ELECTRONIC TRANSACTIONS BILL

[Mr Speaker in the Chair]

Debate resumed.

Dr Toh See Kiat (Aljunied): Mr Speaker, Sir, let me first declare my interest. I am the Chairman of CommerceNet Singapore Limited which is a grouping of commercial companies that has been set up to promote e-commerce, to set standards, to provide feedback on laws and policies to the Government, and as a self-regulatory business association.

Mr Speaker, I have to say too that I have been involved from the early days of this Bill because I was fortunate to have been invited on the Drafting Committee and I have also given my feedback at various times to the various agencies involved in this. Still, as with all committees, there are certain things which of course I feel have to be addressed but were not addressed satisfactorily or, as with committees, I get out-voted.

Sir, I wish to raise these issues publicly in this House for clarification and also to have these aired so that others can join in the debate. As has been evident from the speeches of the Members earlier on before the break, there are many, many more issues which have to be addressed and these may have to be taken up at a different time. This is why even though I was minded to move some amendments to this Bill, I have decided that we should not put barriers in the path of this Bill, but have it go through and then work at refining and fine-tuning it later.

I am in support of this motion, particularly, the four guiding principles that the Minister has stated. These are the principles that, firstly, the Bill must be technology neutral. Secondly, it must be light regulation. Thirdly, it must be certain and transparent. And, fourthly, it must track the global developments in this area: Because if Singapore tries to run too far ahead of the crowd, it could say that it is a leader but there is no point in being a leader when it turns back and see that the rest of the field has actually turned off or sidetracked and gone off in a different direction.

I will now address the specific points of these four guiding principles. First of all, I do share some reservations about its total neutrality, as Prof. Chin mentioned earlier. There is, for example, in clause 3, an over-emphasis on the word "electronic". Clause 3 talks about electronic records, electronic communications, etc. The medium of electronic communications is not the only communication channel for e-commerce, particularly if technology in optical communications and radio wave communications is considered. Like Prof. Chin, I think it appears to be a Bill which gives overdue treatment to the digital signature. I have raised this several times throughout the course of this drafting and I know that efforts have been put in to make sure that there is a set: the electronic signature - which means any procedure that you can have, it is technology neutral. And with digital signature, it is meant only to be a sub-set which gives the law certainty. The intention is good and it is there but, as I will point out later in my speech, does not come through all that well.

The second point, which is a guiding principle, is that it must be light regulation. In other words, we should try and be as sparing with new rules as we can until we are sure that these are necessary. In this context, I would like to highlight clause 9 which aims to make all electronic records generally recognised in law. Prof. Chin has reservations in that if we make this too wide, it could cover a lot of transactions that should not be on paper yet, like consumer transactions, for example. Again, I will raise that in a while. But clause 9 has this intention that if the law allows for an electronic record, then the Electronic Transactions Bill should carry on with it. But where the law is silent, the intention is that this Bill will make it possible. The proviso, however, I feel is like giving with one hand and taking away with the other. We say that it is possible to have electronic records provided the approval of the department or ministry of the Government, organ of State or the statutory corporation, which has supervision over the requirement for the retention of such records, is mandatory.

Sir, I would like to ask the Minister how would a businessman who wants to do e-commerce know whose approval he needs from the thousands of Government agencies around. Most would of course clear with the known regulators, like the MAS, IRAS, Customs and Excise, RCB and the Stock Exchange of Singapore Ltd (SES). What if, after clearing all these points with the agencies involved, one fine day down the road, some obscure Government agency says, "Hey, you didn't check with me and therefore the whole record is invalid." This proviso should be removed in future. This proviso in clause 9(1)(d), particularly, should be tolerated temporarily to give Government agencies time to put in place the control and security measures.

As an illustration, a quick reading of the Companies Act would give confidence that company books, accounts and registers are expressly permitted to be electronic, for example, sections 199 and 395 of the Companies Act. But the average businessman is still not sure if his contractual documents and other papers, such as invoices, for which he needs to verify his tax liability, can be paperless till the taxmen say so. And this means nobody would convert his papers to electronic records with clear confidence. So you have the regulation, but I think the proviso in clause 9(1)(d) has gone too far.

Perhaps, the Minister could take the opportunity to clarify that the Government agencies fully support the use of IT, document processing systems and e-commerce systems and will not place unnecessary burdens in the way of businesses which wish to execute and convert electronic documents, especially if these documents are electronic from the outset of the creation. Otherwise, businessmen would be asked impliedly to maintain two separate systems, ie, paper and electronic.

In terms of certainty and transparency, great efforts have been made to clarify. But like what they say on the Internet websites, "This site is under construction." I would say that this Act is under construction. It is still something which needs to be further worked on.

Mention has been made to clause 4. Clause 4 says that we are trying to do some incremental changes here and we should not be too broad and sweep out all the paper immediately. There are some things that still require paper, for example, as Prof. Chin has pointed out, consumer transactions. We need to protect the consumers, we need to keep certain seriousness and certain warning procedures inside contracts that deal with consumers. At various stages, I have actually raised this issue. Again, as I said, because it has been an issue on which I have been out-voted, I wish to emphasise again that consumer transactions, for example, such as those dealing with guarantees, money lending, hire purchase and even the provisions of the Unfair Contract Terms Act, which Prof. Chin has alluded to, should be included in the list of exclusions in clause 4. And obviously, the Minister has got the power in the subsidiary legislation to introduce this if he is so minded.

Clause 4 too deals with documents of title. This is a clause which is one thing to businessmen and another thing to lawyers because the meaning differs. It is probably useful to clarify that the meaning here is that of law, which means that essentially title deeds which are documents of title to land and negotiable bills of lading which are truly in law only quasi-negotiable and these would have to be specially and specifically covered.

Clause 10 is another clause needing certainty. Prof. Chin has said that this is a clause which is too wide because network service providers cover the whole world. Sir, I beg to differ and because I beg to differ, maybe it is not clear after all. I think this clause is too narrow in scope. Seemingly, it covers only Internet service providers (ISPs). It does not cover resellers of network services, such as Singapore Network Services, for example, or America Online. And it does not cover operators of cybermalls, such as, perhaps, locally, we have Silk Route ventures. It does not cover search engine operators, such as Yahoo and Alta Vista, and other providers of services or networks whose service may be used to disseminate defamatory and infringing works of copyright even when these are beyond their control. If the intention is only to cover ISPs, then I think it is too narrow because there are certain commercial operations like this that also need that protection from defamation and copyright infringement for things that they cannot control, unless the Minister says that this particular clause is a provision only limited to protection of ISPs from hackers and non-subscribers. If so, this is a very restrictive protection and does not give much comfort for e-commerce.

Clause 10(3) deals with third parties over which the service provider has "no effective control". What does this mean? Most service providers can put in their service contracts that the subscribers must not use the service to post illegal or offensive material. They can reserve the rights to terminate services and pull out or block objectionable content and they can indemnify themselves from the consequences of the subscribers' breaches of contract. They can also add, if they so wish, a clause to prohibit the subscribers from defaming others but they cannot prevent such people from deliberately breaching the rules and the agreement. They can only do so by a lengthy court proceeding. This, however, may still be seen to be "effective control" and thus the service provider's immunity would be removed, and that is why I say this provision would only protect the service provider against incursions by hackers and non-subscribers. If this is not the case, I wish the Minister could clarify that.

Going on to clause 13(3)(b), it deals with relationships and it says that if the relationship to the originator of a message is close enough, then it is the message of the originator. Is this relationship contractual, social or fiduciary? Does it mean a degree of proximity as in marriage, in kinship? In other words, does it cover parents, child, siblings, in-laws? Or is it wider than that, covering legal relationships, such as employer/employee, licenser/licensee, landlord/tenant? I think this can be clarified.

Clause 13(4)(c) says that it may be unconscionable to rely on an electronic record. This is a big word. What is the meaning of "unconscionable"? Perhaps the Minister could clarify this too.

Clause 15(1) deals with despatch and it says:

`. despatch of an electronic record occurs when it enters an information system outside the control of the originator .' This is not applicable obviously when an Intranet owner or a service provider sends messages to its own subscribers, because everything is within its control. It does not go out of its control. So, what rules of sending and receipt would apply in this case?

Clause 15(2)(a) says that there is a designated information system that you can send documents to. Should this designated information system be expressly designated? If not, is the mere mention of an e-mail address on my name card sufficient to designate that I intended to receive contractually binding documents at that mail box? This cannot be so, as I could well mean it as a means of social communication only. I give you my e-mail address to chit chat with me, not to send me a contract. In addition, I may not necessarily be indicating an "information system", but essentially a messaging system.

Again, there is this question of designated information system designated by whom and to whom. If I tell X my e-mail address and Z comes along and takes that address from X without my knowledge and consent, am I designating to Z? What if I have it on my name card which I give only to X without intending and not expecting that he should pass it on to Z? And what if I have my professional card and my CASE card and they both designate different e-mail addresses, as they do, can a document binding on my law firm, in this case, be sent to my CASE e-mail address? This is not satisfactory. I hope the Minister can also clarify this.

The neatest rule in an electronic system is really to have a rule which requires actual receipt. This can mean in most cases the actual retrieving or opening of the message by the recipient, and it is up to the sender to stipulate to the recipient that arrival in the latter's mail box is sufficient by prior arrangement or by agreement, if that is what he wants. This is the same as the rules for receipt of messages by fax or telex, except that in situations where a mail box is expressly stipulated as a place of receipt of legally binding documents, then this express designation moves the time of actual receipt to the time when the message is deposited or is capable of being retrieved from the designated mail box. And so I would hope that in future there is a clarification, and mail box can be defined as referring to the server or the system on which the mail service is run.

Moving on to clause 23, there is, I think, a need to have more direct language in this provision. As it stands, the clause can mean one of two things.

(a) It can mean that it is foreseeable that a relier on digital signature will also rely on a valid certificate. And hence, if the issuer has issued a false certificate, there is negligence straightaway without further proof, as foreseeability is a test of the existence of a duty of care.

(b) It can refer to the fact that it is foreseeable that a relier on a digital signature should also go on to check the validity of the certificate issued, failing which he would be held to be negligent.

Which meaning is it (a) or (b)? Or perhaps the law is speaking with a forked tongue! We should be more precise in this respect.

Mrs Lim has mentioned a problem with clause 39. It is the same problem with clause 40 also. Here, the subscriber has got certain obligations, eg, to keep the keys safe and to inform the certification authority (CA) when the private key has been compromised.

There is no clear provision in these two clauses as to whether a breach of this is a criminal offence or it gives rise to civil liability. Mrs Lim seems to think that clause 56 applies because it is a criminal offence, but I do not think it is all that clear.

On the subject of offences, are the penalties for violation of clauses 25, 26 and 42 sufficient? Cheating under sections 419 and 420 of the Penal Code are subject to penalties of up to three to seven years in jail respectively. Under clauses 25, 26 and 42, the penalties are not that serious. Should electronic cheating warrant any less protection? As has been pointed out by Prof. Chin, the instances of consumers being cheated on the Net would be immense, and immensely possible too.

The fourth guiding principle that the Minister has mentioned about this Bill is that it hopes to track global developments in this area, and there are many model laws, for example, that have been drafted by different countries. Some of these are already existing legislation. And I do know that the committee in drafting this Bill referred to provisions as varied as the Utah Digital Signature Act, the Illinois Act, German Act and so on.

Several Members have raised this point that it is good and fine for us to have a law which deals with electronic commerce. But as with all laws, it is territorial in nature. It can only apply to Singapore transactions and to transactions in which the parties stipulate the use of Singapore law. When you have a cross-border transaction as e-commerce is wont to be, then it is difficult to say that Singapore law applies and therefore the consumer must not be lulled into thinking that now he can trade on all these cyber stores in the United States, Germany or Italy with clear laws. The whole idea of tracking international laws and developments in this area, especially the United Nations Commission for International Trade Law model provisions, is that we are able to achieve total harmonisation of the laws when all countries in the world accept the model laws. This is different from a United Nations Convention where all the signatory parties would sign and the law is immediately effective once the different Parliaments pass domestic legislation to accept those laws. But the model law is meant to be something that you can follow at your own pace, at your own time. And so we have actually followed some of the provisions but not all of them.

It is important for consumers and business dealings all around the world, across borders, that there must be maximum harmonisation of laws in different countries, just as there is harmonisation of laws for letters of credit. The International Chamber of Commerce has a set of model provisions which are incorporated into letters of credit contracts by bankers and traders all around the world. And different courts, even though they have different ways of looking at these model provisions, nonetheless, have adopted similar approaches. We hope that if the model laws are adopted all around the world, then the fact that ours is the first Act in this area, it is not going to be too significant.

On the other point of harmonisation, I have argued that the electronic commerce provisions of the Electronic Transactions Bill are separate from the digital signature provisions. I have argued that the two sets of provisions should be kept separate as two separate pieces of legislation. Prof. Chin has earlier on alluded to some of the difficulties in this: Because of all the digital signature provisions, this Bill has become very technical and loaded down with details which should not be there. I feel that in the spirit of the United Nations model laws, for example, they have two separate model laws; one for electronic commerce and one for digital signature. Because when you talk about contractual principles and rules of communication, you are talking about concepts. You are talking about principles and you are not bogged down by the technology and it does not matter what technology is used as long as the procedures are there. Firstly, the technology itself is going to change very fast and very soon digital signatures within three to five years might actually be obsolete. And we should not entrench these provisions into a general Bill.

Secondly, the contractual rule gives rise to civil liability, but most of the digital signature framework gives rise to regulatory and prescriptive provisions, a breach of which gives rise to criminal liability, and this is really trying to mix everything and be all things to all men, which is not very good for clarity.

I know that the EC Policy Committee has argued that this combining of two different laws into one would aid retrieval and reference, but I think, with respect, this is not a strong argument because digital signature is a state of art set of words and people who want to look for laws on digital signatures can look for them under that title. And if they are looking for laws on electronic commerce, I suspect there are not too many laws in our statute books that have got an electronic title, and I do not think therefore it is going to be so difficult to chase. Nonetheless, if they become two Bills, they could cross refer to each other and, ultimately, electronic searches are possible in Singapore, since we have statutes on CD-ROMs. Then, a good search engine is really all that you need.

Sir, I would agree that we cannot burden an electronic transaction Bill with all these technical provisions, but it is now a fact and I would hope that eventually we can rethink this and in the next set of rules, try to separate the technical from the clearly conceptual and the legal principles. I think this is possible and I look forward to that day.

Dr Tan Boon Wan (Ang Mo Kio): Sir, I rise in support of this Bill.

It is not only important and necessary in our growing IT oriented society but timely as we and the world move quickly to embrace electronic commerce. This Bill will give legal standing to electronic transactions which will be the basis of a growing number of commercial exchanges. However, I am concerned with the wide scope of clause 48(1) that appears to taint with illegality innocent acts like the forwarding of e-mail and information obtained from the Internet. We must not inadvertently set obstacles to curtail the usefulness, potential and growth of a medium of communication of the future. I would like the Minister's assurances that the provision and others in this Bill do not inadvertently taint innocent exchanges and acts between parties on the Internet.

Mr Lee Yock Suan: Mr Speaker, Sir, I wish to thank all the Members who have spoken for their support of the Bill, even though some of them have reservations about very specific legal or technical aspects of this Bill. I will try and respond to the main points that have been raised. I can assure Members that my officers have been listening very carefully to all the points made and they will refer them to the relevant Ministries and agencies to further study this matter. This Bill really represents the best effort up to this point in time by the officers concerned to deal with a very complicated area which is fast evolving. Like Hong Kong, Australia, US and so on, we are trying to position ourselves at the forefront of this fast developing field which holds great potential for us. I think there is a good possibility for us to become an electronic commerce hub and to be a place where people have confidence in doing business on the Net, making use of our trustee services and so on, because of our record of reliability, transparency and the high regard of the international community for our laws and the judicial process. This is an area we want to position ourselves quickly to try and take advantage of what is fast evolving. In the process, they have come out with a Bill which is quite technical. They have assured me that they have tried to make this Bill neutral so that later on when there are other kinds of technology they can be incorporated fairly readily. This remains to be seen. But there is no big problem because, if need be, the Bill can be refined and further improved upon.

I agree with Members that public education is very important. It is not just a question of investing a lot of money into Singapore One, infrastructure and so on. We must get people to use it. This means changing the habits of people. They may prefer to go shopping and make it a day's outing for the family. We are trying to make it convenient for people to shop on the Net and also to do business, especially cross border business. We are not trying to cater just for Singaporeans. Of course, Singaporeans, being so used to changes in the way we do things, are a good test bed, as it were. Once we have wired up the whole island into an intelligent island, we can try out new services, video-on-demand, education and of course e-commerce. That is an area where a lot of people are putting in effort and we ourselves are involved in the international arena. For example, in APEC, we are working with Australia. We co-chair this APEC Task Force on E-Commerce. So we have raised the profile of Singapore to be one of the key players in this area.

It is very important that we have this education programme, which has to be an on-going effort, to bring the public on board and to make them confident of what we are trying to do. So this whole law is to give confidence to consumers and businesses to make use of the systems that have been developed.

One of the systems that NCB has developed is the digital signature system which makes use of a dual key system where one party holds a private key and the so-called certification authority certifies that this is indeed the person and there is a public key that can be matched with this private key through some computer process so that it can assure the two parties that in fact they are dealing with the people they profess to be. So this process of identification comes in.

This system also helps to ensure that the documents are not altered once they have been signed. I have been told that this process actually does that. This will give extra confidence to the businesses and the consumers. Even without this system, in fact, a lot of business has already been done. For example, those who order on mail service or order on the Internet and you give your credit card numbers. In fact, you are exposing yourself to misuse of the credit card numbers.

Whereas if people were to use this system here, at least they have the assurance. For example, if you trade shares and you bid COEs or other big transactions, the parties involved are really the parties they claim to be, and there is assurance that the documents are secure and the process is safe, and where there are disputes the law tries to provide for those disputes. It has to be read together with other kinds of laws governing fraud, contracts and so on. This is to make it such that transactions done on the Net electronically can also be accepted in a court. Government ministries and departments like the Inland Revenue Authority are gradually moving on to this paperless world on an opt-in system. Not everything can be done paperless. There are certain areas like wills and title deeds where you still need paper. The Bill provides for those areas to be exempted. Later on, when we are ready we can bring them in. So to answer Dr Toh See Kiat's point about businessmen being confused, I think there should be no confusion here because it depends on what area you are involved with. It is for the Government ministry or department to say, "Okay, from now on, we can accept the electronic documents for this purpose." So businessmen will have to know what are the areas they need to look into and, if necessary, clarify with the departments concerned. There is no central body responsible for this. It is up to the different Ministries and agencies to come on board as and when they are ready. Even when they come on board, they may still insist that certain documents be kept on paper form.

In using this system, of course, there are responsibilities of the parties involved, not only the certification authority, but also the holder of the private key. Just like you would not allow your ATM card to be used by your family members, you must also be careful that you do not allow your family members easy access to these keys and misuse them.

In addition, following this Bill, there is another Bill known as the Computer Misuse (Amendment) Bill which will be enhancing penalties for different kinds of fraud or hacking and so on. So we are trying to do all these things to provide the technical and legal infrastructure, enhance the penalties and so on, to make sure that we are in a position to make use of this technology and take advantage of this new and exciting field that opens up vast opportunities for us in the field of business.

On the point about the use of the term "certification authorities", I have been told that in fact this is the term that has been internationally recognised and used in the USA and other OECD countries. I agree with the Member that in reading this Bill, one gets the impression that "authority" often refers in our case to Government. But it is a matter of getting used to the term and, if need be, we can of course make changes later on.

Mrs Lim Hwee Hua asked how this would apply to cross border situations. What are the liabilities and so on? This Bill does provide for the possibility of cross certification. For example, the NCB has signed a memorandum of understanding with its counterpart in Canada to recognise each other's certificate. Through this process, we can extend the coverage of this law to also the other parties, or the contracting parties themselves can opt to be covered by certain laws. So those situations could be provided for.

This new technology provides a lot of scope for the small businesses because through this means they are able, for example to create their web page, which can then allow them to access the international market. There have been instances of companies which are very small, for example in Australia, which are able to grow their business through making use of the system. So we have to help our small industries through various means, through funding support for example, in computerisation, through helping them to hire consultants and so on, to get them on to this new process. So my Ministry and the relevant statutory boards will work together with the SMEs to educate them and help them in this process. I think this is a great opportunity for them because it levels the field. It is not only the big players who are able to make use of this electronic commerce but also the small firms. There could be possibilities, for example, of central bureaus which provide service to these companies so that it is not too costly for them to develop their own systems. So they can make use of a common system to get on to the world markets.

Of course, in the process, it may also cut out certain middleman roles. There will be certain businesses which will be affected, because when the seller can reach the buyer directly, they do not need the middleman. This may be true in theory but, in practice, for big deals you still want to see the person. It is a matter of trust. So it is unavoidable that there must still be person to person contacts and there will be a role for the middleman in marrying these parties. So it cannot displace this middleman role in that situation. It might be more useful in cases like where you are trying to sell books or relatively small items. There again, because of our physical location and our shipping and airport facilities and so on, we can combine the commerce area, the Internet, the ease of communication, the trust and so on, with our physical infrastructure to position ourselves so that we are able to service the region and they are able to place their orders for products which are then kept here, whether it is books or consumer items or spare parts. There again, combining the Internet possibilities with all the logistic possibilities, I think, will open up a great new area for us.

Prof. Chin touched on quite a few legal points. As I said, I will ask my officers to look further into them. He was concerned that the exemptions given to Internet service providers are too broad and so forth. This is an area which has been looked into very carefully. The Attorney-General's Chambers have been involved in this area and perhaps I could just read out to Members their comments on this point:

`Clause 10 was drafted after very careful consideration of the scope of protection that should be granted to network service providers. Special attention should be given to the words "merely provides access". These words are in a sense the linch-pin of the section. Protection is only available where the network service providers merely provide access. In other words, where the service provider is merely fulfilling a conduit role in the transmission of content from the originator to the end user. This conduit-only role would occur, for example, when Internet access service providers provide connectivity services that allow their subscribers to access web sites in far flung corners of the globe. In such a case, these companies are not aware of, have no control over, and should not be held responsible for the content that the user obtains from these web sites. This type of protection is similar to the protection enjoyed by the postal service in respect of the content in postal mail. However, if the network service provider does anything more than merely provide access, then the protection is not available to him. Two examples are:

(a) where the network service provider hosts on its servers or servers under its control the content in question. In such a scenario, the service provider has direct and actual control over the content and cannot in respect of the content be merely providing access; and

(b) where the network service provider does not host but adopts by reference or hyperlinking the content of a third party. In such a scenario, the network service provider may, by endorsing it, be deemed to have adopted the content as its own. Hence, if a network service provider recommends or points users to content which infringes intellectual property rights, he may be deemed to have adopted such content to be his own, and may be held responsible for contributing to the infringement of the copyright owner's rights.

But I would like to emphasise that clause 10 is not intended to impose or create liability when there is currently no liability under common law. What it does is to make it clear that there is no liability within certain restricted circumstances where the provider does no more than merely provide access.

Much would depend on the facts of each particular case. Clause 10 leaves it to a court to decide in each instance whether the network service provider has in fact done more than merely provide access. I would like to point out that clause 10 does not absolve the network service providers from regulatory regimes such as the Singapore Broadcasting Authority's Class Licence Scheme which requires some service providers to prohibit access to certain objectionable material.

Finally, I would like to assure the Member that we are following international trends very closely. If there is a need to fine-tune clause 10 in the light of the experience of other countries or other international developments, we will do so.'

.So this is the response from the Attorney-General's Chambers on this particular point.

I think I have covered most of the points. If Members feel that I should cover something more adequately, please let me know.

Question put, and agreed to.

Bill accordingly read a Second time and committed to a Committee of the whole House.

The House immediately resolved itself into a Committee on the Bill. - [Mr Lee Yock Suan].

Bill considered in Committee; reported without amendment, read a Third time and passed.