Electronic Transactions Act, 2008 (Act 772)

This section states the Act’s purpose: to support electronic communications and related transactions in the public interest.

This Act applies to electronic transactions and electronic records of every type.

The Act should not be read as forcing a person to use electronic form for information, documents, or signatures, and it should not be read as stopping a person from setting how electronic records will be accepted.

This Act does not apply to certain listed documents, instruments, property transactions, affidavits, and any class of documents or transactions later notified by Gazette.

A writing requirement is satisfied if the information is made available electronically, accessible, and capable of being kept for later reference, unless this Act provides otherwise.

An electronic record can satisfy a legal requirement for original form if its integrity is reliably assured and it can be displayed to the person who must receive it.

Electronic records cannot be denied as evidence except as provided in the Act, and the Court must consider specified reliability factors when weighing them.

Electronic records can satisfy a retention requirement if they are accessible, reusable for later reference, preserved accurately, and kept for six years.

If a security procedure is applied to an electronic record, the record is treated as secure for that period. An unauthorised alteration of the security procedure makes the record invalid.

A required handwritten signature may be satisfied by using a digital signature on an electronic record.

This section says digital signatures keep legal effect if they meet this Act, another law, or a contract, unless this Act provides otherwise.

A person may sign an electronic record using a personal digital signature or another recognized, secure, and verifiable signing method.

A person relying on a digital signature bears the legal consequences if they do not take reasonable steps to verify the signature’s authenticity, or—when a certificate supports it—to verify the certificate’s validity and observe any certificate limits.

A person may choose the digital signature, certificate, or authentication they use, unless another law says otherwise. The Minister may recognise a foreign provider’s digital signature, certificate, or authentication for use by a public servant by Gazette notice.

Electronic signatures can satisfy notarisation, acknowledgement, verification, oath, and certified-copy requirements for electronic records and copies.

This section says an electronic record can satisfy certain paper-copy and corporate-seal requirements.

Automated transactions remain valid even if an electronic agent is used, but a party dealing with an electronic agent is not bound by agreement terms unless they could access those terms before the contract formed.

An electronic record is treated as despatched when it enters a processing system outside the control of the originator or the originator’s agent, unless the originator and addressee agree otherwise.

This section sets when an electronic record counts as received, depending on whether the addressee has designated a receiving system, and it also deems where despatch and receipt occur unless the parties agree otherwise.

An electronic expression of intent or other electronic representation between the originator and the addressee of an electronic record is admissible when it is relevant in law.

Electronic records may be treated as originating from the originator in specified circumstances, and the addressee may rely on that assumption unless stated exceptions apply.

An addressee may acknowledge receipt of an electronic record by communicating or acting to show it was received.

An agreement remains valid even if it was made partly or entirely through electronic means.

Sections 5 to 23 apply only when the parties handling electronic records have not agreed on the matters covered by those sections.

A public body must take steps or make arrangements so its functions can be carried out, delivered, or accessed electronically or online.

Public agencies may handle filings, permits, approvals, and payments electronically, and may set electronic record and signature requirements by Gazette notice.

A Gazette publication requirement is treated as satisfied if the material is published electronically as an E-Gazette.

A person must not sell or provide encryption or authentication services contrary to the Act.

An encryption or authentication service or product is treated as provided in the country if it is made available through listed local or Ghana-linked connections.

The National Information Technology Agency must help establish the Certifying Agency, and the Certifying Agency must maintain a website and provide information on it as required by the Act.

The Agency may license, monitor, suspend, revoke, and audit encryption and authentication service providers and licence holders.

The Agency may suspend or revoke a licence if requirements are not met, but it must first give written notice, describe the alleged breach, and let the licence holder respond and try to fix it.

A licensee with a suspended or revoked licence must surrender it to the Agency within 24 hours of notice.

The Agency may recognise a foreign entity as a certifying agency, and may revoke that recognition if conditions are breached.

The Agency must keep Digital Signature Certificates, use secure systems and procedures, follow any prescribed standards, and maintain a computerized database of public keys for public verification.

The Agency must keep a register of licence holders and publish related licence-status information, while licence holders do not have to disclose confidential information or trade secrets.

A person may disclose information under this Act in specified situations, subject to the Constitution.

The Agency may not issue or grant a licence to an individual, must consider specified factors when reviewing an application, and may set the licence period and conditions.

The Agency cannot grant a licence unless the applicant’s security procedure meets listed conditions, and the Agency may set certificate-related requirements before licensing authentication products or services.

A licensee must conspicuously display its licence at the premises of its principal place of business.

A licensee must make sure that every person it employs or engages follows this Act, regulations made under it, and the licence conditions.

A renewal application must be in the prescribed form, include the prescribed fees, and be paid in full before the licence is issued.

The Agency may grant or reject a licence renewal application after considering the application documents and other necessary factors, and it must give the applicant written reasons if it rejects the application.

The Agency must use reasonable efforts to notify people likely to be affected by an adverse event, or handle the event under its certification practice statement procedure, when it thinks the event may materially affect its computer system or licence conditions.

A licensed person must use secure hardware, software, and procedures, keep services reliably suited to their intended functions, and follow security and other prescribed standards.

Sections 47 to 54 apply only to electronic transactions.

Suppliers in electronic transactions must disclose specified information to consumers, provide chances to review and correct terms before contracting, use secure payment systems, and may face contract cancellation and refund duties if they fail to comply.

The supplier must execute an order within 14 days of receiving it, unless the parties agree אחרת. If the supplier cannot perform because the goods or services are unavailable, the supplier must immediately notify the consumer and refund any payment within 7 days after notification.

Consumers may cancel a goods or services transaction, and any related credit agreement, within a short grace period, subject to listed exceptions.

A person generally must not send unsolicited electronic communications to a consumer without prior consent, except for certain service notices from an electronic communications provider.

The holder of an electronic payment medium is generally not liable to the issuer for loss from unauthorized use, unless acting in collusion. There are exceptions for certain possession-gap and consent cases, and oral notice must be confirmed in writing within 14 clear days.

Financial institutions must not share, lend, or sell lists of electronic payment medium holders and their contact/account details without prior written consent, unless a court orders otherwise.

For consumer sales of goods in this country, the Act applies even if the contract says otherwise.

Any agreement term that excludes consumer rights given by this Act is void.

The Minister can declare certain systems protected, and unauthorized access attempts to a protected system are an offence.

The Minister may, by notice in the Gazette, declare certain classes of information to be critical electronic records and establish a procedure for identifying critical databases.

The Minister may declare certain classes of information to be a critical electronic record for sections 58 to 62.

The Minister may set registration requirements and procedures for a critical database by notice in the Gazette.

The Minister must prescribe minimum standards for managing critical databases, and the Act does not limit a public body’s right to perform an authorised function under other law.

The Agency may not disclose information from the register of a critical database except to responsible Agency employees, and it may disclose information to specified public authorities.

The Minister may order audits to be carried out by a critical database administrator to check compliance with the Act.

After an audit report, the Minister must consider remedial action and its timeframe, then report the recommendation to the National Security Council. The Council may take action or give directions it considers necessary for national security.

This section establishes a Domain Name Registry and says it is a body corporate that may sue and be sued.

The Registry must manage the country domain name space, regulate registries and registrars, and publish guidelines; persons may not operate the country domain name except as allowed by the Act.

The Registry has duties to promote domain name registration, research the domain name system, monitor the .gh domain name space, and evaluate the Act’s effectiveness; it may also investigate, issue information, liaise with others, and appoint experts.

A person must be licensed by the Registry before updating a repository or administering a second level country domain name, and licence applications must follow the prescribed procedure and fees.

The Registry is governed by a Board, and the President appoints its members and one chairperson.

Board members serve for up to four years, may be re-appointed, but cannot serve more than two consecutive terms.

The Board must meet at least once every two months, the chairperson must convene extraordinary meetings on written request from at least one-third of members, and the Board may set its own meeting procedure subject to this section.

Board members who have an interest in a matter must disclose it in writing and must not take part in the Board’s deliberations on that matter.

The Board may appoint committees, and those committees may be chaired by a Board member.

The Board must set up a Dispute Resolution Committee, and the Committee must hear and investigate matters brought before it.

The Dispute Resolution Committee has several powers for handling disputes, including summoning witnesses, examining evidence, making orders, and deciding how matters proceed.

Board members and committee members are to be paid allowances, subject to Ministerial approval in consultation with the Minister responsible for Finance.

The President must appoint an Executive Director for the Registry, and that Executive Director holds office on the terms in the appointment letter.

The Executive Director manages the Registry day to day, answers to the Board, may delegate functions to Registry officers, and must carry out any other functions the Board determines.

The President must appoint necessary Registry staff. Other public officers may be transferred or seconded to the Registry, or otherwise assist it. The Registry may also hire advisers and consultants if the Board recommends it.

The Registry’s funds come from Parliament, donations, grants, gifts, fees, and other money approved by the Minister responsible for Finance.

The Board must keep proper accounting records, submit the Registry’s accounts to the Auditor-General within three months after the financial year ends, and the Auditor-General must audit them and send the audit report to the Minister.

The Board must send an annual report to the Minister within one month after getting the audit report, and the Minister must then send the report to Parliament within one month after receiving it.

The Agency must set up a dispute resolution process for certain licence and consumer disputes, and it may make rules on how those disputes are handled.

This section creates the Information Communication Technology Tribunal and says it is convened on an ad hoc basis to hear certain appeals.

The Public Services Commission appoints the Tribunal’s members and its Registrar. The Tribunal’s expenses are paid from Agency income and included in the Agency’s annual budget.

The Board must propose rules of procedure for the Tribunal.

A person affected by a decision of the Agency or the Dispute Resolution Committee may appeal to the Tribunal by notice of appeal.

The Tribunal may decide an appeal by quashing, allowing, varying, or dismissing it, and its decision has the same effect as a High Court judgment.

A Tribunal decision may be appealed to the Court of Appeal on a point of law only, and only by a party to the Tribunal proceedings.

This section creates an Industry Forum and lets the Agency designate an industry body to serve as the Forum if certain conditions are met.

The Forum may prepare a voluntary industry code, but it is not effective until the Agency registers it.

Intermediaries and service providers are not liable for certain access, routing, transmission, or storage functions if they meet specified technical conditions.

An intermediary or service provider is not liable for temporary storage of an electronic record if the storage is for onward transmission and several conditions are met.

A hosting intermediary or service provider must quickly remove or disable access to infringing information after a takedown notice, and the liability limit applies only if it has an infringement-notification address or agent.

An intermediary or service provider is exempt from liability for damages from linking to infringing content if it lacks knowledge, has no apparent reason to infer infringement, gets no direct financial benefit, and removes access within a reasonable time after notice.

A person who says online material is illegal or unlawful must notify the publisher, and unlawful-activity notices must be sent in a permanent medium with specified contact and complaint details.

Intermediaries and service providers do not have to monitor certain electronic records, but they still must follow court or competent agency orders and contractual obligations.

This section restricts public electronic communication and remote computing service providers from knowingly revealing communication contents, but lists several allowed disclosure situations.

Sections 89 to 96 do not override certain obligations, including contractual obligations, service-provider obligations under law, and obligations to remove, block, or deny access to an electronic record.

A law enforcement agent may seize specified digital or physical items when executing a warrant under this Act, if there are reasonable grounds to believe an offence has been or is about to be committed.

A law enforcement officer executing a warrant may use an authorised person’s help to inspect computers, search records, copy records, and obtain decryption-related access; the officer may also require certain people to provide a computer, technical help, or decryption information.

A communications or remote computing provider must preserve records and evidence on a written request from law enforcement, and must keep that request confidential while the request is pending court order.

A Court may order disclosure of certain electronic communication contents in electronic storage, but only if the Court is satisfied the disclosure is relevant and necessary for investigative purposes or is needed in the interest of national security.

Electronic communication and remote computing service providers generally may not disclose subscriber-related records or information without consent, but must disclose to law enforcement on a court order or written consent.

A provider of electronic communication service or remote computing service must keep certain logs and records for twelve months.

A court may order an electronic communication provider to make and preserve a backup copy for law enforcement, and the provider must follow notice, non-destruction, and release rules.

A subscriber or customer may apply to a Court to vacate an order obtained under the Act by a law enforcement agency.

Evidence obtained only from a disclosure order is inadmissible if a court varies, quashes, or modifies that order.

This section says the stealing provision applies, with necessary modifications, to things done using electronic processing or procuring systems and to things received partly or wholly through electronic records.

This section says the appropriation rule in section 122(2) applies with necessary modifications to conduct done through electronic processing or procurement procedures, and it broadens “thing” for cyber offences to include certain electronic-related matters.

Section 109 says the false pretences rule in Section 133 applies, with necessary modifications, to representations made through electronic processing systems or electronic records.

The newspaper rule on charlatanic advertisement also applies, with necessary modification, to electronic records and website-related publications.

Section 111 says the rule on attempts to commit crimes applies, with necessary modification, to a person who attempts a crime using an electronic medium or electronic agent.

Sections 20 and 21 on abetment of crime apply, with necessary modification, to anyone who abets a crime by electronic means or an electronic agent.

A person who knows someone is planning or committing a felony must use reasonable means to try to prevent it.

The conspiracy rule in Section 23 applies, with necessary modification, to anyone who conspires to commit an offence even if an electronic medium or electronic agent was used.

Forgery rules apply to anyone who forges anything, including where the forgery is done partly or wholly by electronic means.

If a person uses an electronic medium or electronic agent, the person is treated as intending the resulting event.

A person using an electronic medium or electronic agent may be treated as having caused an event negligently if the event was caused by voluntary action without intending the event and without reasonably necessary skill and care.

A person must not secure, or try to secure, unauthorised access to a protected system if doing so contravenes the Act; doing so is an offence.

A person must not make a false representation to obtain an electronic payment medium; doing so is an offence.

A person found with certain electronic-related payment documents or related device representations without a lawful explanation commits electronic trafficking and can be fined or imprisoned.

A person must not receive, possess, transfer, buy, sell, control, or keep custody of equipment used to make counterfeit electronic materials or electronic records.

A person who, without authority, fraudulently uses another person's payment or account details during an electronic fund transfer, or fraudulently obtains money, goods, services, or anything, commits an offence.

Offences committed partly or wholly by electronic means are treated as offences under this Act, and the Act applies with necessary modifications to the offender, except as otherwise provided in the Act.

It is an offence for a person to intentionally access or intercept an electronic record without authority or permission.

A person who intentionally and without authority interferes with an electronic record in a way that modifies, destroys, or makes it ineffective commits an offence.

A person who unlawfully deals in or possesses devices, programs, or components designed to defeat security measures for electronic records commits an offence.

A person must not, without lawful authority, use a device or computer program to defeat security measures protecting an electronic record or access to it.

A person who intentionally interferes with access to an information system to cause a denial of service, including partial denial to legitimate users, commits an offence.

It is an offence to intentionally access, or improperly access or interfere with, certain stored electronic communications without lawful authority.

A person must not, knowing and without authority, cause a computer to perform a function to secure access to a programme or electronic record.

A person must not, without authority, do an act that the person knows or ought to know will cause an unauthorised modification of a computer programme or electronic record.

A person who knowingly and without authority discloses a password, access code, or similar access means to a computer-held programme or electronic record commits an offence and may be fined or imprisoned on summary conviction.

It is an offence to access computers or protected information without authorisation, or to cause unauthorised transmission that damages a protected computer.

A person must not intentionally engage in conduct that causes a computer to stop functioning, including virus writing or virus and worm dissemination.