Electronic signatures and digital certification: The liability of registry authorities under Brazilian legislation

Abstract

The establishment of a framework to provide legal validity for signatures in electronic documents in Brazil was introduced through Provisional Measure no 2.200, subsequently revoked by the Provisional Measure no 2.200-2 of 24 of August, 2001. A range of regulations, such as Ministerial Decrees, Executive Orders (Portarias) and Resolutions relating to the electronic signature infrastructure and relevant technical issues for implementation have also been passed, having created and designed a Brazilian Public Key Infrastructure. This infrastructure, known as “ICP-Brazil” is the entity responsible for digital certification that aims to ensure the secrecy and privacy of correspondence and personal communications as well as to provide for the integrity and authenticity of electronically signed documents. The network of ICP-Brazil is composed of Registry Authorities, which transmit data received from individuals and companies to an accredited Certification Service Provider, so that the latter can process digital certificates. In this paper we discuss the civil liability of Registry Authorities under the Brazilian legislation, whose role is to identify and register users on the network, to process requests for certificates and forward the requests on to the Certification Service Provider and to maintain the Registration system. The Registry Authorities can be public or private companies, and they undertake the link between the network and the final users, guaranteeing that the data originator is indeed an existing person. The Registry Authorities are responsible for the translation of data received from a physical to a digital format, similar to the service provided by a Public Notary. Strict Liability The Constitutional Approach