DEVELOPMENT OF CYBER LAW IN INDIA PRE AND POST IT ACT 2000

INTRODUCTION

With the dawn of cyberspace came paradigm shifts in the established laws. Laws are territorial in nature and are implemented within the confines of a specific country or state by the sovereign powers. In simple terms, jurisdiction is the authority of a state to make laws and enforce them on people and property under its control. The internet, however, transcends all geographical boundaries, making it difficult to regulate. Cyberspace is non-territorial and is a completely decentralized medium. Electronic data can travel with ease from one part of the world to another without any hindrance, making it difficult for states to establish control over online happenings.
Any given online act or event can have multiple effects in various jurisdictions. A single transaction can be initiated from one jurisdiction, passed through several others as it transverses the web, and finally stored on an online server in yet another. The offended party might be located in yet another state. This can lead to intricate issues of law conflicts.

Traditionally, in cases having conflicting laws, connection tests are made to determine the relevant jurisdiction. But, with regard to the internet, where acts and events are increasingly being attributed to extraterritorial jurisdictions, there are bound to be sovereignty clashes.
Furthermore, the internet allows for a level of anonymity in the online world that is unmatched in the physical world. The protocols employed on the internet are aimed at facilitating the fast and reliable exchange of information. The implementation of tools such as rotating IP addresses and virtual private networks and encryption technologies make it impossible to trace down a user who commits a cybercrime.

Traditional law enforcement measures that rely on service of process, preservation of evidence and search and seizure are not effective electronic crime investigations tools.
It was in this context that the need for cyber law was debated for the first time:

Cyber-Separatism (Cyber-Libertarianism): Proponents of this view held that cyberspace is a new sovereign jurisdiction that requires laws of its own^[1].It was argued that national governments were not fit to regulate the internet^[2].

The “Law of the Horse” Theory: This argument arose when U.S. Federal Judge Frank H. Easterbrook was asked to rule on a case that involved a law of cyberspace. Easterbrook rejected the notion that a special law for the internet was required^[3]. He likened it to a law of the horse and argued that the conflict of laws cases did not require a separate law for cyberspace but rather an application of the existing legal principles for contracts, torts, and property law.
Lex Informatica and Architectural Regulation: Later, scholars of the conflict of laws drew a distinction between Easterbrook’s approach and that of the cyber separate theorists and proposed their own approach. Joel Reidenberg put forth the idea of Lex Informatica, which holds that technology, rules, and procedures have the power to regulate behaviour^[4].

Lessig later laid out the various ways in which regulation takes place online, stating that law and code have a relationship^[5]. He showed how behaviour can be regulated by architecture by describing how a system’s design can limit or permit action and thus alter people’s behaviour.

Architectural regulation works by designing a system in such a manner that it denies or grants access to an entity based on the given requirements.

Prior to 2000, India did not have specific laws that applied directly to the issues that had arisen on the internet. This meant that Indian courts were forced to interpret existing laws to cover cybercrimes, a task that had to be done on a case-by-case basis. For instance, in the Yahoo! Inc. v. Akash Arora case^[6], the Indian courts adapted the passing off law in order to address domain name disputes. However, such special measures were not a sustainable solution to cybercrime adjudication problems, and the need for a specialized cyber law soon became evident.

Enactment of Information Technology Act, 2000

The Information Technology Act, 2000 was a landmark piece of legislation in many ways as it was the first codified law to govern electronic commerce, transactions and related computer crimes. Before its enactment, Indian laws made no provision for electronic records, digital documentation or computer-specific crimes. The Act’s aim was to provide a legal and regulatory framework for electronic commerce – making the documentation process faster and easier and helping in the faster disposal of electronic communications with public agencies by introducing the concept of e-governance. To incorporate the provisions for electronic data into the existing legal framework, the Indian Penal Code, 1860; the Indian Evidence Act, 1872; the Bankers’ Books Evidence Act, 1891 and the Reserve Bank of India Act, 1934 were amended^[7].

Formally, a transaction used to require paper and manual signature to be valid as evidence. With the IT Act came the validation of transaction done electronically. In addition, the Act provided a legal baseline for e-governance by enabling state departments to accept filings, applications, returns and other statutory forms submitted in electronic mode and also enabling licensing and statutory records keeping in digital formats. The IT Act incorporated the concept of ‘function equivalence’ – a concept taken from the UNCITRAL Model Law on Electronic Commerce, 1996^[8] which states that an electronic record or signature has the same value as that of its paper equivalent:

• Under the UNCITRAL Model Law Section 4 It states that if a law requires information to be in a particular form or requires that a particular act be done in writing or in any particular manner or that any instrument be registered or that a copy thereof be filed, an electronic record shall be sufficient for all such purposes if it is accessible for later reference.
• Under the UNCITRAL Model Law Section 5, grants statutory recognition to digital signatures and affords them the same weightage as handwritten signatures.
• Whereas Section 10A of the UNCITRAL Model Law, states that contracts made by electronic means are valid and enforceable merely by virtue of their being made by electronic means.

The initial authentication technique required a technology specific approach based on asymmetric cryptography and Public Key Infrastructure (PKI). In this approach, a digital signature is created using the sender’s private key and decoded by the receiver using the corresponding public key. A mathematical hash of the data is created using a cryptographic hash function and encrypted using the sender’s private key. The encrypted hash is decrypted by the receiver using the sender’s public key to verify the sender’s authenticity.

The Act provided for a specialized quasi-judicial and regulating framework in order for the electronic environment to function within the confines of the law that the Controller of Certifying Authorities was empowered to regulate and license Certifying Authorities who issue digital signature certificates; adjudicating Officers appointed under Section 46 of the Act were given the authority to inquire into civil violations and award compensation and the Cyber Regulations Appellate Tribunal was established to hear appeals against orders passed by the Controller and the Adjudicating Officers. The Act incorporates electronic data into the existing statutory framework. The Indian Penal Code was amended to provide for electronic forgery and the Indian Evidence Act was amended with the insertion of Sections 65A and 65B to provide for procedures for the admissibility of electronic records^[9];  the Bankers’ Books Evidence Act was extended to include electronic bank ledgers and the Reserve Bank of India Act was amended to lay down the legal parameters for the electronic fund transfer and electronic clearing houses.

The IT Act clearly laid out the civil and criminal violations and their consequences. While, Section 43 of the Act made provisions for imposing compensation and penalties for unauthorized access, download, virus insertion, denial of access and destruction of computer systems. The criminal violations like tampering with computer source code and malicious hacking, were covered under Chapter XI of the Act and were punishable under Sections 65 and 66. Publishing and transmitting obscene content electronically was covered under Section 67 and unauthorized release of confidential data was covered under Section 72.

Early case law went on to illustrate the Act’s provisions. In the case of State of Tamil Nadu v. Suhas Katti, the court got India’s first conviction under Section 67 of the IT Act for publishing and transmitting defamatory and harassing messages on an internet messaging board and confirmed the evidentiary reliability of the electronic audit trail^[10].In SMC Pneumatics (India) Pvt. Ltd. v. Jogesh Kwatra the Delhi High Court awarded an injunction against an employee for sending defamatory emails and demonstrated the application of the tort principles against digital communication^[11].

2008 Amendment & Evolution of Cybercrime Jurisprudence

The Information Technology (Amendment) Act, 2008 emerged as a watershed moment in India’s cyber law development, addressing the shortcomings of the Information Technology Act, 2000. The original Act of 2000 was primarily focused on facilitating electronic commerce, leaving little room for addressing complex cybercrimes, personal data privacy, identity theft, national cyber security, or corporate liability. Two pivotal events triggered the need for amending the IT Act – the controversial Baazee.com case and the 26/11 Mumbai terrorist attacks^[12].

The Baazee.com case cantered around an objectionable video featuring two school students, placed up for auction on an adult dating website. The next obscenity charge against the anonymous poster and the website’s managing director, Avnish Bajaj, raised critical questions about the responsibility of online platforms for user-generated content^[13]. The current safe harbor provisions in Section 79 IT Act were insufficient since the Indian Penal Code, 1860 did not provide specific standards for due diligence by digital intermediaries.

. At the same time, the Mumbai attacks highlighted the need for updated surveillance laws, as the government struggled to tap encrypted communications utilized by terrorists^[14].This confluence of issues led to the introduction of the 2008 Amendment, which made several significant additions and modifications to the IT Act:

Technology Neutrality (Section 3A): The encryption and Public Key Infrastructure (PKI) based authentication system recognized in Section 3 was replaced with more flexible “electronic signature.” The new Section 3A permits the use of any encryption mechanism that involves “exclusive control” of the signer and provides “reasonable evidence of authenticity” of the purporting sender.

Classification of Substantive Cybercrimes: Section 66 was bifurcated to create a comprehensive offense encompassing all acts of deliberate dishonesty, fraud, and corruption listed in Section 43. Several cyber-specific offenses were also added:

Section 66B: Dishonest receipt or retention of computer related resources or communication device

Section 66C: Theft of identity including passwords, electronic signature, and other unique identifiers

Section 66D: Cheating by impersonation through computer resources

Section 66E: Voyeurism and dissemination of images of private areas without consent

Section 66F: Cyber-terrorism with enhanced punishment for acts threatening unity, integrity, security, and sovereignty of India

Sections 67A and 67B: Obscenity in electronic form was further classified based on the nature of sexually explicit material and child sexual abuse material.

Corporate Liability and Data Protection (Section 43A): This section mandated that anybody corporate handling sensitive personal data or information must compensate for loss arising out of their failure to adopt reasonable security practices. The Information Technology (SPDI Rules), 2011 required corporates to formulate privacy policies, obtain individual consent, undertake appropriate safeguards for trans-border processing of SPDI, and adopt globally recognized security practices like ISO/IEC 27001^[15].

Surveillance and Information Control: The 2008 Amendment gave the government extensive powers to intercept, monitor, decrypt, and survey digital communications for the official sovereignty and security. Similarly, the government can issue blocking directions to intermediaries for contravention of the IT Act through Section 69A. Section 69B mandated designated agencies to monitor traffic data for gathering cyber forensics intelligence.

Intermediary Safe Harbor (Section 79): This amendment responded to the long-standing jurisprudential challenges posed by the Baazee.com case and clarified that an intermediary shall not be liable for any offense under the IT Act or any other law for merely providing access to a computer resource or network. However, intermediaries were expected to follow due diligence procedures and remove access to any unlawful material on getting notice of such violations^[16].With these changes, the IT Act, 2000 was transformed from an electronic commerce law to a comprehensive cyber law penalizing and regulating digital offenses.

Admissibility of Electronic Evidence & Procedural Lasw

The advent of technology has created numerous challenges in terms of evidence in Indian procedural law. Courts grapple with emails, text messages, CCTV footage, call detail records, and other computer-generated data. Since such data is prone to manipulation and deletion, Indian law has stringent rules concerning such digital evidence. The Information Technology Act, 2000 amended the Indian Evidence Act, 1872 to address this lacuna by introducing Sections 65A and 65B^[17]. Section 65A provides that the contents of an electronic record may be proved only by the methods prescribed under Section 65B. Section 65B prescribes specific guidelines for proving the contents of computer-generated records, whether printed on paper, stored, recorded, or copied in optical or magnetic media. In terms of Section 65B(2), the proponent of such computer-generated records must prove that the computer generated output was produced by the computer during the period that it is in regular service; Information of the same nature as contained in the record was regularly fed into the computer; the computer was in proper working condition during the material period or any period of non-working did not affect the accuracy of the electronic record; the record produced is a true replica of the electronic data fed into the computer. Section 65B (4) mandates production of an authenticating certificate as a preliminary condition for proving secondary electronic evidence. This certificate must indicate the nature of the electronic record, method of its generation, details of the computer used, that the conditions specified in Section 65B (2) are satisfied, and must be signed by a person who is duly authorized and in lawful possession of the computer. The Supreme Court consistently addressed the requirements of Section 65B (4) in four significant judgments, namely: in State (NCT of Delhi) v. Navjot Sandhu (2005) the Parliament Attack case, Section 65B (4) was held to be directory in nature. The Supreme Court granted liberal construction under Sections 63 and 65 of the Indian Evidence Act, 1872^[18].

In Anvar P.V. v. P.K. Basheer (2014)^[19] the three-judge bench of the Supreme Court overruled the decision in Navjot Sandhu and held that Sections 65A and 65B create a distinct code of procedure, which governs evidence in electronic form. It held that compliance with Section 65B (4) is mandatory for admission of secondary electronic records as evidence. In Shafhi Mohammad v. State of Himachal Pradesh (2018)^[20]This judgment carved out an equitable exception to the inflexible test of Section 65B (4). The Supreme Court held that such certificate under Section 65B (4) shall be considered directory in nature where the proponent of evidence is not in possession or lawful control of the computer^[21].In Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020): The three judge-bench overruled Shafhi Mohammad and reasserted the mandatory nature of Section 65B (4). The Supreme Court held that certificate under Section 65B(4) is an absolute condition precedent for admissibility of secondary electronic records. The Court held that where a person who is not in possession or lawful custody of a computer controls it, the trial court must invoke its powers under the Code of Criminal Procedure, 1973 and the Evidence Act to obtain such certificate and it may be provided at a later stage, even before the conclusion of trial.This law now continues to operate under the Bharatiya Sakshya Adhiniyam (BSA), 2023. In terms of Section 61 of the BSA, electronic and digital records shall not be denied legal validity or admissibility solely on the ground that they are in electronic form. Section 63 of the BSA preserves the requirements relating to evidence in electronic form. Thus, the Indian law continues to require forensic examination of such digital evidence in courts of law^[22].

Intermediary Liability, Free Speech & Platform Governance

The rise of social media platforms, communication applications, search engines and cloud networks have sparked a fundamental debate about whether an online intermediary should be legally liable for content uploaded by its users. Indian cyber law tackles such concerns through the notion of intermediary liability, statutory safe harbour under Section 79 of the Information Technology Act, 2000 and Section 79(3)(b) which states that an intermediary cannot be ordered to adjudicate over the legality of an enormous amount of user content on the receipt of private complaints. An intermediary is a person or entity that receives, stores or transmits an electronic record on behalf of another. Given the large volume of information and data, strict liability would make the operation of such platforms legally impossible. Thus, Section 79, creates a conditional safe harbour by affording legal immunity to intermediaries for third-party information, data links hosted by them. However, this safe-harbour is a conditional statutory privilege and it is waived for violating any of the statutory requirements^[23].

Intermediary liability is tied up in the Constitution’s guarantee of free speech. The initial statutory regime included Section 66A which criminalized the sending of “grossly offensive” or “annoying” electronic messages. Due to the vague and subjective wording of this Section, freedom of expression online was severely threatened. In the landmark case of Shreya Singhal v. Union of India, the Supreme Court struck down Section 66A in toto, considering it unconstitutional for being in violation of Article 19(1)(a) of the Constitution of India^[24].

In addition, the Court interpreted the language of Section 79(3)(b) and held that an intermediary was not obliged to adjudicate the legality of a vast amount of user content on the receipt of private complaints, as this would amount to private censorship. The Court further held that an intermediary only loses safe-harbour immunity from takedown responsibilities if it fails to expeditiously remove unlawful content following receipt of actual knowledge via a binding court order or upon an authorized government directive issued under Section 69A. Platform governance was significantly enhanced by the notification of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021^[25]. The Rules mandate heightened due diligence requirements and compliance timelines as well as grievance redressal mechanisms. Platforms categorized as Significant Social Media Intermediaries (SSMIs) are required to appoint a Chief Compliance Officer, a Nodal Contact Person and a Resident Grievance Officer. Rule 4(2) requires that major messaging platforms be enabled to identify the first originator of unlawful information as per a lawful order. Due to the potential incompatibility with end-to-end encryption protocols, this traceability mandate has led to widespread legal dispute. Tensions between free speech and state moderated speech were further highlighted by the appointment of a government-appointed Fact-Check Unit to identify false information regarding official business, which was challenged in Kunal Kamra v. Union of India^[26].Indian cyber law thus, continues to negotiate a sensitive balance between platform safe harbours, state moderation and the constitutional right to digital speech.

The Privacy Approach: From Puttaswamy case to DPDP Act, 2023

The evolution of data privacy protections is a pivotal narrative in the history of Indian cyber law. In a digitally connected society where an individual’s personal information is continuously processed by private industries, public authorities and digital platforms, privacy protections must extend beyond physical boundaries to safeguard informational privacy.

Early constitutional jurisprudence did not recognize an independent right to privacy. In M.P. Sharma v. Satish Chandra^[27] and Kharak Singh v. State of U. P^[28]., the Supreme Court held that the Constitution did not guarantee an independent fundamental right to privacy. However, this restrictive doctrine was unanimously dismantled by a nine-judge bench in the historic ruling of Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)^[29]. The Supreme Court held that privacy is an intrinsic element of life, dignity and personal liberty guaranteed under Article 21 of the Constitution. By enshrining informational privacy as an inviolable right, the Court established a three-fold test any state intervention must pass the Legality: The intrusion must be backed by an enacted statutory law; Legitimate State Aim: The measure must pursue an identifiable public interest; and Proportionality and Necessity: The means adopted must be strictly proportional to the objective sought and represent the least intrusive measure available.

The principles articulated in Puttaswamy laid the legal foundation for the subsequent landmark judgments. services^[30]; while in Internet and Mobile Association of India v. Reserve Bank of India, the test of proportionality was applied to evaluate regulatory measures in digital asset markets. In the Aadhaar case, the Court was called upon to balance biometric identity systems, welfare distribution and individual privacy protections30; and in Karmanya Singh Sareen v. Union of India it addressed the data sharing policies of commercial messaging services31, while in Internet and Mobile Association of India v. Reserve Bank of India, the test of proportionality was applied to assess regulatory measures in digital asset markets. These judicial milestones led to the enactment of the Digital Personal Data Protection (DPDP) Act, 2023 which embodies the constitutional principles as an active legislative regime32. The Act governs the processing of the digital personal data and stipulates the legal definitions of the Data Principal (data subject) and Data Fiduciary (processor). It requires that processing be founded on lawful, informed and explicit consent and detailed privacy notices. The DPDP Act codifies enforceable rights for individuals such as the right to access summaries of the processed personal data, rectify inaccuracies, erase completed data and seek grievance redressal. It imposes heightened obligations on Significant Data Fiduciaries, sets out a framework for cross-border data transfers, outlines state exemptions and sets up the Data Protection Board of India (DPBI) as an independent adjudicatory authority empowered to enforce compliance and levy financial penalties. By virtue of Puttaswamy and the DPDP Act, Indian jurisprudence has transitioned to a rights-based framework for digital personal data governance.

CONCLUSION

Indian cyber jurisprudence has evolved from facilitating commerce through the Information Technology Act, 2000 to advancing a rights-based approach through the Constitution and statutes. While the early constitutional judgments in M.P. Sharma and Kharak Singh^[31] declined to recognize a right to privacy, this jurisprudence has since been invalidated by the ruling in Justice K.S. Puttaswamy (Retd.) v. Union of India which held informational privacy as an intrinsic component of personal liberty, autonomy and human dignity enshrined in Article 21 of the Constitution^[32]. The Supreme Court further held that state surveillance or intrusion must answer to the twin tests of legality, legitimate state aim and proportionality.

The DPDP Act, 2023^[33] gives this constitutional directive statutory form through the duties imposed on Data Fiduciaries and the correlative rights of Data Principals including consent, access, correction, erasure and remedy with the support of the regulatory framework provided by the Data Protection Board of India. Yet, full digital governance necessitates further legislative action as replacing the colonial procedural and penal statutes with the Bharatiya Nyaya Sanhita (BNS), 2023 and Bharatiya Sakshya Adhiniyam (BSA), 2023 (which incorporates digital evidence certification in its Section 63) leaves room for legal conflicts with respect to mass data collection, traceability of platforms, algorithmic accountability and Generative Artificial Intelligence. The proposed Digital India Act (DIA) must therefore take the form of a comprehensive legal framework replacing the amended IT Act, resolving such conflicts of laws and ensuring the primacy of constitutional rights in an era of technological progress^[34].

REFERENCE(S):

1. David R. Johnson & David Post, Law and Borders: The Rise of Law in Cyberspace, 48 Stan. L. Rev. 1367, 1370–1375 (1996).
2. Stephen D. Krasner, Sovereignty: Organized Hypocrisy (Princeton University Press 1999) 20–25.
3. Orin S. Kerr, The Problem of Perspective in Internet Law, 91 Geo. L.J. 357, 362 (2003).
4. Dan Jerker B. Svantesson, Solving the Internet Jurisdiction Puzzle (Oxford University Press 2017) 45–52
5. See generally Michael D. Birnhack, The Territoriality of Data: An Analytical Framework, 17 U. Pa. J. Const. L. 1 (2014).
6. See generally Michael D. Birnhack, The Territoriality of Data: An Analytical Framework, 17 U. Pa. J. Const. L. 1 (2014).
7. United Nations Commission on International Trade Law, UNCITRAL Model Law on Electronic Commerce with Guide to Enactment 1996 with Additional Article 5 bis as Adopted in 1998, G.A. Res. 51/162, U.N. Doc. A/RES/51/162 (Jan. 30, 1997).
8. Jonathan Zittrain, The Future of the Internet—And How to Stop It (Yale University Press 2008) 36–40.
9. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021,
10. Bankers’ Books Evidence Act, 1891 (Act No. 18 of 1891)
11. Bharatiya Sakshya Adhiniyam, 2023 (Act No. 47 of 2023)
12. Constitution of India, 1950, Arts 14, 19, 21
13. Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
14. Indian Evidence Act, 1872 (Act No. 1 of 1872)
15. Indian Penal Code, 1860 (Act No. 45 of 1860)
16. Information Technology Act, 2000 (Act No. 21 of 2000)
17. Information Technology (Amendment) Act, 2008 (Act No. 10 of 2009)
18. Reserve Bank of India Act, 1934 (Act No. 2 of 1934)
19. Bharatiya Nyaya Sanhita, 2023 (Act No. 45 of 2023) 

[1]  David R. Johnson & David Post, ‘Law and Borders: The Rise of Law in Cyberspace’ (1996) 48 Stanford Law Review 1367, 1370–1375; Stephen D. Krasner, Sovereignty: Organized Hypocrisy (Princeton University Press 1999) 20–25

[2]  Jonathan Zittrain, The Future of the Internet—And How to Stop It (Yale University Press 2008) 36–40.

[3]  Frank H. Easterbrook, ‘Cyberspace and the Law of the Horse’ [1996] University of Chicago Legal Forum 207.

[4]  Joel R. Reidenberg, ‘Lex Informatica: The Formulation of Information Policy Rules Through Technology’ (1998) 76 Texas Law Review 553.

[5] Lawrence Lessig, Code and Other Laws of Cyberspace (Basic Books 1999); Michael D. Birnhack, ‘The Territoriality of Data: An Analytical Framework’ (2014) 17 University of Pennsylvania Journal of Constitutional Law 1.

[6] Yahoo! Inc. v. Akash Arora 1999 SCC OnLine Del 233.

[7] David R. Johnson & David Post, ‘Law and Borders: The Rise of Law in Cyberspace’ (1996) 48 Stanford Law Review 1367, 1370-1375; Stephen D. Krasner, Sovereignty: Organized Hypocrisy (Princeton University Press 1999) 20-25.

[8]  United Nations Commission on International Trade Law, UNCITRAL Model Law on Electronic Commerce with Guide to Enactment 1996 with Additional Article 5 bis as Adopted in 1998, G.A. Res. 51/162, U.N. Doc. A/RES/51/162 (Jan. 30, 1997).

[9] Indian Evidence Act, 1872, ss 65A, 65B.

[10] State of Tamil Nadu v. Suhas Katti, CC No. 4680 of 2004, Decided by the Additional Chief Metropolitan Magistrate Court, Egmore, Chennai (2004).

[11]  SMC Pneumatics (India) Pvt. Ltd. v. Jogesh Kwatra, CS (OS) No. 1279 of 2001, Delhi High Court (2001).

[12]  Vakul Sharma, Information Technology: Law and Practice (Universal Law Publishing 2011).

[13] Vakul Sharma, Information Technology: Law and Practice (Universal Law Publishing 2011).

[14] David R. Johnson & David Post, ‘Law and Borders: The Rise of Law in Cyberspace’ (1996) 48 Stanford Law Review 1367, 1370-1375.

[15] Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, Ministry of Communications and Information Technology, Notification G.S.R. 313(E) (11 April 2011).

[16] Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, Ministry of Communications and Information Technology, Notification G.S.R. 313(E) (11 April 2011).

[17] Indian Evidence Act, 1872, ss 65A, 65B.

[18]  State (NCT of Delhi) v. Navjot Sandhu (2005) 11 SCC 600

[19] Anvar P.V. v. P.K. Basheer & Ors. (2014) 10 SCC 473.

[20] Shafhi Mohammad v. State of Himachal Pradesh (2018) 2 SCC 801.

[21] Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1

[22] Bharatiya Sakshya Adhiniyam, 2023, ss 61, 63.

[23]  David R. Johnson & David Post, ‘Law and Borders: The Rise of Law in Cyberspace’ (1996) 48 Stanford Law Review 1367, 1370–1375; Stephen D. Krasner, Sovereignty: Organized Hypocrisy (Princeton University Press 1999) 20–25.

[24] Shreya Singhal v. Union of India (2015) 5 SCC 1.

[25]  Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Ministry of Electronics and Information Technology, Notification G.S.R. 139(E) (25 February 2021), as amended by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2023.

[26] Kunal Kamra v. Union of India & Ors. 2024 SCC OnLine Bom 2998.

[27] M.P. Sharma v. Satish Chandra AIR 1954 SC 300.

[28] Kharak Singh v. State of U.P. AIR 1963 SC 1295.

[29] Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1.

[30]  Karmanya Singh Sareen v. Union of India (2019) 17 SCC 353.

[31]  M.P. Sharma v. Satish Chandra AIR 1954 SC 300

[32] Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1.

[33] The Digital Personal Data Protection Act, No. 22 of 2023, Acts of Parliament (India).

[34] M.P. Sharma v. Satish Chandra AIR 1954 SC 300; Kharak Singh v. State of U.P. AIR 1963 SC 1295; Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1.