Preservation and Retention of Information by Intermediaries

In one line

An intermediary must preserve and retain the information the Central Government prescribes, for the duration, in the manner and in the format prescribed, and an intentional or knowing failure is now a penalty of up to twenty five lakh rupees.

In the wording a student can write in an exam: section 67C(1) of the Information Technology Act, 2000 provides that an intermediary shall preserve and retain such information as may be specified for such duration and in such manner and format as the Central Government may prescribe.

Why the obligation exists

Investigation of a cyber offence is investigation of records. Logs, subscriber details, timestamps and addresses are the whole of the evidence, and they are held by intermediaries who have no business reason to keep them for long.

So the Act imposes a duty to keep them. Without it, the offences in this Chapter would be unprovable in most cases, because the trail would be gone before anyone knew there had been an offence.

And the duty is entirely delegated. The section fixes no period, names no information and prescribes no format. Everything is left to rules.

The provision itself

Sub-section (1). An intermediary shall preserve and retain such information as may be specified, for such duration and in such manner and format as the Central Government may prescribe.

Sub-section (2). Any intermediary who intentionally or knowingly contravenes sub-section (1) shall be liable to penalty which may extend to twenty five lakh rupees.

What sub-section (2) used to say. Item (F) of the Jan Vishwas schedule replaced the words "punished with an imprisonment for a term which may extend to three years and also be liable to fine". So the old provision was three years and a fine, and it is now a penalty of up to twenty five lakh rupees, with effect from 30 November 2023.

"Intermediary" is section 2(1)(w). Any person who, with respect to a particular electronic record, receives, stores or transmits it on behalf of another, or provides any service with respect to it, including telecom, network and internet service providers, web hosts, search engines, online payment, auction and market places, and cyber cafes.

Broken down

Two verbs, not one. Preserve and retain. Preservation is about keeping the information intact; retention is about keeping it for a period.

Four things are prescribed. What information, for how long, in what manner and in what format. A rule that specifies the information but not the format leaves the duty incomplete.

The mental element is in sub-section (2), not (1). The duty is absolute; the liability arises only on an intentional or knowing contravention. An intermediary that loses records to a genuine failure is in breach of the duty but not liable to the penalty.