CYBER OFFENCES WITH

RECENT DEVELOPMENT ON
CYBER LAWS AND PRIVACY
LAW.

Submitted to – Dr Supinder Submitted by – Soumil Goyal

Roll no - 1234/19
Class - LL.M 1st sem
 Acknowledgement

I would like to express my special thanks of gratitude to my teacher

“Dr. Supinder ” who gave me the golden opportunity to do this wonderful
project on the topic ‘Cyber offences with respect to privacy laws’, which also
helped me in doing a lot of Research and I came to know about so many new
things. I am really thankful to her. I would also like to thank my parents and
friends who helped me a lot in finishing this project within the limited time.
 INDEX

1. Inroduction…………………………………………..Page 4-6

a. Need of Cyber Act………………………….Page 5

b. Need for Amendment……………………….Page 6

2. Various Offences under IT act………………………Page 7-17

3. Right to Privacy and its infringement……………….Page 17-22

4. Bibliography…………………………………………Page 23
Cyber Laws in India

Introduction:
Crime is both a social and economic phenomenon. It is as old as human society.
Many ancient books right from pre-historic days, and mythological stories have
spoken about crimes committed by individuals be it against another individual
like ordinary theft and burglary or against the nation like spying, treason etc.
Kautilya’s Arthashastra written around 350 BC, considered to be an authentic
administrative treatise in India, discusses the various crimes, security initiatives
to be taken by the rulers, possible crimes in a state etc. and also advocates
punishment for the list of some stipulated offences. Different kinds of
punishments have been prescribed for listed offences and the concept of
restoration of loss to the victims has also been discussed in it.1
Penetration of Mobile
Crime in any form adversely affects all the members of the society. In
developing economies, cyber crime has increased at rapid strides, due to the
rapid diffusion of the Internet and the digitisation of economic activities.
Thanks to the huge penetration of technology in almost all walks of society
right from corporate governance and state administration, up to the lowest level
of petty shop keepers computerizing their billing system, we find computers and
other electronic devices pervading the human life. The penetration is so deep
that man cannot spend a day without computers or a mobile.
No Legislative Defination of Cyber Crime- Snatching some one’s mobile will
tantamount to dumping one in solitary confinement. Cyber Crime is not defined
in Information Technology Act 2000 nor in the I.T. Amendment Act 2008 nor
in any other legislation in India. In fact, it cannot be too. Offence or crime has
been dealt with elaborately listing various acts and the punishments for each,
under the Indian Penal Code, 1860 and quite a few other legislations too.
Hence, to define cyber crime, we can say, it is just a combination of crime
and computer. To put it in simple terms ‘any offence or crime in which a
computer is used is a cyber crime’. Interestingly even a petty offence like
stealing or pick-pocket can be brought within the broader purview of cyber
crime if the basic data or aid to such an offence is a computer or an information
stored in a computer used (or misused) by the fraudster. The I.T. Act defines a

1
Moore, R. (2005) “Cyber crime: Investigating High-Technology Computer Crime,” Cleveland, Mississippi:
Anderson Publishing
computer, computer network, data, information and all other necessary
ingredients that form part of a cyber crime, about which we will now be
discussing in detail.2
In a cyber crime, computer or the data itself the target or the object of offence or
a tool in committing some other offence, providing the necessary inputs for that
offence. All such acts of crime will come under the broader definition of cyber
crime.

Let us now discuss in detail, the Information Technology Act -2000 and the I.T.
Amendment Act 2008 in general and with particular reference to banking and
financial sector related transactions. Before going into the section-wise or
chapter-wise description of various provisions of the Act, let us discuss the
history behind such a legislation in India, the circumstances under which the
Act was passed and the purpose or objectives in passing it.
Need of Cyber Act - The Genesis of IT legislation in India: Mid 90’s saw an
impetus in globalization and computerisation, with more and more nations
computerizing their governance, and e-commerce seeing an enormous growth.
Until then, most of international trade and transactions were done through
documents being transmitted through post and by telex only. Evidences and
records, until then, were predominantly paper evidences and paper records or
other forms of hard-copies only. With much of international trade being done
through electronic communication and with email gaining momentum, an
urgent and imminent need was felt for recognizing electronic records ie the data
what is stored in a computer or an external storage attached thereto.
The United Nations Commission on International Trade Law (UNCITRAL)
adopted the Model Law on e-commerce in 1996. The General Assembly of
United Nations passed a resolution in January 1997 inter alia, recommending all
States in the UN to give favourable considerations to the said Model Law,
which provides for recognition to electronic records and according it the same
treatment like a paper communication and record.
Objectives of I.T. legislation in India: It is against this background the
Government of India enacted its Information Technology Act 2000 with the
objectives as follows, stated in the preface to the Act itself. “to provide legal
recognition for transactions carried out by means of electronic data interchange

2
IT. Act 2008.
and other means of electronic communication, commonly referred to as
"electronic commerce",
The Information Technology Act, 2000, was thus passed as the Act No.21 of
2000,
The Act essentially deals with the following issues:
Legal Recognition of Electronic Documents
Legal Recognition of Digital Signatures
Offenses and Contraventions
Justice Dispensation Systems for cyber crimes.
Amendment Act 2008: Being the first legislation in the nation on technology,
computers and ecommerce and e-communication, the Act was the subject of
extensive debates, elaborate reviews and detailed criticisms, with one arm of the
industry criticizing some sections of the Act to be draconian and other stating it
is too diluted and lenient. There were some conspicuous omissions too resulting
in the investigators relying more and more on the time-tested (one and half
century-old) Indian Penal Code even in technology based cases with the I.T. Act
also being referred in the process and the reliance more on IPC rather on the
ITA.

Need for Amendment - Thus the need for an amendment – a detailed one –
was felt for the I.T. Act almost from the year 2003- itself. Major industry bodies
were consulted and advisory groups were formed to go into the perceived
lacunae in the I.T. Act and comparing it with similar legislations in other
nations and to suggest recommendations. Such recommendations were analysed
and subsequently taken up as a comprehensive Amendment Act and after
considerable administrative procedures, the consolidated amendment called the
Information Technology Amendment Act 2008 was placed in the Parliament
and passed without much debate, towards the end of 2008 (by which time the
Mumbai terrorist attack of 26 November 2008 had taken place).
Some of the notable features of the ITAA are as follows:
Focussing on data privacy
Focussing on Information Security
Defining cyber café
 Making digital signature technology neutral
Defining reasonable security practices to be followed by corporate
Redefining the role of intermediaries
Recognising the role of Indian Computer Emergency Response Team
Inclusion of some additional cyber crimes like child pornography and cyber
terrorism
authorizing an Inspector to investigate cyber offences (as against the DSP
earlier)
Through this project we will be broadly discussing the various provisions of
ITA 2000 and wherever the same has been amended or a new section added as
per the ITAA 2008, such remark will be made appropriately.

Various Offences Under IT ACT after Amendment

Chapter IX dealing with Penalties, Compensation and Adjudication is a major
significant step in the direction of combating data theft, claiming compensation,
introduction of security practices etc discussed in Section 43, and which deserve
detailed description.
Section 43 deals with penalties and compensation for damage to computer,
computer system etc.3
This section is the first major and significant legislative step in India to combat
the issue of data theft.
The IT industry has for long been clamouring for a legislation in India to
address the crime of data theft, just like physical theft or larceny of goods and
commodities. This Section addresses the civil offence of theft of data. If any
person without permission of the owner or any other person who is in charge of
a computer, accesses or downloads, copies or extracts any data or introduces
any computer contaminant like virus or damages or disrupts any computer or
denies access to a computer to an authorised user or tampers etc…he shall be
liable to pay damages to the person so affected. Earlier in the ITA -2000 the
maximum damages under this head was Rs.1 crore, which (the ceiling) was
since removed in the ITAA.

3
Id pg 24
Essence of Section
The essence of this Section is civil liability. Criminality in the offence of data
theft is being separately dealt with later under Sections 65 and 66. Writing a
virus program or spreading a virus mail, a bot, a Trojan or any other malware in
a computer network or causing a Denial of Service Attack in a server will all
come under this Section and attract civil liability by way of compensation.
Under this Section, words like Computer Virus, Compute Contaminant,
Computer database and Source Code are all described and defined.

Questions like the employees’ liability in an organisation which is sued against

for data theft or such offences and the amount of responsibility of the employer
or the owner and the concept of due diligence were all debated in the first few
years of ITA -2000 in court litigations like the bazee.com case and other cases.
Subsequently need was felt for defining the corporate liability for data
protection and information security at the corporate level was given a serious
look.
After Amendment the new Section 43-A dealing with compensation for failure
to protect data was introduced in theITAA -2008. This is another watershed in
the area of data protection especially at the corporate level.
As per this Section, where a body corporate is negligent in implementing
reasonable security practices and thereby causes wrongful loss or gain to any
person, such body corporate shall be liable to pay damages by way of
compensation to the person so affected. The Section further explains the phrase
‘body corporate’ and quite significantly the phrases ‘reasonable security
practices and procedures’ and ‘sensitive personal data or information’.
Thus the corporate responsibility for data protection is greatly emphasized
by inserting Section 43A whereby corporates are under an obligation to ensure
adoption of reasonable security practices. Further what is sensitive personal data
has since been clarified by the central government vide its Notification dated 11
April 2011 giving the list of all such data which includes password, details of
bank accounts or card details, medical records etc. After this notification, the IT
industry in the nation including tech savvy and widely technology-based
banking and other sectors became suddenly aware of the responsibility of data
protection and a general awareness increased on what is data privacy and what
is the role of top management and the Information Security Department in
organisations in ensuring data protection, especially while handling the
customers’ and other third party data.4

Reasonable Security Practices

Site certification
Security initiatives
Awareness Training
Conformance to Standards, certification
Policies and adherence to policies
Policies like password policy, Access
Control, email Policy etc
Periodic monitoring and review.

The Information Technology (Reasonable security practices and procedures and

sensitive personal data or information) Rules have since been notified by the
Government of India, Dept of I.T. on 11 April 2011.
Any body corporate or a person on its behalf shall be considered to have
complied with reasonable security practices and procedures, if they have
implemented such security practices and standards and have a comprehensive
documented information security programme and information security policies
containing managerial, technical, operational and physical security control
measures commensurate with the information assets being protected with the
nature of business. In the event of an information security breach, the body
corporate or a person on its behalf shall be required to demonstrate, as and when
called upon to do so by the agency mandated under the law, that they have
implemented security control measures as per their documented information
security programme and information security policies.
In view of the foregoing, it has now become a major compliance issue on the
part of not only IT companies but also those in the Banking and Financial
Sector especially those banks with huge computerised operations dealing with
public data and depending heavily on technology. In times of a litigation or any
security breach resulting in a claim of compensation of financial loss amount or

4
Id
damages, it would be the huge responsibility on the part of those body corporate
to prove that that said “Reasonable Security Practices and Procedures” were
actually in place and all the steps mentioned in the Rules passed in April 2011
stated above, have been taken.
The issue has wider ramifications especially in the case of a cloud computing
scenario (the practice of using a network of remote servers hosted on the
Internet to store, manage, and process data, rather than a local server, with the
services managed by the provider sold on demand, for the amount of time used)
where more and more organisations handle the data of others and the
information is stored elsewhere and not in the owners’ system. Possibly, more
debates will emanate on the question of information owners vis a vis the
information container and the information custodians and the Service Level
Agreements of all parties involved will assume a greater significance.
The criminal provisions of the IT Act and those dealing with cognizable
offences and criminal acts follow from Chapter IX titled “Offences”
Section 65: Tampering with source documents is dealt with under this section.
Concealing, destroying, altering any computer source code when the same is
required to be kept or maintained by law is an offence punishable with three
years imprisonment or two lakh rupees or with both. Fabrication of an
electronic record or committing forgery by way of interpolations in CD
produced as evidence in a court (Bhim Sen Garg vs State of Rajasthan and
others, 2006, Cri LJ, 3463, Raj 2411) attract punishment under this Section.
Computer source code under this Section refers to the listing of programmes,
computer commands, design and layout etc in any form.5
Section 66: Computer related offences are dealt with under this Section. Data
theft stated in Section is referred to in this Section. Whereas it was a plain and
simple civil offence with the remedy of compensation and damages only, in that
Section, here it is the same act but with a criminal intention thus making it a
criminal offence. The act of data theft or the offence stated in Section 43 if done
dishonestly or fraudulently becomes a punishable offence under this Section and
attracts imprisonment upto three years or a fine of five lakh rupees or both.
Earlier hacking was defined in Sec 66 and it was an offence.6
Now after the amendment, data theft of Sec 43 is being referred to in Sec 66 by
making this section more purposeful and the word ‘hacking’ is not used. The
word ‘hacking’ was earlier called a crime in this Section and at the same time,

5
Id , pg 45
6
Id
courses on ‘ethical hacking’ were also taught academically. This led to an
anomalous situation of people asking how an illegal activity be taught
academically with a word ‘ethical’ prefixed to it. Then can there be training
programmes, for instance, on “Ethical burglary”,
“Ethical Assault” etc say for courses on physical defence? This tricky situation
was put an end to, by the ITAA when it re-phrased the Section 66 by mapping it
with the civil liability of Section 43 and removing the word ‘Hacking’.
However the act of hacking is still certainly an offence as per this Section,
though some experts interpret ‘hacking’ as generally for good purposes
(obviously to facilitate naming of the courses as ethical hacking) and ‘cracking’
for illegal purposes. It would be relevant to note that the technology involved in
both is the same and the act is the same, whereas in ‘hacking’ the owner’s
consent is obtained or assumed and the latter act ‘cracking’ is perceived to be an
offence.
Thanks to ITAA, Section 66 is now a widened one with a list of offences as
follows:
66A Sending offensive messages through communication service, causing
annoyance etc through an electronic communication or sending an email to
mislead or deceive the recipient about the origin of such messages (commonly
known as IP or email spoofing) are all covered here. Punishment for these acts
is imprisonment upto three years or fine.7
66B Dishonestly receiving stolen computer resource or communication device
with punishment upto three years or one lakh rupees as fine or both.8
66C Electronic signature or other identity theft like using others’ password or
electronic signature etc.9
Punishment is three years imprisonment or fine of one lakh rupees or both.

66D Cheating by personation using computer resource or a communication

device shall be punished with imprisonment of either description for a term
which extend to three years and shall also be liable to fine which may extend to
one lakh rupee.

7
id
8
Id
9
id
66E Privacy violation – Publishing or transmitting private area of any person
without his or her consent etc. Punishment is three years imprisonment or two
lakh rupees fine or both.
66F Cyber terrorism – Intent to threaten the unity, integrity, security or
sovereignty of the nation and denying access to any person authorized to access
the computer resource or attempting to penetrate or access a computer resource
without authorization. Acts of causing a computer contaminant (like virus or
Trojan Horse or other spyware or malware) likely to cause death or injuries to
persons or damage to or destruction of property etc. come under this Section.
Punishment is life imprisonment.
It may be observed that all acts under S.66 are cognizable and non-bailable
offences. Intention or the knowledge to cause wrongful loss to others ie the
existence of criminal intention and the evil mind ie concept of mens rea,
destruction, deletion, alteration or diminishing in value or utility of data are all
the major ingredients to bring any act under this Section.
To summarise, what was civil liability with entitlement for compensations and
damages in Section 43, has been referred to here, if committed with criminal
intent, making it a criminal liability attracting imprisonment and fine or both.
Section 67 deals with publishing or transmitting obscene material in electronic
form. The earlier Section in ITA was later widened as per ITAA 2008 in which
child pornography and retention of records by intermediaries were all
included.10
Publishing or transmitting obscene material in electronic form is dealt with here.
Whoever publishes or transmits any material which is lascivious or appeals to
the prurient interest or if its effect is such as to tend to deprave and corrupt
persons who are likely to read the matter contained in it, shall be punished with
first conviction for a term upto three years and fine of five lakh rupees and in
second conviction for a term of five years and fine of ten lakh rupees or both.
This Section is of historical importance since the landmark judgement in what is
considered to be the first ever conviction under I.T. Act 2000 in India, was
obtained in this Section in the famous case “State of Tamil Nadu vs Suhas
Katti” on 5 November 2004. The strength of the Section and the reliability of
electronic evidences were proved by the prosecution and conviction was
brought about in this case, involving sending obscene message in the name of a

10
Id , pg 25
married women amounting to cyber stalking, email spoofing and the criminal
activity stated in this Section.
Section 67-A deals with publishing or transmitting of material containing
sexually explicit act in electronic form. Contents of Section 67 when combined
with the material containing sexually explicit material attract penalty under this
Section.
Child Pornography has been exclusively dealt with under Section 67B.
Depicting children engaged in sexually explicit act, creating text or digital
images or advertising or promoting such material depicting children in obscene
or indecent manner etc or facilitating abusing children online or inducing
children to online relationship with one or more children etc come under this
Section. ‘Children’ means persons who have not completed 18 years of age, for
the purpose of this Section. Punishment for the first conviction is imprisonment
for a maximum of five years and fine of ten lakh rupees and in the event of
subsequent conviction with imprisonment of seven years and fine of ten lakh
rupees. Bonafide heritage material being printed or distributed for the purpose
of education or literature etc are specifically excluded from the coverage of this
Section, to ensure that printing and distribution of ancient epics or heritage
material or pure academic books on education and medicine are not unduly
affected.
Screening videographs and photographs of illegal activities through Internet all
come under this category, making pornographic video or MMS clippings or
distributing such clippings through mobile or other forms of communication
through the Internet fall under this category.
Section 67C fixes the responsibility to intermediaries that they shall preserve
and retain such information as may be specified for such duration and in such
manner as the Central Government may prescribe. Non-compliance is an
offence with imprisonment upto three years or fine.
Transmission of electronic message and communication:
Section 69: This is an interesting section in the sense that it empowers the
Government or agencies as stipulated in the Section, to intercept, monitor or
decrypt any information generated, transmitted, received or stored in any
computer resource, subject to compliance of procedure as laid down here.
This power can be exercised if the Central Government or the State
Government, as the case may be, is satisfied that it is necessary or expedient in
the interest of sovereignty or integrity of India, defence of India, security of the
State, friendly relations with foreign States or public order or for preventing
incitement to the commission of any cognizable offence relating to above or for
investigation of any offence. In any such case too, the necessary procedure as
may be prescribed, is to be followed and the reasons for taking such action are
to be recorded in writing, by order, directing any agency of the appropriate
Government. The subscriber or intermediary shall extend all facilities and
technical assistance when called upon to do so.
Section 69A inserted in the ITAA, vests with the Central Government or any of
its officers with the powers to issue directions for blocking for public access of
any information through any computer resource, under the same circumstances
as mentioned above.
Section 69B discusses the power to authorise to monitor and collect traffic data
or information through any computer resource. Commentary on the powers to
intercept, monitor and block websites: In short, under the conditions laid down
in the Section, power to intercept, monitor or decrypt does exist. It would be
interesting to trace the history of telephone tapping in India and the legislative
provisions (or the lack of it?) in our nation and compare it with the powers
mentioned here. Until the passage of this Section in the ITAA, phone tapping
was governed by Clause 5(2) of the Indian Telegraph Act of 1885, which said
that “On the occurrence of any public emergency, or in the interest of the public
safety, the Government may, if satisfied that it is necessary or expedient so to
do in the interests of the sovereignty and integrity of India, the security of the
State, friendly relations with foreign States or public order or for preventing
incitement to the commission of an offence, for reasons to be recorded in
writing, by order, direct that any message or class of messages to or from any
person or class of persons, or relating to any particular subject, brought for
transmission by or transmitted or received by any telegraph, shall not be
transmitted, or shall be intercepted or detained, or shall be disclosed to the
Government making the order or an officer thereof mentioned in the order”.
Other sections of the act mention that the government should formulate
“precautions to be taken for preventing the improper interception or disclosure
of messages”. There have been many attempts, rather many requests, to
formulate rules to govern the operation of Clause 5(2). But ever since 1885, no
government has formulated any such precautions, maybe for obvious reasons to
retain the spying powers for almost a century.
A writ petition was filed in the Supreme Court in 1991 by the People’s Union
for Civil Liberties, challenging the constitutional validity of this Clause 5(2).
The petition argued that it infringed the constitutional right to freedom of
speech and expression and to life and personal liberty. In December 1996, the
Supreme Court delivered its judgment, pointing out that “unless a public
emergency has occurred or the interest of public safety demands, the authorities
have no jurisdiction to exercise the powers” given them under 5(2). They went
on to define them thus: a public emergency was the “prevailing of a sudden
condition or state of affairs affecting the people at large calling for immediate
action”, and public safety “means the state or condition of freedom from danger
or risk for the people at large”. Without those two, however “necessary or
expedient”, it could not do so. Procedures for keeping such records and the
layer of authorities etc were also stipulated.
Now, this Section 69 of ITAA is far more intrusive and more powerful than the
above-cited provision of Indian Telegraph Act 1885. Under this ITAA Section,
the nominated Government official will be able to listen in to all phone calls,
read the SMSs and emails, and monitor the websites that one visited, subject to
adherence to the prescribed procedures and without a warrant from a
magistrate’s order. In view of the foregoing, this Section was criticizsed to be
draconian vesting the government with much more powers than required.
Having said this, we should not be oblivious to the fact that this power (of
intercepting, monitoring and blocking) is something which the Government
represented by the Indian Computer Emergency Response Team, (the National
Nodal Agency, as nominated in Section 70B of ITAA) has very rarely
exercised. Perhaps believing in the freedom of expression and having
confidence in the self-regulative nature of the industry, the CERT-In has stated
that these powers are very sparingly (and almost never) used by it.
Critical Information Infrastructure and Protected System have been discussed in
Section 70. The Indian Computer Emergency Response Team (CERT-In)
coming under the Ministry of Information and Technology, Government of
India, has been designated as the National Nodal Agency for incident response.
By virtue of this, CERT-In will perform activities like collection, analysis and
dissemination of information on cyber incidents, forecasts and alerts of cyber
security incidents, emergency measures for handling cyber security incidents
etc.
The role of CERT-In in e-publishing security vulnerabilities and security alerts
is remarkable.
Penalty for breach of confidentiality and privacy is discussed in Section 72
with the punishment being imprisonment for a term upto two years or a fine of
one lakh rupees or both.
Considering the global nature of cyber crime and understanding the real time
scenario of fraudster living in one part of the world and committing a data theft
or DoS(Denial of Service) kind of an attack or other cyber crime in an entirely
different part of the world, Section 75 clearly states that the Act applies to
offences or contravention committed outside India, if the contravention or the
offence involves a computer or a computer network located in India.
This Act has over-riding provisions especially with regard to the regulations
stipulated in the Code of Criminal Procedure. As per Section 78,
notwithstanding anything contained in the Code of Criminal Procedure, a police
officer not below the rank of an Inspector shall investigate an offence under this
Act. Such powers were conferred to officers not below the rank of a Deputy
Superintendent of Police earlier in the ITA which was later amended as
Inspector in the ITAA.
Due Diligence: Liability of intermediaries and the concept of Due Diligence has
been discussed in Section 79. As per this, intermediary shall not be liable for
any third party information hosted by him, if his function is limited to providing
access to a communication system over which information made available by
third parties is transmitted or temporarily stored or hosted or if he does not
initiate the transmission, select the receiver of the transmission and select or
modify the information contained in the transmission and if he observes due
diligence and follows the guidelines prescribed by the Central Government.
This concept of due diligence is also much being debated. Due Diligence was
first discussed as an immediate fallout of the famous bazee.com case in New
Delhi, when the NRI CEO of the company was arrested for making the MMS
clipping with objectionable obscene material depicting school children was
made available in the public domain website owned by him, for sale (and later
the CD was sold).
The larger issue being discussed at that time was how far is the content provider
responsible and how far the Internet Service Provider and what is due diligence
which as the CEO of the company, he should have exercised.
After passage of the ITAA and the introduction of ‘reasonable security practices
and procedures’ and the responsibility of body corporate as seen earlier in
Section 43A, and to set at rest some confusion on the significance of due
diligence and what constitutes due diligence, the DIT came out with a set of
rules titled Information Technology (Intermediaries Guidelines) Rules on 11
April 2011. As per this, “the intermediary, on whose computer system the
information is stored or hosted or published, upon obtaining knowledge by itself
or been brought to actual knowledge by an affected person in writing or through
email signed with electronic signature about any such information as mentioned
in sub-rule above, shall act within thirty six hours and where applicable, work
with user or owner of such information to disable such information that is in
contravention of sub-rule . Further the intermediary shall preserve such
information and associated records for at least ninety days for investigation
purposes…..”
In essence, an intermediary shall be liable for any contravention of law
committed by any user unless the Intermediary can prove that he has exercised
due diligence and has not conspired or abetted in the act of criminality.
Power to enter, search etc has been described in Section 80. Notwithstanding
anything contained in the Code of Criminal Procedure, any police officer, not
below the rank of an Inspector or any other office authorised may enter any
public place and search and arrest without warrant any person found therein
who is reasonably suspected of having committed or of committing or of being
about to commit any offence under this Act. This is another effective weapon
that has been rarely and almost never utilised by the police officers.
The Act is applicable to electronic cheques and truncated cheques (ie the image
of cheque being presented and processed curtailing and truncating the physical
movement of the cheque from the collecting banker to the paying banker).
Overriding powers of the Act and the powers of Central Government to make
rules and that of State Governments to make rules wherever necessary have
been discussed in the Sections that follow.

Right to Privacy and Its Infringement in Cyberspace.

The ‘netizens’ in present scenario, are dangerously exposed to the risk of
privacy
infringement in cyberspace. With the growing use of internet by the citizens of
the country, the risk of their being exploited and victimized by infringing their
privacy over internet is increasing day by day. This concern is felt more in the
case of youth and teenagers who constitute majority of the internet users and are
susceptible in understanding the risk of exposing themselves to the cyber world.
The social networking sites which are now used extensively for social
interactions between the individuals by uploading their personal content, has
further aggravated the issue of ‘internet privacy’ at the grass-root levels. The
population using it still is not accustomed to the threats it can pose to their
privacy. The security measures therefore, are often neglected, which make them
more prone to attacks on their privacy. The majority of internet users in India
are young teenagers who do not understand the risks in exposing themselves to
the completely unknown cyber-world. They often fail to analyze the potential
threat that they are under while using the internet for social networking or
otherwise. The Privacy concerns in India are thus unaddressed by the internet
users and lack of security and legislative measures in this direction are adding to
the gravity of this already serious issue.11
What amounts to privacy infringement in cyberspace?
It is necessary to understand how privacy of a person can be violated in
cyberspace. There are innumerable ways in which privacy over internet can be
violated and it is difficult to list and explain all of them. It is imperative
therefore, to explain privacy infringement in general terms whereby any act
befitting this general explanation results into violation of piracy. The
cyberspace by its very nature is not user friendly in terms of privacy. The
content in the form of any information uploaded and shared on the internet is
permanently saved in the form of link and is available for reference by anyone
who is able to trace it. The information of any kind may it be an email, the
credit card details, the personal content like images and documents, the chats
and messages in all formats etc. are all stored somewhere on the remote
computer through which it may be accessed at anytime and by anyone unless
few safety measures are strictly followed. Thus, it is in fact a paradox to speak
of absolute privacy protection over internet, as it is not possible. The stealing of
any such information that one has shared on the internet leads to privacy
infringement obligation not to ply with the privacy of the internet users and
shall adopt all the necessary measures to ensure maximum protection to them. 12
Internet Privacy: Legislative Measures
The right to privacy being the most important right for the individual to
maintain his dignity and respect, it is necessary to evolve a suitable mechanism

11
Art.12 of the Universal Declaration of Human Rights and Art.14 and 17 of the International Covenant on Civil
and Political Rights.
12
Right to privacy is not enumerated as a fundamental right in our Constitution but has been culled out of the
provisions of Article 21 of the Constitution and other provisions of the Constitution relating to Fundamental
rights read with the Directive Princ
iples of State Policy. Referred in Justice Palok Basu’s ‘Law relating to Protection of Human Rights’ p.n.505.
See T. Sarreetha v. Venkata Subbaiah AIR 1983 AP 356, Kharak Singh v. State of Uttar Pradesh AIR 1963 SC
1295, X v Z AIR 1999 SC495, Phoolan Devi v. Shkhar Kapoor AIR 2002 Del 58, R. R. Gopal v. State of Tamil Nadu
AIR 1995 Sc 264. etc.
12
to improve the deplorable internet privacy scenario in the present context. The
entire international community has long being expressing its concern over the
issue and on several occasions the internet giants like Google Inc. has been
asked to address the issue of internet privacy. These internet giants have
requested the United Nations Organization to intervene and come with the
common regulation to be observed by the internet service providers and other
important players in the web world. No effort till now has resulted into adoption
of any common guidelines in this regard, however the European Union on
regional level has come up with some regulation in the year 2012. India today
has nearly 900 million mobile subscribers, 160 million Internet users and close
to 85 million citizens on social media. Internet and social media users are
expected to double by 2015.

The right to privacy enjoys a status of fundamental right in India and it is a

responsibility of the State to protect this right by adopting suitable legislative
and policy measures. So far, there is no comprehensive law for protection of
privacy or for providing legal remedies for its violation. The principal law
governing internet use in India is the Information Technology Act, 2000, that
contains some provisions, which are relevant to protection of privacy in India.
Various provisions of the Information Technology Act and the Rules there
under provide for protection to the information shared on the internet by the
user. The protection can be summarized as follows-13

13
Section 43A of the Act and Rule 4 of the Information Technology (Reasonable security practices and
procedures and sensitive personal data or information) Rules, 2011

Section 43A of the Act and Rule 5(1) of the Information Technology (Reasonable security practices and
procedures and sensitive personal data or information) Rules, 2011

Section 43 of the Act and Rules 5(5)

Section 43A of the Act and Rule 5(6) of the Information Technology (Reasonable security practices and
procedures and sensitive personal data or information) Rules, 2011

Under Section 43A, any body corporate who fails to observe data protection norms may be liable to pay
compensation if : it is negligent in implementing and maintaining reasonable security practices, and thereby
causes wrongful loss or wrongful gain to any person. "Wrongful loss" and "wrongful gain" have been defined
by Section 23 of the Indian Penal Code.

Section 43A of the Act and Rule 5(9) of the Information Technology (Reasonable security practices and
procedures and sensitive personal data or information) Rules, 2011

Sec.66 and all its subsections of IT Act. 2000

 1. These provisions require the corporate bodies to implement and maintain
reasonable security practices concerning the information that they
receive, store, deals, transfers etc.
2. It is mandatory for the corporate bodies to declare their privacy policy to
the user and obtain their consent to the same.

3. It is necessary to obtain consent of the users before collecting any

sensitive information and to state the lawful purposes for which the same
shall be used by the corporate body.
4. The rules prohibit the retention of the information collected beyond
reasonable time for the purpose for which it is collected.
5. The rules require the corporate bodies to allow the user to access the
information that has been shared and to correct it if the user intends.
6. It is also provided that any failure on the part of corporate body in this
regard shall attract a penalty in the form of compensation to the person affected
by any such failure and may also result in incurring a criminal liability if the
consequence of any such failure is wrongful loss or gain.
7. The law also provides for the grievance mechanism, which can be used by
the affected person to claim the remedy for privacy violation.
8. The Act provides for the stringent punishments to the offences like hacking,
sending offensive messages, voyeurism, child pornography etc. The protection
is also provided to the copyrighted data by disallowing any use of this data
without proper authorization.
9. The cybercafés are regulated by providing for different security measures to
be adopted by them and also for their timely inspection in this regard by the
authorities created there forth.
10. The Interception of the electronically transmitted information is possible
only by the order and under the control of Ministry of Home Affairs strictly in
accordance with the rules laid down there under.

The Telegraph Act 1885 amended in the year 2006 and the rules there under
govern the communications made by way of telegraphy, phone, fax etc. and
prohibit any kind of unauthorized interception of the information communicated
through any of these means.
Italso provides for the criminal liability of the any employee of the service provi
ders responsible forviolation of any provision of this Act. The Internet Service
Providers are entitled to licenses in India provided they follow condition of
adopting all necessary measures for privacy protection and information security.
The telecom Regulatory Authority of India, which is responsible for
maintaining and regulating the standards of telecom services in India, has also
framed guidelines for the unsolicited telemarketing calls etc., which also make
serious inroads into the privacy of an individual in India.14

The Indian Courts have also evolved considerable jurisprudence on the issue of
internet privacy by upholding the sanctity of this right and by enforcing it
through suitable orders and attimes even by framing guidelines in this regard.

Government of India has recently decided to introduce an exhaustive law on

privacy, which will soon be introduced before the parliament. This law provides
for stringent punishment, including revocation of licences of telecom service
providers, for illegally intercepting telephone calls and making their content
public. This would be punishable with five years of imprisonment and a fine of
Rs 1 Lakh. The Bill defines “right to privacy as confidentiality of
communication, family life, bank and health records, protection of honour and
good name and protection from use of photographs, fingerprints, DNA samples
and other samples taken at police stations and other places”. The said bill would
also be a blow to the illegal snooping done upon the citizens of India mostly by
various private agency.
Another significant step taken by the government of India for ensuring cyber
security and controlling cyber attacks in India is the launch of National Cyber
Security Policy, 2013. The policy was the outcome of the serious concerns
expressed over the internet security in India and the reports of increasing
snooping by US. Nevertheless, unfortunately the reactions of cyber experts over
the policy in terms of privacy protection are not encouraging. The need of
incorporating stringent provision in this policy to deal with privacy
infringement effectively is expressed by the individuals concerned. The
importance of right to privacy for the maintenance of dignity of an individual is

14
, Monitoring, and Decryption of Information) Rules 2009
15
Telecom Commercial Communications Customer Preference Regulations 2010.
16
See Radiological and Imaging Association v. Union of India 2011(113)BomLR3107, Nirav Navin Bhai Shah and
Ors. v. State of Gujarat and Another, Criminal Misc. Application No. 10291 of 2006, Shankara Shekhar Mishra v.
Ajay Gupta, 2011VIIIAD(Delhi) 139, State of Maharashtra v. Bharat Shanti Lal Shah and Ors. (2008) 13 SCC 5,
Amar Singh v. Union of India (2011) 7 SCC 69, Rayala M. Bhuvaneswari v. Nagaphanender Rayala, AIR 2008
beyond explanation. It is paramount in the light of increasing attacks on the
privacy over internet to address this issue immediately and adopt stringent
measures against these attacks. The solution to this problem lies into the global
initiatives and any measure adopted nationally is not likely to produce drastic
results. But, still it is necessary to evolve some mechanism by which effective
remedy be provided to those who are victimized of privacy violation. The
legislative measures are adopted in India in this regard though seem to be
enough on paper but when it comes to implementation, lack of awareness
amongst the users, the internet habits of the users in India and lack of expertise
amongst the enforcement agencies are presenting serious challenges ahead.
 Bibliography

STATUTORY COMPILATIONS
1. THE INFORMATION TECHNOLOGY ACT, 2000.

DICTIONARIES
1. BRYAN A. GARNER, BLACK’S LAW DICTIONARY (8th ed. 2001).
2. OXFORD ENGLISH DICTIONARY, (2nd ed. 2009).
3. WEBSTER’S NEW INTERNATIONAL DICTIONARY (1926).

WEBSITES
1. http://lawisgreek.com/cyber-laws-what-is-cyber-contravention-and-cyber-offences/
2. http://sapost.blogspot.in/2011/11/beware-of-section-43-of-information.html
3. https://en.wikipedia.org/wiki/MafiaBoy
4. http://www.wipo.int/edocs/lexdocs/laws/en/in/in098en.pdf
5. http://cis-india.org/internet-governance/blog/analysis-of-cases-filed-under-sec-48-it-act-
for-adjudication maharashtra.
6. http://www.wipo.int/edocs/lexdocs/laws/en/in/in098en.pdf
7. http://www.wipo.int/edocs/lexdocs/laws/en/in/in098en.pdf
8. http://www.wipo.int/edocs/lexdocs/laws/en/in/in098en.pdf
9. http://www.wipo.int/edocs/lexdocs/laws/en/in/in098en.pdf

BOOKS
1. Kunwar, Vijay, A Handbook on Cyber Laws & Investigations, Chandigarh: Shreeram Law
House, 1st ed. (2012).
2. Sharma, Vakul, “Information Technology Law and Practice”, 3rd ed., New Delhi:
Universal Law Publishing Co., 2014.
3. Jyoti, Rattan, “Cyber Laws and Information Technology”, 5th ed., Delhi: Bharat Law
House Pvt. Ltd., 2015.