disabled. We suggest that reference is made to the US example of Section 508 of the Rehabilitation Act: Electronic and Information Technology Accessibility Standards. See http://www.access-board.gov/508.htm

CHAPTER 3

CRYPTOGRAPHY PROVIDERS

AUTHENTICATION PROVIDER

THE US EXAMPLE

CONSUMER PROTECTION

DOMAIN NAME AUTHORITY

LIABILITY OF ISPs

CYBER INSPECTORS

SUMMARY

TRANSNET

CHAPTER II

The Bill requires the Minister to develop the national e-Strategy within 24 months and this is too long. The e-Strategy should not be the responsibility of one Ministerial department.

=

CHAPTER III

Does the Bill suggest that a message-conveying acceptance of an offer is not required to come to the attention of the offerer?

What about electronic storage of information?

Storage of final messages distributed electronically – How do you ensure consistency in terms of changes after distribution?

Recognition of documents in electronic format is unspecified.

Sec 21 is open for abuse because the party using the electronic agent may not disclose the terms and later renege on the agreement.

CHAPTER IV

What are the standards for electronic filing or processing as referred to in this chapter?

Costs of transforming from paper based filing to electronic filing should be considered, specifically taking into consideration people without computer access.

E-government touches various departments e.g. Communications, Public enterprise and public works and therefore it should be addressed by all these departments.

CHAPTER V

Many "off the shelf" products have cryptography services/products embedded in them. How can these large international companies be required to pay for and register with DoC?

CHAPTER VI

mention to the three-tier structure incorporating the user, an accreditation authority and government – the involvement of government is questionable. What about industry self-regulation?

CHAPTER VII

The relevant jurisdiction in case of a foreign customer complaining about a service provider established in South Africa seems not to be addressed.

CHAPTER VIII

The Bill provides that data controller may not disclose personal information, but there is no sanction or penalty in the event that the data controller does not comply with this obligation

CHAPTER IX

Protection of critical information should be included in the Promotion of Access to Information Act.

CHAPTER X

CHAPTER XI

What specific do this chapter address?

CHAPTER XII

Cyber Inspectors – Will businesses be protected in terms of disclosure of confidential information and trade secretes?

Are we creating a separate police force, Should this not be part of SAPS?

What is open information and what can be classified as confidential information?

CHAPTER XIII

GENERAL

GENERAL

Concepts around public key cryptography and the regulation of an authentication infrastructure are very complex and the impact needs to be assessed.

CONSUMER AFFAIRS COMMITTEE

The definition of a consumer in the Bill is restrictive it refers to the natural consumer and the end user of goods and services. It is therefore suggested that this definition should be similar to the definition in the Consumer Affairs (Unfair Business Practices) Act, 1988 (Act no. 71 of 1988).

CHAPTER V

Cryptography providers – It is the stated aim of the chapter to provide the SAPS and other law-enforcement agencies with help to decipher text.

This Bill does not deal with deciphering or interception of any text in any form, this is dealt with under the Interception and Monitoring Bill.

The scope of reference of Sec 31(3) is very wide and technically it covers all users of computers given that most computers have cryptography program installed in them.

SOUTH AFRICAN POLICE SERVICE

CHAPTER XIII

The provisions of Sec 90 and 91 are too limited and the penalty provisions are in adequate.

Cyber terrorism should be addressed in the Bill.

It is recommended that the chapter on cyber crime be removed from the Bill since this will be covered in the comprehensive legislation which will be established after the research conducted by the South African Law Commission on behalf of SAPS

SOUTH AFRICAN LAW COMMISSION

CHAPTER VIII

CREDIT BUREAU ASSOCIATION

CHAPTER VII

The provisions in Sec 52 are unconstitutional in that they purport to make the right to privacy an absolute right.

Sec 51 - "Electronic Transactions" should be defined in Sec 1 of the Bill.

CHAPTER IX

This chapter should be deleted because it gives the Minister powers, which violate the constitutional right of access to information.

If there is a need to protect critical data then it should be dealt with in the Promotion of Access to Information Act.

LINUX

CHAPTER V

Cryptography - This chapter makes the use cryptography embedded in a free software illegal and large portions of these software’s have no single owner or distributor and this implies that this software will be impossible to register.

CHAPTER VII

Consumer protection – Sec 43(2)(g) means that if a consumer unseals a software package and finds the terms and conditions not satisfactory, the consumer would still be obliged to accept the sale as binding.

JOHANNESBURG STOCK EXCHANGE

CHAPTER I

distributor of such technologies without such access?

Chapter V

Sec 3 must be amended to expressly provide for an order of priority in the event of conflict.

The generic concepts for cross cutting laws should not be left to individual Ministries to address in legislation and regulation on an ad hoc basis.

The ECT Bill should specifically provide clarity that should apply across all laws in respect of inspection, search and/or seizure contemplated in the electronic environment.

Other Recommendation

Chapter X

MCELL

Existing regulatory bodies be used for regulation of e-commerce.

Private sector databases should be excluded from critical database list.

Provisions for cyber inspectors should be removed as duties can be performed by existing law enforcement agencies.

Chapter 1: Section 4.

Questions the absence of taxation and companies act from Bill.

Section 15

Chapter 6: part 1.

Chapter 7

Chapter 4: E-Government

The NRF is concerned that the forms for electronic filing and submission will have to be gazetted.

Chapter 8: Protection of personal information

Correction Chapter VIII s51(3)

Chapter IX: Critical Databases: s54

s59(2)

No provision is made for right of appeal to criminal prosecution.

Delay in the establishment of an accreditation authority will affect every instance where signature is required by law.

PROBLEMS WITH S13

*Does this sect include regulatory bodies in the private and public sectors?

s 14 Original

-having regard to all other relevant circumstances

Section 16: Retention

-origin and destination of that data message and the date and time it was sent or received can be determined

Production of document or information

-the integrity of the information contained in a document is maintained if the information has remained complete and unaltered

Accreditation

-"authentication service provider" means a person whose authentication products or services have been accredited by the Authority under section 38 or recognised under section 41 (recognition of foreign accreditation)

Evidence: Admission and Weight