Electronic Signatures & File What One Needs to Know

Transcription

1 Electronic Signatures & File What One Needs to Know Zachary Gifford, Associate Director Systemwide Risk Manager & Daniel Howell, Program Director CSURMA Alliant Insurance Services

2 Session Overview California Law Elements of Enforceable On-Line Transactions Electronic Signatures Requirements to Insure Validity ICSUAM 8100 Multiple Languages (Waivers / Informed Consent)? Minors Document Retention Working With Your Friends in IT

3 California Law California law gives an electronic signature the same legal significance as an original signature. The statutes authorizing and explaining the use of electronic signatures in California can be found in the California Civil Code from Sections to Section Collectively, these sections are referred to as the Uniform Electronic Transactions Act, or UETA. The UETA was enacted in 1999 and applies only to electronic signatures created and used as of January 1, California Government Code 16.5 addresses using an electronic signature in written communications with a public entity.

4 Elements of Enforceable On-Line Transactions In short, the basic elements that render electronically signed agreements valid/enforceable, mirror the elements that are required in wet contracts and agreements; Offer Acceptance Consideration Competence/Capacity Mutual Consent Legality

5 CA Code of Regulations Title 2 Division 7 Chapter 10; Digital Signatures Definitions Digital Signatures Must be Created by an Acceptable Technology Criteria for Determining if a Digital Signature Technology is Acceptable List of Acceptable Technologies Provisions for Adding New Technologies to the List of Acceptable Technologies Issues to be Addressed by Public Entities When Using Digital Signatures.

6 What About On-line? Notice disclosure of terms of the agreement Acknowledgment and receipt of agreement Identification and authorization Consent (the signor needs to know that by clicking they are signing) Security (pin/passcode required?) Ready access and retrieval Integrity of records retention practices

7 Insuring the Validity of Electronic Signatures (and Acknowledgements) Electronic signatures and acknowledgements can only be used if the signature and/or acknowledgement can be authenticated and a copy of the authentication and process can be produced upon request. The electronic signature or acknowledgement must be stronger than simply clicking I Agree. CA Government Code section 16.5 and CA Code of Regulations (Title 2, Division 7, Chapter 10, Sections ) set out the requirements for creating a valid electronic signature.

8 ICSUAM Electronic Signatures 200 Digital Signatures 300 Electronic and Digital Signature Implementation 400 Acceptable Use

9 100 Electronic Signatures An electronic signature is an electronic sound (e.g., audio files of a person's voice), symbol (e.g., a graphic representation of a person in JPEG file), or process (e.g., a procedure that conveys assent), attached to or logically associated with a record, and executed or adopted by a person with the intent to sign the record.

10 200 Digital Signatures A digital signature is a specific type of electronic signature that uses cryptographic transformation of data to provide authenticity, message integrity, and nonrepudiation. For a digital signature to be valid, it must be created by a technology accepted for use by the State of California and conform to technologies capable of creating digital signatures as set forth in California Government Code Section 16.5

11 California Government Code Section 16.5 (1) It is unique to the person using it; (2) It is capable of verification; (3) It is under the sole control of the person using it; (4) It is linked to data in such a manner that if the data are changed, the digital signature is invalidated; (5) It conforms to Title 2, Division 7, Chapter 10, of the California Code of Regulations.

12 300 Electronic and Digital Signature Implementation Campuses must develop procedures to identify, evaluate, and document where electronic signatures are permitted and digital signatures are required. Campus and Chancellor s Office standards and procedures for electronic signatures must meet CSU electronic and digital signature standards and may be used for transactions between the CSU and outside parties only when approved by the campus Vice President for Administration/CFO and when both parties have agreed to conduct transactions by digital means.

13 400 Acceptable Use Simple Electronic Signatures may convey intent of an individual to sign a record and are often easier to implement. Simple Electronic Signatures may be acceptable and authorized for internal campus or Chancellor s Office uses involving low risk. Digital Signatures may be used where Simple Electronic Signatures are acceptable and authorized for use. Digital Signatures must be used instead of a Simple Electronic Signature when legally required or when greater risk exists.

14 ICSUAM AOA s Take-away Parroting CSU s practices and policies while also adhering to applicable codes is a good practice.

15 Multiple Languages (Waivers / Informed Consent)? When requiring a waiver/informed consent can it be in multiple languages? Ja or Nein? There is no legal requirement to provide releases in languages other than English. In general, California courts have held that English-language releases signed by adults who cannot read English are valid.

16 Minors What if the participant is a minor? A parent or guardian must sign the form if the participant is a minor. Because the participant s parent or guardian signs the release, there is no need to also have the participant sign the release. May the release for a minor be consented to electronically? No.

17 Nothing says riveting subject matter more than Document Retention Retention must be consistent with your organization s retention policy, regardless of electronic or otherwise. Releases must be stored for at least three years after an activity ends. Documents signed by a parent or guardian on behalf of a minor must be retained for at least three years after an activity ends or until the minor turns twenty, whichever is longer.

18 IT Considerations Terminology i.e. we need the 7 elements addressed not just Identification/Authentication & Security (secure transaction) User Access kiosk? Download? ? Does IT understand ID/Authentication needs. Does IT understand how to establish consent? Document retention needs. Space on the server?

19 Questions?

20