Part I – Preliminary

1. Short Title, Extent and Commencement.

(1) This Act may be called the Electronic Commerce Act, 1998.

(2) This Act extends to the whole of India, except the State of Jammu and Kashmir.

(3) This Act shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint in this behalf.

2. Definitions. In this Act, unless the context otherwise requires -

(a) “Asymmetric cryptosystem” means a computer-based system capable of generating and using a secure key pair, consisting of a private key for creating a digital signature and a public key to verify the digital signature.

Source: ABA Digital Signature Guidelines §1.3.

Comments: Asymmetric cryptography is the core of the current digital signature technology. An asymmetric cryptosystem is an information system utilizing an algorithm or series of algorithms that provide for a cryptographic key pair consisting of a private key and the corresponding public key. A secure key pair is a key pair that is cryptographically strong and is capable of reliably creating and verifying digital signatures.

(b) “Authentication” means a process used to ascertain the identity of a person or the integrity of specific information. For a message, authentication involves ascertaining its source and confirming that it has not been modified or replaced in transit.

Source: ABA Digital Signature Guidelines §1.4.

Comments: Authentication is necessary to determine the source and integrity of information. Authentication requires the verification that a record was sent by the sender and that the integrity of the record was not compromised. This concept has been added here to recognize the importance of determining the identity of the sender and the integrity of the contents of an electronic record in an electronic commerce transaction. Authentication is distinguishable from verification of a digital signature.

(c) “Authorized officer” means any officer that has been authorized by the Controller to exercise the powers of the Controller under this Act as identified in Section 41 of this Act.

Source: Singapore Electronic Transactions Act §50.

Comments: An Authorized Officer will have the authority, if delegated by the Controller (as defined herein), to perform the duties and obligations of the Controller as specified herein.

(d) “Certificate” means a record, that at a minimum: (i) identifies the certification authority issuing it; (ii) names or otherwise identifies its subscriber, or a device or electronic agent under the control of the subscriber; (iii) contains a public key that corresponds to a private key under the control of the subscriber; (iv) specifies its operational period; and (v) is digitally signed by the certification authority issuing it.

Source: ABA Digital Signature Guidelines §1.5.

Comments: A certificate binds a particular public key to a person that controls the corresponding private key. A certificate is used to identify the subscriber who actually controls the private key. A certificate usually helps the recipient of a digitally signed message attribute the digital signature to the sender by determining whether the public key and corresponding private key are identified with the signer. See Part VII and VIII of this Act for discussion of certificates in connection with the use of digital signatures. A certificate must be signed by the certification authority issuing it so that the certificate may not be forged.

(e) “Certification authority” means a person who authorizes or causes the issuance of a certificate.

Source: ABA Digital Signature Guidelines §1.6.

Comments: This definition expands on the definitions provided in the Singapore Electronic Transactions Act and others by regulating the process of issuance of certificates. The certification authority is responsible for issuing certificates for digital signatures to subscribers and for creating and digitally signing certificates. Once the certificate is issued by the certification authority, a representation is made as to the identity of the person named in the certificate and the binding of that person to a particular public-private key pair. See Part VII of this Act for discussion of certification authorities in connection with the use of digital signatures.

(f) “Certification practice statement” means a statement issued by a certification authority that specifies the policies or practices that the certification authority employs in issuing, managing, suspending and revoking certificates and providing access to them.

Source: ABA Digital Signature Guidelines §1.8.

Comments: The certification practice statement generally takes the form of a declaration that the systems and procedures that it uses in creating certificates for digital signatures are trustworthy. These statements typically describe the types of procedures that a certification authority uses to verify an applicant’s identity before it issues the certificate, the security measures used to protect cryptographic keys and the process that the certification authority takes to generate keys. See Part VII of this Act for discussion of certification practice statements in connection with the use of digital signatures.

(g) “Computer” means an electronic, magnetic, electromagnetic, digital, optical, or other information processing system or device used for creating, generating, transmitting, receiving, storing, displaying, or otherwise processing information, together with any supporting software, input, output, or data storage devices used therewith.

Source: Malaysia Computer Crimes Act §2(1); Uniform Electronic Transactions Act §102(12)

Comments: This definition is broader than other definitions found in similar acts in order to encompass the broadest range of apparatus used in electronic transactions. For example, facsimile machines, sophisticated telephone systems, telex and telegraph systems all are covered by this definition, in addition to the devices commonly known as computers. The definition also is intended to cover computer software and peripheral devices.

(h) “Computer network” means two or more computers in communication with or connected to each other.

Comment: This definition is intended to encompass the broadest range of computer interconnections that could be used in facilitating electronic transactions.

(i) “Computer program” means a set of instructions or statements, and related data, to be used directly or indirectly in a computer or computer network in order to cause a certain result.

Source: Uniform Electronic Transactions Act §102.

(j) “Computer security system” means the design, procedures or other measures that the person responsible for the operation and use of a computer employs to restrict the use of the computer to particular persons or uses, or that the owner or licensee of data stored or maintained by a computer in which the owner or licensee is entitled to store or maintain the data employs to restrict access to or protect the confidentiality of the data.

Source: Texas Penal Code §33.01.

(k) “Computer virus” means any computer instruction, information, data or program that degrades the performance of a computer; disables, damages or destroys a computer; or attaches itself to another computer and executes when the host computer program, data or instruction is executed or when some other event takes place in the host computer, data or instruction.

Source: Maine Criminal Code §431(9).

(l) “Controller” means the Controller of Certification Authorities appointed under Section 41.

Source: Singapore Electronic Transactions Act §2.

Comments: The Controller of Certification Authorities shall be appointed by the Central Government to regulate and control operation of certification authorities. The duties of the Controller of Certification Authorities include licensing, certifying, monitoring and overseeing the activities of all certification authorities in India.

(m) “Correspond” in relation to private or public keys, means to belong to the same key pair.

Source: ABA Digital Signature Guidelines §1.10; Singapore Electronic Transactions Act §2.

Comments: In an asymmetric cryptosystem, two keys are said to “correspond” if one key can be used to encrypt a message and only the other key can be used to decrypt the message.

(n) “Damage” means any destruction, alteration, disruption, deletion, addition, modification or other impairment to the integrity or availability of a computer, data, electronic record, a program, an information system or information.

Source: United States Code, 18 U.S.C. §1030.

Comment: The definition of “damage” is based on the definition contained in the United States Computer Fraud and Abuse Act, but includes a wider range of categories of impairment of computer resources.

(o) “Data” means a representation of information or of concepts that are being prepared or have been prepared in a form suitable for use in a computer.

Source: Malaysia Computer Crimes Act §2.

(p) “Digital signature” means an electronic signature consisting of a transformation of an electronic record using an asymmetric cryptosystem and a hash function such that a person having the initial untransformed electronic record and the signer’s public key can accurately determine: (i) whether the transformation was created using the private key that corresponds to the signer’s public key and (ii) whether the initial electronic record has been altered since the transformation was made.

Source: Singapore Electronic Transactions Act §2.

Comments: A digital signature is a form of an electronic signature.

(q) “Electronic” includes electrical, digital, magnetic, optical, electromagnetic or any other form of technology that entails capabilities similar to these technologies.

Source: Illinois Electronic Commerce Security Act §5-105; Uniform Electronic Transactions Act §102(5)(September 1998 draft).

Comments: This definition clarifies that this Act applies broadly to existing technologies, as well as any future technologies. It also is intended to make clear that the use of the term “electronic” is not to be taken so literally as to exclude certain technologies obviously intended to be covered but not literally “electronic” (i.e., information stored in magnetic form on a computer disk or information contained on a CD-ROM).

(r) “Electronic device” means a computer program or electronic record or other automated means configured or enabled by a person to independently initiate or respond to electronic records or performances on behalf of that person without review by an individual.

Source: Uniform Electronic Transactions Act §102(6)(September 1998 draft); UCC Article 2B §2B-102(19)(August 1998 draft).

Comment: In the electronic marketplace, an increasing number of agreements are executed automatically through the use of electronic devices. Therefore, it is critical to include provisions governing formation of contracts through the use of electronic devices in the proposed legislation. The definition of electronic device contemplates transactions where one or both parties are represented by automated devices configured to respond to specific input and to carry out transactions on behalf of their human counterparts. Given the automated nature of such devices, of course, the law of agency should not apply to such devices.

(s) “Electronic record” means a record generated, sent, received or stored by electronic means for use in an information system or for transmission from one information system to another.

Source: UNCITRAL Model Law, Article 2(a).

Comments: Electronic records include all messages sent by some electronic means. This definition can encompass computer-generated data records created for internal record-keeping purposes as well as communications to a third party.

(t) “Electronic signature” means any letters, characters, numbers or other symbols in digital form attached to or logically associated with an electronic record, and executed or adopted with the intention of authenticating or approving the electronic record.

Source: Singapore Electronic Transactions Act §2.

Comments: This definition is included for purposes of clarity and also to expressly state the requirement that the electronic signature be attached to or logically associated with the electronic record. Since electronic records can be communicated separately from any tangible media on which they may exist, this definition requires that the signature must, in some way, be “attached to or logically associated with” the electronic record being signed.

(u) “Hash function” means an algorithm mapping or translating one sequence of bits into another, generally smaller, set (the hash result) such that: (i) a record yields the same hash result every time the algorithm is executed using the same record as input; (ii) it is not feasible that a record can be derived or reconstituted from the hash result produced by the algorithm; and (iii) it is computationally infeasible that two records can be found that produce the same hash result using the algorithm.

Source: Singapore Electronic Transactions Act §2.

(v) “Information” includes data, text, images, sound, codes, computer programs, software, databases and the like.

Source: Singapore Electronic Transactions Act §2.

Comments: The term “information” is technologically neutral but intended to include anything that can be transmitted in electronic or digital form.

(w) “Information system” means a system for creating, generating, sending, receiving, storing, displaying or otherwise processing information.

Source: Uniform Electronic Transactions Act §102(12).

(x)”Internet” means a global network of interconnected computer networks, each using the transmission control protocol/internet protocol or any combination thereof or such other standard network interconnection protocols as is used to transmit data that is directly or indirectly delivered to a computer.

(y) “Key pair” in an asymmetric cryptosystem, means a private key and its mathematically related public key, having the property that the public key can verify a digital signature that the private key creates.

Source: Singapore Electronic Transactions Act §2.

Comments: A key pair is normally generated by the person or entity that intends to use the key pair in order to digitally sign electronic records. A key pair includes a private key that is used to create a digital signature and a public key, which is used to verify digital signatures on messages sent by the holder of the corresponding private key.

(z) “Network service provider” means a person that provides the software, hardware, telecommunications facilities or any combination of the above, to facilitate access to the Internet or any other computer network, and includes a value added network service provider.

Source: United States Code, 47 U.S.C. §230(e).

Comments: This Act includes a definition based on the definition of “interactive computer service” contained in the United States Code. The definition is drafted broadly enough to encompass operators of online services, Internet access providers, VANS, and those entities that provide the telecommunications facilities to permit access to the Internet.

(aa) “Operational period of a certificate” begins on the date and time the certificate is issued by a certification authority (or on a later date and time if stated in the certificate), and ends on the date and time it expires as stated in the certificate or is earlier revoked or suspended.

Source: Singapore Electronic Transactions Act §2.

Comments: The operational period of a certificate is the period of its validity.

(bb) “Private key” means the key of a key pair used to create a digital signature.

Source: Singapore Electronic Transactions Act §2.

Comments: A private key is the secret key used to create a digital signature.

(cc)“Prescribed” means prescribed by rules made under this Act.

(dd) “Provide access” means, in relation to material provided by a third party, the provision of the necessary technical means by which such material may be accessed and includes the automatic and temporary storage of such material for the purpose of providing access.

Source: Singapore Electronic Transactions Act §2.

(ee) “Public key” means the key of a key pair used to verify a digital signature.

Source: Singapore Electronic Transactions Act §2; Illinois Electronic Commerce Security Act §5-105.

Comments: The public key is usually provided via a certificate issued by a certification authority and is used to verify the digital signature of a message purportedly sent by the holder of the corresponding private key.

(ff) “Record” means information that is inscribed, stored or otherwise fixed in a tangible medium or that is stored in an electronic or other intangible medium and may be retrieved in perceivable form.

Source: Singapore Electronic Transactions Act §2.

(gg) “Repository” means a system for storing and retrieving certificates or other information relevant to certificates, including information related to the status of a certificate.

Source: Singapore Electronic Transactions Act §2.

Comments: A repository is a collection of information related to issued certificates stored by the certification authority or another person. The repository may contain the certificates accepted by subscribers and any other necessary information.

(hh) “Revoke a certificate” means to permanently end the operational period of a certificate from a specified time forward.

Source: Singapore Electronic Transactions Act §2.

Comments: A certificate may be revoked prior to the end of the operational period. Once a certificate is revoked, its effectiveness is terminated.

(ii) “Rule of law” includes any provision contained in an enactment or any rule derived from any other source of law.

(jj) “Security procedure” means a procedure for the purpose of: (i) verifying that an electronic record is that of a specific person or (ii) detecting error or alteration in the communication, content or storage of an electronic record since a specific point in time. A security procedure may require the use of algorithms or codes, identifying words or numbers, encryption, answer back or acknowledgment procedures, or similar security devices.

Source: Singapore Electronic Transactions Act §2.

Comments: This definition does not attempt to define security procedure in terms of any specific technology, and recognizes that there are a variety of technologies in place today, as well as new technologies that will be developed in the future, that may qualify as appropriate security procedures.

(kk) “Signed” or “signature,” in relation to electronic records, includes any symbol executed or adopted, or any security procedure employed or adopted, using electronic means or otherwise, by or on behalf of a person with the intent to authenticate such record.

Source: Singapore Electronic Transactions Act §2.

Comments: This definition of the terms “signed” and “signature” has the effect of: (1) extending to the electronic medium the traditional paper-based definition of “signed” and (2) recognizing that a signature can be created both through the use of a symbol as well as through the use of a security procedure.

(ll) “Subscriber” means a person who is the subject named or identified in a certificate issued, who holds a private key that corresponds to a public key listed in that certificate and who is the person to whom digitally signed messages verified by reference to such certificate are to be attributed.

Source: Singapore Electronic Transactions Act §2.

Comments: The subscriber is the person named or otherwise identified in a certificate. Note that a person who digitally signs an electronic record, but who has not been issued a certificate, is not a subscriber, even though such person is using a digital signature.

(mm) “Suspend a certificate” means to temporarily suspend the operational period of a certificate from a specified time forward.

Source: Singapore Electronic Transactions Act §2.

Comments: Suspension of a certificate involves a temporary termination of its effectiveness prior to the end of its stated operational period.

(nn) “Third party” means, in relation to a network service provider, a person over whom the provider has no effective control.

Source: Singapore Electronic Transactions Act §10(3).

(oo) “Trustworthy system or manner” means the use of, or adoption of any device involving the use of, computer hardware, software and procedures that, in the context in which they are used: (i) can be shown to be reasonably resistant to penetration, compromise and misuse; (ii) provide a reasonable level of reliability and correct operation; (iii) are reasonably suited to performing their intended functions or serving their intended purposes; (iv) comply with applicable agreements between the parties, if any; and (v) adhere to generally accepted security procedures

Source: Illinois Electronic Commerce Security Act §5-105; See ABA Digital Signature Guidelines §1.35.

Comments: The term “trustworthy system or manner” is intended to define a general yet flexible standard, recognizing that computer security is a matter of degree and depends upon the circumstances. This definition focuses on a variety of different aspects of the trustworthiness of an information system, including (1) security from intrusion and misuse; (2) reliability and correct operation; (3) suitability to performing intended functions or purposes; (4) compliance with applicable agreements of the parties; and (5) adherence to generally accepted security procedures. The manner in which a system is configured to achieve the objectives of trustworthiness will vary depending on the type of technology available.

(pp) “Valid certificate” means a certificate that a certification authority has issued and that the subscriber listed in the certificate has accepted.

Source: Singapore Electronic Transactions Act §2.

(qq) “Verify a digital signature” means to use a public key listed in a valid certificate to determine: (i) that the digital signature was created using the private key corresponding to the public key listed in the certificate and (ii) the electronic record has not been altered since its digital signature was created.

Source: Singapore Electronic Transactions Act §2.

3. Purpose and Construction.

This Act shall be construed consistently with what is commercially reasonable under the circumstances and to effectuate the following purposes:

(a) To facilitate electronic communications by means of reliable electronic records;

(b) To facilitate and promote electronic commerce, to eliminate barriers to electronic commerce resulting from uncertainties over writing and signature requirements, and to promote the development of the legal and business infrastructure necessary to implement secure electronic commerce;

(c) To facilitate the electronic filing of documents with government agencies and statutory corporations, and to promote efficient delivery of government services by means of electronic records;

(d) To minimize the incidence of forged electronic records, intentional and unintentional alterations of records, and fraud in electronic commerce and other electronic transactions;

(e) To promote public confidence in the integrity and reliability of electronic records, electronic signatures and electronic commerce;

(f) To establish uniform rules and standards regarding the authentication and integrity of electronic records; and

(g) To create a legal infrastructure for the use of digital signatures.

Source: Florida Electronic Signature Act of 1996 §2; Singapore Electronic Transactions Act §3, Utah Digital Signature Act §102.

Comments: This Act aims to remove actual and perceived barriers to electronic commerce and to set forth a legal framework to promote and facilitate the development of electronic commerce. It seeks to remove barriers by clarifying existing uncertainty over whether electronic records are “writings” or “signatures” or “records” for legal purposes. To promote electronic commerce, this Act provides for recognition of a class of electronic records known as “secure” electronic records and signatures. Secure electronic records and signatures are afforded higher evidentiary presumptions to provide parties engaged in electronic commerce assurance that their transactions are enforceable. In addition, this Act addresses evidentiary concerns as to the admissibility of electronic records. The Act presents a logical and coherent approach to resolving issues raised by electronic commerce and, where possible, seeks to preserve uniformity among the approaches to electronic commerce legislation taken by various countries.

4. Application.

(a) Parts II or IV of this Act shall not apply to any law requiring writing or signatures in any of the following circumstances:

(1) the creation or execution of a will;

(2) the execution of negotiable instruments;

(3) the creation, performance or enforcement of an indenture, declaration of trust or power of attorney with the exception of constructive and resulting trusts;

(4) any contract for the sale or other disposition of immovable property, or any interest in such property;

(5) the conveyance of immovable property or the transfer of any interest in immovable property;

(6) documents of title for movable or immovable property; or

(7) where such application would involve a construction of a rule of law that is clearly inconsistent with the manifest intent of the lawmaking body or repugnant to the context of the same rule of law, provided that the mere requirement that information be “in writing,” “written” or “printed” shall not by itself be sufficient to establish such intent.

(b) The Central Government may modify in the public interest, by notification published in the Official Gazette, the provisions of section (a) by adding, deleting or amending any class of transactions or matters specified in that section.

(c) In relation to this Act, electronic records shall not be liable to stamp duty under the Stamp Act, 1899.

(d) Notwithstanding anything contained in the Telegraph Act, 1885, or rules made under this Act, it shall be lawful to transmit and receive records electronically.

Source: Singapore Electronic Transactions Act §4; Illinois Electronic Commerce Security Act §5-115.

Comments: It is not feasible to give broad legal recognition to all documents that are signed with an electronic signature because, under Indian Law, hand written signatures are more appropriate for certain categories of agreements. Therefore, the purpose of limiting application of this Act is to acknowledge the intent of relevant laws that mandate the use of pen and ink for some documents. For example, in the case of negotiable instruments, the current state of technology does not adequately provide a reliable mechanism for the transfer or negotiation of electronic records to holders in due course beyond an originator and an initial recipient of the electronic record. Additionally, this section provides authority to the Central Government to amend, as appropriate, the limitations set forth in this section. Further, the application of the Stamp Act has been limited to recognize the intangible nature of electronic records, based upon precedent set in the Depositories Act, 1996. The applicability of the Telegraph Act also has been limited in recognition of the necessity to encrypt data in relation to the transmission of certain types of secure electronic records.

5. Variation by Agreement. As between parties involved in generating, sending, receiving, storing or otherwise processing electronic records, any provision of Part II or IV of this Act may be varied by agreement of the parties.

Source: UNCITRAL Model Law, Article 4; UCC Article 2B §2B-107(b); ABA Digital Signature Guidelines §2.2.

Comments: This section states the general principle that parties may vary the provisions of Parts II or IV by agreement. Thus, where the signer and the recipient of an electronic record, agree to the terms of a contract, the rules set forth in this Act may be varied by a contract between the parties.