IT Act and Cyber Laws in India: Sections and PYQs

The correct answer is B, 2000. The Information Technology Act was passed by Parliament in 2000, received assent on 9 June 2000 and came into force on 17 October 2000; it is therefore cited as the Information Technology Act, 2000. Option A is wrong because 1998 precedes the Act, though the UNCITRAL Model Law on Electronic Commerce on which it is modelled dates from 1996. Option C is wrong because 2005 is the year of the Right to Information Act, which is often confused with it in lists of early twenty-first century legislation. Option D is wrong because 2008 is the year of the Information Technology (Amendment) Act, which substantially rewrote the parent Act and came into force on 27 October 2009; that amendment year is the commonest distractor in this question.

The correct answer is A, Shreya Singhal v. Union of India. In 2015 the Supreme Court struck down section 66A, which punished the sending of offensive messages, holding it vague and overbroad and therefore a violation of the freedom of speech and expression under Article 19(1)(a). Option B is wrong because the Puttaswamy case of 2017 declared the right to privacy a fundamental right under Article 21; it is related in subject but is a different judgment. Option C is wrong because Kesavananda Bharati, decided in 1973, laid down the basic structure doctrine. Option D is wrong because the Vishaka judgment of 1997 laid down guidelines against sexual harassment at the workplace, later replaced by legislation in 2013. Note that the same judgment upheld section 69A on the blocking of content and read down section 79, so it did not sweep away the whole chapter of offences.

The correct answer is C, section 66F. Section 66F, inserted by the amendment of 2008, defines cyber terrorism and is the most severely punished offence in the Act, carrying imprisonment which may extend to life. Option A is wrong because section 65 deals with tampering with computer source documents and carries up to three years or a fine up to two lakh rupees. Option B is wrong because section 66E punishes violation of privacy by capturing or publishing an image of a private area of a person without consent. Option D is wrong because section 67B punishes publishing or transmitting material depicting children in a sexually explicit act, the most severely punished of the obscenity provisions but not cyber terrorism. The order of sections 66A to 66F is worth memorising.

The correct answer is C, section 70B. Section 70B, inserted in 2008, appoints the Indian Computer Emergency Response Team as the national nodal agency for collecting, analysing and circulating information on cyber incidents and for issuing advisories; it works under the Ministry of Electronics and Information Technology and was set up in 2004. Option A is wrong because section 43A provides compensation where a body corporate fails to protect sensitive personal data. Option B is wrong because section 69A empowers the government to block public access to information, a power upheld in the Shreya Singhal judgment. Option D is wrong because section 79 gives intermediaries a safe harbour from liability for third party content provided they observe due diligence. The Controller of Certifying Authorities, which licenses the issuers of digital signature certificates, works under the same ministry but is created by section 17.

The correct answer is B, the UNCITRAL Model Law on Electronic Commerce. The model law was adopted by the United Nations Commission on International Trade Law in 1996 and recommended to member states by the General Assembly, and India's Act follows its scheme for giving legal recognition to electronic records and signatures. Option A is wrong because the Budapest Convention on Cybercrime of 2001 is a Council of Europe treaty to which India is not a party. Option C is wrong because the General Data Protection Regulation is a European Union law of 2016 that came much later and concerns data protection, not electronic commerce. Option D is wrong because the Berne Convention of 1886 deals with copyright in literary and artistic works. The model law was adopted to let member states give electronic records the same standing as paper, and India's sections 4, 5 and 10A follow it almost directly.

The correct answer is C, a will. The First Schedule to the Act excludes certain documents from electronic form: a negotiable instrument other than a cheque, a power of attorney, a trust deed, a will or other testamentary disposition, and any contract for the sale or conveyance of immovable property. Option A is wrong because a cheque is specifically carved out of the exclusion of negotiable instruments. Option B is wrong because a contract for the sale of goods may be made electronically, and section 10A expressly confirms the validity of contracts formed by electronic means. Option D is wrong for the same reason; purchase orders and similar commercial communications are exactly the transactions the Act was passed to facilitate. Section 10A, added in 2008, puts the matter beyond doubt by providing that a contract formed through electronic means is not unenforceable merely on that ground.

The correct answer is B, an asymmetric crypto system and a hash function. Section 3 provides that an electronic record is authenticated by affixing a digital signature created by use of an asymmetric crypto system and a hash function; the hash function reduces the record to a message digest and the signer's private key encrypts it, while anyone can verify it with the matching public key. Option A is wrong because a symmetric system uses one shared key and cannot establish who signed. Option C is wrong because a biometric scan by itself is not what the section describes, though electronic signatures added in 2008 allow other reliable techniques. Option D is wrong because a one time password authenticates a transaction, not the record itself.

The correct answer is A, 1930. The helpline 1930 is run with the national cyber crime reporting portal by the Indian Cyber Crime Coordination Centre under the Ministry of Home Affairs, and is meant for the quick reporting of online financial fraud so that the transfer of money can be stopped. Option B is wrong because 1098 is Childline, the helpline for children in distress. Option C is wrong because 1800 is the prefix of toll free numbers in India and is not a helpline by itself. Option D is wrong because 112 is the single emergency response number for police, fire and ambulance services, and although a cyber complaint may be passed on from it, it is not the dedicated cyber fraud line. Complaints may also be filed on the national cyber crime reporting portal, and after the 2008 amendment an offence under the Act is investigated by an officer not below the rank of inspector.

The correct answer is B, the amendment of 2008. The Information Technology (Amendment) Act, 2008 came into force on 27 October 2009 and made the most important changes to the parent Act: it added section 3A on electronic signatures, inserted the computer-related offences of sections 66A to 66F and 67A to 67C, added section 43A on compensation for failure to protect personal data, and created sections 70A and 70B. Option A is wrong because no amendment of this kind was made in 2006. Option C is wrong because 2015 is the year of the Shreya Singhal judgment, which struck down a section rather than inserting any. Option D is wrong because 2021 is the year of the Intermediary Guidelines and Digital Media Ethics Code Rules, which are rules made under the Act, not an amendment to it.

The correct answer is B, K. S. Puttaswamy v. Union of India. A bench of nine judges held in 2017 that the right to privacy is intrinsic to the right to life and personal liberty under Article 21, which became the constitutional basis for India's data protection framework and for the Digital Personal Data Protection Act, 2023. Option A is wrong because Shreya Singhal, decided in 2015, concerned freedom of speech and struck down section 66A of the Information Technology Act. Option C is wrong because the M. C. Mehta cases concern environmental law and the absolute liability principle. Option D is wrong because Maneka Gandhi, decided in 1978, widened the meaning of personal liberty and due process but did not declare a right to privacy.

The correct answer is A, exemption of intermediaries from liability for third party information. Section 79 gives an intermediary such as a network service provider or a social media platform a safe harbour, provided it merely transmits or hosts the content, does not initiate or modify it, and observes the due diligence prescribed by the rules; the Shreya Singhal judgment read the section down so that an intermediary need act only on a court order or a government direction. Option B is wrong because identity theft is punished by section 66C. Option C is wrong because the power to intercept, monitor and decrypt is given by section 69. Option D is wrong because compensation for damage to a computer system is provided by section 43.