HF 56

2nd Engrossment - 80th Legislature (1997 - 1998) Posted on 12/15/2009 12:00am

  1.1                          A bill for an act 
  1.2             relating to commerce; providing for the use, validity, 
  1.3             and security of electronic signatures and messages 
  1.4             transmitted in commerce; prescribing penalties; 
  1.5             appropriating money; proposing coding for new law as 
  1.6             Minnesota Statutes, chapter 325K. 
  1.7   BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA: 
  1.8      Section 1.  [SHORT TITLE.] 
  1.9      This chapter may be cited as the Minnesota electronic 
  1.10  authentication act. 
  1.11     Sec. 2.  [325K.01] [PURPOSES AND CONSTRUCTION.] 
  1.12     This chapter shall be construed consistently with what is 
  1.13  commercially reasonable under the circumstances and to 
  1.14  effectuate the following purposes: 
  1.15     (1) to facilitate commerce by means of reliable electronic 
  1.16  messages; 
  1.17     (2) to minimize the incidence of forged digital signatures 
  1.18  and fraud in electronic commerce; 
  1.19     (3) to implement legally the general import of relevant 
  1.20  standards, such as X.509 of the International Telecommunication 
  1.21  Union, formerly known as the international telegraph and 
  1.22  telephone consultative committee; and 
  1.23     (4) to establish, in coordination with multiple states, 
  1.24  uniform rules regarding the authentication and reliability of 
  1.25  electronic messages. 
  1.26     Sec. 3.  [325K.02] [DEFINITIONS.] 
  2.1      Subdivision 1.  [SCOPE.] Unless the context clearly 
  2.2   requires otherwise, the terms used in this chapter have the 
  2.3   meanings given them in this section.  
  2.4      Subd. 2.  [ACCEPT A CERTIFICATE.] "Accept a certificate" 
  2.5   means either:  
  2.6      (1) to manifest approval of a certificate, while knowing or 
  2.7   having notice of its contents; or 
  2.8      (2) to apply to a licensed certification authority for a 
  2.9   certificate, without canceling or revoking the application by 
  2.10  delivering notice of the cancellation or revocation to the 
  2.11  certification authority and obtaining a signed, written receipt 
  2.12  from the certification authority, if the certification authority 
  2.13  subsequently issues a certificate based on the application. 
  2.14     Subd. 3.  [ASYMMETRIC CRYPTOSYSTEM.] "Asymmetric 
  2.15  cryptosystem" means an algorithm or series of algorithms that 
  2.16  provide a secure key pair. 
  2.17     Subd. 4.  [CERTIFICATE.] "Certificate" means a 
  2.18  computer-based record that: 
  2.19     (1) identifies the certification authority issuing it; 
  2.20     (2) names or identifies its subscriber; 
  2.21     (3) contains the subscriber's public key; and 
  2.22     (4) is digitally signed by the certification authority 
  2.23  issuing it. 
  2.24     Subd. 5.  [CERTIFICATION AUTHORITY.] "Certification 
  2.25  authority" means a person who issues a certificate. 
  2.26     Subd. 6.  [CERTIFICATION AUTHORITY DISCLOSURE 
  2.27  RECORD.] "Certification authority disclosure record" means an 
  2.28  on-line, publicly accessible record that concerns a licensed 
  2.29  certification authority and is kept by the secretary.  A 
  2.30  certification authority disclosure record has the contents 
  2.31  specified by rule by the secretary under section 352K.03. 
  2.32     Subd. 7.  [CERTIFICATION PRACTICE 
  2.33  STATEMENT.] "Certification practice statement" means a 
  2.34  declaration of the practices that a certification authority 
  2.35  employs in issuing certificates generally, or employed in 
  2.36  issuing a material certificate. 
  3.1      Subd. 8.  [CERTIFY.] "Certify" means to declare with 
  3.2   reference to a certificate, with ample opportunity to reflect, 
  3.3   and with a duty to apprise oneself of all material facts. 
  3.4      Subd. 9.  [CONFIRM.] "Confirm" means to ascertain through 
  3.5   appropriate inquiry and investigation. 
  3.6      Subd. 10.  [CORRESPOND.] "Correspond," with reference to 
  3.7   keys, means to belong to the same key pair. 
  3.8      Subd. 11.  [DIGITAL SIGNATURE.] "Digital signature" means a 
  3.9   transformation of a message using an asymmetric cryptosystem 
  3.10  such that a person having the initial message and the signer's 
  3.11  public key can accurately determine: 
  3.12     (1) whether the transformation was created using the 
  3.13  private key that corresponds to the signer's public key; and 
  3.14     (2) whether the initial message has been altered since the 
  3.15  transformation was made. 
  3.16     Subd. 12.  [FINANCIAL INSTITUTION.] "Financial institution" 
  3.17  means a national or state-chartered commercial bank or trust 
  3.18  company, savings bank, savings association, or credit union 
  3.19  authorized to do business in the state of Minnesota and the 
  3.20  deposits of which are federally insured. 
  3.21     Subd. 13.  [FORGE A DIGITAL SIGNATURE.] "Forge a digital 
  3.22  signature" means either: 
  3.23     (1) to create a digital signature without the authorization 
  3.24  of the rightful holder of the private key; or 
  3.25     (2) to create a digital signature verifiable by a 
  3.26  certificate listing as subscriber a person who either: 
  3.27     (i) does not exist; or 
  3.28     (ii) does not hold the private key corresponding to the 
  3.29  public key listed in the certificate. 
  3.30     Subd. 14.  [HOLD A PRIVATE KEY.] "Hold a private key" means 
  3.31  to be authorized to utilize a private key. 
  3.32     Subd. 15.  [INCORPORATE BY REFERENCE.] "Incorporate by 
  3.33  reference" means to make one message a part of another message 
  3.34  by identifying the message to be incorporated and expressing the 
  3.35  intention that it be incorporated. 
  3.36     Subd. 16.  [ISSUE A CERTIFICATE.] "Issue a certificate" 
  4.1   means the acts of a certification authority in creating a 
  4.2   certificate and notifying the subscriber listed in the 
  4.3   certificate of the contents of the certificate. 
  4.4      Subd. 17.  [KEY PAIR.] "Key pair" means a private key and 
  4.5   its corresponding public key in an asymmetric cryptosystem, keys 
  4.6   which have the property that the public key can verify a digital 
  4.7   signature that the private key creates. 
  4.8      Subd. 18.  [LICENSED CERTIFICATION AUTHORITY.] "Licensed 
  4.9   certification authority" means a certification authority to whom 
  4.10  a license has been issued by the secretary and whose license is 
  4.11  in effect. 
  4.12     Subd. 19.  [MESSAGE.] "Message" means a digital 
  4.13  representation of information. 
  4.14     Subd. 20.  [NOTIFY.] "Notify" means to communicate a fact 
  4.15  to another person in a manner reasonably likely under the 
  4.16  circumstances to impart knowledge of the information to the 
  4.17  other person. 
  4.18     Subd. 21.  [OPERATIVE PERSONNEL.] "Operative personnel" 
  4.19  means one or more natural persons acting as a certification 
  4.20  authority or its agent, or in the employment of, or under 
  4.21  contract with, a certification authority, and who have: 
  4.22     (1) managerial or policymaking responsibilities for the 
  4.23  certification authority; or 
  4.24     (2) duties directly involving the issuance of certificates, 
  4.25  creation of private keys, or administration of a certification 
  4.26  authority's computing facilities. 
  4.27     Subd. 22.  [PERSON.] "Person" means a human being or an 
  4.28  organization capable of signing a document, either legally or as 
  4.29  a matter of fact. 
  4.30     Subd. 23.  [PRIVATE KEY.] "Private key" means the key of a 
  4.31  key pair used to create a digital signature. 
  4.32     Subd. 24.  [PUBLIC KEY.] "Public key" means the key of a 
  4.33  key pair used to verify a digital signature. 
  4.34     Subd. 25.  [PUBLISH.] "Publish" means to record or file in 
  4.35  a repository. 
  4.36     Subd. 26.  [QUALIFIED RIGHT TO PAYMENT.] "Qualified right 
  5.1   to payment" means an award of damages against a licensed 
  5.2   certification authority by a court having jurisdiction over the 
  5.3   certification authority in a civil action for violation of this 
  5.4   chapter. 
  5.5      Subd. 27.  [RECIPIENT.] "Recipient" means a person who 
  5.6   receives or has a digital signature and is in a position to rely 
  5.7   on it. 
  5.8      Subd. 28.  [RECOGNIZED REPOSITORY.] "Recognized repository" 
  5.9   means a repository recognized by the secretary under section 
  5.10  325K.25. 
  5.11     Subd. 29.  [RECOMMENDED RELIANCE LIMIT.] "Recommended 
  5.12  reliance limit" means the monetary amount recommended for 
  5.13  reliance on a certificate under section 325K.17, subdivision 1. 
  5.14     Subd. 30.  [REPOSITORY.] "Repository" means a system for 
  5.15  storing and retrieving certificates and other information 
  5.16  relevant to digital signatures. 
  5.17     Subd. 31.  [REVOKE A CERTIFICATE.] "Revoke a certificate" 
  5.18  means to make a certificate ineffective permanently from a 
  5.19  specified time forward.  Revocation is effected by notation or 
  5.20  inclusion in a set of revoked certificates, and does not imply 
  5.21  that a revoked certificate is destroyed or made illegible. 
  5.22     Subd. 32.  [RIGHTFULLY HOLD A PRIVATE KEY.] "Rightfully 
  5.23  hold a private key" means the authority to utilize a private key:
  5.24     (1) that the holder or the holder's agents have not 
  5.25  disclosed to a person in violation of section 325K.13, 
  5.26  subdivision 1; and 
  5.27     (2) that the holder has not obtained through theft, deceit, 
  5.28  eavesdropping, or other unlawful means. 
  5.29     Subd. 33.  [SECRETARY.] "Secretary" means the Minnesota 
  5.30  secretary of state. 
  5.31     Subd. 34.  [SUBSCRIBER.] "Subscriber" means a person who: 
  5.32     (1) is the subject listed in a certificate; 
  5.33     (2) accepts the certificate; and 
  5.34     (3) holds a private key that corresponds to a public key 
  5.35  listed in that certificate. 
  5.36     Subd. 35.  [SUITABLE GUARANTY.] "Suitable guaranty" means 
  6.1   either a surety bond executed by a surety authorized by the 
  6.2   commissioner of commerce to do business in this state, or an 
  6.3   irrevocable letter of credit issued by a financial institution 
  6.4   authorized to do business in this state, that: 
  6.5      (1) is issued payable to the secretary for the benefit of 
  6.6   persons holding qualified rights of payment against the licensed 
  6.7   certification authority named as the principal of the bond or 
  6.8   customer of the letter of credit; 
  6.9      (2) is in an amount specified by rule by the secretary 
  6.10  under section 325K.03; 
  6.11     (3) states that it is issued for filing under this chapter; 
  6.12     (4) specifies a term of effectiveness extending at least as 
  6.13  long as the term of the license to be issued to the 
  6.14  certification authority; and 
  6.15     (5) is in a form prescribed or approved by rule by the 
  6.16  secretary. 
  6.17     A suitable guaranty may also provide that the total annual 
  6.18  liability on the guaranty to all persons making claims based on 
  6.19  it may not exceed the face amount of the guaranty. 
  6.20     Subd. 36.  [SUSPEND A CERTIFICATE.] "Suspend a certificate" 
  6.21  means to make a certificate ineffective temporarily for a 
  6.22  specified time forward. 
  6.23     Subd. 37.  [TIME STAMP.] "Time stamp" means either: 
  6.24     (1) to append or attach to a message, digital signature, or 
  6.25  certificate a digitally signed notation indicating at least the 
  6.26  date, time, and identity of the person appending or attaching 
  6.27  the notation; or 
  6.28     (2) the notation thus appended or attached. 
  6.29     Subd. 38.  [TRANSACTIONAL CERTIFICATE.] "Transactional 
  6.30  certificate" means a valid certificate incorporating by 
  6.31  reference one or more of the digital signatures. 
  6.32     Subd. 39.  [TRUSTWORTHY SYSTEM.] "Trustworthy system" means 
  6.33  a computer hardware and software that: 
  6.34     (1) are reasonably secure from intrusion and misuse; 
  6.35     (2) provide a reasonable level of availability, 
  6.36  reliability, and correct operation; and 
  7.1      (3) are reasonably suited to performing their intended 
  7.2   functions. 
  7.3      Subd. 40.  [VALID CERTIFICATE.] "Valid certificate" means a 
  7.4   certificate that: 
  7.5      (1) a licensed certification authority has issued; 
  7.6      (2) the subscriber listed in it has accepted; 
  7.7      (3) has not been revoked or suspended; and 
  7.8      (4) has not expired. 
  7.9      However, a transactional certificate is a valid certificate 
  7.10  only in relation to the digital signature incorporated in it by 
  7.11  reference. 
  7.12     Subd. 41.  [VERIFY A DIGITAL SIGNATURE.] "Verify a digital 
  7.13  signature" means, in relation to a given digital signature, 
  7.14  message, and public key, to determine accurately that: 
  7.15     (1) the digital signature was created by the private key 
  7.16  corresponding to the public key; and 
  7.17     (2) the message has not been altered since its digital 
  7.18  signature was created. 
  7.19     Sec. 4.  [325K.03] [ROLE OF THE SECRETARY.] 
  7.20     Subdivision 1.  [TRANSITIONAL DUTY.] If six months elapse 
  7.21  during which time no certification authority is licensed in this 
  7.22  state, then the secretary shall be a certification authority, 
  7.23  and may issue, suspend, and revoke certificates in the manner 
  7.24  prescribed for licensed certification authorities.  Except for 
  7.25  licensing requirements, this chapter applies to the secretary 
  7.26  with respect to certificates the secretary issues.  The 
  7.27  secretary must discontinue acting as a certification authority 
  7.28  if another certification authority is licensed, in a manner 
  7.29  allowing reasonable transition to private enterprise. 
  7.30     Subd. 2.  [RECORD.] The secretary must maintain a publicly 
  7.31  accessible database containing a certification authority 
  7.32  disclosure record for each licensed certification authority.  
  7.33  The secretary must publish the contents of the database in at 
  7.34  least one recognized repository. 
  7.35     Subd. 3.  [RULES.] The secretary must adopt rules 
  7.36  consistent with this chapter and in furtherance of its purposes: 
  8.1      (1) to govern licensed certification authorities, their 
  8.2   practice, and the termination of a certification authority's 
  8.3   practice; 
  8.4      (2) to determine an amount reasonably appropriate for a 
  8.5   suitable guaranty, in light of the burden a suitable guaranty 
  8.6   places upon licensed certification authorities and the assurance 
  8.7   of quality and financial responsibility it provides to persons 
  8.8   who rely on certificates issued by licensed certification 
  8.9   authorities; 
  8.10     (3) to specify reasonable requirements for the form of 
  8.11  certificates issued by licensed certification authorities, in 
  8.12  accordance with generally accepted standards for digital 
  8.13  signature certificates; 
  8.14     (4) to specify reasonable requirements for recordkeeping by 
  8.15  licensed certification authorities; 
  8.16     (5) to specify reasonable requirements for the content, 
  8.17  form, and sources of information in certification authority 
  8.18  disclosure records, the updating and timeliness of the 
  8.19  information, and other practices and policies relating to 
  8.20  certification authority disclosure records; and 
  8.21     (6) to specify the form of the certification practice 
  8.22  statements.  
  8.23     Sec. 5.  [325K.04] [FEES.] 
  8.24     The secretary may adopt rules establishing reasonable fees 
  8.25  for all services rendered under this chapter, in amounts 
  8.26  sufficient to compensate for the costs of all services under 
  8.27  this chapter.  All fees recovered by the secretary must be 
  8.28  deposited in the state general fund. 
  8.29     Sec. 6.  [325K.05] [LICENSURE AND QUALIFICATIONS OF 
  8.30  CERTIFICATION AUTHORITIES.] 
  8.31     Subdivision 1.  [LICENSE CONDITIONS.] To obtain or retain a 
  8.32  license, a certification authority must: 
  8.33     (1) be the subscriber of a certificate published in a 
  8.34  recognized repository; 
  8.35     (2) employ as operative personnel only persons who have not 
  8.36  been convicted within the past 15 years of a felony or a crime 
  9.1   involving fraud, false statement, or deception; 
  9.2      (3) employ as operative personnel only persons who have 
  9.3   demonstrated knowledge and proficiency in following the 
  9.4   requirements of this chapter; 
  9.5      (4) file with the secretary a suitable guaranty, unless the 
  9.6   certification authority is a department, office, or official of 
  9.7   a state, city, or county governmental entity, provided that: 
  9.8      (i) each of these public entities act through designated 
  9.9   officials authorized by rule or ordinance to perform 
  9.10  certification authority functions; or 
  9.11     (ii) one of these public entities is the subscriber of all 
  9.12  certificates issued by the certification authority; 
  9.13     (5) have the right to use a trustworthy system, including a 
  9.14  secure means for limiting access to its private key; 
  9.15     (6) present proof to the secretary of having working 
  9.16  capital reasonably sufficient, according to rules adopted by the 
  9.17  secretary, to enable the applicant to conduct business as a 
  9.18  certification authority; and 
  9.19     (7) maintain an office in this state or have established a 
  9.20  registered agent for service or process in this state.  
  9.21     Subd. 2.  [LICENSE PROCEDURES.] The secretary must issue a 
  9.22  license to a certification authority that: 
  9.23     (1) is qualified under subdivision 1; 
  9.24     (2) applies in writing to the secretary for a license; and 
  9.25     (3) pays a filing fee adopted by rule by the secretary. 
  9.26     Subd. 3.  [RULES.] The secretary may by rule classify 
  9.27  licenses according to specified limitations, such as a maximum 
  9.28  number of outstanding certificates, cumulative maximum of 
  9.29  recommended reliance limits in certificates issued by the 
  9.30  certification authority, or issuance only within a single firm 
  9.31  or organization, and the secretary may issue licenses restricted 
  9.32  according to the limits of each classification.  A certification 
  9.33  authority acts as an unlicensed certification authority in 
  9.34  issuing a certificate exceeding the restrictions of the 
  9.35  certification authority's license. 
  9.36     Subd. 4.  [REVOCATION OR SUSPENSION.] The secretary may 
 10.1   revoke or suspend a certification authority's license, in 
 10.2   accordance with the administrative procedure act, chapter 14, 
 10.3   for failure to comply with this chapter or for failure to remain 
 10.4   qualified under subdivision 1. 
 10.5      Subd. 5.  [OTHER AUTHORITIES.] The secretary may recognize 
 10.6   by rule the licensing or authorization of certification 
 10.7   authorities by other governments, provided that those licensing 
 10.8   or authorization requirements are substantially similar to those 
 10.9   of this state.  If licensing by another government is so 
 10.10  recognized: 
 10.11     (1) sections 325K.19 to 325K.24 apply to certificates 
 10.12  issued by the certification authorities licensed or authorized 
 10.13  by that government in the same manner as it applies to licensed 
 10.14  certification authorities of this state; and 
 10.15     (2) the liability limits of section 325K.17 apply to the 
 10.16  certification authorities licensed or authorized by that 
 10.17  government in the same manner as they apply to licensed 
 10.18  certification authorities of this state. 
 10.19     Subd. 6.  [APPLICABILITY TO DIGITAL SIGNATURES.] Unless the 
 10.20  parties provide otherwise by contract between themselves, the 
 10.21  licensing requirements in this section do not affect the 
 10.22  effectiveness, enforceability, or validity of any digital 
 10.23  signature, except that sections 325K.19 to 325K.24 do not apply 
 10.24  in relation to a digital signature that cannot be verified by a 
 10.25  certificate issued by an unlicensed certification authority. 
 10.26     Subd. 7.  [NONAPPLICABILITY.] A certification authority 
 10.27  that has not obtained a license is not subject to the provisions 
 10.28  of this chapter. 
 10.29     Sec. 7.  [325K.06] [PERFORMANCE AUDITS.] 
 10.30     Subdivision 1.  [ANNUAL AUDIT; AUDITOR QUALIFICATIONS; 
 10.31  RULES.] A certified public account having expertise in computer 
 10.32  security or an accredited computer security professional must 
 10.33  audit the operations of each licensed certification authority at 
 10.34  least once each year to evaluate compliance with this chapter.  
 10.35  The secretary may by rule specify the qualifications of auditors.
 10.36     Subd. 2.  [COMPLIANCE CATEGORIES.] Based on information 
 11.1   gathered in the audit, the auditor must categorize the licensed 
 11.2   certification authority's compliance as one of the following: 
 11.3      (a) [FULL COMPLIANCE.] The certification authority appears 
 11.4   to conform to all applicable statutory and regulatory 
 11.5   requirements. 
 11.6      (b) [SUBSTANTIAL COMPLIANCE.] The certification authority 
 11.7   appears generally to conform to applicable statutory and 
 11.8   regulatory requirements.  However, one or more instances of 
 11.9   noncompliance or of inability to demonstrate compliance were 
 11.10  found in an audited sample, but were likely to be 
 11.11  inconsequential. 
 11.12     (c) [PARTIAL COMPLIANCE.] The certification authority 
 11.13  appears to comply with some statutory and regulatory 
 11.14  requirements, but was found not to have complied or not be able 
 11.15  to demonstrate compliance with one or more important safeguards. 
 11.16     (d) [NONCOMPLIANCE.] The certification authority complies 
 11.17  with few or none of the statutory and regulatory requirements, 
 11.18  fails to keep adequate records to demonstrate compliance with 
 11.19  more than a few requirements, or refused to submit to an audit. 
 11.20     The secretary shall publish in the certification authority 
 11.21  disclosure record it maintains for the certification authority 
 11.22  the date of the audit and the resulting categorization of the 
 11.23  certification authority. 
 11.24     Subd. 3.  [EXEMPTION FROM AUDIT.] The secretary may exempt 
 11.25  a licensed certification authority from the requirements of 
 11.26  subdivision 1, if: 
 11.27     (1) the certification authority to be exempted requests 
 11.28  exemption in writing; 
 11.29     (2) the most recent performance audit, if any, of the 
 11.30  certification authority resulted in a finding of full or 
 11.31  substantial compliance; and 
 11.32     (3) the certification authority declares under oath, 
 11.33  affirmation, or penalty of perjury that one or more of the 
 11.34  following is true with respect to the certification authority:  
 11.35     (i) the certification authority has issued fewer than six 
 11.36  certificates during the past year and the recommended reliance 
 12.1   limits of all of the certificates do not exceed $10,000; 
 12.2      (ii) the aggregate lifetime of all certificates issued by 
 12.3   the certification authority during the past year is less than 30 
 12.4   days and the recommended reliance limits of all of the 
 12.5   certificates do not exceed $10,000; or 
 12.6      (iii) the recommended reliance limits of all certificates 
 12.7   outstanding and issued by the certification authority total less 
 12.8   than $1,000. 
 12.9      Subd. 4.  [FALSE DECLARATION.] If the certification 
 12.10  authority's declaration under subdivision 3 falsely states a 
 12.11  material fact, the certification authority has failed to comply 
 12.12  with the performance audit requirements of this section. 
 12.13     Subd. 5.  [RECORD OF EXEMPTION.] If a licensed 
 12.14  certification authority is exempt under subdivision 3, the 
 12.15  secretary must publish in the certification authority disclosure 
 12.16  record it maintains for the certification authority that the 
 12.17  certification authority is exempt from the performance audit 
 12.18  requirement. 
 12.19     Sec. 8.  [325K.07] [ENFORCEMENT OF REQUIREMENTS FOR 
 12.20  LICENSED CERTIFICATION AUTHORITIES.] 
 12.21     Subdivision 1.  [INVESTIGATION.] The secretary may 
 12.22  investigate the activities of a licensed certification authority 
 12.23  material to its compliance with this chapter and issue orders to 
 12.24  a certification authority to further its investigation and 
 12.25  secure compliance with this chapter. 
 12.26     Subd. 2.  [SUSPENSION OR REVOCATION.] The secretary may 
 12.27  suspend or revoke the license of a certification authority for 
 12.28  its failure to comply with an order of the secretary. 
 12.29     Subd. 3.  [CIVIL PENALTY.] The secretary may by order 
 12.30  impose and collect a civil monetary penalty for a violation of 
 12.31  this chapter in an amount not to exceed $5,000 per incident, or 
 12.32  90 percent of the recommended reliance limit of a material 
 12.33  certificate, whichever is less.  In case of a violation 
 12.34  continuing for more than one day, each day is considered a 
 12.35  separate incident. 
 12.36     Subd. 4.  [PAYMENT OF COSTS.] The secretary may order a 
 13.1   certification authority, which it has found to be in violation 
 13.2   of this chapter, to pay the costs incurred by the secretary in 
 13.3   prosecuting and adjudicating proceedings relative to the order, 
 13.4   and enforcing it. 
 13.5      Subd. 5.  [ADMINISTRATIVE PROCEDURES; INJUNCTIVE 
 13.6   RELIEF.] (a) The secretary must exercise authority under this 
 13.7   section in accordance with the administrative procedure act, 
 13.8   chapter 14, and a licensed certification authority may obtain 
 13.9   judicial review of the secretary's actions as prescribed by 
 13.10  chapter 14.  
 13.11     (b) The secretary may also seek injunctive relief to compel 
 13.12  compliance with an order. 
 13.13     Sec. 9.  [325K.08] [DANGEROUS ACTIVITIES BY CERTIFICATION 
 13.14  AUTHORITY PROHIBITED.] 
 13.15     Subdivision 1.  [PROHIBITION GENERALLY.] No certification 
 13.16  authority, whether licensed or not, may conduct its business in 
 13.17  a manner that creates an unreasonable risk of loss to 
 13.18  subscribers of the certification authority, to persons relying 
 13.19  on certificates issued by the certification authority, or to a 
 13.20  repository. 
 13.21     Subd. 2.  [NOTICE AUTHORIZED; PROTEST, HEARING, AND 
 13.22  SUBSEQUENT ACTION.] The secretary may publish in the repository 
 13.23  it provides, or elsewhere, brief statements advising 
 13.24  subscribers, persons relying on digital signatures, or other 
 13.25  repositories about activities of a certification authority, 
 13.26  whether licensed or not, that create a risk prohibited by 
 13.27  subdivision 1.  The certification authority named in a statement 
 13.28  as creating or causing such a risk may protest the publication 
 13.29  of the statement by filing a written defense of 10,000 bytes or 
 13.30  less.  Upon receipt of a protest, the secretary shall publish 
 13.31  the protest along with the secretary's statement, and shall 
 13.32  promptly give the protesting certification authority notice and 
 13.33  an opportunity to be heard.  Following the hearing, the 
 13.34  secretary shall rescind the advisory statement if its 
 13.35  publication was unwarranted under this section, cancel it if its 
 13.36  publication is no longer warranted, continue or amend it if it 
 14.1   remains warranted, or take further legal action to eliminate or 
 14.2   reduce a risk prohibited by subdivision 1.  The secretary shall 
 14.3   publish its decision in the repository it provides. 
 14.4      Subd. 3.  [ORDERS AND CIVIL ACTIONS.] In the manner 
 14.5   provided by the administrative procedure act, chapter 14, the 
 14.6   secretary may issue orders and obtain injunctions or other civil 
 14.7   relief to prevent or restrain a certification authority from 
 14.8   violating this section, regardless of whether the certification 
 14.9   authority is licensed.  This section does not create a right of 
 14.10  action in a person other than the secretary. 
 14.11     Sec. 10.  [325K.09] [GENERAL REQUIREMENTS FOR CERTIFICATION 
 14.12  AUTHORITIES.] 
 14.13     Subdivision 1.  [USE OF TRUSTWORTHY SYSTEM.] A licensed 
 14.14  certification authority or subscriber may use only a trustworthy 
 14.15  system: 
 14.16     (1) to issue, suspend, or revoke a certificate; 
 14.17     (2) to publish or give notice of the issuance, suspension, 
 14.18  or revocation of a certificate; or 
 14.19     (3) to create a private key. 
 14.20     Subd. 2.  [DISCLOSURE REQUIRED.] A licensed certification 
 14.21  authority shall disclose any material certification practice 
 14.22  statement and disclose any fact material to either the 
 14.23  reliability of a certificate that it has issued or its ability 
 14.24  to perform its services.  A certification authority may require 
 14.25  a signed, written, and reasonably specific inquiry from an 
 14.26  identified person and payment of reasonable compensation as 
 14.27  conditions precedent to effecting a disclosure required in this 
 14.28  subdivision. 
 14.29     Sec. 11.  [325K.10] [ISSUANCE OF CERTIFICATE.] 
 14.30     Subdivision 1.  [CONDITIONS.] A licensed certification 
 14.31  authority may issue a certificate to a subscriber only after all 
 14.32  of the following conditions are satisfied: 
 14.33     (1) the certification authority has received a request for 
 14.34  issuance signed by the prospective subscriber; and 
 14.35     (2) the certification authority has confirmed that: 
 14.36     (i) the prospective subscriber is the person to be listed 
 15.1   in the certificate to be issued; 
 15.2      (ii) if the prospective subscriber is acting through one or 
 15.3   more agents, the subscriber duly authorized each agent to have 
 15.4   custody of the subscriber's private key and to request issuance 
 15.5   of a certificate listing the corresponding public key; 
 15.6      (iii) the information in the certificate to be issued is 
 15.7   accurate; 
 15.8      (iv) the prospective subscriber rightfully holds the 
 15.9   private key corresponding to the public key to be listed in the 
 15.10  certificate; 
 15.11     (v) the prospective subscriber holds a private key capable 
 15.12  of creating a digital signature; and 
 15.13     (vi) the public key to be listed in the certificate can be 
 15.14  used to verify a digital signature affixed by the private key 
 15.15  held by the prospective subscriber. 
 15.16     The requirements of this subdivision may not be waived or 
 15.17  disclaimed by either the licensed certification authority, the 
 15.18  subscriber, or both. 
 15.19     Subd. 2.  [PUBLICATION.] If the subscriber accepts the 
 15.20  issued certificate, the certification authority shall publish a 
 15.21  signed copy of the certificate in a recognized repository, as 
 15.22  the certification authority and the subscriber named in the 
 15.23  certificate may agree, unless a contract between the 
 15.24  certification authority and the subscriber provides otherwise.  
 15.25  If the subscriber does not accept the certificate, a licensed 
 15.26  certification authority shall not publish it, or shall cancel 
 15.27  its publication if the certificate has already been published. 
 15.28     Subd. 3.  [APPLICATION OF OTHER STANDARDS.] Nothing in this 
 15.29  section precludes a licensed certification authority from 
 15.30  conforming to standards, certification practice statements, 
 15.31  security plans, or contractual requirements more rigorous than, 
 15.32  but nevertheless consistent with, this chapter. 
 15.33     Subd. 4.  [SUSPENSION OR REVOCATION.] After issuing a 
 15.34  certificate, a licensed certification authority shall revoke it 
 15.35  immediately upon confirming that it was not issued as required 
 15.36  by this section.  A licensed certification authority may also 
 16.1   suspend a certificate that it has issued for a reasonable period 
 16.2   not exceeding 48 hours as needed for an investigation to confirm 
 16.3   grounds for revocation under this subdivision.  The 
 16.4   certification authority shall give notice to the subscriber as 
 16.5   soon as practicable after a decision to revoke or suspend under 
 16.6   this subdivision. 
 16.7      Subd. 5.  [ORDER OF SUSPENSION OR REVOCATION.] The 
 16.8   secretary may order the licensed certification authority to 
 16.9   suspend or revoke a certificate that the certification authority 
 16.10  issued if, after giving any required notice and opportunity for 
 16.11  the certification authority and subscriber to be heard in 
 16.12  accordance with the administrative procedure act, chapter 14, 
 16.13  the secretary determines that: 
 16.14     (1) the certificate was issued without substantial 
 16.15  compliance with this section; and 
 16.16     (2) the noncompliance poses a significant risk to persons 
 16.17  reasonably relying on the certificate. 
 16.18     Upon determining that an emergency requires an immediate 
 16.19  remedy, and in accordance with the administrative procedure act, 
 16.20  chapter 14, the secretary may issue an order suspending a 
 16.21  certificate for a period not to exceed 48 hours. 
 16.22     Sec. 12.  [325K.11] [WARRANTIES AND OBLIGATIONS UPON 
 16.23  ISSUANCE OF CERTIFICATE.] 
 16.24     Subdivision 1.  [ABSOLUTE WARRANTIES TO SUBSCRIBERS.] By 
 16.25  issuing a certificate, a licensed certification authority 
 16.26  warrants to the subscriber named in the certificate that: 
 16.27     (1) the certificate contains no information known to the 
 16.28  certification authority to be false; 
 16.29     (2) the certificate satisfies all material requirements of 
 16.30  this chapter; and 
 16.31     (3) the certification authority has not exceeded any limits 
 16.32  of its license in issuing the certificate. 
 16.33     The certification authority may not disclaim or limit the 
 16.34  warranties of this subdivision. 
 16.35     Subd. 2.  [NEGOTIABLE WARRANTIES TO SUBSCRIBERS.] Unless 
 16.36  the subscriber and certification authority otherwise agree, a 
 17.1   certification authority, by issuing a certificate, promises to 
 17.2   the subscriber: 
 17.3      (1) to act promptly to suspend or revoke a certificate in 
 17.4   accordance with section 325K.14 or 325K.15; and 
 17.5      (2) to notify the subscriber within a reasonable time of 
 17.6   any facts known to the certification authority that 
 17.7   significantly affect the validity or reliability of the 
 17.8   certificate once it is issued. 
 17.9      Subd. 3.  [WARRANTIES TO THOSE WHO REASONABLY RELY.] By 
 17.10  issuing a certificate, a licensed certification authority 
 17.11  certifies to all who reasonably rely on the information 
 17.12  contained in the certificate that: 
 17.13     (1) the information in the certificate and listed as 
 17.14  confirmed by the certification authority is accurate; 
 17.15     (2) all information foreseeably material to the reliability 
 17.16  of the certificate is stated or incorporated by reference within 
 17.17  the certificate; 
 17.18     (3) the subscriber has accepted the certificate; and 
 17.19     (4) the licensed certification authority has complied with 
 17.20  all applicable laws of this state governing issuance of the 
 17.21  certificate. 
 17.22     Subd. 4.  [WARRANTIES FOLLOWING PUBLICATION.] By publishing 
 17.23  a certificate, a licensed certification authority certifies to 
 17.24  the repository in which the certificate is published and to all 
 17.25  who reasonably rely on the information contained in the 
 17.26  certificate that the certification authority has issued the 
 17.27  certificate to the subscriber. 
 17.28     Sec. 13.  [325K.12] [REPRESENTATIONS AND DUTIES UPON 
 17.29  ACCEPTING CERTIFICATE.] 
 17.30     Subdivision 1.  [SUBSCRIBER WARRANTIES.] By accepting a 
 17.31  certificate issued by a licensed certification authority, the 
 17.32  subscriber listed in the certificate certifies to all who 
 17.33  reasonably rely on the information contained in the certificate 
 17.34  that: 
 17.35     (1) the subscriber rightfully holds the private key 
 17.36  corresponding to the public key listed in the certificate; 
 18.1      (2) all representations made by the subscriber to the 
 18.2   certification authority and material to the information listed 
 18.3   in the certificate are true; and 
 18.4      (3) all material representations made by the subscriber to 
 18.5   a certification authority or made in the certificate and not 
 18.6   confirmed by the certification authority in issuing the 
 18.7   certificate are true. 
 18.8      Subd. 2.  [AGENT WARRANTIES.] By requesting on behalf of a 
 18.9   principal the issuance of a certificate naming the principal as 
 18.10  subscriber, the requesting person certifies in that person's own 
 18.11  right to all who reasonably rely on the information contained in 
 18.12  the certificate that the requesting person: 
 18.13     (1) holds all authority legally required to apply for 
 18.14  issuance of a certificate naming the principal as subscriber; 
 18.15  and 
 18.16     (2) has authority to sign digitally on behalf of the 
 18.17  principal, and, if that authority is limited in any way, 
 18.18  adequate safeguards exist to prevent a digital signature 
 18.19  exceeding the bounds of the person's authority. 
 18.20     Subd. 3.  [DISCLAIMER LIMITATIONS.] No person may disclaim 
 18.21  or contractually limit the application of this section, nor 
 18.22  obtain indemnity for its effects, if the disclaimer, limitation, 
 18.23  or indemnity restricts liability for misrepresentation as 
 18.24  against persons reasonably relying on the certificate. 
 18.25     Subd. 4.  [INDEMNIFICATION BY SUBSCRIBER OR AGENT.] By 
 18.26  accepting a certificate, a subscriber undertakes to indemnify 
 18.27  the issuing certification authority for loss or damage caused by 
 18.28  issuance or publication of a certificate in reliance on: 
 18.29     (1) a false and material representation of fact by the 
 18.30  subscriber; or 
 18.31     (2) the failure by the subscriber to disclose a material 
 18.32  fact if the representation or failure to disclose was made 
 18.33  either with intent to deceive the certification authority or a 
 18.34  person relying on the certificate, or with negligence.  If the 
 18.35  certification authority issued the certificate at the request of 
 18.36  one or more agents of the subscriber, the agent or agents 
 19.1   personally undertake to indemnify the certification authority 
 19.2   under this subdivision, as if they were accepting subscribers in 
 19.3   their own right.  The indemnity provided in this section may not 
 19.4   be disclaimed or contractually limited in scope.  However, a 
 19.5   contract may provide consistent, additional terms regarding the 
 19.6   indemnification. 
 19.7      Subd. 5.  [CERTIFIED ACCURACY.] In obtaining information of 
 19.8   the subscriber material to issuance of a certificate, the 
 19.9   certification authority may require the subscriber to certify 
 19.10  the accuracy of relevant information under oath or affirmation 
 19.11  of truthfulness and under penalty of perjury. 
 19.12     Sec. 14.  [325K.13] [CONTROL OF PRIVATE KEY.] 
 19.13     Subdivision 1.  [DUTY.] By accepting a certificate issued 
 19.14  by a licensed certification authority, the subscriber identified 
 19.15  in the certificate assumes a duty to exercise reasonable care to 
 19.16  retain control of the private key and prevent its disclosure to 
 19.17  a person not authorized to create the subscriber's digital 
 19.18  signature. 
 19.19     Subd. 2.  [PRIVATE PROPERTY.] A private key is the personal 
 19.20  property of the subscriber who rightfully holds it. 
 19.21     Subd. 3.  [AUTHORITY AS FIDUCIARY.] If a certification 
 19.22  authority holds the private key corresponding to a public key 
 19.23  listed in a certificate that it has issued, the certification 
 19.24  authority holds the private key as a fiduciary of the subscriber 
 19.25  named in the certificate, and may use that private key only with 
 19.26  the subscriber's prior written approval, unless the subscriber 
 19.27  expressly grants the private key to the certification authority 
 19.28  and expressly permits the certification authority to hold the 
 19.29  private key according to other terms. 
 19.30     Sec. 15.  [325K.14] [SUSPENSION OF CERTIFICATE.] 
 19.31     Subdivision 1.  [SUSPENSION FOR 48 HOURS.] Unless the 
 19.32  certification authority and the subscriber agree otherwise, the 
 19.33  licensed certification authority that issued a certificate that 
 19.34  is not a transactional certificate must suspend the certificate 
 19.35  for a period not to exceed 48 hours: 
 19.36     (1) upon request by a person identifying himself or herself 
 20.1   as the subscriber named in the certificate, or as a person in a 
 20.2   position likely to know of a compromise of the security of a 
 20.3   subscriber's private key, such as an agent, business associate, 
 20.4   employee, or member of the immediate family of the subscriber; 
 20.5   or 
 20.6      (2) by order of the secretary under section 325K.10, 
 20.7   subdivision 5.  
 20.8      The certification authority need not confirm the identity 
 20.9   or agency of the person requesting suspension. 
 20.10     Subd. 2.  [SUSPENSION FOR 48 HOURS; OTHER CAUSES.] (a) 
 20.11  Unless the certificate provides otherwise or the certificate is 
 20.12  a transactional certificate, the secretary may suspend a 
 20.13  certificate issued by a licensed certification authority for a 
 20.14  period of 48 hours, if: 
 20.15     (1) a person identifying himself or herself as the 
 20.16  subscriber named in the certificate or as an agent, business 
 20.17  associate, employee, or member of the immediate family of the 
 20.18  subscriber requests suspension; and 
 20.19     (2) the requester represents that the certification 
 20.20  authority that issued the certificate is unavailable. 
 20.21     (b) The secretary may require the person requesting 
 20.22  suspension to provide evidence, including a statement under oath 
 20.23  or affirmation, regarding the requester's identity, 
 20.24  authorization, or the unavailability of the issuing 
 20.25  certification authority, and may decline to suspend the 
 20.26  certificate in its discretion.  The secretary or law enforcement 
 20.27  agencies may investigate suspensions by the secretary for 
 20.28  possible wrongdoing by persons requesting suspension. 
 20.29     Subd. 3.  [NOTICE OF SUSPENSION.] Immediately upon 
 20.30  suspension of a certificate by a licensed certification 
 20.31  authority, the licensed certification authority shall give 
 20.32  notice of the suspension according to the specification in the 
 20.33  certificate.  If one or more repositories are specified, then 
 20.34  the licensed certification authority must publish a signed 
 20.35  notice of the suspension in all the repositories.  If a 
 20.36  repository no longer exists or refuses to accept publication, or 
 21.1   if no repository is recognized under section 325K.25, the 
 21.2   licensed certification authority must also publish the notice in 
 21.3   a recognized repository.  If a certificate is suspended by the 
 21.4   secretary, the secretary must give notice as required in this 
 21.5   subdivision for a licensed certification authority, provided 
 21.6   that the person requesting suspension pays in advance any fee 
 21.7   required by a repository for publication of the notice of 
 21.8   suspension. 
 21.9      Subd. 4.  [TERMINATING SUSPENSION.] A certification 
 21.10  authority must terminate a suspension initiated by request only: 
 21.11     (1) if the subscriber named in the suspended certificate 
 21.12  requests termination of the suspension and the certification 
 21.13  authority has confirmed that the person requesting suspension is 
 21.14  the subscriber or an agent of the subscriber authorized to 
 21.15  terminate the suspension; or 
 21.16     (2) when the certification authority discovers and confirms 
 21.17  that the request for the suspension was made without 
 21.18  authorization by the subscriber.  However, this clause does not 
 21.19  require the certification authority to confirm a request for 
 21.20  suspension. 
 21.21     Subd. 5.  [CONTRACT LIMITATION OR PRECLUSION.] The contract 
 21.22  between a subscriber and a licensed certification authority may 
 21.23  limit or preclude requested suspension by the certification 
 21.24  authority, or may provide otherwise for termination of a 
 21.25  requested suspension.  However, if the contract limits or 
 21.26  precludes suspension by the secretary when the issuing 
 21.27  certification authority is unavailable, the limitation or 
 21.28  preclusion is effective only if notice of it is published in the 
 21.29  certificate. 
 21.30     Subd. 6.  [MISREPRESENTATION.] No person may knowingly or 
 21.31  intentionally misrepresent to a certification authority the 
 21.32  person's identity or authorization in requesting suspension of a 
 21.33  certificate.  Violation of this subdivision is a misdemeanor. 
 21.34     Subd. 7.  [EFFECT ON SUBSCRIBER.] The subscriber is 
 21.35  released from the duty to keep the private key secure under 
 21.36  section 325K.13, subdivision 1, while the certificate is 
 22.1   suspended. 
 22.2      Sec. 16.  [325K.15] [CERTIFICATE REVOCATION.] 
 22.3      Subdivision 1.  [AFTER REQUEST.] A licensed certification 
 22.4   authority must revoke a certificate that it issued but which is 
 22.5   not a transactional certificate, after: 
 22.6      (1) receiving a request for revocation by the subscriber 
 22.7   named in the certificate; and 
 22.8      (2) confirming that the person requesting revocation is the 
 22.9   subscriber, or is an agent of the subscriber with authority to 
 22.10  request the revocation. 
 22.11     Subd. 2.  [AFTER IDENTITY CONFIRMED.] A licensed 
 22.12  certification authority must confirm a request for revocation 
 22.13  and revoke a certificate within one business day after receiving 
 22.14  both a subscriber's written request and evidence reasonably 
 22.15  sufficient to confirm the identity and any agency of the person 
 22.16  requesting the suspension. 
 22.17     Subd. 3.  [AFTER DEATH OR DISSOLUTION.] A licensed 
 22.18  certification authority must revoke a certificate that it issued:
 22.19     (1) upon receiving a certified copy of the subscriber's 
 22.20  death certificate, or upon confirming by other evidence that the 
 22.21  subscriber is dead; or 
 22.22     (2) upon presentation of documents effecting a dissolution 
 22.23  of the subscriber, or upon confirming by other evidence that the 
 22.24  subscriber has been dissolved or has ceased to exist. 
 22.25     Subd. 4.  [UNRELIABLE CERTIFICATE.] A licensed 
 22.26  certification authority may revoke one or more certificates that 
 22.27  it issued if the certificates are or become unreliable, 
 22.28  regardless of whether the subscriber consents to the revocation 
 22.29  and notwithstanding a provision to the contrary in a contract 
 22.30  between the subscriber and certification authority. 
 22.31     Subd. 5.  [NOTICE OF REVOCATION.] Immediately upon 
 22.32  revocation of a certificate by a licensed certification 
 22.33  authority, the licensed certification authority must give notice 
 22.34  of the revocation according to the specification in the 
 22.35  certificate.  If one or more repositories are specified, then 
 22.36  the licensed certification authority must publish a signed 
 23.1   notice of the revocation in all repositories.  If a repository 
 23.2   no longer exists or refuses to accept publication, or if no 
 23.3   repository is recognized under section 325K.13, then the 
 23.4   licensed certification authority must also publish the notice in 
 23.5   a recognized repository. 
 23.6      Subd. 6.  [WHEN CERTIFICATION BY SUBSCRIBER CEASES.] A 
 23.7   subscriber ceases to certify, as provided in section 325K.12, 
 23.8   and has no further duty to keep the private key secure, as 
 23.9   required by section 325K.13, in relation to the certificate 
 23.10  whose revocation the subscriber has requested, beginning at the 
 23.11  earlier of either: 
 23.12     (1) when notice of the revocation is published as required 
 23.13  in subdivision 5; or 
 23.14     (2) one business day after the subscriber requests 
 23.15  revocation in writing, supplies to the issuing certification 
 23.16  authority information reasonably sufficient to confirm the 
 23.17  request, and pays any contractually required fee. 
 23.18     Subd. 7.  [WARRANTIES DISCHARGED.] Upon notification as 
 23.19  required by subdivision 5, a licensed certification authority is 
 23.20  discharged of its warranties based on issuance of the revoked 
 23.21  certificate and ceases to certify as provided in section 
 23.22  325K.11, subdivisions 2 and 3, in relation to the revoked 
 23.23  certificate. 
 23.24     Sec. 17.  [325K.16] [CERTIFICATE EXPIRATION.] 
 23.25     Subdivision 1.  [EXPIRATION DATE.] A certificate must 
 23.26  indicate the date on which it expires. 
 23.27     Subd. 2.  [EFFECT OF EXPIRATION.] When a certificate 
 23.28  expires, the subscriber and certification authority cease to 
 23.29  certify as provided in this chapter and the certification 
 23.30  authority is discharged of its duties based on issuance, in 
 23.31  relation to the expired certificate. 
 23.32     Sec. 18.  [325K.17] [RECOMMENDED RELIANCE LIMITS AND 
 23.33  LIABILITY.] 
 23.34     Subdivision 1.  [TOTAL AMOUNT AT RISK.] By specifying a 
 23.35  recommended reliance limit in a certificate, the issuing 
 23.36  certification authority and accepting subscriber recommend that 
 24.1   persons rely on the certificate only to the extent that the 
 24.2   total amount at risk does not exceed the recommended reliance 
 24.3   limit. 
 24.4      Subd. 2.  [LIABILITY.] Unless a licensed certification 
 24.5   authority waives application of this subdivision, a licensed 
 24.6   certification authority is: 
 24.7      (1) not liable for a loss caused by reliance on a false or 
 24.8   forged digital signature of a subscriber, if, with respect to 
 24.9   the false or forged digital signature, the certification 
 24.10  authority complied with all material requirements of this 
 24.11  chapter; 
 24.12     (2) not liable in excess of the amount specified in the 
 24.13  certificate as its recommended reliance limit for either: 
 24.14     (i) a loss caused by reliance on a misrepresentation in the 
 24.15  certificate of a fact that the licensed certification authority 
 24.16  is required to confirm; or 
 24.17     (ii) failure to comply with section 325K.10 in issuing the 
 24.18  certificate; 
 24.19     (3) liable only for direct compensatory damages in an 
 24.20  action to recover a loss due to reliance on the certificate, 
 24.21  provided that direct compensatory damages do not include: 
 24.22     (i) punitive or exemplary damages, and nothing in this 
 24.23  chapter may be interpreted to permit punitive or exemplary 
 24.24  damages that would not otherwise be permitted by Minnesota law; 
 24.25     (ii) damages for lost profits or opportunity; or 
 24.26     (iii) damages for pain or suffering. 
 24.27     Sec. 19.  [325K.18] [COLLECTION BASED ON SUITABLE 
 24.28  GUARANTY.] 
 24.29     Subdivision 1.  [BOND OR LETTER OF CREDIT.] (a) If the 
 24.30  suitable guaranty is a surety bond, a person may recover from 
 24.31  the surety the full amount of a qualified right to payment 
 24.32  against the principal named in the bond, or, if there is more 
 24.33  than one such qualified right to payment during the term of the 
 24.34  bond, a ratable share, up to a maximum total liability of the 
 24.35  surety equal to the amount of the bond. 
 24.36     (b) If the suitable guaranty is a letter of credit, a 
 25.1   person may recover from the issuing financial institution only 
 25.2   in accordance with the terms of the letter of credit. 
 25.3      (c) Claimants may recover successively on the same suitable 
 25.4   guaranty, provided that the total liability on the suitable 
 25.5   guaranty to all persons making qualified rights of payment 
 25.6   during its term must not exceed the amount of the suitable 
 25.7   guaranty. 
 25.8      Subd. 2.  [ATTORNEY FEES AND COURT COSTS.] (a) Subject to 
 25.9   paragraph (b), in addition to recovering the amount of a 
 25.10  qualified right to payment, a claimant may recover: 
 25.11     (1) from the proceeds of the guaranty, until depleted; 
 25.12     (2) the attorneys' fees, reasonable in amount; and 
 25.13     (3) court costs incurred by the claimant in collecting the 
 25.14  claim.  
 25.15     (b) However, the total liability on the suitable guaranty 
 25.16  to all persons making qualified rights of payment or recovering 
 25.17  attorneys' fees during its term must not exceed the amount of 
 25.18  the suitable guaranty. 
 25.19     Subd. 3.  [QUALIFIED RIGHT TO PAYMENT.] (a) To recover a 
 25.20  qualified right to payment against a surety or issuer of a 
 25.21  suitable guaranty, the claimant must: 
 25.22     (1) file written notice of the claim with the secretary 
 25.23  stating the name and address of the claimant, the amount 
 25.24  claimed, and the grounds for the qualified right to payment, and 
 25.25  any other information required by rule by the secretary; and 
 25.26     (2) append to the notice a certified copy of the judgment 
 25.27  on which the qualified right to payment is based. 
 25.28     (b) Recovery of a qualified right to payment from the 
 25.29  proceeds of the suitable guaranty is barred unless the claimant 
 25.30  substantially complies with this subdivision. 
 25.31     Subd. 4.  [STATUTE OF LIMITATIONS.] Recovery of a qualified 
 25.32  right to payment from the proceeds of a suitable guaranty are 
 25.33  forever barred unless notice of the claim is filed as required 
 25.34  in subdivision 3, paragraph (a), clause (1), within three years 
 25.35  after the occurrence of the violation of this chapter that is 
 25.36  the basis for the claim.  Notice under this subdivision need not 
 26.1   include the requirement imposed by subdivision 3, paragraph (a), 
 26.2   clause (2). 
 26.3      Sec. 20.  [325K.19] [SATISFACTION OF SIGNATURE 
 26.4   REQUIREMENTS.] 
 26.5      (a) Where a rule of law requires a signature, or provides 
 26.6   for certain consequences in the absence of a signature, that 
 26.7   rule is satisfied by a digital signature, if: 
 26.8      (1) no party affected by a digital signature objects to the 
 26.9   use of digital signatures in lieu of a signature, and the 
 26.10  objection may be evidenced by refusal to provide or accept a 
 26.11  digital signature; 
 26.12     (2) that digital signature is verified by reference to the 
 26.13  public key listed in a valid certificate issued by a licensed 
 26.14  certification authority; 
 26.15     (3) that digital signature was affixed by the signer with 
 26.16  the intention of signing the message and after the signer has 
 26.17  had an opportunity to review items being signed; and 
 26.18     (4) the recipient has no knowledge or notice that the 
 26.19  signer either: 
 26.20     (i) breached a duty as a subscriber; or 
 26.21     (ii) does not rightfully hold the private key used to affix 
 26.22  the digital signature. 
 26.23     (b) However, nothing in this chapter precludes a mark from 
 26.24  being valid as a signature under other applicable law. 
 26.25     Sec. 21.  [325K.20] [UNRELIABLE DIGITAL SIGNATURES.] 
 26.26     Unless otherwise provided by law or contract, the recipient 
 26.27  of a digital signature assumes the risk that a digital signature 
 26.28  is forged, if reliance on the digital signature is not 
 26.29  reasonable under the circumstances.  If the recipient determines 
 26.30  not to rely on a digital signature under this section, the 
 26.31  recipient must promptly notify the signer of any determination 
 26.32  not to rely on a digital signature and the grounds for that 
 26.33  determination.  Nothing in this chapter shall be construed to 
 26.34  obligate a person to accept a digital signature or to respond to 
 26.35  an electronic message containing a digital signature. 
 26.36     Sec. 22.  [325K.21] [DIGITALLY SIGNED DOCUMENT IS WRITTEN.] 
 27.1      (a) A message is as valid, enforceable, and effective as if 
 27.2   it had been written on paper, if it: 
 27.3      (1) bears in its entirety a digital signature; and 
 27.4      (2) that digital signature is verified by the public key 
 27.5   listed in a certificate that: 
 27.6      (i) was issued by a licensed certification authority; and 
 27.7      (ii) was valid at the time the digital signature was 
 27.8   created. 
 27.9      (b) Nothing in this chapter shall be construed to 
 27.10  eliminate, modify, or condition any other requirements for a 
 27.11  contract to be valid, enforceable, and effective.  No digital 
 27.12  message shall be deemed to be an instrument under the provisions 
 27.13  of section 336.3-104 unless all parties to the transaction 
 27.14  agree, including any affected financial institution. 
 27.15     Sec. 23.  [325K.22] [DIGITALLY SIGNED ORIGINALS.] 
 27.16     A copy of a digitally signed message is as effective, 
 27.17  valid, and enforceable as the original of the message, unless it 
 27.18  is evident that the signer designated an instance of the 
 27.19  digitally signed message to be a unique original, in which case 
 27.20  only that instance constitutes the valid, effective, and 
 27.21  enforceable message. 
 27.22     Sec. 24.  [325K.23] [CERTIFICATE AS ACKNOWLEDGMENT.] 
 27.23     Unless otherwise provided by law or contract, a certificate 
 27.24  issued by a licensed certification authority is an 
 27.25  acknowledgment of a digital signature verified by reference to 
 27.26  the public key listed in the certificate, regardless of whether 
 27.27  words of an express acknowledgment appear with the digital 
 27.28  signature and regardless of whether the signer physically 
 27.29  appeared before the certification authority when the digital 
 27.30  signature was created, if that digital signature is: 
 27.31     (1) verifiable by that certificate; and 
 27.32     (2) affixed when that certificate was valid. 
 27.33     Sec. 25.  [325K.24] [PRESUMPTIONS IN ADJUDICATING 
 27.34  DISPUTES.] 
 27.35     In adjudicating a dispute involving a digital signature, a 
 27.36  court of this state presumes that: 
 28.1      (a) A certificate digitally signed by a licensed 
 28.2   certification authority and either published in a recognized 
 28.3   repository, or made available by the issuing certification 
 28.4   authority or by the subscriber listed in the certificate is 
 28.5   issued by the certification authority that digitally signed it 
 28.6   and is accepted by the subscriber listed in it. 
 28.7      (b) The information listed in a valid certificate and 
 28.8   confirmed by a licensed certification authority issuing the 
 28.9   certificate is accurate. 
 28.10     (c) If a digital signature is verified by the public key 
 28.11  listed in a valid certificate issued by a licensed certification 
 28.12  authority: 
 28.13     (1) that digital signature is the digital signature of the 
 28.14  subscriber listed in that certificate; 
 28.15     (2) that digital signature was affixed by that subscriber 
 28.16  with the intention of signing the message; and 
 28.17     (3) the recipient of that digital signature has no 
 28.18  knowledge or notice that the signer: 
 28.19     (i) breached a duty as a subscriber; or 
 28.20     (ii) does not rightfully hold the private key used to affix 
 28.21  the digital signature. 
 28.22     (d) A digital signature was created before it was time 
 28.23  stamped by a disinterested person utilizing a trustworthy system.
 28.24     Sec. 26.  [325K.25] [RECOGNITION OF REPOSITORIES.] 
 28.25     Subdivision 1.  [CONDITIONS.] The secretary must recognize 
 28.26  one or more repositories, after finding that a repository to be 
 28.27  recognized: 
 28.28     (1) is operated under the direction of a licensed 
 28.29  certification authority; 
 28.30     (2) includes a database containing: 
 28.31     (i) certificates published in the repository; 
 28.32     (ii) notices of suspended or revoked certificates published 
 28.33  by licensed certification authorities or other persons 
 28.34  suspending or revoking certificates; 
 28.35     (iii) certification authority disclosure records for 
 28.36  licensed certification authorities; and 
 29.1      (iv) all orders or advisory statements published by the 
 29.2   secretary in regulating certification authorities; 
 29.3      (3) operates by means of a trustworthy system; 
 29.4      (4) contains no significant amount of information that is 
 29.5   known or likely to be untrue, inaccurate, or not reasonably 
 29.6   reliable; 
 29.7      (5) contains certificates published by certification 
 29.8   authorities that conform to legally binding requirements that 
 29.9   the secretary finds to be substantially similar to, or more 
 29.10  stringent toward the certification authorities, than those of 
 29.11  this state; and 
 29.12     (6) keeps an archive of certificates that have been 
 29.13  suspended or revoked, or that have expired, within at least the 
 29.14  past three years.  
 29.15     Subd. 2.  [APPLICATION.] A repository may apply to the 
 29.16  secretary for recognition by filing a written request and 
 29.17  providing evidence to the secretary sufficient for the secretary 
 29.18  to find that the conditions for recognition are satisfied. 
 29.19     Subd. 3.  [RECOGNITION DISCONTINUED.] A repository may 
 29.20  discontinue its recognition by filing 30 days' written notice 
 29.21  with the secretary.  In addition, the secretary may discontinue 
 29.22  recognition of a repository in accordance with the 
 29.23  administrative procedure act, chapter 14, if it concludes that 
 29.24  the repository no longer satisfies the conditions for 
 29.25  recognition listed in this section or in rules adopted by the 
 29.26  secretary. 
 29.27     Sec. 27.  [325K.26] [LIABILITY OF REPOSITORIES.] 
 29.28     Subdivision 1.  [REASONABLE RELIANCE.] Notwithstanding a 
 29.29  disclaimer by the repository or a contract to the contrary 
 29.30  between the repository, a certification authority, or a 
 29.31  subscriber, a repository is liable for a loss incurred by a 
 29.32  person reasonably relying on a digital signature verified by the 
 29.33  public key listed in a suspended or revoked certificate, if loss 
 29.34  was incurred more than one business day after receipt by the 
 29.35  repository of a request to publish notice of the suspension or 
 29.36  revocation, and the repository had failed to publish the notice 
 30.1   when the person relied on the digital signature. 
 30.2      Subd. 2.  [LIMITATIONS.] Unless waived, a recognized 
 30.3   repository or the owner or operator of a recognized repository 
 30.4   is: 
 30.5      (1) not liable for failure to record publication of a 
 30.6   suspension or revocation, unless the repository has received 
 30.7   notice of publication and one business day has elapsed since the 
 30.8   notice was received; 
 30.9      (2) not liable under subdivision 1 in excess of the amount 
 30.10  specified in the certificate as the recommended reliance limit; 
 30.11     (3) liable under subdivision 1 only for direct compensatory 
 30.12  damages, which do not include: 
 30.13     (i) punitive or exemplary damages; 
 30.14     (ii) damages for lost profits or opportunity; or 
 30.15     (iii) damages for pain or suffering; 
 30.16     (4) not liable for misrepresentation in a certificate 
 30.17  published by a licensed certification authority; 
 30.18     (5) not liable for accurately recording or reporting 
 30.19  information that a licensed certification authority or the 
 30.20  secretary has published as required or permitted in this 
 30.21  chapter, including information about suspension or revocation of 
 30.22  a certificate; and 
 30.23     (6) not liable for reporting information about a 
 30.24  certification authority, a certificate, or a subscriber, if the 
 30.25  information is published as required or permitted in this 
 30.26  chapter or a rule adopted by the secretary, or is published by 
 30.27  order of the secretary in the performance of the licensing and 
 30.28  regulatory duties of that office under this chapter. 
 30.29     Sec. 28.  [APPROPRIATION.] 
 30.30     $50,000 is appropriated from the general fund to the 
 30.31  secretary of state for the biennium ending June 30, 1999, for 
 30.32  purposes of sections 1 to 27. 
 30.33     Sec. 29.  [EFFECTIVE DATE.] 
 30.34     Sections 1 to 28 are effective January 1, 1999, except that 
 30.35  any provision authorizing or requiring rules to be adopted is 
 30.36  effective the day following final enactment.