The e-Government Act

This provision says the Act may be cited as the e-Government Act.

This Act applies to all public institutions of the Government of the United Republic.

This section defines key terms used in the Act, including Authority, Board, data, ICT security, e-Government services, and related bodies and concepts.

The e-Government Authority is established as a body corporate, and the Attorney General may intervene in cases involving it through the Solicitor General.

The Authority must coordinate and oversee e-Government work, enforce related rules in public institutions, and may approve software and hardware for public institutions.

The Authority has power to demand information, inspect and audit ICT projects, manage complaints, and require public institutions to provide access, records, and answers.

This section creates the e-Government Authority Board, says it is the Authority’s governing body, and sets out how its members are appointed.

The Board has a range of functions, including advising the Minister, approving policies and budgets, overseeing management, and reporting quarterly to the Minister.

The Board must establish as many committees as it decides are needed to help perform its functions, and those committees must carry out the Board’s functions on terms and conditions the Board determines.

The Board may delegate its functions or powers to a Board committee or the Director General, subject to terms and conditions, but it cannot delegate fee-setting, borrowing/lending, or appointing management staff.

The President appoints a Director General, who serves as chief executive officer and accounting officer, and candidates must meet specified qualification requirements.

The Director General is responsible for managing the Authority and must follow the Public Service Act and other relevant laws when doing so.

The Authority must have the necessary number and categories of directors and staff, and those directors and staff must report to the Director General when performing their functions.

A person aggrieved by a decision of the Board or Director General may seek remedy under the Public Service Act.

An e-Government governance structure and related processes must be established in the Public Service to oversee implementation and proper use of ICT in public institutions.

This section establishes a National e-Government Steering Committee and sets out its members, functions, secretariat, and reporting duty.

The Minister must establish an e-Government Technical Committee to provide technical guidance on ICT initiatives, and the committee must report quarterly to the National e-Government Steering Committee.

The accounting officer of each public institution must set up an Institutional ICT Steering Committee, and that committee must report quarterly.

The committees must hold meetings or deliberate matters to carry out their functions, and they may co-opt a person whose presence they consider desirable during a meeting.

The Minister may make regulations about committee operations, accountability, working relationships, and related matters.

Public institutions must establish an ICT Management Unit, staff it with qualified ICT specialists, and have its head report directly to the accounting officer.

Public institutions must manage e-Government initiatives in line with the Minister’s and Authority’s guidelines, and must do an annual self-assessment report to the Authority. The Authority must also ensure compliance within public institutions.

Public institutions must use Government-approved communication infrastructure. Government-owned infrastructure projects must also include ICT design, share ICT design with the Authority, and provide space for communication infrastructure installation.

Public institutions must implement ICT projects according to technical standards and guidelines set by the Authority.

Public institutions must follow government e-Government standards when developing, deploying, hosting, operating, and maintaining systems.

Public institutions must manage Government ICT resources by following value-for-money and technical criteria, using licensed and approved software, keeping a register, and getting specifications guidance from the Authority.

A public institution may handle data, documents, or services in electronic form under this Act, and the Minister may issue Gazette guidelines on how electronic transactions and related controls must be carried out.

A public e-Government services institution must use ICT and related measures to deliver government services properly.

Public institutions must reduce paper documents by digitising work processes and sharing administrative information; the Minister may make regulations to implement this section.

Electronic records can satisfy a retention requirement if they stay accessible, accurately formatted, and include details showing origin, destination, date, and time of sending or receiving.

A payment or receipt requirement is satisfied if the payment is made or the receipt is issued electronically under the Electronic Transactions Act.

A document is treated as satisfying a Gazette publication requirement if it is published in the Gazette or electronic Gazette.

Electronic communication can satisfy the stated communication requirements, and the Minister may set rules on approved systems, devices, and information that must not be sent electronically.

If a law allows audit of documents, records, or information, that law also applies to the same materials when they are kept electronically.

The Minister may authorise service providers to work with government systems, and an authorised service provider may collect and keep prescribed service charges.

The law establishes the e-Government Security Operations Center and allows the Minister to make regulations about its composition and duties.

A public institution must set up and maintain ICT security governance, policies, reviews, risk assessments, and reporting.

A public institution must carry out listed ICT security measures, including monitoring systems, keeping records, testing, securing networks and data, and protecting endpoint ICT equipment.

A public institution must identify, classify, manage, and report ICT assets to the Authority for ICT security.

All public institutions must manage user identity and access for ICT systems, including authentication, access monitoring, focused auditing, and informing users of their ICT security responsibilities.

A public institution must manage ICT security incidents, plan resources for possible incidents, and report significant incidents to the Authority.

A public institution must set up backup/restoration mechanisms, prepare a disaster recovery plan, test it at prescribed intervals, and submit the test report to the Authority.

A public institution must include ICT security control requirements for new systems or enhancements and must design, develop, implement, and test ICT security controls.

Public institutions must screen personnel before assigning critical ICT duties, set up appropriate segregation of duties, provide ICT security awareness and training, and submit a report to the Authority.

A public institution must protect certain Government ICT facilities, use only the allowed facilities or approved supplier environment, and keep visitation and maintenance records.

A public institution must carry out regular independent ICT security assessments and audits, and comply with legal, regulatory, and ICT security requirements in its ICT operations and management.

Public institutions must set up and follow an electronic data management mechanism prescribed by the Minister, and must keep their electronic data confidential, intact, and available.

Public institutions must share data electronically as prescribed by the Minister, and the Authority must establish and manage a data sharing and exchange platform.

Public institutions must comply with technical standards and guidelines issued by the Authority when capturing, storing, processing, or sharing electronic data.

The Authority’s funds and resources come from listed sources, and it may collect fees, charges, or commissions under regulations.

The Board must manage and administer the Authority’s funds under the financial laws and regulations, and use those funds to cover expenses for the Authority’s functions under the Act.

The Director General must prepare and submit the budget to the Board at least three months before the end of each financial year, and the Authority must submit a copy of the Budget to the Minister for approval, subject to subsection (1).

The Authority’s funds cannot be used for expenditure unless the spending is part of Board-approved expenditure for the relevant financial year. The Director General must ensure payments are correctly made and authorised and that control over property and liabilities is maintained.

The Authority’s financial year runs for one year and ends on 30 June.

The Authority must keep proper accounting records, have its accounts audited, and submit annual accounts and supporting statements to the Controller and Auditor-General after each financial year.

The Authority must prepare and submit an annual report to the Minister within three months after 30 September each year.

A person who commits listed ICT-security and data-handling acts commits an offence and may face fines, imprisonment, or both; public servants may also face disciplinary or criminal proceedings.

If a person breaches an Act provision with no specific penalty, that person commits an offence and may be fined, imprisoned, or both. If convicted, the court may also order payment to the Authority for repair costs.

If a judgment or order is obtained against the Authority, execution or attachment cannot be issued against the Authority or its property, but the Authority must pay the awarded amount out of its revenue to the person entitled.

The Minister may make regulations for the Act and, after consulting the Authority, set rules on the matters listed here; the Minister must also consult the Minister responsible for procurement when setting computer and equipment standards for public institutions.

The Authority may prepare rules, guidelines, and a code of ethics and conduct for staff activities.

The Board must elect one of its members to serve as Vice Chairman for four years, and that person may be re-elected.

Board members are appointed for fixed terms, may be re-appointed only once, and a member may resign by written notice to the appointing authority.

The Board may co-opt a person it considers desirable to attend and take part in Board deliberations, but that person has no right to vote.

The Board must meet every three months, and the Chairman must convene ordinary meetings and send notice to members. If the Chairman cannot act, the Vice Chairman must convene the meeting. The Chairman or Vice Chairman may also convene a special meeting if at least half the members request it in writing.

A Board member may stop being a member if certain disqualifying events or failures happen.

If a Board member cannot attend because of illness, infirmity, or absence from the United Republic, the Minister may appoint a temporary member in that member’s place.

A Board meeting has quorum only if more than half of the Board members are present.

Board members with a conflict of interest must disclose it immediately and stop taking part in the matter; if the Board learns of the conflict, it must direct the member to step back.

Board decisions are made by majority vote of the members present, and the Chairman has a casting vote if votes are equal.

The Board must keep proper minutes of each meeting and confirm them at its next meeting.

The Board may decide the official seal’s shape, size, and form, and the seal must be affixed when witnessed under hand by the Chairman, Director General, Secretary, or another duly authorised person.

Board proceedings are not invalid because of defects or irregularities in a member’s appointment, or because someone acted as a member while actually disqualified.

If a member misses three consecutive Board meetings without sufficient cause, the Board must tell the appointing authority, and the appointing authority may end the member’s appointment and replace the member.

The Board may regulate its own procedure for meetings and meeting transactions, subject to this Act.