(1) Notwithstanding a disclaimer by the repository or a contract to the contrary between the repository, a certification authority, or a subscriber, a repository is liable for a loss incurred by a person reasonably relying on a digital signature verified by the public key listed in a certificate that has been suspended or revoked by the licensed certification authority that issued the certificate, if loss was incurred more than one business day after receipt by the repository of a request from the issuing licensed certification authority to publish notice of the suspension or revocation, and the repository had failed to publish the notice when the person relied on the digital signature.

     (2) Unless waived, a recognized repository or the owner or operator of a recognized repository is:

     (a) Not liable for failure to record publication of a suspension or revocation, unless the repository has received notice of publication and one business day has elapsed since the notice was received;

     (b) Not liable under subsection (1) of this section in excess of the amount specified in the certificate as the recommended reliance limit;

     (c) Not liable under subsection (1) of this section for:

     (i) Punitive or exemplary damages; or

     (ii) Damages for pain or suffering;

     (d) Not liable for misrepresentation in a certificate published by a licensed certification authority;

     (e) Not liable for accurately recording or reporting information that a licensed certification authority, or court clerk, or the secretary has published as required or permitted in this chapter, including information about suspension or revocation of a certificate;

     (f) Not liable for reporting information about a certification authority, a certificate, or a subscriber, if the information is published as required or permitted in this chapter or a rule adopted by the secretary, or is published by order of the secretary in the performance of the licensing and regulatory duties of that office under this chapter.

     (3) Consequential or incidental damages may be liquidated, or may otherwise be limited, altered, or excluded unless the limitation, alteration, or exclusion is unconscionable. A recognized repository may liquidate, limit, alter, or exclude damages as provided in this subsection by agreement, or by notifying any person who will rely on a digital signature verified by the public key listed in a suspended or revoked certificate of the liquidation, limitation, alteration, or exclusion before the person relies on the certificate.

[1999 c 287 § 17; 1997 c 27 § 33; 1996 c 250 § 502.]

NOTES:

     Effective date -- 1999 c 287: See note following RCW 19.34.010.

     Effective date -- Severability -- 1997 c 27: See notes following RCW 19.34.030.