Cyberspace Law materials – Electronic Commerce
1.	What is Electronic Commerce?
2.	What is a contract?
3.	Elements of an enforceable contract
4.	Standard terms of a contract
5.	Form and execution of contract
6.	Benefits of a written contract
7.	Contract issues in the digital environment
8.	Jurisdiction
8.1.	Where is an electronic contract formed?
Common law
Statute: Electronic Transaction Act
8.2.	Jurisdiction and online contracts
9.	When is an electronic contract formed?
Offer or mere invitation to treat?
Timing of acceptance - can be revoked prior
Terms - relevance of Standard terms
10.	Electronic Transactions Act 1999 (Cth)
11.	Electronic payment systems
11.1.	Types of payment systems
11.2.	Regulation of EPSs
11.3.	Consumer friendly EPS
12.	Secure contract formation in a digital environment
12.1.	Legal risks in electronic transactions
12.2.	Digital signatures
12.3.	Legal risk with digital signatures
13.	Identity and capacity to contract
14.	Secure storage of electronic records
14.1.	Electronic records and the record keeping requirements of Commonwealth or State law
14.2.	When electronic records must be kept
14.3.	Corporations Act 2001 (Cth)
14.4.	Limitations legislation
14.5.	Retaining electronic contract records
15.	E-commerce best practice guidelines
16.	EFT Code of Conduct
17.	Scams and Swindles
17.1.	Bank Scams – NetBank
18.	UNCITRAL Model Laws and UN Convention
18.1.	UNCITRAL Model Law on Electronic Commerce (1996)
18.2.	UNCITRAL Model Law on Electronic Signatures (2001)
18.3.	UN Convention on the Use of Electronic Communications in International Contracts (CUECIC) 2005
 
1.	What is Electronic Commerce?
Electronic Commerce (e-commerce) refers to commercial transactions that occur on the Internet. Often in e-commerce transactions the parties never meet each other face to face. This creates obvious trust issues between the parties and also makes it difficult to ensure the parties act lawfully and that the transaction itself is legal, this is a particular concern where there is unequal bargaining power between the parties. Online contracts play an important role in e-commerce as they stipulate the terms and conditions governing a transaction between two or more parties. A body of law has developed to ensure the legality of all aspects of e-commerce and the online contracting process.
2.	What is a contract? 
A contract is a legally binding agreement between two or more people or organisations. 
The terms of a contract may be expressed in writing or orally, implied by conduct, industry custom, and law or by a combination of these things.
3.	Elements of an enforceable contract 
A binding contract is usually formed when the elements below are satisfied:
•	One party makes an offer setting out the terms of the proposed contract to another party or parties. The terms must be sufficiently certain.
•	An unequivocal acceptance of the offer is communicated to the party who made the offer.
•	In common law countries (Australia, the US, Canada, the UK and other countries whose law originated from the UK), the contract must be supported by consideration. Consideration is best described as a ‘promise for a promise’. Consideration will be presumed to exist if certain formal requirements are followed (for example where a contract is executed as a deed).
•	The parties to the transaction must have an intention to create legal relations. Courts will not force people into a contract if they did not intend to be legally bound. The following rebuttable presumptions exist:
•	if the parties are in a commercial (but not domestic) environment, the parties are presumed to have an intention to create legal relations;
•	if the parties are in a domestic environment (e.g family members or neighbours), the presumption is that the parties did not intend to create legal relations.
•	All parties to the transaction must have the legal capacity to effect the transaction.
If any one of these elements do not exist or are vitiated (e.g due to fraud) there will be no contract between the parties. 
4.	Standard terms of a contract 
Subject to exceptions (for example, consumer transactions), the parties are free to choose the terms of their contract. An online contract should at least contain the following terms:
•	a clear identification of the parties to the transaction;
•	the subject matter of the transaction, including a description of any goods or services to be supplied; 
•	the price, delivery and payment terms;
•	warranties, liability, insurance, intellectual property and dispute resolution;
•	how orders are to be placed and accepted including use of electronic agents;
•	record keeping, audit trails and evidence;
•	security, format and authentication of messages;
•	when and where messages are sent and received;
•	responsibility for lost, incomplete or garbled messages; and
•	the law governing the transaction.
5.	Form and execution of contract 
Some contracts, for example, those involving the conveyance of land and consumer credit transactions, must be in a particular form or be signed in a certain way. Otherwise there is no general requirement under Australian law that a contract be in a particular form or be executed in a particular manner.
Apart from contracts which must be completed in accordance with certain formal requirements, there is no reason in principle that contracts cannot be formed by email exchanges or "click through" agreements or executed by use of digital signatures. In each case, the question will be whether anything in the formation of the contract might leave either party at risk that the other party will later challenge the enforceability of the contract, for example on the basis that terms were not brought to their attention, or that they did not in fact participate in the formation of any contract (perhaps because another person impersonated them).
The legal status of computer-generated evidence is not the same in all jurisdictions. To reduce the risk that a court will reject the evidence on which a party relies to establish a contract, a jurisdiction clause in an online contract should specify a jurisdiction whose laws of evidence accept electronic evidence.
6.	Benefits of a written contract 
Benefits of a written contract include:
•	the risk that terms will be implied into the contract by a court is reduced;
•	when signed, the parties are deemed to have read the contract and accepted the written terms, making it difficult for either party to deny the existence of the written contract except in the case of fraud, mistake, unconscionable conduct or other exceptions recognised by the law;
•	when properly drafted, the parties should know with certainty their respective obligations;
•	identifies the parties to the transaction and the commencement of the commercial arrangement; and
•	a conventional or electronic signature on an original contract provides protection against tampering or repudiation by the signatory.
7.	Contract issues in the digital environment 
The parties to an electronic contract should:
•	satisfy themselves about the identity and capacity of the other parties to the contract;
•	determine when a binding contract is formed;
•	determine the governing law of the contract;
•	agree on the electronic payment system used;
•	ensure information exchanges leading up to and including the formation of a contract are secure to prevent later repudiation;
•	determine by appropriate terms in the contract the consequences of breach, frustration and other factors which may affect the performance of the contract; and
•	store electronic data relating to or evidencing the contract in a manner that prevents alteration by any agent without detection.
8.	Jurisdiction
Jurisdiction is relevant to determining where the contract was formed. Jurisdiction is usually based on state or national borders, and is therefore a difficult legal concept to apply to the Internet.
8.1.	Where is an electronic contract formed? 
The question of jurisdiction for online transactions is divided into two parts – the applicable law and the forum. 
The applicable law is the law under which a dispute should be decided. The forum is the location in which a court should sit to consider the dispute. The question of Internet jurisdiction can be simplified into a debate between those who support the jurisdiction being that of the consumer, and those who support it being that of the business.
Unfortunately, attempts to agree on how the jurisdiction of an Internet transaction should be determined have, to date, failed. The OECD attempted to settle this matter when writing their Consumer Protection in Electronic Commerce Guidelines in 1999. However, the United States and the European nations could not agree on an appropriate formula, with the US supporting the ‘business’ test and the Europeans supporting the ‘resident’ test. The draft Hague Convention on Jurisdiction and Foreign Judgments in Civil and Commercial Matters (http://www.hcch.net/upload/wop/jdgm2001draft_e.pdf) and its various preliminary documents are indicative of the current struggle in developing a new agreement on international jurisdiction. 
(Due to a range of factors, including difficulties raised by the Internet, the wide scope and great ambitions of the ‘judgment project’ [above] proved impossible to pursue to conclusion, and in 2003, the ‘judgments project’ was replaced, also in name, by a much more narrow convention proposal titled Convention on Exclusive Choice of Court Agreements. <http://www.hcch.net/index_en.php?act=conventions.text&cid=98> : Dan Jerker B. Svantesson. (2005) ‘An Update on the proposed Hague Convention on Exclusive Choice of Court Agreements’, Bond University epublications, at: <http://epublications.bond.edu.au/law_pubs/60>)
Common law
In the absence of a general agreement on the jurisdiction of Internet transactions, the common law applies. There have been a handful of US cases that have considered this issue, but unfortunately they have been inconclusive, with various courts arriving at opposite rulings. 
Australia’s leading Internet jurisdiction case is Dow Jones & Company Inc v Gutnick [2002] HCA 56 (http://www.austlii.edu.au/au/cases/cth/HCA/2002/56.html), it is discussed in detail in the Case Study in section 2.2 of the Defamation Course Materials. 
In Dow Jones the High Court held that a Victorian court would have jurisdiction over a defamation action involving an article that was written in New York and uploaded onto a web server in New Jersey as Victoria was the place where the damage was suffered. It was said that ‘in the case of material on the World Wide Web, it is not available in comprehensible form until downloaded on to the computer of a person who has used a web browser to pull the material from the web server. It is where that person downloads the material that the damage to reputation may be done... that will be the place where the tort of defamation is committed.’ (per Gleeson CJ, McHugh, Gummow and Hayne JJ at para 44). This finding though specific to defamation jurisdiction on the Internet is consistent with existing common law rules. 
Statute: Electronic Transaction Act 
The Electronic Transaction Act 1999 (Cth) (ETA), discussed below in more detail, establishes presumptions about when and where a contract is formed over the internet. The presumptions can be displaced by agreement between the communicating parties. 
In the absence of any such agreement, the default presumptions apply. The default presumptions:
•	Time of Dispatch: the time of dispatch of an electronic communication is as soon as it enters the first information system outside the control of the originator (sender) (ss 14(1) and 14(2)). 

An Information System is defined as ‘a system for generating, sending, receiving, storing or otherwise processing electronic communications’ (section 5). Note that this definition is so broad as to include anything a standalone internet connection at home, to a large network of computers running its own server.
•	Time of Receipt: the time of receipt of an electronic communication is when it enters into the information system designated for receipt of electronic communications by the addressee (section 14 (3)). 

Where there is no such delegated information system, then it is the time that it comes to the attention of the addressee (section 14 (4)). 
•	Location: Under the ETA, the parties are deemed to be located at their respective place of business, or if they have not place of business, at their residential address (section 14(5)). 
See Fitzgerald et al, Internet and e-commerce law, Thomson, 2007: p.520-521
8.2.	Jurisdiction and online contracts
It is now established under the Electronic Transactions Act 1999 (Cth) (see section 10) in the absence of agreement to the contrary, an electronic communication is generally received when it enters an information system under the recipient’s control and is taken to be received at the recipient’s place of business having the closest relationship to the transaction (if the recipient has more than one place of business).
If a jurisdiction clause is incorporated into a contract of sale, this may affirm or alter the general common law rule. 
However in certain circumstances (for example, where it is extremely unjust for one of the parties,) a court may override the effect of such a jurisdiction clause.
There are also several international conventions and treaties (e.g the Hague Conference on Private International Law – http://www.hcch.net/index_en.php?act=conventions.text&cid=29) that allow traders to select the law of a particular jurisdiction as the governing law. Generally, consumer protection laws affecting Australian consumers will not be affected by these conventions or treaties, and in many cases will apply even if contracts include express provisions attempting to modify their effect.
9.	When is an electronic contract formed? 
The general law rules are that 
•	acceptance must be communicated before a contract will come into existence, and 
•	a contract is formed in the jurisdiction where acceptance is received.
Offer or mere invitation to treat?
Displaying information about a product or service for sale on a website may be construed either as a binding offer, or a mere "invitation to treat". The courts will look at the intention of the alleged offerer, gathered from all the circumstances to determine how the display of information is characterised. 
•	If the seller’s intention shows a willingness to be contractually bound without any further negotiations, the display may be regarded as an offer. 
•	If the trader’s intention falls short of this, the display is likely to be interpreted as a mere "invitation to treat". An "invitation to treat" is an invitation to the website visitor to make an offer that the seller may accept or reject. 
It may be in a trader’s interests to ensure that information displayed on a website is not characterised as a binding offer, as this will provide an opportunity to review their capacity to supply goods (or other issues, for example, any legal restrictions on entering into contracts with users from particular jurisdictions) before a binding contract is formed.
Assuming the display of information on a website is an invitation to treat, and the website visitor makes an offer in relation to the goods or services displayed and the seller communicates acceptance of that offer to the purchaser through the website, it is likely that the law may regard the contract as forming in the jurisdiction of the website visitor (that is the place where the offeror received communication of the acceptance). 
If the offeree uses other methods to communicate acceptance (for example by posting a letter) this may affect the place where the law regards the contract as forming. 
Timing of acceptance - can be revoked prior 
The timing of acceptance is critical, because generally an offer may be revoked at any time before it is accepted. 
Terms - relevance of Standard terms
Use of standard form terms and conditions is common on the Internet. Whether or not any contract formed will be subject to these terms and conditions will depend on a number of factors, including whether a reasonable attempt is made to bring the terms to the customer’s attention or the customer has a reasonable opportunity to read them. A contract will not necessarily be invalid just because standard terms and conditions have not been the subject of any negotiation.
10.	Electronic Transactions Act 1999 (Cth) 
The Electronic Transactions Act 1999 (Cth) (http://www.austlii.edu.au/au/legis/cth/consol_act/eta1999256 ) (ETA) provides businesses and individuals with the option of using electronic communications when dealing with government agencies.
The ETA states that transactions taking place under a law of the Commonwealth will not be invalid just because they are completed electronically. The ETA applies to all laws of the Commonwealth unless specifically excluded by the Electronic Transactions Regulations 2000 (Cth) (http://www.austlii.edu.au/au/legis/cth/consol_reg/etr2000365/ ).
The Act is based upon the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce (see section 18.1), and is based on three principles: 
1.	Functional equivalence – paper documents and electronic transactions are treated equally by the law.
2.	Technology neutrality – the law does not discriminate between different forms of technology. 
3.	Non-Discrimination – parties using electronic means should not face discrimination.
The ETA allows businesses to fulfil, in electronic form, any of the following legal requirements:
•	Giving information in writing;
•	Providing a handwritten signature;
•	Producing a document in material form; and 
•	Recording or retaining information.
The ETA stipulates a uniform method for attributing the time and place of dispatch and receipt of electronic communications. Generally, a contract is formed at the place where acceptance of the offer to transact is received. 
The ETA provides that receipt of an electronic communication occurs at the place of business of the addressee or, if the addressee does not have a physical place of business, at the addressee’s ordinary place of residence. 
The time of receipt is the time when the electronic communication enters an information system designated by the addressee. If no such system has been designated, then an electronic communication is received when it comes to the attention of the addressee.
In order to achieve national uniformity all States and Territories have passed Electronic Transactions Acts that complement the Commonwealth’s ETA. This layer of state legislation covers private sector transactions:
•	Australian Capital Territory – Electronic Transactions Act 2001 (ACT) (http://www.legislation.act.gov.au/a/2001-10/default.asp)
•	New South Wales – Electronic Transactions Act 2000 (NSW) (http://www.austlii.edu.au/au/legis/nsw/consol_act/eta2000256) 
•	Northern Territory – Electronic Transactions Act 2000 (NT) (http://notes.nt.gov.au/dcm/legislat/Acts.nsf/830a91a0fb6c1fed6925649e0009c237/3dd0f2b65db57ff66925697c000aacc2?OpenDocument&ExpandSection=4.1#_Section4.1) 
•	Queensland – Electronic Transactions Act 2001 (Qld) (http://www.legislation.qld.gov.au/LEGISLTN/ACTS/2001/01AC042.pdf)
•	South Australia – Electronic Transactions Act 2000 (SA) (http://www.legislation.sa.gov.au/LZ/C/A/ELECTRONIC%20TRANSACTIONS%20ACT%202000.aspx)
•	Tasmania – Electronic Transactions Act 2000 (Tas) (http://www.austlii.edu.au/au/legis/tas/consol_act/eta2000256/)
•	Victoria – Electronic Transactions Act 2000 (Vic) (http://www.legislation.vic.gov.au/Domino/Web_Notes/LDMS/PubLawToday.nsf/95c43dd4eac71a68ca256dde00056e7b/59ed125d1af3f2e0ca256e5b000377ae!OpenDocument) 
•	Western Australia – Electronic Transactions Act 2003 (WA) (http://www.slp.wa.gov.au/statutes/swans.nsf/Current+Legislation+Version2?openview&Count=600&RestrictToCategory=E) 
11.	Electronic payment systems 
11.1.	Types of payment systems  
There are a number of ways payment of goods can be effected through cyberspace. A paramount concern when using such electronic payment systems is the security of the transaction, including ensuring that payment reaches the vendor, and the customer’s credit card information or the customer’s identifier for some other form of electronic payment is not intercepted and used without the customer’s knowledge. The following are some of the common electronic payment systems (EPS):
•	Internet banking 
Current Internet banking only permits cash deposits and withdrawals to be made using existing ‘non-Internet’ methods such as cheques, cash or electronic funds transfer. Future personal computers or telephones with smart card readers will permit the transfer of value from an account onto a stored smart card, using the Internet or telephone lines. 
•	Credit cards 
Credit card details are entered into a merchant’s web form on the Internet. The details may be manually sent by e-mail and verified by the merchant as a mail-order/telephone-order (MOTO) transaction, or encrypted using secure socket layering (SSL) techniques and then automatically processed by the relevant bank. Transactions using SSL are more secure but are also more costly. 
•	Virtual credit card 
Appearing as an icon on a computer screen, the card is used to purchase products using secure electronic transaction (SET) protocol to authenticate the buyer and seller by use of digital signatures. Under the SET mechanism, it is a third party not the merchant who verifies the credit card details, increasing confidentiality and security.
•	Digital cash 
Digital cash is a payment or transfer of value initiated and processed electronically within current inter-bank payment systems. Digital cash is effectively money stored as computer code. The digital cash is essentially a message issued by a bank containing its value, the bank’s identity, the bank’s Internet address and a serial number. The digital cash is securely transferred using data encryption methods.
•	Stored value cards (SVCs) (including smart cards) 
SVC is a plastic card that can contain a microprocessor chip (more commonly known as a smart card) or a magnetic strip. The chip stores more information than magnetic strip cards and can perform simple computing operations. The SVC is inserted into a terminal with a read/write mechanism that allows information to pass between the card and the terminal. The SVC represents a value of prepaid funds with a counter that keeps track of the amount which reduces with each payment until exhausted and then is either recharged or thrown away. The SVC issuer pays the merchant the dollar value of the SVC value spent by the customer. 
11.2.	Regulation of EPSs 
All of these Acts pre-date the existence of electronic payments. An EPS can be structured and implemented in a way that avoids infringement of these Acts: 
•	Corporations Act 2001 (Cth) (http://www.austlii.edu.au/au/legis/cth/consol_act/ca2001172/) 
Under the Corporations Act an EPS will most likely be classified as a financial service as it is a facility where a person can make non-cash payments. Similarly an EPS provider will most likely be classified as a financial service provider and will need to be licensed. The EPS provider is bound by the conditions of the license which include having sufficient financial, technological and human resources to properly provide services and supervision in an efficient, fair and honest way.
•	Payment Systems (Regulation) Act 1988 (http://www.austlii.edu.au/au/legis/cth/consol_act/psa1998333) 
This Act establishes the Payment Systems Board (PSB) (http://www.rba.gov.au/payments-system/policy-framework/psb-board.html) within the Reserve Bank of Australia (RBA) with powers to regulate payment systems such as an EPS. The PSB implements policies to improve payments system efficiency and enhance competition in the market of payment services. The RBA (through the PSB) regulates payment systems (including clearing and settlement systems). A payment system will be regulated by the Act if designated by the RBA by notice in the Gazette after satisfying a public interest test. 
•	Banking Act 1959 (Cth) (http://www.austlii.edu.au/au/legis/cth/consol_act/ba195972) 
Applicability of the Banking Act is still unclear both within Australian and on an international level. The undecided issue of contention is whether an EPS operator is carrying on banking that requires regulation because of the issue of digital cash or SVCs alone.
•	Other relevant legislation includes the Currency Act 1965 (Cth) (http://www.austlii.edu.au/au/legis/cth/consol_act/ca1965120) and the Consumer Credit Code (http://www.asic.gov.au/asic/asic.nsf/byheadline/Consumer-Credit-Code?openDocument) which is discussed in section 5.1 of the Consumer Protection Course Materials. 
•	EFT Code of Practice
The Electronic Funds Transfer Code of Conduct is discussed in section 6 of the Consumer Protection course materials, next topic. 
See ASIC, ‘Using Electronic Funds Transfer: Your Rights’, ASIC website,  last updated 1/12/2010, (http://www.asic.gov.au/asic/asic.nsf/byheadline/Your-guide-to-the-EFT-Code?openDocument)
11.3.	Consumer friendly EPS 
A consumer friendly EPSs operating over the Internet should: 
•	be easy to use and offer a level of security appropriate to the transaction and method of payment, as well as protect the privacy and personal information of the user;
•	provide consumers with information on: 
o	the available methods of making payments;
o	the level of risk associated with those methods; and
o	how to effectively use those methods, 
•	provide consumers with a confirmation process that allows the consumer to buy, review and accept or reject the contract terms, identify and correct any errors and confirm acceptance or rejection of the offer and allows the vendor to acknowledge receipt of the order.
12.	Secure contract formation in a digital environment 
Australian companies including Internet Service Providers are not subject to any specific legislation or regulatory obligations to guarantee the security of Internet transactions. Accordingly, parties are free to determine such measures as appropriate to achieve confidentiality, integrity and authenticity of data transmissions. 
12.1.	Legal risks in electronic transactions 
•	Confidentiality – people communicating information such as trade secrets, medical records, lawyer-client communications, credit card and bank account details may be required by law or agreement to keep that information confidential. This obligation applies to the communication of electronic information using the Internet. 
•	Authentication – the identification and verification of parties and data transmission is essential to the formation of a binding contract and the allocation of liability for fraud between the parties. 
•	Message integrity – the formation of a binding contract requires a "meeting of minds" on the same terms of the contract. The communication sent must be the same as the communication received. A contract may not be enforceable if one party can establish that data relating to the formation of the contract have been corrupted or interfered with. 
•	Repudiation of contract – where parties agree on the authentication and security methods to be used to form a contract, a party will be prevented from denying the existence, accuracy or validity of a communication which conforms to the agreed methods. 
12.2.	Digital signatures
Cryptography is the science of designing coding and decoding systems. A "cryptographic algorithm" (also called a cipher) is the mathematical function used for encryption and decryption of electronic communications over the Internet and other telecommunications networks. A digital signature uses cryptography to provide a method for signing electronic contracts which establishes the: 
•	identity of the parties to the contract;
•	integrity of the terms and conditions governing the contract;
•	timeframe of the terms and conditions; and 
•	acceptance of the terms and conditions by the parties to be bound. 
A digital signature is not a computerised image of a hand written signature. It is unique for each electronic document produced as it is derived from the document itself. Any change in the document will generate a new signature allowing the recipient to ascertain whether an alteration has occurred after the first digital signing. 
Generally, three components comprise a digital signature. 
1.	Public key pair: consists of two large prime numbers generally called the public key and the private key. The two very large prime numbers relate to each other mathematically but it is computationally infeasible to determine the private key value by only knowing the public key value. The private key is kept secret by its holder. The public key is published to the world at large. Any document signed using the private key can be verified only by use of the public key. 
2.	A one-way hash function: this algorithm converts a document of any length into a fixed length message digest. Any change to an original document will substantially affect the value of the message digest. If a one-way hash function is used, it is impossible to determine the contents of the original document from knowing the message digest. The hashing mechanism is not reversible. 
3.	A trustworthy mechanism to publish public keys: the current method of publishing public key is via an X 500 directory using an X 509 (Version 3) certificate. This certificate contains, at a minimum, the name of the owner of the public key, the value of the public key, the algorithm used to sign the document, the hashing algorithm used to create the message digest, the serial number of the certificate, and the validity dates of the certificate. 
12.3.	Legal risk with digital signatures 
Australian law has not yet prescribed any standards concerning legal liability in relation to digital signatures. It is up to parties to rely on existing contract and torts law to protect themselves against legal risks. 
Parties using digital signatures should clearly and precisely allocate liability for acts and non-acts that compromise a private key. Typically, the private key number will be between 160 and 500 digits long. The parties should agree that it must be kept secret by its lawful holder via a secure token or other secure means. 
Although the parties might agree to different terms, typically the private key holder would be liable for loss resulting from a compromise of the security of the private key. In the event the private key is compromised, the parties may have negotiated liability on a sliding scale depending on the circumstances in which the key was compromised. In most cases parties will agree on a cap on liability.
13.	Identity and capacity to contract 
How can a party to a contract be sure that the other party is who they say they are? Some measures include the use of Public Key Infrastructure technology or other "identifiers". 
It is possible for users of a computer to instruct the computer to carry out transactions automatically. For example, a person may use an electronic agent:
•	to initiate or respond on their behalf to electronic messages without review by the person;
•	as an online shopping agent programmed to surf the Internet and make purchases; or
•	as an inventory control system programmed to place orders when stocks reach a particular level.
Although the legal status of electronic agents is uncertain, on one view a computer tool programmed by or with a person’s authority to implement their intention can make and accept contractual offers on their behalf.
14.	Secure storage of electronic records 
14.1.	Electronic records and the record keeping requirements of Commonwealth or State law 
A Commonwealth or State law may require: 
•	information to be recorded in writing;
•	a written document to be kept; or 
•	an electronic communication to be kept. 
An electronic record will satisfy the above requirements in relation to laws of the Commonwealth, New South Wales, Victoria and Western Australia provided certain conditions are met (see Section 10 of these Course Materials, and the Electronic Transactions Act generally). 
14.2.	When electronic records must be kept 
Electronic documents may need to be retained and securely archived in accordance with the following requirements where applicable: 
•	Proceeds of Crime Act 2002 (Cth) (http://www.austlii.edu.au/au/legis/cth/consol_act/poca2002160/) 
Financial institutions must retain certain essential financial transaction documents for seven years after a transaction takes place or seven years after the date on which the account is closed. Documents should be stored in a manner that makes retrieval reasonably practicable. 
•	Income Tax Assessment Act 1936 (Cth) (http://www.austlii.edu.au/au/legis/cth/consol_act/itaa1936240)
An entity subject to income tax must keep records, provide access to premises and reasonable facilities and assistance for the inspection of records. The obligations apply to a document or record in electronic form (s 25 Acts Interpretation Act 1901 (Cth) (http://www.austlii.edu.au/au/legis/cth/consol_act/aia1901230)). Records must be kept for five years and be readily accessible and convertible into writing in the English language. The careless or intentional unavailability of an encryption key may attract a significant monetary penalty (Tax Administration Act 1953 (Cth) (http://www.austlii.edu.au/au/legis/cth/consol_act/taa1953269)). Where the integrity of electronic records can be verified and ensured, the records should have the same standing as traditional paper documents. 
•	EFT Code of Conduct 
<http://www.asic.gov.au/asic/asic.nsf/byheadline/Electronic+Funds+Transfer%3A+Code+of+Conduct?openDocument> – An account institution must ensure where possible that a receipt is issued for every electronic transaction whether made over the Internet or using EFTPOS facilities. The receipt must indicate the amount, exact time, place, type of transaction, an identifier of some sort distinguishing the particular customer and where security and privacy permits, the remaining or accumulated balance in the customer’s account. Account institutions must also provide periodic statements to their customers. 
14.3.	Corporations Act 2001 (Cth)
The Australian Company Number (ACN) of a corporation must be displayed on every public document or negotiable instrument of the company: s 219 Corporations Act 2001 (http://www.austlii.edu.au/au/legis/cth/consol_act/ca2001172/). The website of a corporation used to conduct commercial transactions should display the ACN of that corporation. 
A company must keep accounting records which correctly record and explain its transactions and financial position for 7 years after completion of the transaction to which they relate. Records must be kept in (or readily convertible into) writing in the English language (s 287). 
14.4.	Limitations legislation 
Statutory limitation periods limit the time in which an action may be brought against a person or entity. A statutory limitation period is typically six years from the cause of action arising (eg breach of contract) but this may vary in certain cases. In most cases, a corporation (including an Internet Service Provider (ISP)) should keep electronic records for at least six years to defend or bring proceedings in relation to breach of an electronic contract or defend against possible tort claims: Limitation Act 1969 (NSW) (http://www.austlii.edu.au/au/legis/nsw/consol_act/la1969133).  
14.5.	Retaining electronic contract records 
There are no data retention requirements in relation to electronic contracts, however, any data evidencing the formation and terms of a contract may be required for evidentiary purposes in any future dispute proceedings. 
A digital signature identifies when a document has either been changed since it was signed or was not signed by the party who is attributed as being the signatory. An electronic contract tendered in court whose digital signature indicates either of these events may amount to fraud or perjury, in which case its evidential value will be reduced. 
Archiving procedures for electronic records should take into account any advance in technology. For example, if you have archived your data to a 5 1/4 inch disk, you need to retain a 5 1/4 inch disk drive to later recover that data. 
15.	E-commerce best practice guidelines
The Federal Government has developed and promoted best practice guidelines for business-to-consumer (B2C) e-commerce providers: ‘The Australian Guidelines for Electronic Commerce,’ Australian Treasury, 17 March 2006,  at: <http://www.treasury.gov.au/contentitem.asp?NavId=&ContentID=1083>.  These guidelines do not have the force of law and are merely advisory. 
The Best Practice Model's objective is to guide businesses on:
1.	fair business practices;
2.	accessibility and disability access;
3.	advertising and marketing;
4.	engaging with minors;
5.	disclosure of a business’s identity and location;
6.	disclosure of a contract’s terms and conditions;
7.	the implementation of mechanisms for concluding contracts;
8.	adopting privacy principles;
9.	using and disclosing information about payment, security and authentication mechanisms;
10.	the establishment of fair and effective procedures for handling complaints and resolving disputes; and
11.	the law and forum for the resolution of contractual disputes.
The Guidelines are also discussed in section 6.6 of the Consumer Protection Course Materials.  
16.	EFT Code of Conduct 
The Electronic Funds Transfer Code of Conduct <http://www.asic.gov.au/asic/asic.nsf/byheadline/Electronic+Funds+Transfer%3A+Code+of+Conduct?openDocument>  is also extremely relevant to the field of e-commerce and online contracting. It is discussed in detail in section 6 of the Consumer Protection Course Materials. 
17.	Scams and Swindles 
Most online scams and shams originate in the United States. Many are copied in Australia and elsewhere and consumers need to be aware of the tricks used by fraudsters to induce you to part with your money. According to the United States Federal Trade Commission (http://www.ftc.gov) these are amongst the top online scams and shams:
•	Credit Card Fraud
The Bait: Surf the Internet and view adult images online for free, just for sharing your credit card number to prove you're over 18.
The Catch: Consumers say that fraudulent promoters have used their credit card numbers to run up charges on their cards.
•	International Modem Dialing
The Bait: Get free access to adult material by downloading a "viewer" or "dialer" computer program.
The Catch: Consumers complained about exorbitant long-distance charges on their phone bill. Through the program, their modem is disconnected, then reconnected to the Internet through an international long-distance number.
•	Web Cramming
The Bait: Get a free custom-designed website for a 30-day trial period, with no obligation to continue.
The Catch: Consumers say they've been charged on their telephone bills or received a separate invoice, even if they never accepted the offer or agreed to continue the service after the trial period.
•	Pyramid Schemes
The Bait: Make money through the products and services you sell as well as those sold by the people you recruit into the program.
The Catch: Consumers say that they've bought into plans and programs, but their customers are other distributors, not the general public. Some multi-level marketing programs are actually illegal pyramid schemes. When products or services are sold only to distributors, there's no way to make money.
•	Business Opportunities
The Bait: Be your own boss and make enormous profits.
The Catch: Taken in by promises about potential earnings, many consumers have invested in business with no earnings potential. There was no evidence to back up the earnings claims.
People can complain about an online scam in Australia by contacting the Australian Competition and Consumer Commission (http://www.accc.gov.au). 
For websites or emails received or uploaded from outside Australia you can lodge complaints at the international website Econsumer.gov (http://www.econsumer.gov/english). Complaints received by this site will then be allocated to the appropriate authorities.
17.1.	Bank Scams – NetBank
In 2003 many Commonwealth Bank customers who used NetBank were the victim of an online scam where they were urged in what appeared to be a genuine email from Commonwealth to access a page hyperlinked on the email which purported to direct them to a NetBank site where they had to reactivate their account so that the NetBank Security server could be updated. The hyperlink in fact redirected the user to a bogus website where the customer’s login and password were recorded. 
The unsolicited email did contain clues that it was fraudulent (as do many deceptive emails) including grammatical errors such as “Due to technical update we recommend you to reactivate your account”. While some customer’s accounts had been illegally accessed, Commonwealth maintained that none of its customers lost any money. (See Pearce and Withers ‘Update: Fraudsters seek access to Netbank accounts’ ZDNet Australia 18 March 2003 (http://www.zdnet.com.au/newstech/security/story/0,2000048600,20272945,00.htm), and Colley ‘NetBank suspect nabbed in Sydney’ ZDNet Australia 21 March 2003 (http://www.zdnet.com.au/newstech/security/story/0,2000048600,20273072,00.htm)). 
Commonwealth is not the only bank whose customers have received phony emails. Other institutions that have been affected include AMP ANZ, Westpac and St George. A recent email scam claimed to be from the Reserve Bank of Australia, asking for the details of debit card holders from all the major banks, see the AusCERT article ‘AL-2006.0006 -- Fake Reserve Bank of Australia email and website entice users to disclose banking ATM card number and PIN, January 2006,: <http://www.auscert.org.au/render.html?it=5957> 
18.	UNCITRAL Model Laws and UN Convention
The United Nations Commission on International Trade Law (UNCITRAL) (http://www.uncitral.org/uncitral/uncitral_texts/electronic_commerce.html) has published two Model Laws which are of relevance here – the UNCITRAL Model Law on Electronic Commerce (1996) (http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/1996Model.html ) and the UNCITRAL Model Law on Electronic Signatures (2001) (http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/2001Model_signatures.html).  
The UN Convention on the Use of Electronic Communications in International Contracts 2005 is also relevant. It builds on the other two but has not been widely adopted yet. See <http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/2005Convention.html>
They also published an examination of authentication issues in this area: Promoting confidence in electronic commerce: legal issues on international use of electronic authentication and signature methods, 2007, at: <http://www.uncitral.org/pdf/english/texts/electcom/08-55698_Ebook.pdf>
As noted above, the three core principles of the two Model Laws and the Convention are said, in the Convention explanatory text, to be 
•	non-discrimination, 
•	technological neutrality and 
•	functional equivalence.
These two Model Laws and the Convention are examined below. 
18.1.	UNCITRAL Model Law on Electronic Commerce (1996)
The Model Law on Electronic Commerce has been widely adopted by a number of jurisdictions worldwide (including Australia and the US). See Status document at: <http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/1996Model_status.html>
According to the UNCITRAL,
theModel Law on Electronic Commerce (1996) is intended to facilitate the use of modern means of communications and storage of information, such as electronic data interchange (EDI), electronic mail and telecopy. It is based on the establishment of a functional equivalent for paper-based concepts such as "writing" and "signature". In addition to general norms, the Model Law also contains rules for electronic commerce in specific areas, such as carriage of goods. 
The main Articles of this instrument are:
•	Article 1. Sphere of Application – which states the Law ‘applies to any kind of information in the form of a data message used in the context of commercial activities.’ 
•	Article 5. Legal recognition of data messages – which states ‘information shall not be denied legal effect, validity or enforceability solely on the grounds that it is in the form of a data message.’
•	Article 6. Writing – provides that where information is legally required to be in writing that requirement is met by a data message, provided it is accessible for future reference.
•	Article 7 Signature – allows the use of digital signatures in documents where the signature of a person is required provided it identifies the person, indicates their approval of the content of the document and the signature is in a reliable form. 
•	Article 15. Time and place of dispatch and receipt of data messages – provides that a data message is simultaneously dispatched and received when it is sent though an information system specified by the parties and if no information system is specified the ‘time’ of contract is the instant it is retrieved. The ‘place’ of contract is where the document originator has its place of business. 
18.2.	UNCITRAL Model Law on Electronic Signatures (2001)
This has not been as widely adopted. So far the countries to adopt legislation implementing the Model Law on Electronic Signatures are Barbados , Cape Verde , China , Costa Rica , Ghana , Guatemala , India , Jamaica , Mexico , Nicaragua , Paraguay , Qatar , Rwanda , Saint Lucia , Saint Vincent and the Grenadines , Saudi Arabia , Thailand , Trinidad and Tobago , United Arab Emirates , Viet Nam , Zambia (see http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/2001Model_status.html).
According to the UNCITRAL, :
The Model Law on Electronic Signatures is intended to bring additional legal certainty regarding the use of electronic signatures. Building on the flexible principle contained in Article 7 of the UNCITRAL Model Law on Electronic Commerce, it establishes a presumption that, where they meet certain criteria of technical reliability, electronic signatures shall be treated as equivalent to hand-written signatures (Article 3), using a technologically neutral approach. In addition, the Model Law establishes basic rules of conduct that may serve as guidelines for assessing possible responsibilities and liabilities that might bind upon the various parties involved in the electronic signature process: the signatory (Article 8), the relying party (Article 11) and trusted third parties that might intervene in the signature process (Article 9). 
The main Articles in this Model Law, apart from those mentioned above are:
•	Article 6. Compliance with a requirement for a signature – provides that such compliance is met where ‘an electronic signature is used that is as reliable as was appropriate for the purpose for which the data message was generated.’
•	Article 12. Recognition of foreign certificates and electronic signatures – provides that in determining whether an electronic signature or foreign certificate is legally effective no regard shall be given to the geographic location of where the certificate of signature was issued or the location of the place of business of the signatory, and if a certificate or signature has been created outside an ‘enacting State’ it shall have the same legal effect as if it was created within that State.
18.3.	UN Convention on the Use of Electronic Communications in International Contracts (CUECIC) 2005
In 2005 the UNCITRAL finished drafting the Convention on the Use of Electronic Communications in International Contracts (http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/2005Convention.html ). 
The Convention was adopted by the general Assembly and is now open to signatures of member states. The Convention is aimed as enhancing legal certainty and commercial predictability where electronic communications are used by private parties engaged in international e-commerce. It builds on the principles of the E commerce model laws of 1996. To address issues relating to
-	the location of a party in the electronic environment
-	the time and place of dispatch of electronic communication
-	the use of automated messaging systems in contract formation. 
It remains to be seen whether or not member states will implement the rules that are provided in the Convention. By 2012 only China, Russia, South Korea, Singapore, Saudi Arabia and a host of developing nations had signed the convention. 
Unlike the 1996 model laws on E-Commerce, few countries have implemented legislation which gives domestic effect to the proposed laws (see http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/2005Convention_status.html ).  
However, the Status page of the 1996 Model Law, at note (e), also suggests Australia’s federal and state legislation, as of 2010 and 2011, as well as a number of other countries including Singapore,  now incorporates substantive provisions of the Convention. See <http://www.uncitral.org/uncitral/en/uncitral_texts/electronic_commerce/1996Model_status.html>
When considering whether to adopt the 2005 Convention into domestic law, member states will need to consider whether to apply the laws in the Convention to domestic contracts (as well as international contracts) to avoid having different regimes for domestic and international law.