§ 3-20. Liability for misuse of an electronic signature (elektronisk signatur)

This section sets a cap on how much the person who owns an electronic signature (the signature holder) may have to pay when the signature is misused. The service provider can in principle claim compensation under the ordinary rules. However, the liability can never exceed the excesses in the other paragraphs. According to § 3-16, the signature holder is always a natural person who has the right to create a signature that can be used to enter into financial agreements (finansavtaler).

The amounts increase according to how careless the signature holder has been. As a general rule, the excess is up to 450 kroner. It does not apply if the misuse could not possibly have been discovered in advance and the signature holder has not acted fraudulently (dishonestly). If the signature holder, through gross negligence, has not complied with the obligations in § 3-19, first and second paragraphs, the cap is 12,000 kroner. In the case of an intentional breach, where the signature holder must have understood that there was an imminent risk of misuse, the signature holder is liable for the loss the service provider can claim under the ordinary rules on compensation.

Full exemption applies in several cases. The signature holder is never liable for loss caused by the service provider itself or by anyone acting on its behalf. Unless there is fraud, the signature holder is also not liable for loss arising after he or she has given notice of misuse or risk of misuse. The same applies when the obligation to make arrangements for notification has been breached, when the signing was not secure enough, or when the service provider did not require strong customer authentication (secure confirmation of who you are) where this was relevant. The last ground for exemption is that, given the circumstances, the service provider is best placed to bear the risk of the misuse.

The excesses are closely linked to § 3-19. That section requires the signature holder to protect the security information and to give notice immediately in case of misuse. If notice is not given without undue delay, or within 13 months from the time when the signature holder should have understood that misuse had occurred, the right to the limitation of liability is lost. If the service provider has failed to provide transaction information, the right is lost only 13 months after the signature holder became aware of the misuse. Notification requires someone to receive it: according to § 3-17, the provider must receive notifications at all times, immediately stop further use and confirm receipt in writing. According to § 3-18, the service provider must have easily accessible information on how to give notice.

The reduction rule in § 3-21 is a safety valve. Liability for the excess can be reduced when it is reasonable, taking into account, among other things, what kind of security information was misused, the circumstances of the misuse, and whether the service provider itself was negligent or otherwise contributed to the loss. Example: a signature holder has breached their obligations through gross negligence, but the service provider had not required secure authentication. In that case the signature holder is not liable for the loss, unless he or she has acted fraudulently.