(3) (a) the signatory knows or should have known that the signature creation data have been lost, damaged, compromised, unduly disclosed or known in the manner inconsistent with their purpose; (b) the signatory knows from the circumstances occurred that there is a substantial risk that the signature creation data may have been lost, damaged, compromised, unduly disclosed or known in the manner in consistent with their purpose; where a certificate is issued to support the electronic signature, exercise reasonable care to ensure the accuracy and completeness of all material representations made by the signatory which are relevant to the certificate throughout its life-cycle, or as specified in the certificate. Section 28 Where a certification service is provided to support an electronic signature that may be used for legal effect as a signature, that certification service provider shall perform as follows: (1) act in accordance with representations made by it with respect to its policies and practices; (2) exercise reasonable care to ensure the accuracy and completeness of all material representations made by it that are relevant to the certificate throughout its life-cycle, or as specified in the certificate; (3) provide reasonably accessible means which enable a relying party to ascertain in all material representations from the certificate in the following matters: (4) (a) the identity of the certification service provider; (b) that the signatory that is identified in the certificate had control of the signature creation data at the time when the certificate was issued; (c) that signature creation data were valid at or before the time when the certificate was issued; provide reasonably accessible means which enable a relying party to ascertain from the certificate or otherwise as follows: (a) the method used to identity the signatory; (b) any limitation on the purpose or value for which the signature creation data or the certificate may be used; (c) that the signature creation data are valid and have not been lost, damaged, compromised, unduly disclosed or known in a manner inconsistent with their purpose; (d) any limitation on the scope or extent of liability stipulated by the certification service provider; (e) the availability of the means for the signatory to give notice upon the occurrence of the events pursuant to Section 27 (2); and (f) a timely revocation service is offered; (5) where services under subparagraph (4) (e) are offered, provide a means for a signatory to give notice pursuant to Section 27 (2) and, where services under (4) (f) are offered, ensure the availability of a timely revocation service; (6) utilize trustworthy systems, procedures and human resources in performing its services. Section 29 In determining whether any systems, procedures and human resources under Section 28 (6) are trustworthy, regard shall be had to the following factors: (1) financial and human resources, including existence of assets; www.ThaiLaws.com 7