Encryption and Digital Signatures

Current Irish Government policy permits user access to secure and advanced encryption technologies as well as the right to choose their preferred encryption method. The production, importation and use of encryption technologies are not subject to any specific regulatory controls other than the obligations relating to lawful access.

The export from Ireland of encryption products is regulated by EU legislation and Irish legislation which reflects the commitments made under the 1996 Wassenaar Arrangement on Export Controls for Conventional Arms and Dual Use Goods and Technologies of which Ireland is one of the 33 co-founding countries.

The European Communities (Control of Exports of Dual Use Items) Regulations, 2000 (SI No. 317 of 2000) give effect to the provisions of EC Council Regulation 1334/2000 which sets up an EU regime for the control of exports of what are termed "dual use items and technology" being items and technologies that have both a military and civilian application. Clearly this extends to encryption technologies. In effect, an EU wide general export control regime has been brought into being, which governs exports of amongst other things, encryption products to certain nominated countries which include the United States of America, Canada, Switzerland, Japan, Norway and Australia.

The Electronic Commerce Act, 2000 gives legal recognition to electronic signatures. An electronic signature is defined as "data in electronic form attached to, incorporated in or logically associated with other electronic data and which serves as a method of authenticating the purported originator, and includes an advanced electronic signature". The Act recognises current encryption technology and is designed to be technologically neutral.

Security of communications over the Internet is a fundamental issue. Digital signatures are effectively created by the use of technologies such as public key encryption. As has been stated earlier, the Electronic Commerce Act 2000 gives legal recognition to electronic signatures. The Irish Government has indicated in very clear and unambiguous terms, that it does not propose to bring into being, a regime that will provide for compulsory or forced disclosure of private encryption keys. This policy is clearly reflected in the Electronic Commerce Act, 2000 and this policy, as implemented to date, can be clearly differentiated from the approach of, amongst other jurisdictions, the United Kingdom, which has enacted legislation which provides for mandatory key access in given circumstances.

For further information or general enquiries contact: -
Patrick Ryan
Email: pryan@kilroys.ie
Telephone: +3531-439 5600
Fax: +3531-439 5601/439 5602

© Kilroys Solicitors 2002 - 2003