The document provides an overview of cyberlaw legislation relevant to in-house counsel, including the Electronic Communications and Transactions Act, the Regulation of Interception of Communications Act, and the Promotion of Access to Information Act. It emphasizes the importance of legal recognition for electronic documents and signatures, the legal framework for monitoring communications, and guidelines for electronic transactions and domain name protection. Additionally, it highlights the necessity of document management and data protection policies to safeguard sensitive information and mitigate electronic crime risks.

1. CYBERLAW (ICT LAW) FRANCIS CRONJÉ SANDTON

2. An overview of relevant Legislation pertaining to Cyberlaw and how they relate to in-house counsel Electronic Communications and Transactions Act of 2002; Regulation of Interception of Communications and Provision of Communications related Information Act of 2002; Promotion to Access of Information Act of 2000. Francis Cronjé

3. Electronic Communication and Transactions Act Most NB part of this Act for in-house counsel is Chapter III Chapter III deals with the facilitation of Electronic Transactions and consists of two parts: Part 1 thereof provides for the legal requirements of data messages, while Part 2 deals with the communication of data messages Francis Cronjé

4. Part 1 Gives legal recognition to electronic documents (Sec 11); Gives legal recognition to electronic signatures (Sec 13) No type of technology is prescribed, therefore a signature can be: Scanned image of your signature; Name at the end of an email; or Digital signature HOWEVER!!! Francis Cronjé

5. Part 1 (Cont.) Where a Law requires a signature, then such requirement will only be met once an Advanced Electronic Signature (AES) is used. This constitutes a reliable form of signature and can only be issued by an Authentication Provider which have been accredited in terms of sections 37 and 38 of the ECT Act. Francis Cronjé

6. Part 1 (Cont.) Fulfills the requirement of law that a document or information must be in “writing” (Sec 12) if the document or information is: In the form of a data message; AND Accessible in a manner usable for subsequent reference Francis Cronjé

7. Part 2 Gives validity to agreements concluded electronically (Sec 22); Provides for the time and place of communications, dispatch and receipt (Sec 23); Expression of intent or other statement (Sec 24); Francis Cronjé

8. Francis Cronjé

9. Francis Cronjé

10. Regulation of Interception of Communications & Provision of Communication-related Information Act (RICA) The fundamental principle of RICA for in-house counsel is that an employee’s communications can’t be monitored or intercepted unless it falls under the exceptions as provided for in RICA (Heavy penalties if not complying) These exceptions are dealt with in sections 4, 5 and 6 of the Act and are as follow: Francis Cronjé

11. RICA (Cont.) By a person if that person is a party to the communication; With the prior written consent of a party to the communication; When the interception occurs in connection with carrying on of business (the so-called “business exception”) where written consent is not necessarily required and where express or implied consent suffices. Francis Cronjé

12. RICA (Cont.) Monitoring of e-mails It can only be legal if and when: Monitoring of the employee’s email must have been authorised by the system controller; The email being monitored must relate to the business of the employer; The purpose of the monitoring of the emails must be to monitor or keep record of the emails; The System Controller must have made a reasonable effort to inform employees or third parties in advance that the email would be monitored or the System Controller must have received implied or express permission from the party who’s email is being monitored. Francis Cronjé

13. Promotion to Access of Information Act (PAIA) Section here that is relevant to Cyberlaw and In-house counsel is the fact that the PAIA manual in terms of sections 14 (In the case of a public body) and 51 (In the case of a private body) must be made available on the Public or Private Body’s website. Francis Cronjé

14. The Impact Cyberlaw has on Electronic Transactions E-Commerce: NB to realise, that when drafting any terms and conditions on an E-Commerce site, always stipulate that the products or content for sale, do not constitute an offer to sell, but merely an invitation to buy. This due to the effect of sections 23 and 24 of the ECT Act and the impact of Electronic Agents (Example – price mistake, not enough stock etc.) Have due regard to the consumer protection clauses as stipulated in Sections 43 and 44 which deals with the information that needs to be provided as well as the cooling of periods for services and products. Francis Cronjé

15. The Impact Cyberlaw has on Electronic Transactions (Cont.) E-mail: The same (as with E-Commerce) would imply for concluding agreements via email (Take for instance the automated out of office reply) Make sure that the terms of the email disclaimer verifies that an email is only deemed received once confirmed by the recipient and that an out of office reply does not constitute such a confirmation. Unsolicited email (Section 45) Francis Cronjé

16. Protection of Domain Names and Online Dispute Resolution Protection of domain names Most important aspect for In-house counsel is to ensure that they have an IP Policy. Domain names and its administration and registration should form part and parcel of this Policy, since domain names can be valued as immensely important assets to a company. Francis Cronjé

17. Protection of Domain Names and Online Dispute Resolution (Cont.) This Policy should be read in conjunction with the company’s IT Security Policy and it should be the responsibility of In-house to make the CEO, CFO and CIO aware of these policies and advise on its implementation. In the IT Security Policy, issues would relate for instance to how one can effectively protect your own websites against defamation etc. Francis Cronjé

18. Protection of Domain Names and ODR (Cont.) Online Dispute Resolution Important to realise that there are different dispute mechanisms for the different level domains out there. For all the generic Top Level Domains (gTLD), ICANN makes provision for ODR through WIPO making use of its Uniform Dispute Resolution Policy (UDRP). http://www.wipo.int/amc/en/domains/gtld/index.html It also makes provision for certain country code Top Level Domains (ccTLD). http://www.wipo.int/amc/en/domains/cctld/index.html Francis Cronjé

19. Protection of Domain Names and ODR (Cont.) Online Dispute Resolution In order to file a complaint, a Complainant will have to prove 3 things: That he has a registered trade mark reflecting the name; and That the Respondent has no legitimate interest in the domain name; and That the Respondent has acted in bad faith. Francis Cronjé

20. Protection of Domain Names and ODR (Cont.) Online Dispute Resolution With the South African ccTLD, . co.za , a local dispute resolution mechanism (DomainDisputes.co.za) is used, run by the South African Institute of Intellectual Property Law (SAIIPL). http://www.domaindisputes.co.za/index.php Francis Cronjé

21. Protection of Domain Names and ODR (Cont.) Online Dispute Resolution In order to file a complaint, a Complainant here will only have to prove a combination of 2 things or can also make use of an alternative option: a) the complainant has rights in respect of a name or mark which is identical or similar to the domain name and, in the hands of the registrant the domain name is an abusive registration; or (b) the domain name, in the hands of the registrant, is an offensive registration. http://www.domaindisputes.co.za/content.php?tag=7 Francis Cronjé

22. Document Management and the Protection of the Privacy of Sensitive Information First it is important to distinguish between the following: Document Management (Record Retention); Information Management; and Protection of Personal Information (Privacy) Francis Cronjé

23. Document Management and the Protection of the Privacy of Sensitive Information (Cont.) Document Management has to do with the retention of Business Records according to a law or statute (for example the retention of an invoice); Information Management has to do with the distinction between various forms of information and its sensitivity with regards to distribution and accessibility (for example trade secrets); while Protection of Personal Information (Privacy) deals with the protection of information relating to individuals, whether they are employees or clients (for example the address or health status of a person). Francis Cronjé

24. Document Management and the Protection of the Privacy of Sensitive Information (Cont.) Electronic Document Management (Record Retention) As an example we are going to look at emails: An email is a business record if a regulation or statute says it must be retained; It contains valuable information about business operations; It contains info that must be filed with a regulator (ICASA or JSE); It contains information used to negotiate a contract; A sales forecast depends on information it contains; It is the final version of a contract etc. Francis Cronjé

25. Document Management and the Protection of the Privacy of Sensitive Information (Cont.) Electronic Document Management (Record Retention) Certain sections of Chapter III of the ECT Act allows the use of electronic documents, emails and other forms of electronic information as evidence (sec 15) An audit trail of authenticity ; as well as Integrity of information in terms of structure, content and context must be shown; Email messaging systems such as Microsoft Outlook was not designed to guarantee the above Francis Cronjé

26. Document Management and the Protection of the Privacy of Sensitive Information (Cont.) Electronic Document Management (Record Retention) It is therefore suggested that such emails be stored in a proper records management system. It is imperative to have a Document (Records) Management Policy in place. Francis Cronjé

27. Document Management and the Protection of the Privacy of Sensitive Information (Cont.) Protection of the Privacy of Sensitive Information This is also known as data protection and relates to the protection of personal information, in other words, retaining the privacy of an individual. Taking once again the example of an email, it should be noted that in information so classified, methods of encryption must be used. Francis Cronjé

28. Electronic Crime and IT Security Electronic crimes are a daily occurrence and impacts every company (Edgars an ABSA example); Most of these crimes happen behind the firewall (disgruntled employee); It is therefore imperative to have the right policies in place, ranging from Electronic Communications Policies through to IT Security policies When these crimes occur from the outside, then the ECT Act makes provision for criminal liability in terms of its sections 85 to 88. Francis Cronjé

29. Electronic Crime and IT Security (Cont.) In-house counsel must be aware of section 424 of the Companies Act which relates to a director’s liabilities. Where a director has for instance not given heed to advice received with regards to the implementation of policies, it might be concluded that such a director has acted recklessly and might incur personal liability for losses that the company has suffered. Francis Cronjé

30. Conclusion Due diligence reports relating to a company’s implementation of Corporate Governance must be conducted on regular intervals; This will lead to the implementation of sufficient policies which could and should curtail most onslaughts that face the ever increasing demands that are required from companies’ Information and Communication Technology systems, which in turn; Has an impact on its Corporate Responsibilities. Francis Cronjé

31. THANK YOU! Francis Cronjé [email_address] Mobile: 079 0985 309 Francis Cronjé