Law on Electronic Signatures

OBJECT OF THE LAW. The purpose of this Law is to recognize and regulate the use of electronic signatures applicable to all types of information in the form of data messages, granting them the same validity and legal efficacy as the use of a handwritten signature or other analogous signature that entails a manifestation of will by the signers, provided that the requirements and procedures established in this Law are complied with. This Law does not alter the norms relating to the celebration, formalization, validity and efficacy of contracts and any other legal acts, except as regards the use of electronic means.

SCOPE OF APPLICATION. This Law applies to those electronic signatures that, placed on a data message or added or logically associated thereto, can bind and identify the signer, as well as in its case, to the provision of additional services, such as guaranteeing the authenticity and integrity of electronic documents or guaranteeing the moment of issuance.

DEFINITIONS. For the purposes of this Law, the following shall be understood as:

• 1)

  "ELECTRONIC SIGNATURE": Data in electronic form recorded in a data message, or attached or logically associated thereto, which can be used to identify the signer in relation to the data message and to indicate the will that such party has regarding the information recorded in the data message;

• 2)

  "ADVANCED ELECTRONIC SIGNATURE": One certified by an accredited service provider, which has been created using means that the holder maintains under its exclusive control, in such a way that it binds exclusively to the same and to the data to which it refers, allowing the subsequent detection of any modification, verifying the identity of the holder and preventing it from disclaiming the integrity of the document and its authorship.

• 3)

  "CERTIFICATE": Any data message or other record that confirms the link between a signer and the signature creation data;

• 4)

  "ELECTRONIC CERTIFICATE": Any data message provided by a "Certification Service Provider" that attributes certainty and validity to the electronic signature;

• 5)

  "DATA MESSAGE": Information generated, sent, received or filed or communicated by electronic, optical or similar means, such as, among others, Electronic Data Interchange (EDI), electronic mail, telegraph, telex or facsimile;

• 6)

  "SIGNER": The person who possesses the signature creation data and who acts on their own account or on behalf of the person they represent;

• 7)

  "CERTIFIER OR CERTIFICATION SERVICE PROVIDER": The accredited natural or legal person who issues certificates and may provide other services related to electronic signatures;

• 8)

  "ACCREDITATION": The title granted by the General Directorate of Intellectual Property to Certification Authorities to provide electronic certificates and authenticate signatures, once the requirements established in this Law have been fulfilled; and,

• 9)

  "RELYING PARTY": The person who may act on the basis of a certificate or an electronic signature.

TECHNOLOGIES FOR EQUAL SIGNATURE. The provisions of this Law shall be applied in such a way as not to exclude, restrict or deprive of legal effect any method for creating an electronic signature, provided that it complies with the requirements stated in Article 8 or otherwise complies with the requirements of applicable law.

USE OF ELECTRONIC SIGNATURE BY THE STATE. Authorization is granted to the Legislative, Executive and Judicial Powers, to the Supreme Electoral Tribunal, as well as to all decentralized public institutions and non-state public entities and any sector public dependency for the use of electronic signatures in electronic documents in their internal relations, among themselves and with private parties.

VALIDITY OF ACTS AND CONTRACTS WITH ELECTRONIC SIGNATURE. Acts and contracts granted or celebrated by natural or legal persons, subscribed by means of electronic signature, shall be valid in the same manner and shall produce the same effects as those celebrated in writing and on paper support. Such acts and contracts shall be deemed as written, in cases in which the Law requires that they be recorded in that manner, and in all those cases in which the Law foresees legal consequences when they are equally recorded in writing. The provision in the preceding paragraph shall not be applicable to acts or contracts granted or celebrated in the following cases: 1) Those in which the Law requires a formality that is not susceptible of being fulfilled by electronic document; and 2) Those relating to family law. The electronic signature, whatever its nature, shall be treated as a handwritten signature for all legal purposes.

REQUIREMENT OF ADVANCED ELECTRONIC SIGNATURE. Electronic documents that have the quality of public instrument must be subscribed by means of advanced electronic signature. Otherwise, they shall have the evidentiary value that corresponds, in accordance with the general rules.

REQUIREMENTS OR LEGAL ATTRIBUTES OF ELECTRONIC SIGNATURE. When the Law requires that a communication or contract be signed by a party, or foresees consequences in the event that it is not signed, this requirement shall be deemed fulfilled with respect to an electronic communication if: 1) If a method is used to determine the identity of that party and to indicate the will that such party has regarding the information recorded in the electronic communication; and, 2) The method employed: a) Either is as reliable as is appropriate for the purposes for which the electronic communication was generated or transmitted, taking into account all the circumstances of the case, including any applicable agreement; or b) It has been demonstrated in practice that, by itself or with the support of other evidence, said method has fulfilled the functions stated in numeral 1) above. The electronic signature shall be considered reliable through compliance with the requirements referred to in the preceding paragraph, provided that it incorporates the following:

• 1)

  The signature creation data, in the context in which they are used, correspond exclusively to the signer;

• 2)

  It is susceptible of being verified;

• 3)

  The signature creation data were, at the moment of signature, under the exclusive control of the signer;

• 4)

  It is possible to detect any alteration of the electronic signature made after the moment of signature;

• 5)

  It is bound to the information or data message, in such a way that if these are changed, the electronic signature is invalidated; and 6) It is in conformity with accepted regulations. The provision in this Article shall be understood without prejudice to the possibility that any person demonstrate in any other manner the reliability of an electronic signature; or present evidence that an electronic signature is not reliable.

CONDUCT OF THE SIGNER OR SUBSCRIBER. The signer or subscriber must:

• 1)

  Receive the electronic signature from the Certification Authority or generate it, using a method authorized by it;

• 2)

  Provide the information required by the Certification Authority;

• 3)

  Fulfill the obligations arising from the use of Electronic Signature;

• 4)

  Act with reasonable diligence to prevent unauthorized use of its signature creation data;

• 5)

  When a certificate is used to endorse the electronic signature, act with reasonable diligence to ensure that all declarations it has made in relation to the life cycle of the certificate or that are to be recorded in it are accurate;

• 6)

  Be responsible for the obligations arising from the unauthorized use of its signature, when it has not acted with due diligence to prevent its use, except that the recipient knew of the insecurity of the Electronic Signature or has not acted with due diligence; and,

• 7)

  Timely request the revocation of certificates. The signer shall bear the legal consequences entailed by the failure to comply with the obligations provided for in this Article.

MODIFICATION BY AGREEMENT. The parties may establish exceptions to this Law or modify its effects by agreement, provided that such agreement is valid and effective in accordance with applicable law.

CHARACTERISTICS AND REQUIREMENTS. Natural persons and legal persons, both public and private, who are authorized by the competent Authority to operate as such and who comply with the requirements established by it, may act as Certification Authorities or Certification Service Providers, based on the following conditions:

• 1)

  Have sufficient economic and financial capacity to provide the services authorized as a certification authority, as well as the human resources and legal ethics that its status demands;

• 2)

  Have the technical capacity and elements (equipment and computer programs) necessary for the generation of electronic signatures, guaranteeing their authenticity, for the issuance or processing of certificates and the preservation of data messages and consultation of records, in the terms established in this Law; and,

• 3)

  Availability of information for the signers named in the certificate and for the parties that rely on it. The legal and administrative representatives may not be persons who have been convicted to deprivation of liberty, or who have been suspended in the practice of their profession for serious violation of ethics. This inability shall remain in force for the same period that Penal or Administrative Law establishes for such purpose. Notaries who meet the conditions expressed shall be automatically authorized to act as a certification authority. The provisions of the preceding paragraph shall be applicable to them, as the case may be.

ACTIVITIES OF THE CERTIFICATION AUTHORITY. The Certification Authority may perform, among others, the following activities:

• 1)

  Issue certificates in relation to electronic signatures of natural or legal persons;

• 2)

  Issue certificates regarding verification of alteration between the sending and receipt of the data message;

• 3)

  Offer or facilitate the services of creation of certified electronic signatures;

• 4)

  Offer or facilitate the services of registration and chronological time-stamping in the generation, transmission and receipt of data messages; and,

• 5)

  Offer the services of filing and preservation of data messages.

DUTIES OF THE CERTIFICATION AUTHORITY. The certification authority shall have, among others, the following duties:

• 1)

  Issue certificates in accordance with what is requested or agreed with the subscriber,

• 2)

  Adopt reasonable measures to determine with accuracy the identity of the signature holder and of any other fact or act it certifies;

• 3)

  Implement security systems to guarantee the issuance and creation of electronic or digital signatures, the preservation and filing of certificates and documents on data message support;

• 4)

  Guarantee the protection, confidentiality and proper use of information supplied by the subscriber,

• 5)

  Guarantee that all statements and material manifestations are accurate and complete;

• 6)

  Promptly address requests and material claims, ensuring that they are accurate and complete;

• 7)

  Provide to the holders of signatures a means to give notice that the electronic signature endorsed is in question;

• 8)

  Supply the information required by the competent administrative or judicial entities in relation to electronic signatures and issued certificates, and in general, about any data message under its custody and administration;

• 9)

  Allow and facilitate the performance of audits by the General Directorate of Intellectual Property;

• 10)

  Maintain an electronic register of the issued certificates; and,

• 11)

  Provide to the relying party reasonable means that allow it to determine through the certificate:

  • a)

    The identity of the certification service provider;

  • b)

    That the signer named in the certificate had under its control the signature creation data at the moment the certificate was issued;

  • c)

    That the signature creation data were valid on the date the certificate was issued or before it;

  • d)

    The method used to verify the identity of the signer;

  • e)

    Any limitation of the purposes or value with respect to which the signature creation data or the certificate may be used;

  • f)

    Whether the signature creation data are valid and are not in question;

  • g)

    Any limitation of the scope or degree of responsibility that has been established by the certification service provider;

  • h)

    Whether there is a means for the signer to give notice that the signature creation data are in question, in accordance with the provisions of Article 8 of this Law; and, i) Whether a service is offered to revoke the certificate in a timely manner. The certification service provider shall bear the legal consequences entailed by the failure to comply with the requirements stated in this Article.

REMUNERATION FOR THE PROVISION OF SERVICES. The remuneration for the services of the certification authority shall be freely established by it.

CONDUCT OF THE RELYING PARTY ON THE CERTIFICATE. The relying party on the certificate shall bear the legal consequences entailed by the failure to take reasonable measures to: 1) Verify the reliability of the electronic signature; or 2) When the electronic signature is endorsed by a certificate: a) Verify the validity, suspension or revocation of the certificate; and, b) Take into account any limitation in relation to the certificate.

UNILATERAL TERMINATION. Except by agreement between the parties, the certification authority may terminate the binding agreement with the subscriber by giving notice of no less than thirty (30) days. Upon expiration of this period, the certification authority shall revoke the certificates that are pending expiration. Likewise, the subscriber may terminate the binding agreement with the certification entity by giving notice of no less than thirty (30) calendar days.

CESSATION OF ACTIVITIES BY THE CERTIFICATION AUTHORITY. The authorized Certification Authority may cease the exercise of activities by its own will, provided that it has received authorization from the Accreditation Authority. CHAPTER III OF CERTIFICATES

CONTENT OF CERTIFICATES. A certificate issued by an authorized Certification Authority, in addition to being electronically signed by it, must contain at least the following:

• 1)

  Name, address and domicile of the subscriber;

• 2)

  Identification of the subscriber named in the certificate;

• 3)

  Identification, domicile, address and electronic mail of the Certification Authority;

• 4)

  The public key of the user;

• 5)

  The methodology employed to create and verify the digital signature of the subscriber imprinted in the data message;

• 6)

  The serial number of the certificate; and,

• 7)

  Date and time of issuance, suspension and renewal of the certificate.

ACCEPTANCE OF A CERTIFICATE. Except by agreement between the parties, it is understood that a subscriber has accepted a certificate when the Certification Authority, at the request of the subscriber or of a person in the subscriber's name, has stored it technically and appropriately.

REVOCATION OF CERTIFICATES. The subscriber of a certified digital signature may request the Certification Authority that issued a certificate to revoke it. In any case, the subscriber shall be obligated to request revocation in the following events: 1) For loss of the private key; and, 2) The private key has been exposed or is in danger of being misused. If the subscriber does not request revocation of the certificate in the event the aforementioned situations occur, the subscriber shall be liable for losses or damages incurred by third parties in good faith who relied on the content of the certificate. A Certification Authority shall revoke a certificate issued for the following reasons:

• 1)

  At the request of the subscriber or a third party in the subscriber's name and representation;

• 2)

  Due to death of the subscriber;

• 3)

  Due to liquidation of the subscriber in the case of juridical persons;

• 4)

  Due to confirmation that some information or fact contained in the certificate is false;

• 5)

  The private key of the Certification Authority or its security system has been compromised in a material way that affects the reliability of the certificate;

• 6)

  Due to cessation of activities of the Certification Authority; and,

• 7)

  By court order or from a competent administrative entity.

TERM FOR PRESERVATION OF RECORDS. The records of certificates issued by a Certification Authority must be preserved for the term required by the Law that regulates the particular legal act or transaction. CHAPTER IV SUBSCRIBERS OF ELECTRONIC SIGNATURES

DUTIES OF SUBSCRIBERS. The duties of subscribers are:

• 1)

  To receive the electronic signature from the Certification Authority or generate it, using a method authorized by it;

• 2)

  To supply the information required by the Certification Authority;

• 3)

  To maintain control of the electronic signature; and,

• 4)

  To timely request revocation of the certificates.

RESPONSIBILITY OF SUBSCRIBERS. Subscribers shall be responsible for the falsity, error and omission in the information supplied to the Certification Authority and for the nonfulfillment of their duties as a subscriber. CHAPTER V OF THE ACCREDITATION AUTHORITY

FUNCTIONS OF THE ACCREDITATION AUTHORITY. The General Directorate of Intellectual Property dependent on the Institute of Property (IP), shall be the entity legally authorized to act as the Accreditation Authority, and shall have the following attributions:

• 1)

  To grant authorization to Certification Authorities to operate in the national territory;

• 2)

  To ensure the functioning and efficient provision of service by the Certification Authorities;

• 3)

  To conduct technical audit visits to the Certification Authorities;

• 4)

  To revoke or suspend authorization to operate as a Certification Authority;

• 5)

  To impose sanctions on Certification Authorities in case of noncompliance with obligations derived from the provision of service;

• 6)

  To order the revocation of certificates when the Certification Authority issues them without compliance with legal formalities;

• 7)

  To issue certificates in relation to electronic signatures of the Certification Authorities;

• 8)

  To ensure compliance with constitutional and legal provisions regarding the promotion of competition and restrictive commercial practices, unfair competition and consumer protection, in the markets served by the Certification Authorities; and,

• 9)

  To issue instructions regarding the proper compliance with the provisions to which Certification Authorities must be subject. CHAPTER VI SPECIAL REGIME

RESPONSIBILITY. Certification Authorities shall be responsible for damages and injuries that in the exercise of their activity they cause due to certification or homologation of electronic signature certificates. In any case, it shall correspond to the Certification Authorities to demonstrate that they acted with due diligence.

SANCTIONS. The General Directorate of Intellectual Property, in observance of due process and the right of defense, may impose on Certification Authorities, according to the nature and gravity of the violation, the following sanctions:

• 1)

  Private written admonition;

• 2)

  Institutional fines up to the equivalent of two thousand (2,000) current legal minimum monthly salaries, and personal fines to the administrators and legal representatives of the Certification Authorities, up to three hundred (300) current legal minimum monthly salaries, when it is proven to them that they have authorized, executed or tolerated conduct in violation of the Law;

• 3)

  Immediately suspend all or some of the activities of the offending authority;

• 4)

  Prohibit the offending Certification Authority from providing, directly or indirectly, the services of Certification Authority for a period of up to five (5) years; and,

• 5)

  Definitively revoke the authorization to operate as a Certification Authority. The aforementioned sanctions shall be applied, without prejudice to civil or criminal liability and penalties corresponding to crimes in which, as the case may be, the violators may incur. CHAPTER VII MISCELLANEOUS PROVISIONS

RECOGNITION OF FOREIGN ELECTRONIC SIGNATURES AND CERTIFICATES. Any electronic signature created or used outside the Republic of Honduras shall produce the same legal effects as a signature created or used in Honduras, if it presents an equivalent degree of reliability. Certificates of electronic signatures issued by foreign Certification Authorities or Entities shall produce the same legal effects as a certificate issued by national Certification Authorities, provided that such certificates present a degree of reliability regarding the regularity of their details, as well as their validity and currency. Without prejudice to the provisions of the preceding paragraphs, the parties may agree on the use of certain types of electronic signatures or certificates. Such agreement shall be sufficient for the purposes of cross-border recognition, provided that it is valid and effective in accordance with the Law. Both foreign electronic signatures and foreign electronic certificates shall in any case be valid, provided that there exists a reciprocity agreement between Honduras and the country of origin of the signatory or certification authority.

INCORPORATION BY REFERENCE. Except by agreement to the contrary between the parties, when in a data message there is total or partial reference to directives, norms, standards, agreements, clauses, conditions or terms easily accessible with the intention of incorporating them as part of the content or making them legally binding, it is presumed that those terms are incorporated by reference into that data message. Between the parties and in accordance with law, those terms shall be legally valid as if they had been incorporated in their entirety in the data message.

FUNCTION OF INSPECTION AND REGULATION. The General Directorate of Intellectual Property shall have a period of three (3) months, counted from the publication of this Law, to organize the function of inspection, control and surveillance of the activities conducted by Certification Authorities. Within the same period the respective regulation must be issued.

EFFECTIVENESS. This Law shall become effective after its publication in the Official Gazette "La Gaceta". Given in the City of Tegucigalpa, municipality of the Central District, in the Session Hall of the National Congress, on the thirtieth day of the month of July of the year two thousand thirteen. MAURICIO OLIVA HERRERA PRESIDENT, BY THE LAW RIGOBERTO CHANG CASTILLO SECRETARY GLADIS AURORA LÓPEZ CALDERÓN SECRETARY To the Executive Branch. Therefore: Let it be executed. Tegucigalpa, M.D.C., December 11, 2013. PORFIRIO LOBO SOSA PRESIDENT OF THE REPUBLIC THE SECRETARY OF STATE OF THE PRESIDENTIAL OFFICE. MARÍA ANTONIETA GUILLEN VÁSQUEZ Legislative Branch (DECREE No. 238-2013)

To promote to the rank of Captain the following Officers of Infantry: MEDARDO ARQUÍMIDES REYES PEGO, OSMAN FRANCISCO RODAS GARCÍA, ATILIO RUIZ FUENTES, WILMER RAUL AYESTAS LIRA, ÁNGEL EMILIO CASTILLO AGUIRIANO AND JORGE JOEL CUBIAS IRÍAS; Officers of Engineering: EDGARDO VELÁSQUEZ MEJÍA, ROQUE MARTÍN CERRATO GUEVARA AND FABIO ADALID GARCÍA DOBLADO; Officer of Cavalry: FREDYS ALEXI BAQUEDANO RIVERA; Officers of Armed Forces: ALBERTO MANUEL ANTONIO AMADOR NUÑEZ AND MARIANO A.