1.1 The Accreditation Regulations have been issued under the Electronic Communications and Transactions Act, 2002 (ECT Act) and published in Government Gazette No. 29995 on 20 June 2007. In terms of regulation 4(c) the South African Accreditation Authority (SAAA) should maintain a database that should inter alia contain a complaints procedure for subscribers to accredited
authentication products and services. The relevant database is located at the SAAA website at www.saaa.gov.za. This document sets out the complaints procedure required by regulation 4(c).
1.2 It should be noted that this complaints procedure only applies in respect of Authentication Service Providers that have been accredited by the SAAA. The complaints procedure is available to subscribers that subscribe to the services of such accredited Authentication Service Providers (ASPs) or third parties relying on it.
1.3 This procedure can be used with regard to any matter that falls within the jurisdiction of the SAAA and that the SAAA has locus standi to handle. A complainant may lodge a complaint regarding any non-compliance by an ASP with the ECT Act or Accreditation Regulations. An ASP, for an example, has an obligation to ensure the availability of information to third parties relying on its authentication products or services in terms of regulation 7(c)(vii). A complainant can lodge a complaint if an ASP fails to make such information available as prescribed. A complaint may also be lodged if an ASP fails to comply with for AA_Website_Complaints Procedureinstance its Certificate Policy or Certificate Practice Statement. Following the investigation of a complaint, the SAAA may suspend, revoke or terminate accreditation in terms of section 39 of the ECT Act or in terms of regulations 23 to 25.
6. The following procedure shall apply when lodging a dispute:
6.1A complaint is initiated against an accredited ASP. This complaint must be submitted via post or email and will be processed by the Deputy South African Accreditation Authority or his/ her delegate. The complaint must contain the following information:
- The name of the ASP against whom the complaint is being made;
- The full names, address and contact details of the complainant;
- Identification of that part of the ECT Act or Accreditation Regulations which has allegedly been breached;
- A detailed description of the actions (or inactions) which resulted in the alleged breach.
6.2 If the complaint does contain all of these points, proceed to 6.3.
If the complaint does not contain all of these points, a reply is sent back to the
the complainant requesting that the missing information be provided. End of procedure.
6.3 An acknowledgement of receipt of the complaint is sent to the complainant.
6.4 A few basic sanity checks are done, to ensure that the complaint is valid:
- Is the ASP an accredited ASP?
- Does the SAAA have locus standi to handle the complaint?
- Has the SAAA already dealt with an earlier complaint on the same issue?
- If the complaint passes the sanity tests, then proceed to 5.5.
- If any of these sanity checks fail, a letter is sent to the complainant explaining the reason the complaint cannot be addressed.
6.5 In terms of section 39(2) of the ECT Act the SAAA may not take any action against an ASP such as suspending or revoking accreditation unless it has -
(a) notified the ASP in writing of its intention to do so;
(b) given a description of the alleged breach of any of the requirements, conditions or restrictions subject to which accreditation was granted; and
(c) afforded the ASP the opportunity to
(i) respond to the allegations in writing; and
(ii) remedy the alleged breach within a reasonable time.
6.6 Therefore the ASP against whom the complaint has been initiated is notified in writing of the complaint and given 10 working days to respond to the allegations in writing and indicate how and by when, if applicable, the alleged complaint or breach will be remedied. On request, and at the discretion of the Deputy SAAA, an additional five days may be granted.
6.7 The Deputy SAAA must consider the merits of the complaint, taking into account:
- The complaint;
- Any response the ASP made to the complaint;
- The ECT Act and Accreditation Regulations;
- Any recommendations of an evaluator;
- Any previous complaints made by the complainant;
- Any previous complaints made against the ASP.
6.8 The Deputy SAAA may request that either the complainant or the ASP or both provide additional information relevant to the complaint. The Deputy SAAA must specify a time frame for the provision of this information. If either party fails to provide the required information within this time frame, the Deputy SAAA must proceed to evaluate the complaint without the benefit of the additional information.
6.9 After considering the merits of the complaint, the Deputy SAAA can make any the following resolutions:
- The complaint is not valid;
- The ASP is directed to perform remedial action;
- The ASP is issued with a reprimand or warning;
- The accreditation is suspended or revoked after following the prescribed procedures in the ECT Act and Accreditation Regulations.
6.10 A copy of the Deputy SAAA's resolution and the reasons for such resolution are forwarded to the ASP and the complainant.
6.11 The SAAA must retain records of all complaints lodged in terms of this procedure.
6.12 Target turn-around time from acknowledgement of receipt to resolving it is 6 weeks.