An ISP only needs to RICA (or verify the identity of) its customers if it provides an electronic communications service (ECS) as defined by law. We can help you know whether you must RICA your customers by giving you a written legal opinion. If you don’t need to RICA your customers, you will save a lot of money and time – and break down the barriers to customers signing up with you. By obtaining certainty that you do need to RICA your customers, you avoid the consequences of non-compliance.
Whether an ISP must RICA its customers is a very important question
Many ISPs ask us this tricky question – Must an ISP RICA their customer? It is an important question because if an ISP doesn’t RICA their customer when the law requires them to, the consequences of non-compliance are severe. But RICA’ing a customer takes time, costs money and puts a significant hurdle in front of signing up a new customer – especially consumers who are paying a low subscription.
RICA essentially requires certain organisations (or service providers) to verify the identity of their customers, and their residential and business addresses. Practically doing this is hard, time-consuming and costs money to put the necessary processes and technology in place to do it.
What is the answer for your specific organisation? Unfortunately, it is not an easy one.
RICA is poorly drafted and confusing
The answer to the question is complex and confusing. Unfortunately, the main reason for this is that the law is poorly drafted. The same thing is defined multiple times in different laws. For example, an internet service provider (ISP) is defined differently by different laws. So too is an electronic communications service provider (or ECSP). An ECSP under the Cybercrimes Act is different to an ECSP under RICA. An ISP is defined in RICA and defined in the ECT Act.
One definition includes another definition and you have to refer to multiple places in the same law and other laws to know what something is. And the law is vague, deals with intangible concepts and includes many technical terms (like electromagnetic systems).
It depends on whether an ISP provides an electronic communications service (ECS)
The answer is – sometimes yes and sometimes no. It depends on what kind of service the ISP provides to a person. An ECSP (including an ISP) must RICA its customers but only if it provides an electronic communications service (as defined in law). The law defines an electronic communication service as “any service provided to the public, sections of the public, the State, or the subscribers to such service, which consists wholly or mainly of the conveyance by any means of electronic communications over an electronic communications network, but excludes broadcasting services”. In plain language, an electronic communications service is essentially a service that mainly conveys information electronically over a network or using a facility (like a fibre-to-the-home (FTTH) internet access service). If it provides some other service (like a colocation hosting service) that does not fall within this definition, then no.
All ISPs do not need to RICA their customers
Many ISPs provide many services – some are electronic communications services and others are not. In these cases, an ISP might decide to RICA all customers or only those to whom it provides an electronic communications service. If an ISP, does not provide any electronic communications service, it does not need to RICA its customers. This is why you’ll find that some ISPs RICA their customers while others don’t.
Only an ISP that provides an electronic communication service (as defined by law) has to RICA their customers.
Are you an ISP that provides an electronic communications service?
To answer this question you need to know the technical details of the service you provide and then decide whether your services fall within the legal definition of an “electronic communications service”. The answer will be different for each service. It requires a lawyer to apply the law to the technical description of the service in question to come up with the answer.
Action you can take
Know whether you must RICA your customers by asking us to give you a written legal opinion. You could save a lot of time and money if you don’t need to RICA all your customers for all services. A formal legal opinion relating specifically to your organisation can be very useful in justifying to regulators or law enforcement why you decided not to verify the identity of your customers.
