Recognition of Foreign Certifying Authorities

In one line

A foreign Certifying Authority counts in India only if the Controller has recognised it by notification with the previous approval of the Central Government.

In the wording a student can write in an exam: section 19 of the Information Technology Act, 2000 empowers the Controller, subject to such conditions and restrictions as may be specified by regulations and with the previous approval of the Central Government, to recognise any foreign Certifying Authority as a Certifying Authority for the purposes of the Act by notification in the Official Gazette, provides that a certificate issued by an Authority so recognised shall be valid for the purposes of the Act, and empowers the Controller for reasons recorded in writing to revoke that recognition by notification if satisfied that the Authority has contravened the conditions and restrictions of its recognition.

Why the section is needed

Because a certificate is a statement by somebody, and the reason to believe it is the licence behind it. Chapter 320 sets that out. A certificate issued by an Authority licensed under section 24 is trustworthy in India because the Controller licensed and supervises the issuer.

A certificate issued in Singapore or Germany has none of that behind it, so far as Indian law is concerned. Its issuer is licensed by somebody else, to somebody else's standards, and answerable to somebody else.

And cross-border transactions need the problem solved. An Indian company signing with a German counterparty needs each side's signature to be effective at the other end, and neither wants to obtain a certificate in the other's country.

The section

Section 19(1): "Subject to such conditions and restrictions as may be specified by regulations, the Controller may with the previous approval of the Central Government, and by notification in the Official Gazette, recognise any foreign Certifying Authority as a Certifying Authority for the purposes of this Act."

Four requirements, and each is a step. Conditions and restrictions specified by regulations, which are the Controller's own regulations under section 89. The previous approval of the Central Government. A notification in the Official Gazette. And the effect is that the foreign Authority becomes a Certifying Authority for the purposes of this Act.

Section 19(2): "Where any Certifying Authority is recognised under sub-section (1), the Electronic Signature Certificate issued by such Certifying Authority shall be valid for the purposes of this Act."

So recognition attaches to the Authority and the validity flows to its certificates. There is no mechanism for recognising a single certificate or a class of certificates.

Section 19(3): "The Controller may, if he is satisfied that any Certifying Authority has contravened any of the conditions and restrictions subject to which it was granted recognition under sub-section (1), he may, for reasons to be recorded in writing, by notification in the Official Gazette, revoke such recognition."