Information Technology Act, 2000

Information Technology Act, 2000
Government of India · Public domain · source
Name	Information Technology Act, 2000
Enacted by	Parliament of India
Assent	2000
Status	In force

Information Technology Act, 2000 is an Indian statute that established a legal framework for electronic commerce, electronic evidence, digital signatures and cyber offences. Enacted by the Parliament of India and assented in 2000, the Act aimed to harmonize aspects of Indian Contract Act, 1872, Indian Penal Code, Indian Evidence Act, 1872 and international instruments such as the UNCITRAL Model Law on Electronic Commerce and the Budapest Convention on Cybercrime. The law's implementation intersects with agencies including the Ministry of Communications and Information Technology (India), the Ministry of Home Affairs (India), and judicial bodies like the Supreme Court of India, the High Court of Delhi and various Specialized Courts of India.

Background and Enactment

The legislative genesis drew on precedents from the United Kingdom Computer Misuse Act 1990, the United States Electronic Signatures in Global and National Commerce Act, and commitments under the World Trade Organization and GATT regimes. Drafting involved consultations with the Department of Telecommunications (India), the National Informatics Centre, technology firms such as Tata Consultancy Services, Infosys, and policy think tanks like the NASSCOM and the Centre for Internet and Society. Parliamentary debates referenced landmark cases before the Supreme Court of India and comparative statutes in jurisdictions including Singapore and Malaysia. The final bill was passed amid contemporaneous legislative actions like amendments to the Indian Penal Code and the passage of cybercrime frameworks in states such as Maharashtra and Karnataka.

Key Provisions and Offences

The Act defined legal recognition for electronic records and electronic signatures, invoking standards akin to the ISO/IEC 27001 family and referencing digital certificate authorities similar in role to VeriSign and Entrust. It created specific offences such as unauthorized access, data tampering, and publishing obscene material online, drawing terminology that interacts with provisions in the Indian Penal Code and statutory instruments like the Cinematograph Act, 1952 where applicable. The statute established penalties and adjudicatory mechanisms comparable to models in the European Union directives on electronic commerce, and it addressed intermediary liability in contexts involving platforms akin to Google, Facebook, and Airtel.

Cybersecurity Measures and Liability

Provisions addressed due diligence obligations for intermediaries, notice-and-takedown procedures, and obligations for corporate entities similar to precedents under Sarbanes-Oxley Act compliance and Payment Card Industry Data Security Standard influences. Liability rules intersect with regulators such as the Reserve Bank of India on online banking, the Income Tax Department (India) on electronic record-keeping, and the Telecom Regulatory Authority of India for telecom carriage issues. The Act's sections concerning protection of sensitive personal data converse with jurisprudence in cases brought before the Supreme Court of India and policy pronouncements from the National Cyber Security Coordinator.

Amendments and the IT (Amendment) Act, 2008

The 2008 amendment, often cited alongside deliberations in the Rajya Sabha and Lok Sabha, expanded offences to include identity theft, phishing, and cyber terrorism, and introduced corporate vicarious liability and provisions for adjudication by designated officers. It incorporated concepts from the Convention on Cybercrime debates and responded to incidents such as attacks on infrastructures akin to those affecting Indian Banks Association members and Internet service providers like BSNL and Reliance Jio. The amendment also added provisions relating to interception and monitoring that implicated executive organs like the Central Bureau of Investigation and the Intelligence Bureau (India).

Implementation, Enforcement and Adjudication

Enforcement rests with designated adjudicating officers, the Cyber Appellate Tribunal (subject to judicial restructuring by the Supreme Court of India), law enforcement agencies including the Central Bureau of Investigation and state police cyber cells, and regulators such as the Ministry of Electronics and Information Technology. Litigation has proceeded through forums such as the High Court of Bombay and the High Court of Madras, with appellate review by the Supreme Court of India. Adjudicatory practice engages technical agencies like the CERT-In (Indian Computer Emergency Response Team) and standards bodies such as the Bureau of Indian Standards when determining compliance and sanctioning remedies.

Criticisms, Legal Challenges and Impact

Scholars, civil society groups including the Centre for Internet and Society and policy critics from organizations like Human Rights Watch and Internet Freedom Foundation have argued about tensions between provisions and constitutional guarantees under the Constitution of India, citing landmark rulings such as Justice K.S. Puttaswamy (Retd.) v. Union of India on privacy. Litigation over intermediary liability and content regulation reached the Supreme Court of India and multiple high courts, often involving parties like Twitter, WhatsApp, YouTube and domestic ISPs. Debates also referenced international human rights jurisprudence from bodies such as the European Court of Human Rights and practices in nations like United States, United Kingdom, and Australia to challenge surveillance and censorship implications. The Act has shaped e-governance initiatives by agencies like the Unique Identification Authority of India and influenced commercial adoption of electronic signatures across corporates including State Bank of India and HDFC Bank.

Category:Indian legislation