Reforms to the Regulation of the Electronic Signature Law
Through Legislative Decrees issued in 2021 and 2022, reforms have been approved to the existing Electronic Signature Law, which expand the modalities and functions that Certification Service Providers and Electronic Document Storage Providers, as well as public institutions wishing to be accredited as providers of regulated services, can offer. As a result, it was deemed necessary to issue reforms to the Regulation that develops this law, which were published in the Official Gazette, Volume No. 441, on November 6, 2023, and are now in effect.
Here, we will outline the most significant changes:
- DEFINITIONS
The definition of Foreign Electronic Certificate is added as one issued by a foreign certification service provider that has not been accredited by the Electronic Signature Unit to offer such services in the country but has an equivalent level of reliability according to the parameters of the Law.
Additionally, a Service Provider is defined as a legal entity accredited by the Electronic Signature Unit to provide certification or electronic document storage services.
Lastly, a Physical Document is defined as any information contained in a physical medium, while an Electronic Document is one contained in an electronic medium in a specified format.
- POWERS OF THE ELECTRONIC SIGNATURE UNIT
The competence of the Unit is established in everything related to national accreditation in the field of electronic signatures. It may conduct inspections and audits without prior notice, either in person or remotely, ex officio or by complaint, at the provider’s premises or at a third party with whom the provider has subcontracted infrastructure or electronic services.
The provider is obligated to grant inspectors/auditors access to their information systems, operations, documentation, facilities, and equipment, even when the information is classified as reserved.
All information obtained from such inspections will be recorded in a report, and if any findings or indications of criminal conduct are detected, the Public Prosecutor’s Office will be notified.
- COMPLAINTS
In case of any violation of the electronic invoicing regulations, a complaint may be filed either physically or electronically. The Unit currently offers the option of filing complaints electronically on its website, accessible through the following link: https://firmaelectronica.economia.gob.sv/denuncias/.
- GUARANTEE TO BE PROVIDED
It is established that the calculation for the guarantee to be provided by applicants or accredited service providers will amount to 5% of the assets related to the services for which the applicant seeks accreditation. This calculation should take into account aspects outlined in the law.
Furthermore, the requirement for the guarantee to be issued by a company domiciled in El Salvador is amended, allowing it to be issued by a company authorized by the Superintendence of the Financial System.
- SERVICE PROVIDERS THAT ARE PUBLIC INSTITUTIONS
The obligation for public institutions interested in being accredited is added, requiring them to create and submit an action plan detailing how they will proceed with indemnifying users for damages that may arise during service delivery. This plan should include minimum parameters to be followed, equivalent to the guarantee for private legal entities mentioned in the previous section.
- REQUIREMENTS AND PROCEDURE FOR ACCREDITATION AND REGISTRATION OF SERVICE PROVIDERS
The application for accreditation as a service provider before the Electronic Signature Unit can be submitted in physical format or electronically. The accreditation form must include aspects such as: corporate documentation of the applicant, certifications obtained in the course of their activities or services, and a description of the service to be provided, among other details.
The requirement for proof of payment for accreditation fees is eliminated at this stage, with the payment request being made in subsequent stages.
A 10-business-day deadline is provided to rectify any deficiencies if the accreditation application is rejected, in accordance with the provisions of the Administrative Procedures Law.
- EFFECTS OF ACCREDITATION
The effects of accreditation include registration on the trust lists, and the inspection of the unit at the service provider is removed. However, as previously mentioned, the Unit retains sufficient authority to conduct inspections ex officio or upon complaint, as deemed necessary.
- SERVICE PROVIDER REGISTRATION
The purpose of the registration is to provide visibility into the various service provider accreditations and their status, with this information being accessible through the institutional website. This is currently available and can be consulted through the following link: https://firmaelectronica.economia.gob.sv/proveedores/.
The registration will also include the results of the Unit’s annual review of service providers.
- RECOGNITION OF FOREIGN ELECTRONIC CERTIFICATES
Foreign electronic certificates issued by service providers abroad can be recognized, provided that: a) They are duly accredited in their country of origin by an institution equivalent to the Billing Unit in El Salvador, and b) They are still valid.
Additionally, an agreement between the foreign certificate provider and a national certification service provider is allowed, wherein the foreign provider declares that it meets the requirements for providing national certification services, and the national provider supports this operation and assumes responsibility for any damages caused by the certificate.
- DEMATERIALIZATION OF DOCUMENTS
Dematerialization is not limited to paper-based information but includes information on other physical media such as magnetic tapes, acetates, or similar types. These documents must indicate that they are dematerialized from a physical document to distinguish them.
Electronic document storage service providers must create a dematerialization plan detailing the technology and procedures to be used, which must be approved by the Unit.
- USER IDENTIFICATION
The identity verification of the applicant, prior to issuing any electronic certificate, may be carried out by the certification service provider itself or by any of the identification methods outlined in the law. If the applicant is a natural person, they must present the Unique Identity Document, and if a legal entity, their corporate documentation.
- ELECTRONIC CERTIFICATES FOR LEGAL ENTITIES
Legal entities wishing to use certification services may request it through their legal representative, special executor, or attorney. They have the ability to establish limits on the use of the certificates in accordance with their powers, social agreements, and other applicable documents.
Unions or entities that do not meet the legally established requirements to be considered a legal entity cannot request any type of electronic certificates.
- USER INFORMATION
Once the signature is created by the certification service provider, it must be delivered to the user or certificate holder through any method that ensures the security, confidentiality, and integrity of the signature. The provider is prohibited from retaining a copy of the electronic signature creation data.
- ELECTRONIC DOCUMENTS OF PUBLIC INSTITUTIONS
Documents generated by public institutions may be stored either by the institution itself or through an electronic document storage service provider.
Public institutions may enter into interinstitutional agreements to determine the type of electronic signature to be used when exchanging information between institutions. For administrative acts documented in decrees or resolutions, these must be signed with a certified electronic signature.
The electronic certificates issued to public servants must include a section indicating the functional position and the name of the public institution where they work.
- USE OF SIGNATURES IN RELATION TO PRIVATE PARTIES
Individuals interacting with state entities electronically may use either certified or simple electronic signatures.
Written by: Lic. Camila Aparicio
