The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016

Made: 30th June 2016

Laid before Parliament: 1st July 2016

Coming into force: 22nd July 2016

The Secretary of State is a Minister designated for the purposes of section 2(2) of the European Communities Act 1972 in relation to electronic trust services and other systems to facilitate electronic transactions in the internal market.

These Regulations make provision for a purpose mentioned in section 2(2) of the European Communities Act 1972 and it appears to the Secretary of State that it is expedient for the reference to Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market to be construed as a reference to that instrument as amended from time to time.

The Secretary of State makes these Regulations in exercise of the powers conferred by section 2(2) of, and paragraph 1A of Schedule 2 to, the European Communities Act 1972.

PART 1 — Introduction

Citation and Commencement

1

These Regulations may be cited as the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 and come into force on 22nd July 2016.

Interpretation

2

• (1) In these Regulations—

• ...

• the “2002 Regulations” means the Electronic Signatures Regulations 2002 ;

• “eIDAS Regulation” means Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market , as amended from time to time;

• “supervisory body” has the meaning given in regulation 3(1) of these Regulations;

• “the Tribunal” has the meaning given in section 70(1) of the 1998 Act.

• (2) Other expressions used in these Regulations, which are used in the eIDAS Regulation, have the same meaning as in the eIDAS Regulation.

• (3) References in these regulations to a period expressed in days or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.

PART 2 — Supervisory body

Supervision

3

• (1) The Information Commissioner is the supervisory body and must carry out the supervisory body tasks set out in Article 17 of the eIDAS Regulation.

• (2) The supervisory body must enforce these Regulations and Chapter III of the eIDAS Regulation.

• (3) Schedules 1 (monetary penalties) and 2 (enforcement powers of the Information Commissioner ...) have effect.

PART 3 — Miscellaneous

Transitional provisions and revocations

4

• (1) The Electronic Signatures Regulations 2002 are revoked.

• (2) For the purposes of these Regulations, a qualified certificate issued pursuant to regulation 2 of the 2002 Regulations is to be treated as a qualified certificate for electronic signature pursuant to Article 3(15) of the eIDAS Regulation until it expires.

Consequential amendments

5

Schedule 3 has effect.

Review

6

• (1) The Secretary of State must from time to time—

• (a) carry out a review of these Regulations;

• (b) set out the conclusions of the review in a report; and

• (c) publish the report.

• (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (3) The report must in particular—

• (a) set out the objectives intended to be achieved by the regulatory system established by these Regulations;

• (b) assess the extent to which those objectives are achieved; and

• (c) assess whether those objectives remain appropriate and, if so, the extent to which they could be achieved by a system that imposes less regulation.

• (4) The first report under this regulation must be published before the end of the period of 5 years beginning with the day on which these Regulations come into force.

• (5) Reports under this regulation are afterwards to be published at intervals not exceeding 5 years.

SCHEDULE 1 — Monetary penalties

1

If the supervisory body is satisfied that a trust service provider has contravened or is contravening Chapter III of the eIDAS Regulation, the supervisory body may issue a trust service provider with a fixed monetary penalty notice in respect of such contravention.

2

The amount of a fixed monetary penalty under these Regulations is £1000.

3

Before serving a fixed monetary penalty notice, the supervisory body must serve the trust service provider with a notice of intent.

4

The notice of intent must—

• (a) state the name and address of the trust service provider;

• (b) state the nature of the contravention;

• (c) indicate the amount of the fixed monetary penalty;

• (d) include a statement informing the trust service provider of the opportunity to discharge liability for the fixed monetary penalty notice;

• (e) indicate the date on which the supervisory body proposes to serve the fixed monetary penalty notice; and

• (f) inform the trust service provider that it may make written representations in relation to the proposal to serve a fixed monetary penalty notice within the period of 21 days beginning when the notice of intent is served.

5

A trust service provider may discharge liability for the fixed monetary penalty if it pays to the supervisory body the amount of £800 within the period of 21 days beginning when the notice of intent is received.

6

The supervisory body may not serve a fixed monetary penalty notice until the expiry of the period of 21 days beginning when the notice of intent is served.

7

The fixed monetary penalty notice must state—

• (a) the name and address of the trust service provider;

• (b) details of the notice of intent served on the trust service provider;

• (c) whether there have been any written representations;

• (d) details of any early payment discounts;

• (e) the grounds on which the supervisory body imposes the fixed monetary penalty;

• (f) the date by which the fixed monetary penalty is to be paid; and

• (g) details of, including the time limit for, the trust service provider's right of appeal against the imposition of the fixed monetary penalty.

8

A trust service provider on whom a fixed monetary penalty is served may appeal to the Tribunal against the issue of the fixed monetary penalty notice.

9

Any sum received by the supervisory body by virtue of this Schedule must be paid into the Consolidated Fund.

10

In England and Wales and Northern Ireland, the fixed monetary penalty is recoverable—

• (a) if a county court so orders, under an order of that court;

• (b) if the High Court so orders, under an order of that court.

11

In Scotland, the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.

SCHEDULE 2 — Information Commissioner's enforcement powers

Enforcement powers

1

For the purposes of enforcing these Regulations and the eIDAS Regulation, the following provisions of Parts 5 to 7 of the Data Protection Act 2018 apply with the modifications set out in paragraphs 2 to 26—

• (a) section 140 (publication by the Commissioner);

• (b) section 141A (notices from the Commissioner);

• (c) section 142 (information notices);

• (d) section 143 (information notices: restrictions);

• (e) section 144 (false statements made in response to an information notice);

• (f) section 145 (information orders);

• (g) section 146 (assessment notices);

• (ga) section 146A (assessment notices: approval of person to prepare report etc);

• (h) section 147 (assessment notices: restrictions);

• (i) section 148 (destroying or falsifying information and documents etc);

• (ia) section 148A (interview notices);

• (ib) section 148B (interview notices: restrictions);

• (ic) section 148C (false statements made in response to interview notices);

• (j) section 149 (enforcement notices);

• (k) section 150 (enforcement notices: supplementary);

• (l) section 152 (enforcement notices: restrictions);

• (m) section 153 (enforcement notices: cancellation and variation);

• (n) section 154 and Schedule 15 (powers of entry and inspection);

• (o) section 155 and Schedule 16 (penalty notices);

• (p) section 156(4)(a) (penalty notices: restrictions);

• (q) section 157 (maximum amount of penalty);

• (r) section 159 (amount of penalties: supplementary);

• (s) section 160 (guidance about regulatory action);

• (t) section 161 (approval of first guidance about regulatory action);

• (u) section 162 (rights of appeal);

• (v) section 163 (determination of appeals);

• (w) section 164 (applications in respect of urgent notices);

• (x) section 180 (jurisdiction);

• (y) section 182(1), (2), (5), (7) and (13) (regulations and consultation);

• (z) section 196 (penalties for offences);

• (z1) section 197 (prosecution);

• (z2) section 202 (proceedings in the First-tier Tribunal: contempt);

• (z3) section 203 (Tribunal Procedure Rules).

2

The provisions listed in paragraph 1 have effect as if—

• (a) references to the Data Protection Act 2018 were references to the provisions of that Act as applied by these Regulations;

• (b) references to a particular provision of that Act were references to that provision as applied by these Regulations.

SCHEDULE 3 — Consequential Amendments

Electronic Communications Act 2000

1

• (1) The Electronic Communications Act 2000 is amended as set out below.

• (2) In section 7(2)(b), for paragraph (b) substitute—

(b) purports to be used by the individual creating it to sign.

• (3) In section 7(3), for the words “establishing the authenticity of the communication or data, the integrity of the communication or data, or both”, substitute “ signing ”.

• (4) After section 7, insert—

(7A) (1) In any legal proceedings— (a) an electronic seal incorporated into or logically associated with a particular electronic communication or particular electronic data, and (b) the certification by any person of such a seal, shall each be admissible in evidence in relation to any question as to the authenticity of the communication or data, the integrity of the communication or data, or both. (2) For the purposes of this section an electronic seal is so much of anything in electronic form as— (a) is incorporated into or otherwise logically associated with electronic communication or electronic data; and (b) purports to ensure the origin and integrity of the communication or data. (3) For the purposes of this section an electronic seal incorporated into or associated with a particular electronic communication or particular electronic data is certified by any person if that person (whether before or after the making of the communication) has made a statement confirming that— (a) the seal, (b) a means of producing, communicating or verifying the seal, or (c) a procedure applied to the seal, is (either alone or in combination with other factors) a valid means of ensuring the origin of the communication or data, the integrity of the communication or data, or both. (7B) (1) In any legal proceedings— (a) an electronic time stamp incorporated into or logically associated with a particular electronic communication or particular electronic data, and (b) the certification by any person of such a time stamp, shall each be admissible in evidence in relation to any question as whether the communication or data existed at the time the electronic time stamp was incorporated into or logically associated with such communication or data. (2) For the purposes of this section an electronic time stamp is so much of anything in electronic form as— (a) is incorporated into or otherwise logically associated with any electronic communication or electronic data; and (b) purports to bind electronic communication or electronic data to a particular time establishing evidence that such data existed at that time. (3) For the purposes of this section an electronic time stamp incorporated into or associated with a particular electronic communication or particular electronic data is certified by any person if that person (whether before or after the making of the communication) has made a statement confirming that— (a) the time stamp, (b) a means of producing, communicating or verifying the time stamp, or (c) a procedure applied to the time stamp, is (either alone or in combination with other factors) a valid means of establishing whether the communication or data existed at a particular point in time. (7C) (1) In any legal proceedings an electronic document shall be admissible in evidence in relation to any question as to the authenticity of an electronic transaction. (2) For the purposes of this section an electronic document is anything stored in electronic form, including text or sound, and visual or audiovisual recording. (7D) (1) In any legal proceedings, any electronic communication or electronic data sent and received using an electronic registered delivery service shall be admissible in evidence. (2) For the purposes of this section an electronic registered delivery service is a service which— (a) provides for the transmission of data between third parties by electronic means; (b) provides evidence relating to the handling of the transmitted data, including proof of sending and receiving the data; and (c) protects transmitted data against the risk of loss, theft, damage or unauthorised alterations.

Medicines for Human Use (Clinical Trials) Regulations 2004

2

In regulation 2(1) (interpretation) of the Medicines for Human Use (Clinical Trials) Regulations 2004 —

• (a) for the definition “electronic signature”, substitute—

“electronic signature” means data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign;

; and

• (b) after the definition of “serious adverse event”, insert—

“signatory” means a natural person who creates an electronic signature;

National Health Service (General Medical Services Contracts) (Scotland) Regulations 2004

3

In regulation 2(1) (interpretation) of the National Health Service (General Medical Services Contracts) (Scotland) Regulations 2004 for the definition of “advanced electronic signature”, substitute—

“advanced electronic signature” means an advanced electronic signature within the meaning given in Article 3(11) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market ;

National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2004

4

In regulation 2 (interpretation) of the National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2004 for the definition of “advanced electronic signature”, substitute—

“advanced electronic signature” means an advanced electronic signature within the meaning given in Article 3(11) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market;

Hazardous Waste (Wales) Regulations 2005

5

In the Hazardous Waste (Wales) Regulations 2005 —

• (a) in the Welsh language text, for regulation 5(3)(ch) (general interpretation) substitute—

mae i “llofnod electronig” yr ystyr a roddir i “electronic signature” yn Erthygl 3(10) o Reoliad (EU) Rhif 910/2014 Senedd Ewrop a'r Cyngor ar adnabod electronig a gwasanaethau ymddiried ar gyfer trafodiadau electronig yn y farchnad fewnol.

; and

• (b) in the English language text, for regulation 5(3)(d) (general interpretation) substitute—

“electronic signature” (“llofnod electronig”) has the meaning given in Article 3(10) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market.

Producer Responsibility Obligations (Packaging Waste) Regulations 2007

6

In regulation 2 (interpretation and notices) of the Producer Responsibility Obligations (Packaging Waste) Regulations 2007 —

• (a) in regulation 2(2), after the definition “SIC code”, insert the definition—

“signatory” means a natural person who creates an electronic signature;

; and

• (b) in regulation 2(5)(d) for the definition “electronic signature”, substitute—

“electronic signature” means data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign;

Defence and Security Public Contracts Regulations 2011

7

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Human Medicines Regulations 2012

8

• (1) In regulation 8(1) (general interpretation) of the Human Medicines Regulations 2012 , after the definition “electronic communication”, insert—

“electronic signature” has the meaning given within Article 3(10) of Regulation (EU) 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market;

• (2) In regulation 219(5) (electronic prescriptions) of the Human Medicines Regulations 2012, for the definition of “advanced electronic signature”, substitute—