§ 3-17. The provider's duties for electronic signatures

This section places duties on the provider (the supplier of the signature solution, see § 3-16) relating to misuse of the signature. When signature data (the data used to create the signature) are made available, the provider must at the same time tell the signature holder how to report misuse. The provider must make sure that reports can always be received, and must immediately stop further use once the report has been received. The distinction between the provider and the service provider (tjenesteyter) is important: the provider supplies the signature solution, while the service provider enters into the financial agreement (finansavtale) with the customer (kunde).

The second subsection requires the provider to confirm in writing that a report has been received. The provider must be able to produce documentation of the report for at least 18 months after it came in.

The third subsection prevents anyone from getting access to signature data without the signature holder having asked for it personally. The exception is when new data replace previously issued data. The fourth subsection places the risk of the sending on the provider, including for the security information intended to prevent misuse. In other words, it is the provider, not the signature holder, who bears the risk that the data and security information reach the right person.

Example: The signature holder discovers misuse and notifies the provider. The provider must then stop further use of the signature data at once and confirm in writing that the report has been received.

The terms provider, signature holder and misuse are defined in § 3-16. § 3-18 places a corresponding duty to provide information on the service provider that offers entering into agreements with an electronic signature (elektronisk signatur). § 3-19 concerns the signature holder's duties, and § 3-20 and § 3-21 concern the signature holder's liability for losses from misuse and the possibility of reducing it. In particular, § 3-20 sets limits on how much the service provider can claim in compensation (erstatning) from the signature holder.