Electronic Transactions – Legal Challenges Navneet R Wasan Joint Director CBI

1. Electronic Transactions – Legal ChallengesNavneet R Wasan Joint Director CBI LEVERAGING THE POWER OF A DIGITIZED AND CONNECTED BUSINESS ENVIRONMENT

2. Electronic Transactions • Competitive business, compulsion to cut costs, need for increased speed and efficiency have resulted in more and more transactions being conducted electronically • Variety of transactions such as contract for purchase and sale of goods, lease agreements, promissory notes, delivery of documents, stock exchange transactions are conducted electronically and the list is endless. • Electronic transaction could take place through a web site, by email, electronic data interchange.

3. Electronic Transactions A transaction created, transmitted and executed in digital or other intangible form over networksMost commonly used for payment processing over internet Stage 1. Exploration Stage 2. Transaction Stage 3. Fulfillment &Return Online purchase transaction Options comparison Decision making (Either online or from a retail outlet) Post-Purchase Tracking & support Information seeking

4. Electronic Transactions – Key Players Shopper / Cardholder Issuer Merchant Certification Authority E-commerce application service provider that authorizes payments Issues digital certificates for use by other parties Acquirer Payment Gateway

5. Electronic Transactions – Typical Life Cycle • The customer obtains a credit card account with a bank that supports electronic payment • The customer receives a digital certificate from by the bank / issuer • Merchants have their own certificates • The customer places an order • The merchant sends a copy of its certificate so that the customer can verify that it's a valid store • The order and payment are sent • The merchant requests payment authorization • The merchant confirms the order • The merchant ships the goods or provides the service to the customer • The merchant requests payment

6. Evolution of Electronic Transactions Traditional businesses have evolved the ‘E’ way and new business propositions have been made possible by progressive web technologies. Level 4 Business Transformation Level 3 Business Integration Level 2 Prospecting Addnl. Features Supplier integration Customer integration Personalisation Multi channel integration Advanced customisation Level 1 Basic Presence Key to success Addnl. Features e-commerce transactions customer self service Communities Basic personalisation Addnl. Features Extensive information Search Basic interactivity Features Product/service information Brochureware Strategic value PLACEHOLDER IN CYBERSPACE CHANNEL EXPLORATION CHANNEL DEVELOPMENT CHANNEL EXPLOITATION

7. Electronic Transactions • Issue which need to be addressed • Whether transaction could be done electronically? Does the domestic laws permit that? • What specific regulations and standards exist and are applicable • Are the transactions carried out trustworthy • Issues which arise when there are cross border transactions • Sharing of information for the purpose of prevention of violation of transactions/ contracts • Cooperation with other countries in sharing information for post incidence investigation

8. Electronic Transactions • Prevention • A cheaper and effective method • Harmonisation of laws, standards and regulations – a necessary pre-requistive • Requires cross border mutual cooperation • Post incident investigation • A costly preposition • Result may depend on technical capability of investigator and tools available to him • Requires regular up-dation of skills – on account of continuously evolving technology

9. Electronic Transactions • Often subject to harmonised laws, standards and regulation in force • Investigation depends on effective and timely mutual cooperation • May not always lead to success • Investigation may depend on assistance coming forth from other nations

10. Electronic Transactions • Regulations & Standards • For safeguarding personal information provided by the user • Assign responsibility by designating one or more employees to maintain security programme • Provide methods to protect information assets which store personal information • Regular risk assessments to identify internal and external threats to the confidentiality of information and put in place safeguards minimising risks • Appropriate security controls to be in place • Effectiveness of security controls to be tested on regular interval

11. Electronic Transactions • Physical security • Restriction standards on physical access to records • Storage of records and data in locked facilities • Administrative security would include • Limit on personal information to be collected • Time limit for which the information can be stored • Specific permission to access the information • Regulation regarding employees access • Procedure for employees proceeding on leave or removed from service • Security drills and training for employees at regular intervals

12. Electronic Transactions • Technical security regulations • Secure user authentication protocols • Secure access control measures restricting access and allocating unbreakable passwords and logging information • Encryption of all records stored especially in portable devices or transmitted over wireless/ internet • Firewall / antivirus/ up to date operating system patches to prevent any breaking in

13. Electronic Transactions • Full disclosure before consumer finalizes the contract • His address, specifications of the item, warranty terms, return policy • Records regarding electronic transaction to be available to contracting parties and to be communicated in the form in which can be retained and accurately reproduced. • Valid and verifiable electronic signatures to be used – must be attached to or logically associated with electronic record. • Electronic signature must identify the signer and be reliable

14. Electronic Transactions • Trustworthiness of the transaction – parties must have faith that records are authentic and unaltered. • Authentication of electronic signatures- person signing is the same who has identified himself • Depending on the type of electronic signatures used and the level of security inherent in that signature it is possible that the electronic signatures may be subject to greater risk of repudiation than a handwritten ink signatures. • Data integrity – accuracy and completeness of information – ensuring that no alteration has been made intentionally or accidently

15. Electronic Transactions • Integrity – must ensure non-repudiation and authenticity • Document must be same as sent by the sender • Document must not be altered either in storage or transmission • Retention of records –for a minimum period and in manner which would make it admissible in court of law as evidence – in case of a dispute

16. Electronic Transactions • International eBusiness Transactions • Use of electronic signatures may be valid in one country but not in another- need to have uniform standards and legal validity • Transferring & storing personal data across borders may be in conflict with domestic laws of another country – urgent need for harmonisation • Harmonization of processes & standards to ensure legal enforceability

17. Electronic Transactions • Encryption standards • eCommerce processes and laws governing these are still evolving & therefore require continuous dialogue among nations for maintaining uniformity • Need for appropriate provisions in Mutual Legal Assistance Treaties (MLATs) • Preservation of evidence on request • Transmission of evidence in admissible format • Sharing of training facilities and best practices between nations

18. Thank you