The legal framework for advanced electronic signatures is governed by the Business Laws Amendment Act, 2020, and the Kenya Information and Communications Act (KICA).
An electronic signature, according to the Kenyan Law, is data in electronic form that is associated with the identification of a signatory to indicate their approval of the information contained within a data message.
However, the law makes a critical distinction between a standard electronic signature and an advanced electronic signature.
“Advanced electronic signature means an electronic signature which is uniquely linked to the signatory, is capable of identifying the signatory, is created using means that the signatory can maintain under his sole control and is linked to the data… such that any subsequent change to the data is detectable,” KICA states.
Instances Under Which an Electronic Signature is Legal
Legal recognition of electronic signatures is granted through a process that ensures the security of the signature.
For an electronic signature to hold the same as a physical one in a court of law, it must meet the reliability test outlined in Section 83O of KICA.
An electronic signature is legally binding if the signature-creation data, such as private cryptographic keys, is linked exclusively to the signatory.
Additionally, the signatory must have sole control of the signature-creation device at the time of signing.
Where the signature is meant to assure the document’s integrity, any alteration to the information itself after signing must be detectable.
The regulation on the process of establishing whether the signature is reliable is to ensure that there is advanced security, unlike in the traditional paper-based signing.
Also Read: Communications Authority Rolls Out New Specifications for Phones Sold in Kenya
Government Regulation on Electronic Certification Service Providers (E-CSPs)
E-CSPs are licensed entities authorized by the Communications Authority of Kenya (CA)to issue digital signature certificates.
According to the law, the service providers authorized by the CA must use secure systems to guarantee the secrecy and privacy of the signature.
Currently, some of the prominent licensed and accredited providers in Kenya include Evrotrust Technologies, Tendaworld Ltd, Sinam Solutions Ltd, the ICT Authority (ICTA), and eMudhra Technologies Limited.
Legal Exclusions
Despite the Business Laws Amendment Act, 2020, expanding the use of electronic signatures, making them applicable in land transactions and commercial contracts, the law still maintains instances in which the signatures are not recognized.
Section 83B of KICA, the rules regarding electronic signatures do not currently apply to the creation or execution of a will.
In addition, the signatures are not legally binding in negotiable instruments such as checks or documents of title.
Also Read: KRA Digital Team Goes Viral as Kenyans Question Who Runs the Account
Penalties for Misuse of Electronic Signatures
Creating or publishing an electronic signature certificate for fraudulent or unlawful purposes is an offence punishable by up to five years’ imprisonment, a fine of one million shillings, or both.
Additionally, unauthorized access to computer systems or the disclosure of passwords used to gain access is a punishable offence, as it undermines the signatory’s sole control over the rights.
Fraud involving the manipulation of data or computer systems to procure an advantage or cause loss of property falls under Section 84B and results in a fine not exceeding two hundred thousand shillings, imprisonment for a term not exceeding three years, or both.
Knowingly altering a signed document is punishable by a fine of up to five hundred thousand shillings, imprisonment for up to three years, or both.
Additionally, having data or programs intended to commit or facilitate an offence under the Act could result in a fine of up to two hundred thousand shillings, imprisonment for up to two years, or both.
If a company or corporate officials commit an offence, the organization is also guilty of the offence unless it can prove that the act occurred without its consent.
