Explanatory Memo - Definitions
2. CHAPTER I: Interpretation, Objects and Application
2.1 Several definitions now refer simply to the definition given to that term or word in another Act. Although we recognise that requires cross-referencing as between Acts, if the other Acts change then this one would have to change every time to reflect the exact definition if we were to copy the existing definition into this Act. For reasons of flexibility and accuracy we consider this to be a more sensible approach.
2.2 The International Telecommunications Union (ITU) has identified the following categories of e-commerce;
- Subscription and usage-based telephony, online, and Internet access services
- Subscription or transaction-based information services and software sales
- Consumer retail sales
- Business-to-business wholesale and retail services and sales
- Advertising and marketing services
- Financial services and transactions
- Government services and information; and
- Ancillary functions contributing to business/commercial activities.
With this in mind we have proposed a new definition of "electronic transactions" which includes commercial and non-commercial transactions.
This definition is based largely on the definitions of "consideration",
"supplier" and "transaction" from the Consumer Protection Act, 2008 (CPA), for consistency. These definitions are important when it comes to unsolicited communications, dealt with in Chapter VII.
2.3 We have also had regard to the definitions advanced by the OECD, other jurisdictions, and the ITU. In particular we note the ITU's guidelines in the context of a review of e-commerce in Caribbean countries in 2011,
http://www.itu.lnt/ITUD/projects/IT...A_Assessment_Electronic_Transactions_V2-E.pdf, which are generally applicable. The guidelines feature eight categories of general principles which are:
(i) Transparent and Effective Protection for Consumers which is not less than the level of protection afforded in other forms of commerce.
(ii) Fair Business, Advertising and Marketing Practices by businesses engaged in electronic commerce.
(iii) Online Disclosures - Clear and obvious disclosures.
(iv) Confirmation Process included in the electronic transaction affording the consumer an opportunity to express an informed and deliberate consent to the purchase; and retain a complete and accurate record of the transaction.
(v) Secure Payment mechanisms, including information on the level of security such mechanisms afford.
(vi) Dispute Resolution alternatives accessible in a timely manner without undue cost or burden
(vii) Privacy in accordance with the recognized privacy principles set out in the OECD Guidelines Governing the Protection of Privacy and Transborder Flow of Personal Data (1980) to provide appropriate and effective protection for consumers.
(viii) Education and Awareness to educate consumers about electronic commerce, to foster informed decision-making by consumers and to increase business and consumer awareness of the consumer protection framework that applies to their online activities.
2.4 We have noted these principles in proposing other changes to the Act.
2.5 To remove confusion regarding the different "authorities" in the Act, we have defined the Authority responsible for accreditation of authentication products as the "Accreditation Authority" and the Domain Name Authority is simply called ".zadna".
2.6 The definition of a "cryptography provider" is broad and can be construed to mean that even a person who installs software in a computer could be a cryptography provider. This clause in the Act was meant to refer only to people or entities that develop cryptography products and services. The phrase has been reviewed to define "cryptography providers" as entities or individuals that develop cryptography products and service and not end users.
2.7 "critical information databases" are now being referred to as "critical information infrastructure" in terms of both international texts and conventions on cyber security, and our own National Cyber Security Policy Framework of March 2012 (the Framework). We have therefore replaced "database" in this term with "infrastructure". In addition, the Framework distinguishes between "national" and other critical information infrastructure, "national" having reference to information that is of national importance, such as security information. We have amended both the definitions and Chapter IX in this regard.
2.8 The ECT Act contains a definition of the Internet' which the SALRC suggests has been superseded by technical revisions determined by engineers and developers, and case law. The suggested amendment describes the internet as binary code, or data, communicated through a network made up of electronic communications facilities using packet switching technology and communicating through TCP/IP, and as including future versions.
2.9 New entities such as the "National Consumer Commission" have been inserted to refer to the regulatory authority established by the CPA. The "JCPS cluster" refers to the cluster of Ministries tasked with Justice, Crime Prevention and Security, which Ministries are important in relation to the protection of South African networks and information, specifically in relation to cyber security. The Bill refers to this Cluster and to the Framework throughout - this is important to enable co-operation and joined up working to ensure that our information and communications systems are protected in a uniform way.
2.10 Although some changes have been made to the definition of "personal information", these have been made in the hope that this particular definition will not change in the final version of the
Protection of Personal Information Bill when it is finally approved. However, other clauses and provisions of that Bill have not been included because we understand that the Bill, when passed, will take precedence over any provisions pertaining to personal information in the ECT Act in any event. The definition of "personal information" has proved to be relatively uncontroversial and is not likely to change. It remains valid and important to the operation of the remainder of the ECT Act however, even if no other changes are made.
2.11 The ECT Act contains definitions of 'registry' and 'registrar' that do not include the.za Domain Name Authority (.zaDNA) as a registrar and registry or registry operator, as they are known in practice. We agree that the relevant authority or the country code top-level domain (ccTLD) administrator, like.zaDNA, should have the same responsibilities as registries or registrars operators with respect to updating repositories and the second-level domain administration. We have made consequential amendments to Chapter X and amendments to these definitions to address this. Furthermore we agree that an applicant for a domain name should remain an applicant until their application is approved and we have amended the definition of "registrant" accordingly. Finally, changes are also proposed to "repository" to reflect its nature as more accurately a registry database.
2.12 New definitions have been proposed including to define domain data as being data specifically used in and with relevance to the domain name registration process and the holding of a domain name. We propose to refer here to "registry data" including domain names, registrant names and contact details, zone records, registration and renewal dates, and any other data as may be prescribed.
2.13 The definition of 'Universal Access' differs in the ECT Act and ECA. In addition, section 82(3) of the ECA empowers the Minister of Communications (Minister) to further determine what constitutes universal service and access, upon the recommendations of the Universal Service and Access Agency of South Africa (USAASA), We propose to remove the definition from the ECT Act which should focus more on transactions, security and use of the internet, than policy goals such as universal service. This belongs more properly in the ECA.
2.14 "Unsolicited communications" are now unlawful unless the recipient has consented to receiving them - the so-called "opt-in" regime now applies. The definition of this term has been guided by the provisions of the CPA. The dti has been consulted in this regard. No consequential changes need to be made to the CPA.
2.15 Because service providers now include not only internet service providers but also wireless application service providers (WASPs), we have included definitions that allow for the recognition of these WASPs and their representative organization.
2.16 As a general matter we note that our review of the legislation has led us to review the penalty and remedy clauses within the Act. Throughout the Act we have replaced reference to a general or specific offence and associated cross-reference to section 85, with specific penalties or remedies for each Chapter. The loss of civil liberty should be a greater deterrent to potential wrongdoers than a financial penalty, therefore we have suggested either a fine up to a maximum or imprisonment with a maximum term, and in the case of service providers, a notice and take down procedure with a notice period. The severity of each offence will be judged on its merits and the adjudicating body or judge as the case may be, will be able to apply the remedy or the fine or imprisonment (as the case may be) to the maximum, in their discretion.
