Class Notes on PG. Diploma Cyber Law - Information Technology Law (SEM II)

Overview of Semester II Cyber Law Curriculum

These academic PG Diploma Cyber Law SEM II class notes provide a structured, in-depth analysis of information technology legislation, regulatory enforcement bodies, electronic commerce standards, data privacy frameworks, and international treaties governing digital environments in India and abroad. The semester curriculum covers the statutory foundations of the Information Technology Act 2000, the establishment and powers of the Cyber Appellate Tribunal, core data protection principles and privacy rights, evidentiary rules for electronic contracts, penal investigation mechanisms for cyber crimes, and multilateral harmonization conventions. This course module builds on foundational principles detailed in our PGD Cyber Law exam guide and supplements practical regulatory handbooks on cyber laws in India.

Unit I: Information Technology Act 2000 and Regulatory Framework

Legislative History, Objectives, and Scope of the IT Act

The Information Technology Act, 2000 (Act No. 21 of 2000) was enacted by the Parliament of India following the adoption of the Model Law on Electronic Commerce by the United Nations Commission on International Trade Law (UNCITRAL) in 1996. The primary objective of the Indian legislature was to create a secure legal environment for electronic commerce, facilitate electronic governance, and establish legal parity between traditional paper-based documentation and electronic records.

The core legislative objectives embodied in the Information Technology Act include:

• Legal Recognition of Electronic Commerce: Providing formal statutory validity to commercial transactions conducted through electronic data interchange (EDI) and other computer-mediated communications.
• Facilitation of Electronic Governance: Enabling citizens and corporate entities to file documents, applications, and statutory returns electronically with government departments, ministries, and regulatory bodies under Sections 4 to 10.
• Evidentiary Amendments: Amending core traditional statutes, including the Indian Penal Code 1860, the Indian Evidence Act 1872, the Bankers Books Evidence Act 1891, and the Reserve Bank of India Act 1934, to admit electronic records and digital data trails into judicial evidence.
• Security and Authentication Infrastructure: Establishing a Public Key Infrastructure (PKI) framework for the generation, verification, and certification of digital signatures and electronic signatures under Sections 3 and 3A.
• Establishment of Regulatory Authorities: Instituting specialized Information Technology Act 2000 regulatory bodies, such as the Controller of Certifying Authorities (CCA), Adjudicating Officers, and specialized appellate mechanisms.

Information Technology Act 2000 Regulatory Bodies

The regulatory architecture of the IT Act operates across administrative, certifying, and judicial tiers:

• Controller of Certifying Authorities (CCA): Established under Section 17 to license, supervise, and monitor Certifying Authorities (CAs) who issue digital signature certificates to individuals and corporate entities. The CCA maintains the National Repository of Digital Certificates (NRDC) and sets security criteria for cryptographic hardware and software.
• Certifying Authorities (CAs): Licensed entities under Section 21 authorized to verify applicant identity, generate public-private key pairs, and issue Digital Signature Certificates (DSCs) across Class 1, Class 2, and Class 3 assurance levels.
• Adjudicating Officers: Appointed by the Central Government under Section 46 (holding the rank of Director to the Government of India or State Secretary) to adjudicate contraventions under Chapter IX of the Act where claims for injury or damages do not exceed statutory monetary thresholds.
• Cyber Appellate Tribunal (CyAT): Established to hear appeals against decisions rendered by the Controller of Certifying Authorities or Adjudicating Officers.

Public Key Infrastructure and Subscriber Duties

The authentication of electronic records relies on asymmetric cryptosystems where two mathematically linked keys perform complementary cryptographic functions. The private key remains strictly in the confidential possession of the subscriber to create a unique digital signature, while the public key is published in a digital certificate to enable any recipient to verify the integrity and origin of the signed message.

Under Sections 40 to 42 of the Act, subscribers bear statutory duties regarding key management:

• Generating Key Pairs: The subscriber must generate the key pair using approved security algorithms and ensure the public key matches the private key.
• Acceptance of Digital Certificate: By accepting a certificate, the subscriber certifies that all representations made during application are truthful and accurate.
• Control of Private Key: The subscriber is legally required to exercise reasonable care to prevent unauthorized access or disclosure of the private key. If the private key is compromised, the subscriber must immediately communicate the loss to the Certifying Authority to prompt certificate revocation under Section 38.

Section 48: Establishment and Constitution of the Cyber Appellate Tribunal

Under Section 48 of the Information Technology Act 2000, the Central Government is empowered to establish, by official notification, one or more appellate bodies known as the Cyber Appellate Tribunal. Sub-section (1) establishes the statutory tribunal, while sub-section (2) authorizes the Central Government to determine the territorial and subject-matter jurisdiction of each tribunal bench.

The qualifications, term of office, and conditions of service for the Chairperson and members of the Cyber Appellate Tribunal are regulated by Section 49 and Section 51. The Chairperson must be a person who is, or has been, or is qualified to be, a Judge of a High Court. This judicial qualification ensures that complex technical and legal determinations regarding computer networks, financial fraud, and evidentiary admissibility are adjudicated with high judicial competence.

Section 52A: Powers of Superintendence, Direction, and Administration

Under Section 52A, the Chairperson of the Cyber Appellate Tribunal exercises powers of general superintendence and direction in the administrative and judicial affairs of the tribunal. In addition to presiding over formal hearings and full-bench sittings, the Chairperson oversees registry operations, case allocation, and tribunal rules.

The Cyber Appellate Tribunal powers and jurisdiction under Section 53 and Section 58 extend to examining questions of fact and law. The tribunal possesses all powers vested in a civil court under the Code of Civil Procedure, 1908, including summoning witnesses, compelling production of electronic documents, receiving evidence on affidavits, and issuing discovery commissions. Following the Finance Act 2017 restructuring, the functions of the Cyber Appellate Tribunal were merged into the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which now serves as the specialized appellate forum for cyber matters.

Unit II: Privacy Issues and Data Protection in the Cyber World

Foundations of Digital Privacy and Informational Self-Determination

In modern digital networks, personal data has become an exceptionally valuable commercial and operational asset. Digital transactions generate extensive electronic footprints, including personal identity records, financial identifiers, biometric indicators, and behavioural tracking metrics. The legal protection of privacy requires establishing enforceable boundaries between corporate processing needs, governmental security interests, and individual informational autonomy.

The constitutional foundation of data privacy in India was firmly established by the nine-judge constitutional bench of the Supreme Court of India in Justice K.S. Puttaswamy (Retd.) vs Union of India (2017). The apex court unanimously ruled that the right to privacy is an intrinsic part of the right to life and personal liberty guaranteed under Article 21 of the Constitution. The Court declared that informational privacy encompasses personal autonomy over data collection, storage, and processing across both public agencies and private corporate fiduciaries.

Data Protection Principles

International and domestic data protection frameworks rest upon universally accepted principles:

• Lawfulness, Fairness, and Transparency: Personal data must be collected and processed through lawful mechanisms with explicit notice provided to the data subject regarding processing purposes.
• Purpose Limitation: Data controllers must collect personal data only for specified, explicit, and legitimate purposes and refrain from processing data for incompatible secondary purposes without fresh consent.
• Data Minimisation: Processing must be restricted strictly to data points that are adequate, relevant, and necessary for the intended transactional purpose.
• Accuracy and Quality: Controllers must take reasonable technical steps to ensure personal records remain accurate, complete, and updated.
• Storage Limitation: Personal data must be retained only for the duration necessary to fulfill the stated processing purpose or statutory compliance mandates.
• Integrity and Confidentiality: Data handlers must deploy appropriate technical and organizational safeguards against unauthorized processing, accidental loss, destruction, or cyber breach.
• Accountability: Data fiduciaries bear the burden of demonstrating active compliance with privacy safeguards, conducting periodic data protection impact assessments, and maintaining auditable logs.

Privacy Rights of Data Subjects

Statutory privacy regulations confer specific, enforceable data protection principles and privacy rights upon individuals:

• Right to Confirm Existence and Purpose: The data subject has the statutory right to obtain confirmation from any data fiduciary or controller whether personal data concerning them is currently being processed, along with a clear summary of processing activities.
• Right of Access: Individuals are entitled to request and receive complete copies of their personal data held in electronic databases, along with information regarding third-party disclosures.
• Right of Rectification and Erasure: The data subject possesses the right to require the controller to correct inaccurate data, complete incomplete entries, and erase outdated or unlawfully processed records (the right to be forgotten).
• Right to Object: Data subjects may object at any time, on legitimate grounds relating to their particular situation, to data processing based on public interest or commercial direct marketing.
• Rights Regarding Automated Decision-Making: Individuals have the right not to be subjected to decisions based solely on automated computer processing, algorithms, or profiling that produce binding legal effects, guaranteeing a right to human intervention.
• Right to Nominate: Data subjects possess the statutory entitlement to nominate a legal representative to exercise privacy rights in the event of death or incapacity.

Protection of Sensitive Personal Data and Information (SPDI)

Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, Indian law established heightened regulatory protections for sensitive data categories. Sensitive Personal Data or Information (SPDI) includes passwords, financial information (bank account details, credit card numbers), physical and mental health conditions, sexual orientation, medical records, and biometric data.

Entities collecting SPDI must publish a clear privacy policy, obtain prior written consent from data providers, refrain from disclosing sensitive information without explicit authorization, and maintain reasonable security practices conforming to international standards such as ISO/IEC 27001. Failure to implement reasonable security practices resulting in wrongful loss or wrongful gain attracts compensatory liability under Section 43A of the IT Act.

Regulation of Trans-Border Data Flows

Trans-border data flow refers to the transfer of electronic personal records across national borders into foreign cloud servers and overseas data centers. Regulatory frameworks impose stringent restrictions on cross-border data transfers to ensure that domestic privacy protections are not circumvented in foreign jurisdictions.

Transfers are permitted only where foreign territories provide an adequate level of data protection, through binding corporate rules (BCRs), standard contractual clauses (SCCs), or explicit user consent for specific cross-border transactions. Modern data governance mandates that critical personal and national security data must remain localized within domestic data centers to ensure regulatory oversight and judicial enforceability during legal investigations.

Unit III: E-Commerce Legal Issues, Electronic Records, and Business Operations

Legal Validity of Electronic Contracts and Electronic Records

Electronic commerce relies on the validity of digital communications to establish binding contractual relations. Under Section 10A of the IT Act, contracts formed through electronic records and electronic communications cannot be denied enforceability solely on the ground that electronic means were employed for proposal, acceptance, or revocation.

The substantive e-commerce legal issues electronic records encompass several critical legal aspects:

• Attribution of Electronic Records (Section 11): An electronic record is attributed to the originator if it was sent by the originator personally, by an authorized agent, or by an automated information system programmed by or on behalf of the originator.
• Acknowledgement of Receipt (Section 12): Where the originator has requested an acknowledgement of receipt, the electronic record is deemed unreceived until the recipient transmits an acknowledgement in the agreed form or through verifiable conduct. If no specific form is agreed upon, any communication or conduct indicating receipt suffices.
• Time and Place of Despatch and Receipt (Section 13): Despatch occurs when an electronic record enters a computer resource outside the control of the originator. Receipt occurs when the record enters the designated computer resource of the recipient. If sent to an undesignated resource, receipt occurs when the recipient actually retrieves the message.
• Contractual Formats in Digital Trade: E-commerce agreements typically take three standard structural forms: Click-wrap contracts (where users click 'I Agree' before downloading software or purchasing items), Shrink-wrap contracts (where opening packaged software seals indicates acceptance of license terms), and Browse-wrap contracts (where continued website usage constitutes acceptance of posted terms).
• Evidentiary Admissibility (Section 65B, Indian Evidence Act): Electronic documents are admissible in legal proceedings subject to statutory certification validating the integrity, operational status, and custody of the computer system that produced the record. The Supreme Court in Arjun Panditrao Khotkar vs Kailash Kushanrao Gorantyal (2020) affirmed that furnishing a Section 65B certificate is a mandatory condition precedent for the admissibility of secondary electronic evidence.

Legal Process Outsourcing (LPO) and Business Process Outsourcing (BPO) Legal Structures

The rapid expansion of the knowledge economy led to the growth of Legal Process Outsourcing (LPO) and Business Process Outsourcing (BPO) sectors in India. LPO enterprises perform legal research, contract drafting, patent analytics, document review, and litigation support for overseas law firms and corporate legal departments.

LPO and BPO operations face unique regulatory challenges:

• Confidentiality and Attorney-Client Privilege: Ensuring foreign professional privilege standards and non-disclosure obligations are strictly maintained across cross-border remote teams. Employees must execute binding non-disclosure agreements, and digital access must be restricted through strict role-based permissions.
• Cross-Border Data Compliance: Adhering to foreign data privacy regimes (such as the European Union General Data Protection Regulation and US privacy statutes like HIPAA and GLBA) while processing client records on domestic servers.
• Service Level Agreements (SLAs) and Liability Allocation: Structuring contractual indemnity, limitation of liability, and jurisdiction clauses to resolve cross-border breach of contract disputes. Contracts must define measurable performance indicators and specify alternative dispute resolution mechanisms such as international arbitration.
• Cybersecurity and Network Audits: Implementing multi-factor authentication, data encryption, and access controls to prevent data exfiltration and intellectual property theft. Regular third-party security audits ensure systems remain resilient against unauthorized penetration.

Unit IV: Cyber Offences, Adjudication, Penalties, and Investigation Procedures

Statutory Classification of Cyber Crimes

The Information Technology Act classifies digital transgressions into civil contraventions (Chapter IX) and criminal offences (Chapter XI). Civil contraventions are adjudicated through compensatory mechanisms, whereas criminal offences carry punitive fines and imprisonment terms.

Key Offences and Penal Provisions under the IT Act

• Section 43 (Civil Penalties for Damage to Computer Systems): Imposes liability to pay compensation to affected persons for unauthorized access, data downloading, copying, virus introduction, system disruption, or denial of service without owner consent.
• Section 65 (Tampering with Computer Source Documents): Prescribes imprisonment up to three years or a fine up to two lakh rupees for intentionally concealing, destroying, or altering computer source code required to be maintained by law.
• Section 66 (Computer-Related Offences): Penalizes any dishonest or fraudulent act referred to in Section 43 with imprisonment up to three years or a fine up to five lakh rupees.
• Section 66A (Historical Context and Judicial Invalidation): Originally penalized sending offensive messages through communication services. In the landmark case Shreya Singhal vs Union of India (2015), the Supreme Court struck down Section 66A in its entirety as unconstitutional, holding that it violated freedom of speech and expression guaranteed under Article 19(1)(a).
• Section 66B (Receiving Stolen Computer Resource): Punishes dishonestly receiving or retaining stolen computer devices or data with imprisonment up to three years and fines.
• Section 66C (Identity Theft): Imposes criminal liability for fraudulent or dishonest use of electronic signatures, passwords, or unique identification features of another person.
• Section 66D (Cheating by Personation using Computer Resource): Punishes impersonation cheating conducted through digital devices with imprisonment up to three years.
• Section 66E (Violation of Privacy): Penalizes capturing, publishing, or transmitting images of private body parts of individuals without consent.
• Section 66F (Cyber Terrorism): Prescribes punishment extending to imprisonment for life for acts aimed at threatening the unity, integrity, security, or sovereignty of India through computer networks.
• Section 67, 67A, and 67B (Publishing Obscene or Sexually Explicit Material): Prescribe severe penal terms for transmitting sexually explicit content or child sexual abuse material in electronic format.

Investigative Powers: Cyber Offences Penalties Search and Seizure

The detection, investigation, and prosecution of digital offences require specialized statutory enforcement tools. Under Section 78 of the IT Act, no police officer below the rank of Inspector is authorized to investigate cyber offences under the Act, ensuring that personnel with adequate investigative seniority and technical training lead complex inquiries.

Key procedural and enforcement powers include:

• Search and Seizure (Section 80): Authorizes designated police officers to enter, search public places, and arrest without warrant any person found committing or reasonably suspected of having committed an offence under the Act. Investigating officers must secure digital evidence following strict chain-of-custody protocols to maintain forensic integrity.
• Power to Intercept, Monitor, and Decrypt (Section 69): Empowers the Central Government or authorized state agencies to direct the interception, monitoring, or decryption of information stored in any computer resource in the interest of state sovereignty, defense, security, public order, or crime prevention. Intermediaries are statutorily bound to provide technical assistance under penalty of imprisonment.
• Blocking Public Access to Information (Section 69A): Provides the statutory procedure for issuing directions to block public access to electronic information generated or hosted on intermediaries. In Shreya Singhal vs Union of India, the Supreme Court upheld the constitutional validity of Section 69A, emphasizing that blocking orders must be backed by recorded reasons and subject to procedural hearings.
• Intermediary Due Diligence (Section 79): Confers safe-harbor immunity on network service providers and social media platforms, provided they observe mandatory due diligence guidelines and expeditiously remove unlawful content upon receiving actual judicial or administrative knowledge.
• Examiner of Electronic Evidence (Section 79A): Empowers the Central Government to notify specialized forensic institutions as accredited examiners of electronic evidence, whose expert reports receive statutory evidentiary status under Section 45A of the Evidence Act.

Unit V: International Cyber Law Conventions, Treaties, and Harmonization

The Imperative for Uniform International Information Technology Laws

Because the internet functions as a global borderless network, cyber activities frequently transcend territorial boundaries. An attacker situated in one continent may route malicious software through proxy servers in a second country to compromise target infrastructure located in a third nation. These jurisdictional complexities make unilateral domestic legislation insufficient to combat cyber crime, enforce cross-border e-commerce contracts, or protect intellectual property.

Key International Instruments and Model Laws

• UNCITRAL Model Law on Electronic Commerce (1996): Established the legal foundational concepts of functional equivalence, technological neutrality, and non-discrimination of electronic records. The Model Law served as the direct drafting template for India Information Technology Act 2000 and national cyber statutes in over 70 jurisdictions worldwide.
• UNCITRAL Model Law on Electronic Signatures (2001): Outlined technical and legal criteria for establishing reliable digital signatures, defining presumption of signer intent and integrity standards for cross-border recognition.
• The Council of Europe Budapest Convention on Cybercrime (2001): The first multilateral treaty specifically addressing internet and computer crimes. The convention focuses on harmonizing domestic criminal substantive law, improving national investigation capabilities, and establishing effective international police cooperation networks (such as 24/7 point-of-contact networks).
• United Nations Convention on the Use of Electronic Communications in International Contracts (2005): Facilitated international electronic trade by establishing clear rules for contract formation, dispatch and delivery confirmation, and automated message systems in cross-border commercial transactions.
• Tallinn Manual on International Law Applicable to Cyber Warfare: An authoritative, non-binding academic study examining how international humanitarian law and state sovereignty apply to state-sponsored cyber operations and cyber armed conflicts.

Harmonization, Mutual Legal Assistance, and Extraterritorial Jurisdiction

Harmonization refers to the systematic alignment of domestic cyber laws with international standards to eliminate legal conflicts. Section 75 of the Indian IT Act exemplifies extraterritorial reach by stipulating that the Act applies to any offence or contravention committed outside India by any person, regardless of nationality, if the act involves a computer, computer system, or computer network located in India.

Achieving international harmonization requires strengthening mutual legal assistance treaties (MLATs), standardizing digital forensics evidence collection protocols, streamlining Letters Rogatory processes through judicial channels, and establishing unified data privacy agreements to ensure uninterrupted global digital trade and collective cybersecurity defense across all sovereign borders.