Ministerial Resolution No. 48 of 2014 Issuing the Executive Regulations of Law No. 20 of 2014 on Electronic Transactions

Ministerial Resolution No. 48 of 2014
Issuing the Executive Regulations of Law No. 20 of 2014 on Electronic Transactions

Article One

The provisions of the Executive Regulations of the aforementioned Law No. 20 of 2014, the texts of which are attached to this Resolution, shall be applied.

Article Two

The competent authorities shall implement this Resolution, which shall come into force from the date of its publication in the Official Gazette.

Executive Regulations of Law No. 20 of 2014 on Electronic Transactions

Chapter One: Definitions

Article 1

In applying the provisions of these Regulations, the following words and terms shall have the meanings set forth next to each of them:
The Law: Law No. 20 of 2014 referred to above.
The Regulations: The Executive Regulations of the Law.
Competent Authority: The body to which the Council of Ministers entrusts the supervision of issuing the licences required to provide electronic certification and electronic signature services and other activities in the field of electronic transactions and information.
Certification Root: An electronic hierarchical model at the top of which is a root key from which sub-keys branch, in the form of an electronic tool consisting of letters, numbers, symbols or other forms, used by the certification service provider to create electronic certification certificates and electronic signature creation data (Root CA).
Certification Root Manager: The body to which the Council of Ministers entrusts the management of the Certification Root.
Public Key: An electronic tool available to all, linked to an electronic certification certificate, created by means of a special mathematical process and containing symbols, signs, numbers, letters or any other elements, and used to verify the identity of the signatory of the electronic document or record and to confirm the validity and integrity of the content of the original electronic document or record.
Private Key: An electronic tool belonging to its holder, created by means of a special mathematical process and used as a tool for electronically signing the electronic document or record; it is kept on an electronic medium, its holder is responsible for safeguarding it, and it is linked to a public key.
Time Service: A mechanism concerned with regulating time and continuously synchronising it with computers connected to computer networks (Network Time Protocol (NTP)).
Interoperability: The interaction, compatibility, communication and exchange of information between information systems developed and operated in different technical development and operating environments.
Encryption Algorithm: A set of mathematical, logical and sequential steps used in encryption.

Chapter Two: Keeping and Retrieval of Electronic Documents and Records

Article 2

The following shall be observed in keeping electronic documents and records:
1 – The keeping shall comply with the requirements of the systems, regulations and procedures relating to the keeping of traditional records and data, without prejudice to Article (9) of the Law.
2 – Issued records shall be kept in their nature and with all their original data, and archived in any form of electronic data that does not prejudice the standard and quality of the record.
3 – It shall be carried out in accordance with the systems, regulations, procedures or agreements concluded between the two parties to the electronic dealing concerning the determination of the period of time during which such records and documents shall remain kept.
4 – Subject to Clause (1) of this Article, the electronic record shall include the data that determine the identity of the record and its connection with the electronic dealing and with other electronic records, and such data shall include, as a minimum, the following elements:
A – Information on the originator of the electronic record.
B – Information on the sender of the electronic record, if different from the originator.
C – Information on the addressee of the electronic record.
D – The reference or number of the transaction contained in the electronic record, and its nature.
E – The date and time of creation of the electronic record according to the time service, the time stamp or what the two parties agree upon in accordance with the provisions of Article (15) of the Law.
F – The date and time of sending the electronic record according to the time service, the time stamp or what the two parties agree upon in accordance with the provisions of Article (15) of the Law.
G – The date and time of receipt of the electronic record according to the time service, the time stamp or what the two parties agree upon in accordance with the provisions of Article (15) of the Law.
H – Information on re-sending, amendment, cancellation or acknowledgement of receipt, where so required by the sender.

Article 3

The following shall be observed when retrieving and accessing electronic records and documents:
1 – Providing the information relating to the electronic dealing in an electronic format that is customary or expressly agreed upon between the two parties to the electronic dealing; electronic records and documents shall be readable, understandable and complete.
2 – Applying appropriate technical solutions to record all instances in which electronic records are accessed or reached, or in which they or their data are changed.

Article 4

In all cases, the entities that keep and retrieve electronic records and documents shall determine the powers of their employees to access and deal with electronic records and documents on the basis of work needs, and shall bind all their employees to the standards relating to privacy protection applicable in such entities. Information and data relating to clients may not be accessed except by the employees competent to provide the services.

Chapter Three: Electronic Signature

Article 5

The following shall be required for the evidentiary force established for the protected electronic signature:
First: Technical controls of the protected electronic signature:
1 – The signature shall be linked to an electronic certification certificate issued by a licensed certification service provider, and the protected electronic signature shall meet, as a minimum, the following technical elements:
A – The issuer of the electronic certification certificate, such that the certificate contains all information indicating the certification service provider and its electronic signature according to the x.509v3 standard.
B – The type of signature, its serial number and its scope of operation.
C – The date of the signature according to the concept of the time stamp, and its validity period.
D – The type of encryption algorithm used with the public key according to the electronic certificate policy and the electronic certification procedures of the certification service provider.
E – The scope of use of the signature and the limits of its statutory liability, as well as the conditions for protecting the confidentiality of information and of the signatory’s identity data, which include the signatory’s full name and address.
2 – The certification certificate linked to the signature shall be valid at the time the signature is made.
3 – Maintaining the integrity of the signatory’s identity data and its consistency with the electronic certification certificate.
4 – If the signature is made jointly with an electronic data system of the signatory, the logical and technical connection between the electronic signature system and the electronic data system shall be sound, and both shall be free of technical defects affecting the validity of making and sending the signature.
5 – The availability of the minimum technical and administrative infrastructure and the related resources through which control over the signature procedures and the confidentiality of data are ensured, according to the technical conditions set out in the electronic certification procedures of the certification service provider.
6 – The signatory’s compliance with all conditions set out in the electronic certification procedures of the certification service provider with respect to making the electronic signature, without conflicting with the systems and regulations issued by the Competent Authority.
Second: Precautions necessary to avoid unlawful use of the protected electronic signature:
When making an electronic signature, the necessary precautions shall be taken to avoid any unlawful use of the signature creation data and of the personal equipment relating to the signature, and such precautions shall include the following:
1 – Safeguarding the electronic certification certificate and the electronic signature documents issued by the certification service provider that are of a confidential nature, and not enabling unauthorised persons to access them.
2 – Applying appropriate, secure and tamper-proof solutions and technologies, in accordance with the provisions on providing electronic certification services issued by the Competent Authority.
3 – The signatory may engage specialised technical bodies for review and audit in support of the quality and confidentiality of the signature process, without prejudice to any statutory or contractual controls or conditions between the parties to the dealing.
4 – The holder of the electronic signature shall notify the certification service provider as soon as he becomes aware of any unlawful use of his signature, and the data relating to the unlawful use shall be documented.
Third: Procedures for verifying the protected electronic signature:
Whoever relies on the electronic signature of another party shall exercise the necessary care to verify the validity of the signature, by using the electronic signature verification data, according to the following procedures:
1 – Confirming the origin of the certificate of the sender of the message, that it was issued by a certification service provider licensed in accordance with the provisions of these Regulations, and verifying its validity and that it is in force.
2 – Confirming that the data attached to the electronic signature match the data of the signature holder as shown in the certificate issued to him.
3 – No alert or warning messages appearing that indicate an automatic mismatch of the signature or any other defect relating to the origin or the content, within the received message and signature.

Article 6

An electronic signature shall be deemed protected and accredited if the following are met:
1 – If the signature creation tool used is exclusive to the signatory and to no one else.
2 – If the signature creation tool is, at the time of signing, under the control of the signatory and of no one else.
3 – If it is possible to detect any change to the electronic signature occurring after the time of signing.
4 – If it is possible to detect any change in the information linked to the signature occurring after the time of signing.
5 – If it cannot be copied from the electronic medium on which it was created.

Chapter Four: Issuance and Renewal of Licences to Provide Electronic Certification and Electronic Signature Services, and Monitoring and Supervision of the Activities of Certification Service Providers

Article 7

An applicant for a licence, or for its renewal, to provide electronic certification and electronic signature services shall have the following:
First: An electronic data system and an integrated system for electronic certification certificates and electronic signatures of no lower security level than the standards set by the Competent Authority, as set out in the electronic certification and electronic signature procedures, according to the following controls:
1 – The private keys or the data constituting the electronic signature shall not be capable of being inferred or deduced, and the Competent Authority shall determine the standards required for this.
2 – Maintaining the confidentiality of data and protecting it from damage, forgery or breach, according to the security level set by the Competent Authority.
Second: A technical infrastructure and administrative resources of a high degree of efficiency, at a level no lower than the standards approved by the Competent Authority, to operate and manage all electronic certification and electronic signature operations, the most important of which are:
1 – Issuing certification certificates and the related renewal, suspension, cancellation and restoration of certificates.
2 – Managing encryption operations and the related keeping of the private key of the certification service provider, as well as of the public keys.
3 – Using the best international systems and standards in information security, according to the controls set by the Competent Authority.
Third: Making the data for verifying the validity of certificates and electronic signatures available to all parties to the electronic dealing, while ensuring that they are directly linked to the lists of suspended and cancelled certificates.
Fourth: Establishing, operating and managing all electronic resources according to a mechanism that ensures keeping and archiving operations, as well as transfer to other systems and databases, while providing the alternatives and plans under which continuity of service is ensured.
Fifth: The issuance by the Certification Root Manager of a technical certificate approving the connection to the Certification Root, and the text of the terms and controls set by the Certification Root Manager and approved by the Competent Authority.

Article 8

The certification service provider shall prepare the contracts and detailed procedures, including the service charges for the services it provides, and have them approved by the Competent Authority, in a manner that preserves the rights of all parties concerned. It shall also submit an activity termination plan containing the details of the procedures to be followed when the certification service provider ceases to practise its activity at its own request, or in cases of its suspension, the cancellation of its licence or its non-renewal, in a manner that ensures the rights of all relevant parties.

Article 9

A licence applicant to provide electronic certification and electronic signature activities shall provide the guarantees and insurances determined by the Competent Authority to cover any damage or risks relating to the concerned parties in the event of the termination, cancellation or suspension of the licence for any reason, or to cover any breach or shortcoming on its part in the obligations set out in the licence.

Article 10

The certification service provider shall be liable to its beneficiary clients for all services and administrative and technical resources under it, whether directly or indirectly.

Article 11

The following shall be required for approval of a request to cease activity, assign the licence or for a merger:
1 – The certification service provider shall continue to provide its services to the beneficiaries, and may not, for any reason, cease to provide them until it meets the conditions set by the Competent Authority and obtains its approval, in order to ensure the rights of the related parties.
2 – The certification service provider shall not assign or merge with any other party except after the approval of the Competent Authority and the submission of a comprehensive study setting out the justifications and objectives and the effect thereof on the services and the beneficiaries.
The Competent Authority may, on the basis of what the systems and the interest of the beneficiaries require, accept, reject or amend the request.

Article 12

The Competent Authority shall, in accordance with what its policies and procedures require, review and evaluate the performance of the certification service provider, and may for this purpose engage such specialised expert firms as it deems fit.
The Certification Root Manager, in coordination with the Competent Authority, shall carry out the periodic control and audit procedures over certification service providers during the licence period.

Article 13

The certification service provider shall be deemed to have breached its obligations in the following cases:
1 – If it violates the conditions set out in Articles (7), (8), (10) or (12) of these Regulations.
2 – If a complaint is received from concerned parties relating to electronic certification and electronic signature activities and its validity is verified.
3 – If paragraph (F) of Article (14) of these Regulations applies to it.
4 – If a penalty is imposed on it in accordance with the provisions of Articles (37) and (38) of the Law.
5 – If cases of temporary suspension are repeated.
6 – If it is proven to have committed an error resulting in damage or risks relating to the concerned parties or to the public interest.

Article 14

In the event of a lack of interoperability between the Certification Root Manager and the electronic certification service provider, the Certification Root Manager shall impose a temporary suspension and the following procedures shall be taken:
A – The Certification Root Manager shall directly notify the Competent Authority of the temporary suspension, specifying the reasons for the lack of interoperability.
B – The Certification Root Manager shall deal directly with the certification service provider to take the procedures required to end the lack of interoperability.
C – The electronic certification service provider shall end the lack of interoperability within a period not exceeding one week.
D – The Certification Root Manager shall submit a detailed report to the Competent Authority on the procedures taken between it and the certification service provider within one week of its notifying the Competent Authority of the temporary suspension.
E – If it becomes clear to the Competent Authority, on the basis of the report of the Certification Root Manager, that the technical reasons for the lack of interoperability that led to the temporary suspension of the certification service provider have been remedied in an acceptable and correct manner, it shall notify the certification service provider of the end of the temporary suspension.
F – If it becomes clear to the Competent Authority, on the basis of the report of the Certification Root Manager, that the technical reasons for the lack of interoperability that led to the temporary suspension have not been remedied in an acceptable and correct manner, it may deem the certification service provider to have breached or fallen short in its work, and it shall be notified thereof, and Article (18) of these Regulations shall also be applied to it.

Article 15

Continuity of service in the event of the suspension of the certification service provider, or the cancellation or non-renewal of its licence, shall be according to the following:
1 – Taking the measures necessary for the continued provision of services to the users of the services of the certification service provider whose licence has been cancelled or has expired.
2 – If the suspended certification service provider, or the one whose licence has been cancelled or has expired, does not take the measures set by the Competent Authority towards ensuring the rights of its beneficiaries, including the measures set out in the activity termination plan, the Competent Authority may take whatever procedures are necessary to complete those measures as quickly as possible at the expense of the certification service provider.
3 – The Competent Authority may extend the licence period of the service provider, in coordination with the Certification Root Manager, so that it may liquidate all its operations relating to its beneficiary clients, provided that they are not charged any financial costs relating to the liquidation process.
The Competent Authority may add any other conditions to ensure that the beneficiaries continue to receive the service.

Article 16

Where the Competent Authority issues a decision granting the suspended certification service provider, or the one whose licence has been cancelled or has expired, a temporary extension of the licence granted to it, the following shall be taken:
A – Not soliciting or accepting new beneficiaries or expanding the scope of services for existing beneficiaries.
B – Taking the measures necessary to notify the beneficiaries within five working days from the date of the temporary extension of the licence.
C – Taking the measures necessary for the secure transfer of the beneficiaries to a licensed certification service provider.

Article 17

In the event of cancellation or non-renewal, the certification service provider shall:
A – Retain all electronic records and data relating to electronic certification certificates, and other related data, and not amend their content, until they are disposed of by the Competent Authority or by any other body accredited by it.
B – Provide the Competent Authority with all technical details describing the structure, specifications and size of the data from a technical perspective.
C – Convert and transfer the data, wholly or partly, according to the technical controls set by the Competent Authority, in a manner that preserves the rights of the beneficiaries.
The Competent Authority may seize the technical resources and databases and take the appropriate measures required to protect the rights of the beneficiaries.
The service provider whose licence has been cancelled or not renewed may not – after implementing what is set out in Clauses A, B and C – retain any copies of the electronic records or data resulting from its practice of its activity before the cancellation or non-renewal.

Article 18

If there is a shortcoming or breach in the work of the certification service provider requiring temporary suspension by the Certification Root Manager, the following procedures shall apply:
1 – The Certification Root Manager shall submit a detailed report to the Competent Authority on the existence of a breach or shortcoming in the work of the certification service provider, setting out the cases and aspects of the breach and shortcoming in the work, with reference to operations carried out by the certification service provider that support this.
This shall not apply if the breach or shortcoming is based on paragraph 2 or 4 of Article (13) of these Regulations.
2 – The Competent Authority shall study the report of the Certification Root Manager or the complaint submitted by the concerned parties and commence the investigation directly, in coordination with the Certification Root Manager and by summoning a representative of the certification service provider; the concerned parties shall also be summoned in the case of a complaint.
3 – Except for temporary suspension under paragraph (F) of Article (14), the certification service provider shall not be temporarily suspended except upon a notification from the Competent Authority to the Certification Root Manager requesting it to impose the temporary suspension, and the Competent Authority shall notify the certification service provider thereof. It shall be left to the Competent Authority to assess whether the case requires temporary suspension, and it may impose the temporary suspension before or during the investigation if it deems so.
4 – The certification service provider shall apply the procedures followed with respect to temporary suspension referred to in Articles (8, 15) of these Regulations if it is temporarily suspended under this Article.
5 – The investigation shall be completed within one week from the date of its commencement; if the investigation requires additional data from the Certification Root Manager, the certification service provider or the concerned parties, it may be extended for another week that is not extendable.
6 – If the investigation concludes that a shortcoming or breach by the certification service provider in its work is established, it shall remedy it within a period of one month, which may be extended by the Competent Authority up to a maximum period of three months.
The certification service provider shall be notified of the results of the investigation, the aspects it is required to address to remedy the shortcoming or breach in its work, the period of time available to it to complete this, and whether it will be temporarily suspended.
The certification service provider shall directly submit to the Competent Authority the procedures it will take to address the shortcoming or breach in its work, with a timetable based on the period set for it, and it may request an additional period of time, provided that the total period of time does not exceed three months.
The Competent Authority, in coordination with the Certification Root Manager, shall review those procedures, make its observations on them and approve them before they are commenced with the certification service provider.
7 – Temporary suspension under this Article shall be deemed the first step towards the cancellation or non-renewal of the licence of the certification service provider.
8 – The Competent Authority, in coordination with the Certification Root Manager, shall review the procedures completed by the certification service provider to address the shortcoming or breach in its work, on the basis of the report of the Certification Root Manager; if it has completed the procedures correctly and acceptably, the suspension shall be ended and the certification service provider shall be notified thereof by the Competent Authority.
9 – The Competent Authority, in coordination with the Certification Root Manager, may issue a warning to the certification service provider for its failure to comply with the procedures required to address the shortcoming or breach in its work during the period of time set for those procedures.
In the case of receipt of a complaint from the concerned parties, the same procedures set out in this Article shall be followed, except for Clause (1), which shall be replaced by a complaint form prepared by the Competent Authority and used when submitting the complaint.

Article 19

The Competent Authority may cancel the licence of the certification service provider or not renew it in the following cases:
1 – If it becomes clear to the Competent Authority that the certification service provider persists in the breach or shortcoming in its work, has been temporarily suspended under Article (18) of these Regulations, and has not taken the procedures required to remedy the shortcoming or breach within the period of time set for it.
2 – If cases of temporary suspension are repeated.
3 – If complaints are repeated and their validity is established to a notable extent.
4 – If a penalty is imposed on it in accordance with the provisions of Articles (37) and (38) of the Law.
5 – If it is proven to have committed an error resulting in damage to the concerned parties or to the public interest.
The Competent Authority shall notify the certification service provider of the cancellation or non-renewal of the licence, stating the reasons that led thereto, and in this case the provisions of Articles (15), (16) and (17) of these Regulations shall apply.

Article 20

In all cases, the period of extension of the licence of the certification service provider on the basis of the cases set out in these Regulations shall not exceed six months and shall not be renewable.

Chapter Five: Accreditation of Foreign Bodies Competent to Issue Electronic Certification Certificates

Article 21

The Competent Authority may accredit foreign bodies competent to issue electronic certification certificates in any of the following cases:
1 – If it is one of the bodies approved by the State of Kuwait in an international agreement in force as a body competent to issue electronic certification certificates.
2 – If it meets the rules and requirements set out in Clauses First to Fourth of Article (7) of these Regulations.
3 – If it is among the bodies accredited or licensed to issue electronic certification certificates by the licensing authority in its country, provided that there is an agreement thereon between the foreign licensing authority and the Competent Authority.
These bodies shall be accredited upon a request submitted by them or by the concerned parties on the forms prepared by the Competent Authority, and the Competent Authority may, in the two cases referred to in Clauses (1, 3), accredit those bodies on its own initiative.
Where an application for accreditation is submitted, the Competent Authority shall, after receiving the required documents and data, examine them, verify their soundness and decide on the application within a period not exceeding sixty days from the date of fulfilment of the conditions and procedures set by the Competent Authority; if this period lapses without the accreditation being issued, the application shall be deemed rejected.
The decision accrediting the foreign body shall be issued by the Competent Authority, and shall specify the conditions for its renewal and its term of four years or the term of validity of the agreement, whichever is shorter. The Competent Authority may cancel or suspend it by a reasoned decision.

Article 22

Foreign bodies accredited in accordance with the preceding Article may request the Competent Authority to accredit the types or categories of electronic certification certificates they issue. When accrediting the types and categories of foreign certificates, the Competent Authority shall determine their equivalents among the electronic certification certificates issued by licensed bodies in the State of Kuwait, and the mechanism for, and acceptance of, these certificates shall be determined by the Competent Authority.

Article 23

The accredited foreign body shall comply with all provisions of the accreditation issued to it by the Competent Authority. If the accredited foreign body violates any of them, ceases to practise the accredited activity, merges its establishments into another body, or assigns the licence to third parties without obtaining the prior written approval of the Competent Authority, the Competent Authority may issue a decision cancelling the licence or withdrawing the accreditation granted to the foreign body to issue electronic certification certificates, or suspending the effect of either of them.
In cases of cancellation, withdrawal of accreditation or suspension, the Competent Authority may take the appropriate measures in this regard to protect the rights of the concerned parties.

Chapter Six: Provisions on Sending Paper Documents

Article 24

In connection with the sending of the paper documents referred to in paragraph (F) of Article (27) of the Law, government entities shall comply with the following:
1 – The request to send paper documents shall be clear and announced electronically on the same page on which those tasks are carried out.
2 – If the content of the paper documents required to be sent is available as electronic data in electronic data processing systems of the government entities competent for the paper documents, the requesting government entity may use those data electronically after the approval of the government entity competent for the paper documents, and thereby dispense with requesting the sending of paper documents for the tasks set out in Article (26) of the Law.
3 – Government entities competent for paper documents may issue a true electronic copy of the paper document for use in electronic transactions, and the technical characteristics of the true electronic copy shall be specified so as to protect it and its content from any amendment or deletion, according to standards set by the Competent Authority.
A government entity may request an electronic copy of any paper document required to be sent to it for carrying out any task set out in Article (26) of the Law instead of sending the paper document itself, in accordance with the characteristics, conditions and provisions required for this purpose.

Chapter Seven: Procedures and Controls Governing Access to, Erasure of and Amendment of Personal Data and Information

Article 25

For a person to access personal data or information in accordance with Article 33 of the Law, the personal data and information shall relate to him, and the request shall be submitted by him or by his legal representative after payment of the prescribed fees.

Article 26

The following shall be required for the erasure or amendment of any personal information or data of persons in accordance with Article 36 of the Law:
1 – The request for amendment shall be submitted by the person to whom such personal data or information relate, or by his legal representative, after payment of the prescribed fees.
2 – The erasure of personal data or information shall be only in the case of correcting an error, as determined by the laws in force, and the data and information prior to the erasure process shall be retained without being circulated.

Article 27

The procedures prescribed in Article 34 of the Law shall apply to access to, erasure of and amendment of personal data and information.

Chapter Eight: Electronic Payment

Article 28

Every financial institution engaged in electronic payment business in accordance with the provisions of Articles (28), (29), (30) and (31) of the Law shall comply with the instructions, conditions and procedures relating to electronic payment issued by the Central Bank of Kuwait.

Chapter Nine: Fees

Article 29

1 – Government entities shall not charge government entities that apply to obtain data or information recorded in their records or in their electronic processing systems any fees for such data or information, to the extent that this does not conflict with the laws regulating this matter.
2 – Without prejudice to the provisions of any other law, a fee of one quarter of a Kuwaiti dinar shall be imposed for obtaining data or information recorded in the records of government entities or in their electronic processing systems.

Chapter Ten: Publication of Judgments

Article 30

Subject to the provision of the last paragraph of Article (37) of the Law, a summary of the final judgment of conviction shall be published on the electronic communications network on any of the following websites:
1 – A website on the Internet concerned with publishing judicial judgments issued in the State of Kuwait.
2 – The websites on the Internet of two daily local newspapers.
3 – The official website of the Ministry of Justice in the State of Kuwait.

Issued on 24 December 2014 and published in the Official Gazette Kuwait Al-Youm on 4 January 2015.