Electronic Commerce and Digital Signatures (IT Act, 2000) notes — Unit 2

Before 2000, if you formed a contract over email, its legal validity was highly questionable in Indian courts. The Indian Evidence Act demanded "paper" documents and "ink" signatures.

⇒The Primary Objective

The Information Technology Act, 2000 (based on the UNCITRAL Model Law) was passed primarily to provide legal recognition to electronic commerce. It aims to facilitate e-governance and ensure that electronic records and digital signatures are treated on par with traditional paper records and handwritten signatures.

This is the foundational section that transforms Indian commerce.

⇒Section 4 (Legal Recognition of Electronic Records)

Where any law provides that information or any other matter shall be in writing or in the typewritten or printed form, then, notwithstanding anything contained in such law, such requirement shall be deemed to have been satisfied if such information or matter is:

• (a) Rendered or made available in an electronic form; and
• (b) Accessible so as to be usable for a subsequent reference.

(In simple words: An email or a PDF is legally equivalent to a typed piece of paper).

Can a valid contract be formed by clicking "I Agree"?

⇒Validity of E-Contracts

Section 10A states that a contract shall not be deemed unenforceable solely on the ground that electronic form or means was used for the communication of proposals, acceptance of proposals, or revocation thereof.

⇒Types of E-Contracts

• Shrink-wrap Agreements: Terms read after opening software packaging.
• Click-wrap Agreements: User must explicitly click "I Accept" before using the service (Highly enforceable).
• Browse-wrap Agreements: Terms are placed at the bottom of the website; just browsing implies acceptance (Legally weaker, courts often reject them if not prominently displayed).

The IT Act does NOT apply to everything. Certain highly sensitive or traditional documents still require actual paper and ink signatures to prevent severe fraud.

⇒Documents excluded from IT Act:

• A Negotiable Instrument (like a Promissory Note or Cheque) under the NI Act.
• A Power of Attorney under the Powers of Attorney Act, 1882.
• A Trust deed.
• A Will under the Indian Succession Act.
• Any contract for the sale or conveyance of Immovable Property.

(You cannot execute a Will or sell your house via an email or a digital signature).

The IT (Amendment) Act, 2008 introduced a crucial distinction.

⇒Electronic Signature (Broader Concept)

This is a genus. It includes any legally recognized electronic method of authenticating a document. (e.g., A biometric Aadhaar e-sign, or entering an OTP on a banking portal).

⇒Digital Signature (Specific Technology)

This is a species. It is a highly secure, mathematically complex type of electronic signature based exclusively on Asymmetric Crypto System and Hash Functions (Public Key Infrastructure - PKI).

Section 3 of the IT Act legally validates the PKI system.

⇒Asymmetric Crypto System

It uses a "key pair" consisting of two mathematically linked, unique keys:

• Private Key: Kept strictly secret by the sender (usually on a secure USB dongle). Used to create the digital signature.
• Public Key: Available to everyone. Used by the receiver to verify the digital signature.

⇒Hash Function

Before signing, the document is run through an algorithm to create a unique "Hash" (a fixed-length string of characters, like a digital fingerprint). The Private Key encrypts this Hash. If even one comma in the document is altered later, the Hash changes, and the verification using the Public Key will fail. This guarantees Data Integrity.

Section 5 is the twin of Section 4.

⇒The Rule

Where any law requires that a document be signed by a person (ink signature), that requirement is legally satisfied if the document is authenticated by means of an electronic signature affixed in such manner as may be prescribed by the Central Government.

How do you know that a Public Key actually belongs to Mukesh Ambani and not an imposter? You need a trusted third party to vouch for their identity.

⇒The Certifying Authority (CA)

A CA (like TCS, E-Mudhra, NCode) is an agency licensed by the government to issue Electronic Signature Certificates. When you apply for a digital signature, you show your PAN/Aadhaar to the CA. The CA verifies your identity and issues a certificate binding your identity to your Public Key.

Who controls the Certifying Authorities?

⇒The CCA (Section 17)

The Central Government appoints a Controller of Certifying Authorities (CCA). This is the apex authority of the PKI ecosystem in India.

⇒Functions of CCA (Sec 18)

• Exercising supervision over the activities of the Certifying Authorities.
• Laying down the standards to be maintained by CAs.
• Granting, renewing, or revoking the licenses of CAs.
• Resolving any conflict of interests between CAs and subscribers.

The person to whom the digital signature certificate is issued is called the "Subscriber."

⇒Strict Liabilities

Possessing a digital signature comes with high legal responsibility. If someone steals your physical pen, they cannot forge your signature easily. If they steal your Private Key (USB dongle + PIN), they become you digitally.

• Generating the Key Pair (Sec 40): The subscriber must securely generate the key pair.
• Acceptance (Sec 41): By accepting the certificate, the subscriber certifies that all information they gave to the CA is true.
• Control of Private Key (Sec 42): The subscriber shall exercise reasonable care to retain control of the private key and prevent its disclosure. If the key is compromised, they must immediately inform the CA to revoke the certificate.

In contract law, the exact timing of sending and receiving an offer/acceptance is crucial. When is an email legally considered "sent"?

⇒Time of Dispatch

Occurs when the electronic record enters a computer resource outside the control of the originator. (i.e., The moment you hit 'Send' and the email leaves your outbox and enters the Gmail server).

⇒Time of Receipt

Occurs when the electronic record enters the designated computer resource of the addressee. (i.e., It lands in their inbox, even if they haven't opened or read it yet).

How do you prove that an electronic record was actually sent by a specific person?

⇒The Rule

An electronic record shall be attributed to the originator (sender) if it was sent:

• By the originator himself.
• By a person who had the authority to act on behalf of the originator.
• By an information system programmed by or on behalf of the originator to operate automatically (e.g., an automated server sending out invoices).

• Core Objective: IT Act aims to validate e-commerce and e-records (Sec 4) and e-signatures (Sec 5).
• E-Contracts (Sec 10A): Clickwrap, Shrinkwrap, Browsewrap are legally recognized.
• Exceptions: Wills, Property Sale, Power of Attorney cannot be executed digitally.
• Digital Signatures (PKI): Uses Asymmetric Cryptography (Public/Private Key) and Hash functions to ensure Identity, Data Integrity, and Non-repudiation.
• Authorities: Controller of Certifying Authorities (CCA) licenses and monitors the Certifying Authorities (CAs) who issue certificates to Subscribers.
• Subscriber Duty: Must protect the Private Key (Sec 42).

⇒Premium Advice for Top Marks

• PKI Mechanism: If asked about Digital Signatures, you MUST explain the underlying technology. Mention "Asymmetric Cryptography" (Public Key/Private Key) and "Hash Functions". Explaining that the Private key encrypts the hash to ensure data integrity will fetch premium marks.
• Exceptions (Schedule I): Always remember what the IT Act DOES NOT apply to. A favorite tricky question is: "A executes a Will by sending a digitally signed PDF to his lawyer. Is it valid?" Answer: No, Schedule I specifically excludes Wills.
• Dispatch and Receipt (Sec 13): Compare this with the traditional 'Postal Rule' in the Contract Act. In cyber law, receipt happens the millisecond the email hits the designated server, irrespective of when the person actually reads it.