CONTROLLER & CERTIFYING AUTHORITIES

18. Certifying Authorities Controller and other officers.– (1) For the purpose of this Act, the Government may, by notification in the Official Gazette and additionally optionally in Electronic Gazette, appoint a Controller and such number of Deputy Controller(s) and Assistant Controller(s) as it deems fit within 90 days of the enactment of this law.
(2) The Controller shall discharge such functions as are vested in him under this Act under the general superintendence and control of the Government.
(3) The Deputy Controllers and the Assistant Controllers shall perform such functions as are assigned to them by the Controller under the general superintendence and control of the Controller.
(4) The qualifications, experience and terms & conditions of service of Controller, Deputy Controllers and Assistant Controllers shall be such as may be prescribed by the Service Code.
(5) The Head Office of the Controller shall be located at Dhaka and as the Government may think fit may establish Branch Offices at such places for fixed time duration or permanently.
(6) There shall be a seal of the office of the controller, which will be used in places approved by the Government and other defined areas.
(7) For the purpose of preserving all electronic records under this Act there shall be a room in the Office of Controller which will be named as “electronic records repository room.”
19. Functions of the Controller.–The Controller may perform all or any of the following functions, namely:–
(a) exercising supervision over the activities of the Certifying Authorities;
(b) laying down the standards to be maintained by the Certifying Authorities;
(c) specifying the qualifications and experience which employees of the Certifying
Authorities should possess;
(d) specifying the conditions subject to which the Certifying Authorities shall conduct
their business;
(e) specifying the contents of written, printed or visual materials and advertisements that may be used in respect of a Digital Signature Certifying;
(f) specifying the form and content of a Digital Signature Certificate;
(g) specifying the form and manner in which accounts shall be maintained by the
Certifying Authorities;
(h) specifying the terms and conditions subject to which auditors may be appointed and the remuneration to be paid to them for auditing the Certifying Authorities;
(i) facilitatining the establishment of any electronic system by a Certifying Authority
either solely or jointly with other Certifying Authorities and regulation of such
systems;
(j) specifying the manner in which the Certifying Authorities shall conduct their
dealings with the subscribers;
(k) resolving any conflict of interests between the Certifying Authorities and the
subscribers;
(l) laying down the duties and responsibilities of the Certifying Authorities;
(m) maintaining computer based databases, which–
(i) contain the disclosure record of every Certifying Authority containing such
particulars as may be specified by regulations; and
(ii) shall be accessible to the member of the public;
(n) perform any other function under this Act or Codes prepared under this Act.
20. Recognition of foreign Certifying Authorities.– (1) Subject to such conditions and
restrictions as may be specified by regulations, the Controller may, with the previous approval of the Government, and by notification in the Official Gazette and additionally optionally in Electronic Gazette, recognize any foreign Certifying Authority as a Certifying Authority for the purposes of this Act.
(2) Where any Certifying Authority is recognized under sub-section (1) of this section, the Digital Signature Certificate issued by such Certifying Authority shall be valid for the purposes of this Act.
(3) The Controller may, if he is satisfied that any Certifying Authority has contravened any of the conditions and restrictions subject to which it was granted recognition under sub-section (1) of this section, for reasons to be recorded in writing, by notification in the Official Gazette and additionally optionally in Electronic Gazette, revoke such recognition.
21. Controller to act as repository.– (1) The Controller shall be the repository of all Digital Signature Certificates issued under this Act.
(2) The Controller shall ensure that the secrecy and security of the digital signature are assured and in order to do so shall make use of hardware, software and procedures that are secure from intrusion and misuse and follow such standards as may be prescribed.
22. Licence to issue Digital Signature Certificate.– (1) Subject to the provision of subsection (2) of this section, any person may make an application to the Controller for a licence to issue Digital Signature Certificates.
(2) No licences shall be issued under sub-section (1) of this section unless the applicant fulfills such requirements with respect to qualification, expertise, manpower, financial resources and other infrastructure facilities which are necessary to issue Digital Signature Certificates.
(3) A licence granted under sub-section (1) of this section—
(a) shall be valid for certain period;
(b) shall be delivered subject to fulfilling defined terms and conditions; and
(c) shall not be transferable or heritable.
23. Application for licence.– (1) Every application for issue of a licence shall be submitted in a prescribed form.
(2) Every application of sub-section (1) of this section shall be accompanied by—
(a) a certification practice statement;
(b) necessary documents with respect to identification of the applicant;
(c) evidence of payment of defined fees;
(d) such other documents as may be prescribed.
24. Renewal of licence.—Licence issued under this Act shall be renewed automatically for a certain period subject to paying fees in a prescribed procedure.
25. Procedure for grant or rejection of licence.—The Controller may, on receipt an
application under sub-section (1) of section 22 of this Act, after considering the documents accompanying the application and such other factors as he deems fit, grant the licence or reject the application:
Provided that no application shall be rejected under this section unless the applicant has been given a reasonable opportunity of presenting his case.
26. Revocation and suspension of licence.—(1) The Controller may suspend or revoke any licence under this Act, if he is satisfied after making such inquiry, as he may think fit, that a Certifying Authority has—
(a) made statement in, or in relation to, the application for the issue or renewal of the
licence, which is incorrect or false in material particulars;
(b) failed to comply with the terms and conditions subject to which the licence was
granted;
(c) failed to main the standards specified under section 21(2) of this Act;
(d) contravened any provisions of this Act, rules, regulations or orders made thereunder.
(2) No licence shall be revoked unless the Certifying Authority has been given reasonable opportunity of showing cause against the proposed revocation under sub-section (1) of this section.
(3) The Controller may, if he has reasonable cause to believe that there is any ground for revoking a licence under sub-section (1) of this section, by or, suspend such licence temporarily pending the completion of any enquiry ordered by him.
(4) No licence shall be suspended for a period exceeding 14 (fourteen) days unless the Certifying Authority has been given a reasonable opportunity of showing cause against the propose suspension under sub-section (3) of this section;
(5) A Certifying Authority whose licence has been suspended temporarily shall not issue any Digital Signature Certificate during the period of such suspension.
27. Notice of revocation or suspension of licence.—(1) Where the licence of a Certifying Authority is revoked or suspended temporarily, the Controller shall publish notice of such revocation or suspension, as the case may be, in the database maintained by him.
(2) Where one or more repositories are specified, the Controller shall publish notices of such temporarily revocation or suspension, as the case may be, in all such repositories:
Provided that the database containing the temporarily notice of such revocation or suspension, as the case may be, shall be made available electronically including website or any other medium which shall be accessible round the clock.
28. Power to delegate.—The Controller may, in writing, authorize the Deputy Controller, Assistant Controller or any other officer to exercise any of the power of the Controller under this Act.
29. Power to investigate contraventions.—(1) The Controller or any officer authorized by him in this behalf shall take up for investigation any contravention of the provisions of this Act, rules or regulations made thereunder.
(2) The Controller or any officer authorized by him in this behalf shall, for the purposes of sub-section (1) of this section, have the same power as are vested in a Civil Court under the Code of Civil Procedure, when trying a suit in respect of the following matters, namely:–
(a) discovery and inspection;
(b) enforcing the attendance of any person and examining him on oath or
affirmation;
(c) compelling the production of any document; and
(d) issuing commissions for the examination of witness.
30. Access to computers and data.—(1) Without prejudice to the provisions of section 45 of this Act the Controller or any officer authorized by him shall, if he has reasonable cause to suspect that any contravention of the provisions of this Act or rules and regulations made thereunder has been committed, have access to any computer system, any apparatus, data or any other material connected with such system, for the purpose of searching or causing a search to be made for obtaining any information or data contained in or available to such computer system.
(2) For the purpose of sub-section (1) of this section the Controller or any officer
authorized by him may, by order, direct any person in charge of, or otherwise concerned with the operation of, the computer system, data apparatus or material, to provide him with such reasonable technical and other assistance as he may consider necessary.
(3) If authorization has been given to a person, the authorized person shall oblige to
assist as instructed under sub-section (1) of this section.
31. Certifying Authority to follow certain procedures.—Every Certifying Authority shall—
(a) make use of hardware, software and procedures that are secure from intrusion and misuse;
(b) provide a reasonable level of reliability in its services which are reasonable suited to the performance of intended function under this Act;
(c) adhere to security procedures to ensure that the secrecy and privacy of digital
signatures are assured; and
(d) observe such other standards as may be specified by regulations.
32. Certifying Authority to ensure compliance of the Act, rules, regulations, etc.—Every Certifying Authority shall ensure that every person employed or otherwise engaged by it complies, in the course of his employment or engagement, with the provisions of this Act, rules, regulations or orders made thereunder.
33. Display of licence.—Every Certifying Authority shall display its licence at a conspicuous place of the premises in which it carries on its business.
34. Surrender of licence.—Every Certifying Authority whose licence is revoked or suspended, as the case may be, shall immediately after such revocation or suspension, as the case may be, surrender the licence to the Controller.
35. Disclosures.—(1) Every Certifying Authority shall disclose in the manner specified by regulations—
(a) Digital Signature Certificate used by the Certifying Authority to digitally sign
another Digital Signature Certificate;
(b) any certification practice statement relevant thereto;
(c) notice of the revocation or suspension of its Certifying Authority certificate, if any;
and
(d) any other fact the materially and adversely affects either the reliability of a Digital
Signature Certificate, which the Certifying Authority has issued, or the Certifying
Authority’s ability to perform its service.
(2) Where in the opinion of the Certifying Authority any event has occurred or any
situation has arisen which may materially and adversely affect the integrity of its
computer system or the conditions subject to which a Digital Signature Certificate
was granted, then the Certifying Authority shall use reasonable efforts to notify any
person who is likely to affected by the occurrence, or act in accordance with the
procedure specified in its certification practice statement to deal with such event or
situation.
36. Issue of certificate.—The Certifying Authority may issue a certificate to a prospective subscriber only after the Certifying Authority—
(a) has received an application in the prescribed form requesting for issuance of a
certificate from the prospective subscriber;
(b) if it has a certification practice statement, complied with all of the practices and
procedures set forth in such certification practice
(c) if the prospective subscriber is the person to be listed in the certificate to be issued;
(d) if all information in the certificate to be issued is correct; and
(e) whether the prospective subscriber paid such fees as may be prescribed for issuance of certificate.
37. Representations upon issuance of certificate.—(1) By issuing a certificate, the Certifying Authority represents to any person who reasonably relies on the certificate or digital signature described in the certificate that the Certifying Authority has issued the certificate in accordance with any applicable certification practice statement incorporated by reference in the certificate, or of which the relying person has notice.
(2) In the absence of such certification practice statement mentioned in sub-section (1) of this section, the Certifying Authority represents that it has confirmed that—
(a) the Certifying Authority has complied with all applicable requirements of this Act
and the rule and regulations made thereunder in issuing the certificate, and if the
Certifying Authority has published the certificate or otherwise made it available to
such relying person, that the subscriber listed in the certificate has accepted it;
(b) all information in the certificate is accurate, unless the Certifying Authority has
stated in the certificate or incorporated by reference in the certificate a statement that the accuracy of specified information is not confirmed;
(c) the Certifying Authority has no knowledge of any material fact which if it had been
included in the certificate would adversely effect the reliability of the representations
in clauses (a) and (b) of this sub-section.
(3) Where there is an applicable certification practice statement which has been
incorporated by reference in the certificate, or of which the relying person has notice, sub-section (2) of this section shall apply to the extent that the representations are not inconsistent with the certification practice statement.
38. Revocation of Digital Signature Certificate.—A Certifying Authority shall revoke a
Digital Signature Certificate issued by it—
(a) where the subscriber or any person authorized by him makes a request to that effect; or
(b) upon the death of the subscriber; or
(c) where the subscriber is a firm or a company, if it has been dissolved or wound up or has otherwise ceased to exist.
(2) Subject to the provisions of sub-section (3) of this section and without prejudice to the provisions of sub-section (1) of this section, a Certifying Authority may revoke a Digital Signature Certificate which has been issued by it at any time if it is of opinion that—
(a) a material fact represented in the Digital Signature Certificate is false or has been
concealed;
(b) a requirement for issuance of the Digital Signature Certificate was not satisfied;
(c) the Certifying Authority’s identification/security system was compromised in a
manner materially or as a whole affecting the Digital Signature Certificate’s
reliability;
(d) the subscriber has been declared insolvent by a competent court or authority.
(3) A Digital Signature Certificate shall not be revoked unless the subscriber has been given an opportunity of being heard in the matter.
(4) On revocation of a Digital Signature Certificate under this section, the Certifying
Authority shall communicate the same to the subscriber.
39. Suspension of Digital Signature Certificate.—(1) Subject to the provisions of sub-section (2) of this section, the Certifying Authority which has issued a Digital Signature Certificate may suspend such Digital Signature Certificate—
(a) on receipt of a request to that effect from the subscriber listed in the Digital Signature certificate or any person duly authorized to act on behalf of that subscriber;
(b) if it is opinion that the Digital Signature Certificate should be suspended in public
interest.
(2) A Digital Signature Certificate shall not be suspended for a period exceeding 30 (thirty) days without giving the subscriber a notice under sub-section 1 (b) of this section.
(3) Certifying Authority can suspend the Digital Signature Certificate, if the Authority is satisfied on the ground that the explanation given by the subscriber in response to the notice of subsection (2) of this section is not acceptable.
(4) On suspension of a Digital Signature Certificate under this section, the Certifying
Authority shall communicate the same to the subscriber.
40. Notice of revocation or suspension.—(1) Where a Digital Signature Certificate is revoked under section 38 of this Act or suspended under section 39 of this Act, the Certifying Authority shall publish a notice of such revocation or suspension, as the case may be, in the repository specified in the Digital Signature Certificate for publication of such notice.
(2) Where one or more repositories are specified, the Certifying Authority shall publish notices of such revocation or suspension, as the case may be, in all such repositories.