Using the Act in Practice

Ask whether the record is attributed to the person said to have sent it. Section 11: sent by him, by a person authorised, or by an automated system he programmed. If none of the three, the Act does not attribute it, and chapter 940 shows what the Act then does not say.

Ask when and where it was despatched and received. Section 13, and chapter 870. This decides the place of the transaction and often the forum.

Ask who the intermediaries are, record by record. Chapter 160 works the definition; chapter 1360 works what follows.

Question three: does the transaction hold up?

Writing. Section 4. Is the information rendered or made available in electronic form and accessible so as to be usable for a subsequent reference? Chapter 300.

Signature. Section 5, with sections 3 and 3A. Was it authenticated by an electronic signature affixed in the prescribed manner? Remember that section 5 bites only where a law requires a signature. Chapters 280, 290 and 300.

Contract. Section 10A, which since 2009 puts the validity of an electronic contract beyond argument. Chapter 930.

Retention. Section 7, and its three conditions including the metadata condition. Chapter 360.

Security. Sections 14 and 15: is the record or the signature secure? That decides the presumptions rather than the validity. Chapter 220.

Proof. Section 63 of the Bharatiya Sakshya Adhiniyam and its certificate. Chapter 1270.

Question four: what remedy do the facts disclose?

Take the civil side first, because it is the one clients usually want.

Section 43 for damage to a computer, computer system, computer network, data or source code: ten clauses, compensation at large. Section 43A where a body corporate was negligent in protecting sensitive personal data. Section 46: the adjudicating officer decides claims up to five crore rupees, the competent court above that. Chapters 1100, 1040 and 1120.

Then the criminal side. Chapter XI, sections 65 to 78, and the mapping table in chapter 210 is the quickest route from conduct to section. Remember section 66 needs dishonestly or fraudulently, and remember that the general penal law applies alongside, with section 81 and Sharat Babu Digumarti deciding which prevails. Chapters 1180 and 1280.

Then the regulatory side, which is where most practical answers now lie. Is there an intermediary who can be required to take the material down, under rule 3 of the IT Rules 2021? Is a blocking direction under section 69A appropriate? Is there a reporting obligation to CERT-In within six hours? Chapters 1360, 810 and 770.

And always ask what the rules add. Chapter 120 lists the twelve sets of rules and which section each is made under. A question about intermediaries answered only from section 79 loses most of the marks.

The route in one table

A worked example, taking the route in order

Facts. Anaya, in Mumbai, sells handmade jewellery through her own website hosted on a service whose servers are in Ireland. A buyer in Chennai places an order by filling a form and clicking "I agree" to the terms. Anaya ships. The buyer then complains that a photograph of her, taken from her social media account, has been used on Anaya's site without permission, and that her card details, stored by Anaya, have appeared on a fraud forum. Anaya says the order was never placed by that buyer at all.

Step 1. Nothing in the First Schedule. The Act applies.

Step 2. The conduct is in India; the server is not, which does not matter, because the parties and the machines they used are here and section 75 is engaged only for conduct outside India.

Steps 3 and 4. The records in issue are the order, the terms accepted by the click, the photograph on the site, and the stored card details. Anaya is the originator of the terms and of the photograph. The buyer is the originator of the order. The hosting service is an intermediary as to the records it stores, and Anaya is not an intermediary as to her own product photographs.

Step 5. Anaya disputes the order. Section 11 attributes it to the buyer only if she sent it, authorised somebody, or ran an automated system. If a third party used her card details to place it, section 11 does not attribute it and chapter 940 shows that the Act gives Anaya nothing further.

Steps 6 and 7. Section 13 places despatch and receipt at the parties' places of business, Mumbai and Chennai. Section 10A makes the click-wrap contract valid; whether its terms were properly incorporated is a contract question, and chapter 960 works it.

Steps 8 to 10. Anaya's records of the order and the logs are what will prove it, subject to the certificate under section 63 of the Bharatiya Sakshya Adhiniyam.

Step 11. The buyer's card details are sensitive personal data or information under rule 3(ii) of the SPDI Rules. If Anaya was negligent in implementing reasonable security practices under rule 8, section 43A gives the buyer compensation, and section 46 sends the claim to the adjudicating officer.

Step 12. Whoever took the card details is caught by sections 43(b) and 66, and by section 66C if they used the buyer's identifying feature. Using the buyer's photograph without consent may engage section 66E if it was taken in circumstances giving rise to a reasonable expectation of privacy, and chapter 1210 works the elements.

Step 13. The buyer can require the hosting service to take the photograph down under rule 3(2)(b) of the IT Rules 2021 if it is a morphed or intimate image, or on a court order under section 79(3)(b) otherwise. Chapter 1360.

Step 14. The photograph is also a copyright question if the buyer took it herself, and section 81's proviso preserves the Copyright Act. Chapter 1280.

Fourteen steps, and not one of them required a memory of a section number, because each step names the question and the chapter that answers it.

What this does NOT mean

It does not mean the order is rigid. A criminal problem starts at step 12 and works backwards. A contract problem may stop at step 7.

It does not mean the Act is the only statute in play. Almost every real problem in this subject also involves the Bharatiya Nyaya Sanhita, the Bharatiya Sakshya Adhiniyam, the Contract Act, the Consumer Protection Act, the Copyright Act or the DPDP Act. Step 14 exists to make sure the question is asked.

It does not mean an answer should recite the route. The route is how you find the provisions. What goes on the paper is the provisions and what they do.

Quick revision

• Four questions, in order: does the Act apply; what is the record and whose is it; does the transaction hold up; what remedy do the facts disclose.
• Question one is section 1(4) and the First Schedule, then sections 1(2) and 75 for anything done abroad.
• Question two is sections 2, 11 and 13, and it identifies every party including the intermediaries, record by record.
• Question three is sections 4, 5, 10A, 7, 14 and 15, and then section 63 of the Bharatiya Sakshya Adhiniyam for proof.
• Question four has three limbs: civil under sections 43, 43A and 46; criminal under Chapter XI; and regulatory under section 79 with the IT Rules 2021, section 69A, and section 70B with the CERT-In directions.
• Always finish with section 81 and the question of what other statute applies alongside.
• And always ask what the rules add, because most operative detail is in a rule and not in the Act.

Test yourself

1. What is the first question to ask of any facts under this Act, and why is it first? Whether the Act applies at all: whether the document or transaction is in the First Schedule under section 1(4), and, for conduct outside India, whether section 75(2) is satisfied by the involvement of a computer, computer system or computer network located in India. It is first because a negative answer ends the inquiry and no other provision needs to be considered.

2. Why must the intermediary question be asked record by record? Because section 2(1)(w) defines an intermediary "with respect to any particular electronic records", so the same person may be an intermediary as to one record and the author of another. A platform is an intermediary as to a user's post and is not an intermediary as to its own advertising, and the availability of section 79 turns on which record is complained of.

3. Where does a claim for three crore rupees under section 43 go, and where does one for seven crore go? Section 46(1A) gives the adjudicating officer jurisdiction where the claim for damage does not exceed five crore rupees, so three crore goes to the adjudicating officer. The proviso vests jurisdiction in respect of a claim exceeding five crore rupees in the competent court, so seven crore goes there.

4. A client asks whether an email exchange made a binding contract. Which steps of the route apply? Steps 3 and 4 to identify the records and the originator and addressee; step 5, section 11, on attribution if either party denies sending; step 6, section 13, for when and where; step 7, sections 4, 5 and 10A, for writing, signature and validity; and step 10, section 63 of the Bharatiya Sakshya Adhiniyam, for how the exchange will be proved. Step 1 should still be asked, because if the contract is one the First Schedule excludes the Act does not touch it at all.

5. Why is an answer built only on the Act likely to be incomplete? Because section 87 leaves the operative detail to rules, so the duties of an intermediary, the standard of reasonable security practices, the procedure for interception or blocking, and the manner of adjudication are all in rules rather than in the Act; and because section 81's overriding effect is qualified, so the Bharatiya Nyaya Sanhita, the Bharatiya Sakshya Adhiniyam, the Contract Act, the Consumer Protection Act and the Copyright Act frequently apply alongside.