Duties of Subscribers & Penalties , Compensation & Adjudication
Section 40. Generating key pair.
Once a Digital Signature Certificate is accepted by the subscriber & the certificate contains a public key that corresponds to the subscriber’s private key, then:
The subscriber himself must generate that key pair.
The key pair must be generated by following the prescribed security procedure.
Section 40A. Duties of subscriber of Electronic Signature Certificate.
A subscriber has certain responsibilities regarding an Electronic Signature Certificate.
For an Electronic Signature Certificate, the subscriber must carry out specific duties.
These duties are not fixed in the Act itself, but will be prescribed through rules made under the Act.
Section 41. Acceptance of Digital Signature Certificate.
41(1).
A subscriber is considered to have accepted a Digital Signature Certificate if he:
(a). Publishes it, or allows it to be published, to one or more persons.
(b). Publishes it, or authorises its publication, in a repository,
(c). Shows approval in any other way, even if it is not formal publication.
41(2).
By accepting the Digital Signature Certificate, the subscriber makes a declaration to everyone who reasonably relies on that certificate, that:
The following statements and assurances listed are true and trustworthy:
(a).
The subscriber gives an assurance about ownership and authority over the key.
The subscriber possesses the private key.
This private key matches the public key mentioned in the Digital Signature Certificate.
The subscriber is legally entitled to hold and use that private key.
(b).
The subscriber confirms the truth of all information given for the certificate.
All statements and details provided by the subscriber to the Certifying Authority are correct.
Every important fact related to the certificate has been truthfully disclosed.
Nothing relevant has been misstated or hidden.
(c).
The subscriber confirms the accuracy of the certificate details to the extent of their knowledge.
Every detail in the Digital Signature Certificate that the subscriber is aware of, is true and correct.
Section 42. Control of private key.
42(1).
Every subscriber must take reasonable care to keep control over their private key.
The private key must correspond to the public key mentioned in the Digital Signature Certificate.
The subscriber must take all necessary steps to prevent the private key from being disclosed or misused.
42(2).
If the private key linked to the Digital Signature Certificate is compromised. (For example: Lost, Stolen, or Accessed by someone else).
The subscriber must inform the Certifying Authority immediately, without delay.
The information must be given in the manner prescribed by the regulations.
Explanation:
The law makes it clear that there should be no confusion on this point.
The subscriber remains responsible and liable for the use of the private key.
This liability continues until the subscriber informs the Certifying Authority that the private key has been compromised.
Section 43. Penalty and compensation for damage to computer, computer system.
Unauthorised acts involving computers.
When a person acts without permission from the owner or any other person who is lawfully in charge of the computer, computer system, or computer network.
The following unauthorized action will attract legal consequences:
(a).
A person enters, uses, or gains entry into a computer, computer system, computer network, or computer resource without permission.
(b).
A person takes data without permission from a computer or related system.
The person downloads, copies, or extracts data or information.
This data may be from a computer , a computer system & computer network.
It also includes data stored on removable storage devices like pen drives, hard disks, CDs, etc.
All of this is done without the permission of the owner or the person in charge.
(c).
The person introduces or causes the introduction of a computer contaminant or virus.
This may be into a computer, computer system, or computer network.
The act is done without authorisation from the owner or the person in charge.
(d).
The person damages or causes damage to a computer, a computer system, or a computer network.
The damage may also be to data, computer databases, or software and other programs stored in the system.
The act is done without authorisation.
(e).
A person interferes with or interrupts the normal functioning of a computer or digital system without permission.
The person disrupts or causes disruption.
The disruption may affect a computer, a computer system, or a computer network.
The act is done without authorisation.
(f).
The person blocks or prevents authorised users from accessing a computer or network.
The person denies access, or causes access to be denied.
The access is denied to someone who is legally authorised.
The denial may be done by any method.
It relates to a computer, computer system, or computer network.
(g).
A person helps someone else gain illegal access to a computer system.
The person gives assistance or help.
The help is given to another person.
The purpose of the help is to enable access to a computer, computer system, or computer network.
Such access is in violation of the Act or the rules and regulations made under it.
(h).
A person fraudulently shifts service charges to someone else’s account.
The person manipulates or tampers with a computer, computer system, or computer network.
By doing so, they charge the cost of services used by one person to the account of another person, without authorisation.
(i).
The person destroys, deletes, or changes information stored in a computer resource.
Even if the information is not fully destroyed, the act may Reduce its value, Reduce its usefulness, or otherwise harm it.
This harm can be caused by any method.
(j).
A person intentionally interferes with computer source code to cause harm.
The person steals, hides, destroys, or alters computer source code or causes someone else to do any of these acts.
The source code must be used for a computer resource.
The act is done with the intention to cause damage.
The person who commits such acts must compensate the victim.
The person is legally liable.
The compensation is paid to the person who has been affected or harmed by the act.
(i).
Computer contaminant means any set of computer instructions designed:
(a). To modify, destroy, record, or transmit any data or program stored in a computer, computer system, or computer network.
(b). To interfere with or take over the normal functioning of a computer, computer system, or computer network.
(ii).
Computer data-base means a structured collection of information that:
Represents information, knowledge, facts, concepts, or instructions.
May exist in text, image, audio, or video form.
Is prepared in an organised or formal manner, or is generated by a computer, computer system, or computer network.
Is intended to be used in a computer, computer system, or computer network.
(iii).
Computer virus means any computer instruction, data, information, or programme that:
Destroys, damages, degrades, or negatively affects the performance of a computer resource.
Attaches itself to another computer resource.
Operates or activates when a programme, data, or instruction is run, or when some other event occurs in that computer resource.
(iv).
Damage means any act that harms a computer resource, including:
Destroying it.
Altering it.
Deleting it.
Adding to it.
Modifying it.
Rearranging it.
by any method whatsoever.
(v).
Computer source code means the set of instructions and materials used to create and run a computer resource, including:
The program code or listings.
Computer commands.
The design and layout of the programme.
The programme analysis.
in any form.
Section 43A. Compensation for failure to protect data.
The provision applies to a body corporate. (Company, Firm, or Organisation).
This body corporate must be handling sensitive personal data or information.
The data should be stored in a computer resource that the body corporate owns, controls, or operates.
Under circumstances , the body corporate is negligent in:
Putting proper security measures in place.
Maintaining reasonable security practices and procedures.
And because of this negligence:
Someone suffers wrongful loss.
Someone else gains wrongful gain.
In such a case, the body corporate becomes legally liable.
It must pay damages as compensation to the person who is affected.
Explanation:
For the purposes of this section:
(i). Body Corporate
Body corporate means any company includes a firm, a sole proprietorship, or any other association of individuals.
These entities should be engaged in commercial or professional activities.
(ii). Reasonability Security Practices & Procedures
These are security measures meant to protect information from:
Unauthorised access.
Damage.
Misuse.
Modification.
Disclosure.
Impairment.
Such security practices may be:
Specified in an agreement between the parties.
Laid down in any law that is currently in force.
If there is no agreement and no applicable law, then:
The Central Government will prescribe what counts as reasonable security practices.
This will be done in consultation with relevant professional bodies or associations.
(iii). Sensitive Personal Data & Information.
The exact type of personal information covered will be decided by the Central Government.
Certain personal information will be identified and specified.
The Central Government will prescribe what counts as such personal information.
While doing so, the Government will consult relevant professional bodies or associations.
The Government will decide this as it considers appropriate.
Section 44. Penalty for failure to furnish information, return.
If someone has a legal obligation under this Act or its rules and regulations, the following consequences may apply if they fail to comply:
(a).
If a person is legally required to submit a document, return, or report to the Controller or the Certifying Authority, and fails to submit it, then:
That person becomes liable to a penalty.
The penalty can be up to ₹1,50,000 for each failure.
(b).
If a person is required by regulations to:
File a return.
Furnish information, books, or other documents, within a specified time & the person fails to do so within that time, then:
The person becomes liable to a penalty.
The penalty can be up to ₹5,000 for every day the failure continues.
(c).
If a person is required by the Act or regulations to maintain books of account or records, and fails to maintain them, then:
That person becomes liable to a penalty.
The penalty can be up to ₹10,000 for each day the failure continues.
Section 45. Residuary penalty.
If a person violates any rule or registration made under this Act, and no separate penalty is specifically provided for that violation, then the person becomes liable.
The liability can be:
Compensation up to ₹25,000 payable to the person affected.
A penalty up to ₹25,000.
Section 46. Power to adjudicate.
46(1).
In deciding whether a person has committed a contravention under this Act the following rules apply:
The contravention may be of: The Act or any rule, regulation, direction, or order made under it.
Such a contravention must be one that makes the person liable to pay a penalty or compensation.
The Central Government will appoint an adjudicating officer in order to adjudicate that officer.
The appointment 46(3).
The adjudicating officer must be:
Not below the rank of Director to the Government of India.
An equivalent officer of a State Government.
The adjudicating officer will conduct an inquiry in the manner prescribed by the Central Government.
46(1A).
The adjudicating officer appointed under 46(1) can decide cases where the claim for injury or damage is up to ₹5 crore.
If the claim for injury or damage exceeds ₹5 crore then the matter will be handled by the competent court, not the adjudicating officer.
46(2).
The adjudicating officer must first give the concerned person a reasonable opportunity to present their case.
An inquiry is then conducted.
If, after the inquiry, the officer is satisfied that a contravention has been committed then the officer may:
Impose a penalty.
Award compensation.
as the officer considers appropriate, but only in accordance with the provisions of the Act.
46(3).
A person cannot be appointed as an adjudicating officer arbitrarily.
The person must have relevant experience.
The required experience includes:
Experience in the field of Information Technology.
Legal or judicial experience.
The exact qualifications and experience will be prescribed by the Central Government.
46(4).
If the Central Government appoints more than one adjudicating officer it must issue an order.
That order will clearly specify:
The types of matters each adjudicating officer will handle.
The geographical areas (places) where each officer will have authority.
46(5).
Every adjudicating officer has the same powers as a civil court.
These powers are the ones granted to the Appellate Tribunal under Section 58(2).
This allows the adjudicating officer to effectively conduct inquiries and decide cases.
(a).
All proceedings before the adjudicating officer are considered judicial proceedings.
They fall within the meaning of Sections 193 and 228 of the Indian Penal Code.
This implies that:
Giving false evidence (Section 193 IPC).
Insulting or interrupting the adjudicating officer (Section 228 IPC),
can attract criminal liability.
(b).
The adjudicating officer is treated as a civil court for limited criminal procedure purposes.
The adjudicating officer is deemed to be a civil court.
This is only for the purposes of Sections 345 and 346 of the Code of Criminal Procedure, 1973.
These sections relate to action for certain offences committed in the presence of the court, such as contempt or disturbance.
(c).
The adjudicating officer is deemed to be a civil court.
This is specifically for the purposes of Order XXI of the Civil Procedure Code, 1908.
Order XXI deals with the execution of decrees and orders (For example: Recovery of money & Attachment of property.)
Section 47. Factors to be taken into account by the adjudicating officer
When deciding the amount of compensation, the adjudicating officer must consider certain specific factors.
These factors are:
(a).
The amount of unfair gain or advantage obtained because of the default, if it can be measured.
If the wrongdoer benefited financially or otherwise, that gain must be taken into account.
(b).
The amount of loss or harm suffered by any person due to the default.
The actual damage caused to others is an important factor in fixing compensation.
(c).
The repetitive nature of the default.
If the same violation has been committed repeatedly, it might attract a higher compensation.
