Sale of electronic signatures and related services
Good day to all! Opening a new direction in business is always interesting, but we should not forget about the law. A lawyer must be extremely attentive, and the entrepreneur is likely not to do without a lawyer.
Actually, I'm a lawyer. I live in a small town of Stavropol Territory in the south of Russia. By the nature of my activity I constantly come across information technologies. Unexpectedly, I was fascinated by web-programming while I was making a website for my company. Then why did she choose Bitrix, which she regretted more than once, but as they say - this is a completely different story.
At first they wanted to open a certification center, but after long calculations it became clear that it would not pay off financially. It was decided to become a partner of the certification center, because I really wanted to sell the electronic signature. “Demand creates supply” - they constantly ask us if we are dealing with electronic keys. Apparently such conclusions are made by a client who comes to us, let's say, register their business. After all, what does he need for the business to start its existence? Assume:
')
This is the most minimal list, for normal operation you need much more. Of course, you can submit reports by mail (not only VAT), some individual entrepreneurs can work without printing, even opening accounts, but we are still about business, not about survival).
We provide the first three points to our clients; it remains to organize work with ES.
That was the answer from one of the certification centers. Immediately as it is not very believed, I had to check.
The partnership agreement was crammed with all sorts of terms and abbreviations, it was difficult to read, but from the point it was clear that we would process personal data. Accordingly, you need to submit a notice to Roskomnadzor. Before you do this - you need to bring everything in accordance with the law on the protection of personal data. And this is a financial cost. Assume:
Great, all done. Go ahead - license. The regional manager of the certification center insisted that we could work without it, but as they say, there was a trick. “She will need it later,” sounded strange from a legal point of view. A business must be legal from the very beginning, otherwise its existence will not be long, as I understood from practice.
From the review of judicial practice, it became clear that there is no consensus. From a fine of 2 000.00 rubles to imprisonment. Both administrative and civil with criminal liability are provided.
Criminal liability arises in the case of particularly large sizes or harm. From the point of view of the civil code, all transactions are not valid, and therefore the keys are ep, and this threatens with courts and compensation.
The regional manager continued to insist that our actions are legitimate, and we can start work without a license. For ourselves, we have already definitely decided what to do, but the persistent young man still got through to me and began to persuade me to start working with clients before receiving a license in a happy and cheerful voice.
“Well, what are you afraid of, you will not issue an electronic signature, you simply transfer documents and advise clients on our software issues!” - sounds good, it's a pity it still falls under licensing.
A call to the Federal Security Service removed all doubts and put everything in its place. In the licensing department, a benevolent woman answered my questions:
By the way, this question has been raised more than once in training in information security. For example, it was voiced that the company provides paid services to support registration on the portal, and ES is given to the client as a gift. It would be naive to believe that employees of controlled bodies will accept such explanations. Just make a protocol of offense, and then you run around the courts. Also, computers will be removed and prove later what you want.
Be carefull. Especially when it comes to information technology - everything connected with them is now the main vector of development of our country. This sphere is actively developing, there are a lot of “holes in the legislation”, you can easily get under fines and courts. Courts are a dreary, expensive and risky business - it’s better not to get into this system, plus practice is still very small and there’s no reason to hope that the judge will understand all the intricacies and cancel the protocol of the FSB offense.
Your business should be legal from the very beginning, otherwise it will ruin the opportunity to deal with it in the future seriously.
Do not blindly trust partners, they already have a steady business, it’s not hot from your problems.
Introduction
Actually, I'm a lawyer. I live in a small town of Stavropol Territory in the south of Russia. By the nature of my activity I constantly come across information technologies. Unexpectedly, I was fascinated by web-programming while I was making a website for my company. Then why did she choose Bitrix, which she regretted more than once, but as they say - this is a completely different story.
Business expansion
At first they wanted to open a certification center, but after long calculations it became clear that it would not pay off financially. It was decided to become a partner of the certification center, because I really wanted to sell the electronic signature. “Demand creates supply” - they constantly ask us if we are dealing with electronic keys. Apparently such conclusions are made by a client who comes to us, let's say, register their business. After all, what does he need for the business to start its existence? Assume:
')
- Documentation for registration in the tax;
- Documentation for opening a current account (required if it is an LLC);
- Round stamp;
- Electronic signature for reporting;
This is the most minimal list, for normal operation you need much more. Of course, you can submit reports by mail (not only VAT), some individual entrepreneurs can work without printing, even opening accounts, but we are still about business, not about survival).
We provide the first three points to our clients; it remains to organize work with ES.
“One person can start, without a license”
That was the answer from one of the certification centers. Immediately as it is not very believed, I had to check.
The partnership agreement was crammed with all sorts of terms and abbreviations, it was difficult to read, but from the point it was clear that we would process personal data. Accordingly, you need to submit a notice to Roskomnadzor. Before you do this - you need to bring everything in accordance with the law on the protection of personal data. And this is a financial cost. Assume:
- Purchase of a firewall and its configuration;
- Buying antivirus;
- Purchase of security equipment;
- Monthly security costs;
Great, all done. Go ahead - license. The regional manager of the certification center insisted that we could work without it, but as they say, there was a trick. “She will need it later,” sounded strange from a legal point of view. A business must be legal from the very beginning, otherwise its existence will not be long, as I understood from practice.
From the review of judicial practice, it became clear that there is no consensus. From a fine of 2 000.00 rubles to imprisonment. Both administrative and civil with criminal liability are provided.
Doing business without a special permit (license), if such permission (such license) is mandatory (mandatory), is punishable by an administrative fine:
- on citizens in the amount of from two thousand to two thousand five hundred rubles with confiscation of manufactured products, instruments of production and raw materials, or without it;
- on officials - from four thousand to five thousand rubles with confiscation of manufactured products, instruments of production and raw materials, or without it;
- on legal entities - from four hundred to five hundred minimum wages with confiscation of manufactured products, instruments of production and raw materials, or without it.
Criminal liability arises in the case of particularly large sizes or harm. From the point of view of the civil code, all transactions are not valid, and therefore the keys are ep, and this threatens with courts and compensation.
We will simply transfer documents
The regional manager continued to insist that our actions are legitimate, and we can start work without a license. For ourselves, we have already definitely decided what to do, but the persistent young man still got through to me and began to persuade me to start working with clients before receiving a license in a happy and cheerful voice.
“Well, what are you afraid of, you will not issue an electronic signature, you simply transfer documents and advise clients on our software issues!” - sounds good, it's a pity it still falls under licensing.
Resolution of the Government of the Russian Federation dated 04.16.2012 N 313 (as amended on 05.05.2017)
21. Transfer of encryption (cryptographic) means, with the exception of encryption (cryptographic) means of protecting fiscal data developed for use as part of cash registers certified by the Federal Security Service of the Russian Federation.
(clause 21 as amended by the Order of the Government of the Russian Federation of 05/18/2017 N 596)
(see the text in the previous edition)
22. Transfer of encrypted (cryptographic) information system tools protected.
23. Transfer of encrypted (cryptographic) means of telecommunication systems protected.
24. Transfer of tools for the manufacture of key documents
With you says the FSB
A call to the Federal Security Service removed all doubts and put everything in its place. In the licensing department, a benevolent woman answered my questions:
- Yes, you need a license;
- To receive it, we need to train only one person;
- Necessary activities for working with the TC "*******" as a partner - 21, 22, 23, 24;
By the way, this question has been raised more than once in training in information security. For example, it was voiced that the company provides paid services to support registration on the portal, and ES is given to the client as a gift. It would be naive to believe that employees of controlled bodies will accept such explanations. Just make a protocol of offense, and then you run around the courts. Also, computers will be removed and prove later what you want.
Entrepreneurs
Be carefull. Especially when it comes to information technology - everything connected with them is now the main vector of development of our country. This sphere is actively developing, there are a lot of “holes in the legislation”, you can easily get under fines and courts. Courts are a dreary, expensive and risky business - it’s better not to get into this system, plus practice is still very small and there’s no reason to hope that the judge will understand all the intricacies and cancel the protocol of the FSB offense.
Your business should be legal from the very beginning, otherwise it will ruin the opportunity to deal with it in the future seriously.
Do not blindly trust partners, they already have a steady business, it’s not hot from your problems.
Source: https://habr.com/ru/post/338408/
All Articles