The Information Technology Act, 2000 (Act No.21 of 2000) is the primary legislation governing electronic commerce, electronic governance, and cybercrime in India. Enacted on 9 June 2000 and commenced on 17 October 2000, it was India's legislative response to the UNCITRAL Model Law on Electronic Commerce (1996).
Legal Framework
| Provision | Subject |
|---|---|
| S.1 | Short title, extent, commencement, application |
| S.2 | Definitions (49 definitions post-2008 Amendment) |
| S.3 | Authentication of electronic records (digital signature) |
| S.3A | Electronic signature (broader, inserted 2008) |
| S.4-10A | Electronic governance (Ch.III) |
| S.11-16 | Attribution, acknowledgment, dispatch/receipt of electronic records (Ch.IV) |
| S.17-34 | Digital/Electronic Signature Certificates (Ch.V-VIII) |
| S.43-47 | Penalties and adjudication (Ch.IX) |
| S.65-78 | Offences (Ch.XI) |
| S.79 | Intermediary liability (safe harbour) |
| S.81 | Overriding effect over other laws |
| Schedule I | Documents excluded from Act (negotiable instruments, PoA, will, trust, sale deed of immovable property) |
Aims and Objects
The IT Act was enacted to achieve the following objectives:
| Objective | How Achieved |
|---|---|
| Legal recognition to electronic records | S.4: electronic records = written records |
| Legal recognition to digital/electronic signatures | S.5: electronic signature = handwritten signature |
| Facilitate electronic governance | Ch.III (S.4-10A): government filing, notices in electronic form |
| Facilitate electronic commerce | S.10A: validity of e-contracts |
| Define cybercrimes and prescribe penalties | Ch.IX (civil), Ch.XI (criminal) |
| Establish regulatory framework | CCA (S.17), Adjudicating Officer (S.46), Cyber Appellate Tribunal (S.48) |
| Implement UNCITRAL Model Law | Functional equivalence principle adopted |
| Amend Indian Evidence Act, Bankers Books Evidence Act, RBI Act | S.91-94 (consequential amendments; now superseded by BSA 2023) |
Why: Before 2000, no Indian statute recognized electronic records, digital signatures, or e-contracts. Commercial transactions and government functions moving online had no legal foundation. The IT Act filled this void by creating functional equivalence between electronic and physical instruments.
Structure of the Act
| Chapter | Sections | Subject |
|---|---|---|
| I | 1-2 | Preliminary (title, definitions) |
| II | 3-3A | Digital and Electronic Signatures |
| III | 4-10A | Electronic Governance |
| IV | 11-13 | Attribution, Acknowledgment, Dispatch/Receipt |
| V | 14-16 | Secure Electronic Records and Signatures |
| VI | 17-34 | Certifying Authorities |
| VII | 35-39 | Digital Signature Certificates |
| VIII | 40-42 | Duties of Subscribers |
| IX | 43-47 | Penalties, Compensation, Adjudication |
| X | 48-64 | Cyber Appellate Tribunal |
| XI | 65-78 | Offences |
| XII | 79-81 | Intermediary liability, Exemptions |
| XIII | 82-90 | Miscellaneous |
| Schedules | I-IV | Excluded documents; Consequential amendments |
Key Amendments (2008)
The IT (Amendment) Act, 2008 made transformative changes:
| Change | Effect |
|---|---|
| S.3A inserted | Electronic signature (technology-neutral) alongside digital signature |
| S.43A inserted | Body corporate liability for data breach (reasonable security practices) |
| S.66A-66F inserted | New offences (S.66A struck down in 2015) |
| S.67A-67C inserted | Pornography, child porn, intermediary preservation |
| S.69 expanded | Government interception, monitoring, decryption powers |
| S.69A inserted | Power to block websites |
| S.69B inserted | Power to monitor traffic data |
| S.70B inserted | CERT-In as nodal agency |
| S.79 rewritten | Safe harbour for intermediaries (due diligence condition) |
| Cyber Appellate Tribunal reconstituted | Chairperson qualifications and procedure updated |
Non-Applicability (Schedule I)
The IT Act does not apply to:
- Negotiable instruments (other than cheques)
- Power of Attorney (S.1A, Powers of Attorney Act)
- Trust (S.3, Indian Trusts Act)
- Will (S.2(h), Indian Succession Act)
- Contract for sale or conveyance of immovable property
Why: These instruments require physical presence, attestation, registration, or witnessing where the solemnity of the physical act serves evidentiary and protective functions that electronic equivalence cannot yet replicate.
Recall Check
- What international instrument influenced the enactment of the IT Act 2000?
- Name any three documents excluded from the IT Act under Schedule I.
- What was the key change S.3A (2008 Amendment) introduced?
Key Cases
Shreya Singhal v. Union of India (2015) Shreya-Singhal-v-Union-of-India-2015 Issue: Constitutional validity of S.66A IT Act (punishment for sending offensive messages through communication service). Rule: A criminal speech restriction must satisfy Art.19(2) tests; vagueness and overbreadth render a penal provision unconstitutional. Held: S.66A struck down. S.79 read down: intermediary loses safe harbour only upon receiving court order or government notification, not mere private complaint.
Avnish Bajaj v. State (NCT of Delhi) (2008) Avnish-Bajaj-v-State-NCT-Delhi-2008 Issue: Whether the CEO of Bazee.com (eBay India) is criminally liable for obscene content posted by a third-party user on the platform. Rule: Under pre-2008 S.79, intermediary liability depended on knowledge and editorial control; a platform not exercising editorial control is not a publisher. Held: Delhi HC discharged the CEO. Led to Parliament strengthening safe harbour provisions in the 2008 Amendment (rewritten S.79).
Distinctions
| Aspect | IT Act 2000 (Original) | IT Act post-2008 Amendment |
|---|---|---|
| Signature | Digital signature only (S.3) | Digital + Electronic signature (S.3, S.3A) |
| Intermediary liability | Unclear; depended on "knowledge" | Clear safe harbour (S.79) with due diligence conditions |
| Data protection | Not addressed | S.43A (body corporate data breach compensation) |
| Government powers | Limited | S.69/69A/69B (interception, blocking, monitoring) |
| New offences | Basic (S.65-67) | Expanded (S.66A-F, S.67A-C) |
| Regulatory body | Cyber Appellate Tribunal | Reconstituted CAT; CERT-In (S.70B) |
Flashcards
Q: When was the IT Act 2000 enacted and commenced? A: Enacted 9 June 2000; commenced 17 October 2000.
Q: What principle from UNCITRAL Model Law does the IT Act adopt? A: Functional equivalence: electronic records and signatures have the same legal validity as physical counterparts.
Q: Name the chapter of the IT Act dealing with offences. A: Chapter XI (Sections 65 to 78).
Q: What does S.81 provide? A: Overriding effect: the IT Act prevails over any other law inconsistent with it, to the extent of inconsistency.
Q: Which section was struck down in Shreya Singhal (2015)? A: S.66A (punishment for sending grossly offensive messages through communication service).
Q: Name five documents excluded from the IT Act (Schedule I). A: Negotiable instruments (other than cheques), Power of Attorney, Trust, Will, Contract for sale of immovable property.
Q: What did the 2008 Amendment insert regarding data protection? A: S.43A: body corporate handling sensitive personal data must implement reasonable security practices; failure leading to wrongful loss entitles affected person to compensation.
Q: What is the overriding effect provision? A: S.81: IT Act has overriding effect notwithstanding anything inconsistent in any other law for the time being in force.
Exam Scenario
An online retailer enters into a contract with a buyer entirely through electronic communication. The buyer later argues the contract is void because there was no physical document signed by parties. The retailer relies on the IT Act. Advise.
Under S.10A IT Act (inserted 2008), a contract shall not be denied legal validity solely on the ground that it was formed through electronic means. S.4 gives legal recognition to electronic records where law requires writing. S.5 validates electronic signatures where law requires authentication. The buyer's argument fails because the IT Act creates functional equivalence between electronic and physical instruments. The contract is valid provided: (1) parties are identifiable, (2) consent is established (offer and acceptance via electronic communication), (3) the subject matter does not fall within Schedule I exclusions (it does not, as it is a sale of movable goods, not immovable property). The retailer's position is legally sound.