§ 3-19. The signature holder's duties for electronic signatures

This section sets out what a person who uses an electronic signature to enter into financial agreements (finansavtaler) must do to prevent misuse. The signature holder (see § 3-16) must use the signature data in line with the terms for issue and use, and take reasonable precautions to protect personal security information as soon as it has been received. The terms must be objective, non-discriminatory and proportionate to their purpose.

The second subsection requires a signature holder who discovers misuse to give notice without undue delay (without unnecessary delay), following the procedures the service provider or the provider has given. The third subsection attaches a serious consequence to this: a person who does not give notice without undue delay after learning of the misuse loses the right to the limitation of liability in § 3-20. The same applies if 13 months have passed since the signature holder should have realised that misuse had occurred, without notice being given.

There is one exception to the 13-month deadline. If the service provider has failed to give the information about the transaction or agreement the misuse led to, which the Act otherwise requires to be given to customers, the right is lost only 13 months after the signature holder actually became aware of the misuse.

What is at stake is shown in § 3-20. The signature holder's liability is limited to an excess (egenandel): up to NOK 450 as the main rule, up to NOK 12,000 if the loss is due to gross negligence (grov uaktsomhet) in relation to the duties under § 3-19 first and second subsections, and full compensation (erstatning) under the ordinary rules for intentional breach where there is an obvious risk of misuse. The signature holder is not liable for losses caused by the service provider, nor, unless he has acted fraudulently, for losses arising after he has given notice. If he loses the limitation of liability under the third subsection of this section, these caps do not apply.

The section is linked to the duties of the provider and the service provider. § 3-17 and § 3-18 ensure that the signature holder learns how to give notice, and § 3-21 allows liability for the excess to be reduced when this is reasonable.