Comments
to the
Subcommittee on
Courts and Intellectual Property House
Judiciary Committee

regarding

HR 1714 The "Electronic Signatures in Global and National Commerce Act"

September 30, 1999

Margot Saunders
Managing Attorney
National Consumer Law Center
1629 K Street, NW
Washington, D.C. 20006
(202) 986-6060
margot@nclcdc.org

Also on behalf of:

Consumers Union
Consumer Federation of America
U.S. Public Interest Research Group

Mr. Chairman and Members of the Committee, the National Consumer Law Center¹ appreciates the opportunity to provide comments regarding the impact of HR 1714, the "Electronic Signatures in Global and National Commerce Act" on consumers. We offer our testimony here today on behalf of our low income clients, as well as Consumers Union,² the Consumer Federation of America³ and the U.S. Public Interest Research Group.⁴

Our comments regarding the problems with HR 1714 should not be construed to indicate that we are opposed in any way to facilitating electronic commerce. We are not. Indeed, we believe that once access to the Internet is more widely available to all Americans, especially the nation's poor and elderly, there may be many new and beneficial opportunities made available. However, for electronic commerce to benefit consumers, the same basic consumer protections which are required in the physical world must apply to electronic transactions. As currently written, HR 1714 does not assure that consumers who are looking for credit, goods and services both through the Internet, and in the physical world will not be victimized by overreaching merchants of goods and services.

- The bill authorizes businesses to replace paper records, such as warranties, contracts, and notices, with electronic records regardless of whether the transaction is conducted online or offline and regardless of whether the consumer has the equipment and ability to access information electronically. Paper disclosures required by law are designed to serve consumers' interests by providing them with information critical to making informed choices in the marketplace, understanding their rights and obligations during commercial transactions, and enforcing their rights when transactions go sour. Consumers can potentially benefit from receiving information electronically. However, the broad-brush approach of H.R. 1714 will sacrifice important standards and nuances in state and federal consumer law, and erode consumer trust and confidence in electronic commerce.

The bill fails to require the following reasonable elements:

Electronic signatures are provided the same legal status as handwritten signatures without any consumer protections. Although the bill would give equal weight to an electronic signature as it would to a handwritten signature, there are no requirements that:

H.R. 1714 would preempt every state and federal law that requires a paper writing to be provided to a consumer. In each case, an electronic record could be provided instead. State requirements that certain information be given to consumers in writing often are adopted because of a history and pattern of harm to their citizens. Required paper notices and documents are critically important to ensure that consumers are apprized of their rights and obligations. Replacing these essential paper notices and contracts with electronic records should not be done without adequate assurances that consumers will be able to receive and retain electronic information. These state and federal laws should not be lightly swept away.

The bill would allow businesses to provide essential consumer information exclusively online-regardless of whether the transaction occurs on or off line. Nearly two thirds of the American public, and an even larger percentage of low income and minority citizens, do not have access to the Internet. This bill would limit, or eliminate, their access to information deemed critical to a functioning marketplace under state and federal law.

H.R. 1714 would permit electronic disclosures to substitute for paper notices even when the consumer doesn't know that he or she has consented to electronic communication, doesn't have a computer, or can't print the information when it is received. There are no requirements in the bill for meaningful, actual agreement by the consumer to receive records electronically. In almost every transaction between consumers and business it is a "take it or leave it" proposition for the consumer. Nothing in the bill regarding the intent of the parties (Sec. 6(c)) would prevent consumers from being required to accept electronic records instead of paper writings. One can easily imagine computer kiosks on businesses' premises at which consumers would be required to electronically consent to receiving electronic records, as a condition of doing business.

The bill expects that consumers entering into a transaction: a) understand the importance of disclosures and information not yet received; b) understand the technology and capability of a computer to receive, retain and print information before it is received; and, c) assess whether the technology and capacity to receive, retain and print the information will be available at uncertain dates in the future. In many transactions there are ongoing requirements for paper correspondence, including statements of accounts, notices of default, information on escrow accounts, change in mortgage services. Under H.R. 1714 the business will not be required to provide paper copies. Crucial information about the consumer's rights and obligations will not be received.

To provide reliable documentation of transactions, information provided electronically must be tamper proof. Documents provide certainty to transacting parties, capturing the terms of the agreement. Courts and others who are later called upon to interpret and enforce agreements rely on paper records to construct the parties' intent. For electronic information to provide the same certainty to the parties and the courts they must be protected from both inadvertent and intentional changes. If a consumer inadvertently changes a single byte on an electronic document, or an electronically provided notice is deleted during a business' overhaul of their Web site, the documents will be unavailable or useless if disputes arise.

The bill directs courts to give electronic signatures the same weight as their handwritten counterparts without addressing the heightened risks of forgery, duplication, and identity theft evident in today's online marketplace. The bill inappropriately allows businesses to make complicated technology choices and put the risks on consumers. Businesses have access to information about electronic commerce-enabling technology and the ability to limit, and plan for, the risks created by electronic commerce. Consumers have neither the access to information nor the expertise necessary to evaluate the appropriateness of a given technology. Permitting risk shifting to consumers in this situation is bad policy.

To ensure that a robust infrastructure for electronic commerce emerges Congress should place the responsibility and liability for technology failures squarely on the shoulders of certificate authorities, manufacturers, or the businesses dictating the technology to be used. The bill permits "the parties to such contract or agreement [to] establish reasonable requirements regarding the types of electronic records and electronic signatures acceptable to such parties." When the two parties to a transaction are a consumer and a large business the gross inequality of bargaining power will lead to businesses dictating the authentication technology and requiring the consumer to bear the risk. The security of online interactions is critical to both businesses and consumers.

Dishonest businesses could require or permit a form of authentication to be used that is corruptible or unreliable. The use of weak authentication tools may place the consumer in a worse position than the absence of authentication. In the consumer context, the risk of misunderstanding any risk-shifting consequences for adopting an authentication procedure are even greater than in the business to business context since such a rule is directly contrary to the rules that now apply in other similar consumer transactions. As a result, a law that peremptorily establishes the legality of any authentication technology agreed to must ensure that consumers are not bound by the unauthorized use of an online authentication procedure. Unless fraud and error losses associated with online transaction technologies are allocated to technology providers and online vendors, there will be no incentive for investment in the further improvement of the technologies in use. Liability standards must be clearly established in the law.

Electronic commerce requires the development of reliable methods of verifying the identity and capacity of contracting parties. We look forward to a robust online marketplace built upon strong security protections for the individual's identity, personal information, commercial transactions and communications. However, at this time such a framework does not exist. Requiring courts to give the same weight to electronic signatures without assessing the different risks posed by online commerce may unintentionally harm consumers.

Encouraging electronic commerce and protecting consumers need not be competing goals. The key to facilitating electronic commerce while protecting consumers’ interests is to ensure that all of the assumed elements to a transaction in the physical world are in existence in electronic commerce.

Necessary Consumer Protections for Electronic Commerce

We do not seek in this bill to add consumer protections to the electronic marketplace that are not in existence in the physical. We do seek to ensure that the consumer protections that apply in the physical world are equally applicable to e-commerce. Special issues must be addressed because of the differences between the physical world and the electronic world. For example, when a law requires a document to be in writing there are a number of inherent assumptions that automatically apply to that writing that are not necessarily applicable to an electronic record.

A paper writing is by its nature tangible, once handed to a person it will not disappear unless the person makes it disappear. The printed matter on the paper writing will not change every time someone looks at it, and the writing can be used at a later to prove its contents.

None of those assumptions apply to an electronic record. An electronic record can be sent to a person who does not know it is there, because the person does not have email (and unlike the U.S. Postal Service, there is no reasonable guarantee of delivery of email). The electronic record could be provided in a format which is not retainable by the viewer; even if the viewer is able to download the electronic record, it may not be printable in the same format in which it was viewed. Once downloaded the electronic record may be inadvertently changed by the viewer every time it is brought up on the screen; and if this is possible the electronic record thus becomes useless to prove its contents.

Consumer Protections for the Use of Electronic Records

To maintain the status quo; to continue to ensure that consumers are protected while ensuring that a healthy and vigorous electronic marketplace continues to thrive, the same assumptions that apply in the physical world must be made explicitly applicable to electronic commerce. In consumer transactions, electronic records should be permitted to replace paper writings only when the following rules are in place:

Similarly, the assumptions about physical signatures do not easily translate to electronic signatures. In the real world context, in a court proceeding a person who denies that the signature on a contract is really his must present some proof before the party claiming under the signature is required to prove it is valid. ⁵ Proof that a person's signature was not made by that person is relatively easy to present; one can simply say "Look, it doesn't look like my signature, here is what my signature really looks like." Or "I was nowhere near the place the contract was signed on that day, I was at the beach, and here is my hotel receipt to prove that I was at the beach." Once some proof is provided challenging the validity of the signature, the rules as to which party then has the burden of proof on the validity of the signature vary depending upon whether the contract in question is governed by the Uniform Commercial Code or by common law contract law. But the significant point is that in both cases, in order to open up the question regarding the validity of the physical signature some proof must be provided.

HR 1714 would simply transfer these common law rules of burdens of proof to the validity of electronic signature. But these rules do not translate into a fair system in the context of electronic commerce. Asking a person to provide some proof that an electronic signature was not made by that person is asking a person to provide proof of a negative. All a person can really say is something along the lines of: "I did not sign that document." "It was not me that typed in the password, or the macro that initiated my digital signature." What kind of proof can an individual offer to show that they did not type in some letters or words in an electronic transaction? It will be virtually impossible for individual consumers to prove this negative. The result will be that many, many consumers will be forced to pay for goods or services they did not purchase, and from which they did not benefit.

Of course, these concerns may not apply when electronic signatures are based upon biometrics. But HR 1714 covers all electronic signatures, the typing of one's initials, a digital signature, or a thumb print, and more.

There is a better framework to apply to electronic signatures than simply the common law rules of physical signatures: the rules created by this Congress for the use of credit cards under the Fair Credit Billing Act.⁶ Congress realized when the credit card system was authorized that it was logical and appropriate to put the risk of loss from fraud, theft, or system failure on the industry creating and maintaining the credit card system. The clear beneficiaries of this statutory transfer of risk of loss: the credit industry which has enormous profits from credit cards, and merchants for whom the use of credit cards facilitates millions of dollars of sales each year.

An electronic signature is much more like a credit card than it is like a physical signature. It is an electronic device which binds the holder of the credit card to a promise to pay. An electronic signature is also an electronic device -- outside the body of the owner -- which can bind the owner to a promise to pay. Unauthorized use is a likely possibility in many situations. Who should bear the burden of loss when this occurs?. If the use of electronic signatures is left to the rules applied to physical signatures, consumers will bear the cost. This will neither be fair, nor will it appropriately facilitate electronic commerce. A better rule would be to put the burden of proof of unauthorized use of electronic signatures on the merchant in merchant to consumer transactions. This will force the electronic commerce industry to create a system for using and accepting electronic signatures that limits losses from fraud, mistake, theft and system breakdowns to an absolute minimum -- because the creators of the system will bear the losses. Our proposed rules would be: