In our previous Newsletters, we have dealt with the legal recognition of electronic signatures. This article is an update on the legal evolution of electronic signatures in Turkey, as well as a brief evaluation of the consequences and outcomes of such evolution on a practical scale.
The Electronic Signature Law ("Law") entered into force on 23 July 2004. Two additional regulations, namely the Regulation on the Application of the Electronic Signature Law ("Regulation") and the Regulation Amending the Regulation on the Application of the Electronic Signature Law ("Amending Regulation") followed the enactment of the Law. The two main entities for electronic signatures are the Telecommunications Board ("Board") and the certification service providers ("CSP"). CSPs are defined in the Law as "public entities, individuals or private legal entities that provide services related to e-signatures and e-certificates".
CSPs are entities that issue qualified certificates certifying e-signatures. They are entitled to undertake such activity within two months from notification to the Board, after receiving approval. CSPs bear certain obligations related to the security of the transactions and, in their notification to the Board, must evidence that (i) they use safe products and systems; (ii) services are rendered in compliance with safety requirements; and (iii) all precautions have been taken to prevent the duplication and destruction of certificates. Non-compliance with such conditions will result in the suspension of a CSP’s activity by the Board, and a term of one month will be granted to the CSP for compliance with such requirements. Failure to comply will result in the cancellation of the CSP’s activity. In the event the CSP decides to terminate its activities, it must notify the Board and the holders of electronic certificates of such decision, three months prior to the termination date at the latest.
When an application is filed with a CSP for a qualified certificate, the CSP is responsible for the proper and reliable identification of the applicant. CSPs also have a duty to inform the applicant or future holder of the certificate regarding certain issues such as (i) validity of electronic signatures and their effect being equivalent to a hand-written signature; (ii) prohibition to put the data and equipment used for the creation of electronic signatures at the disposal of third parties; (iii) rules and limitations regarding the use of electronic signatures; (iv) terms governing cancellation of the qualification certificate; (v) alternative means for dispute resolution; and (vi) changes of the terms and conditions of the agreement contracted between the CSP and the holder of the certificate, which define the validity term of the qualified certificate and the persons empowered to accomplish formalities regarding such qualified certificate.
The Regulation imposes stringent security and information requirements on CSPs. In this respect, the granting of such right by the Board will be fairly limited because compliance with such requirements depends on the technological development level of the applicants as well as their financial capacities. The certification center for public entities is TÜBİTAK. On othe pther hand, the granting of such function to other entities for the certification of private entities such as banks is a question which remains unanswered today.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
