Section 51 of the Information Technology Act, 2000, concerning the term of office and conditions of service of the Chairperson and Members of the Appellate Tribunal, stands omitted.

Section 50 of the Information Technology Act, 2000 stands omitted with effect from 26 May 2017, leaving no statutory qualifications in that provision for appointment of the Chairperson and Members of the Cyber Appellate Tribunal. Previously, the Chairperson required High Court judicial eligibility, while Members required specified professional expertise and senior government-service experience. Judicial Members required senior Indian Legal Service experience.

Composition of the Cyber Appellate Tribunal under section 49 of the Information Technology Act, 2000 was omitted with effect from 26 May 2017 through the Finance Act, 2017. Before omission, the Tribunal consisted of one person, described as its Presiding Officer, appointed by the Central Government through notification.

Section 48 designates the Telecom Disputes Settlement and Appellate Tribunal as the Appellate Tribunal for purposes of the Information Technology Act, 2000, from commencement of Part XIV of Chapter VI of the Finance Act, 2017. The Tribunal exercises the jurisdiction, powers and authority conferred under that framework. Its jurisdiction is exercised only in relation to matters and places specified through Central Government notification.

Compensation quantum under the Information Technology Act, 2000 is adjudged by the adjudicating officer with due regard to quantifiable gain or unfair advantage from the default, loss caused to any person by the default, and the repetitive nature of the default. These factors guide assessment of compensation within the penalties, compensation and adjudication framework.

Section 46 provides for adjudicating officers to inquire into information technology contraventions that may attract penalties or compensation. Their jurisdiction extends to damage claims not exceeding five crore rupees, with higher claims assigned to the competent court. Appointment requires prescribed information technology and legal or judicial experience. Following a reasonable opportunity for representation, an officer may impose penalty or award compensation upon finding a contravention. Officers have specified civil-court powers, and their proceedings carry judicial and civil-court status for prescribed purposes.

Section 45 creates a residuary penalty for contravention of rules, regulations, directions or orders where no separate penalty is prescribed. The contravener is liable for a penalty up to one lakh rupees, in addition to compensation payable to the affected person. Higher compensation applies to an intermediary, company or body corporate than to any other person.

Civil penalties apply for failure to furnish required documents, returns or reports to the Controller or a Certifying Authority. Defaults in filing returns or furnishing prescribed information, books or documents within regulatory time limits may attract daily penalties while the failure continues. Failure to maintain required books of account or records may also attract a daily penalty for the continuing period of non-compliance.

Section 43 establishes compensatory liability for unauthorised access, data extraction, introduction of contaminants or viruses, damage, disruption, denial of authorised access, account manipulation, information interference, and source-code tampering intended to cause damage. Damages by way of compensation are payable to the affected person. Computer contaminants and viruses include harmful instructions affecting data, programmes or normal computer operations, while damage includes destruction, alteration, deletion, addition, modification or rearrangement of a computer resource.

Section 42 requires every subscriber to exercise reasonable care in retaining control of the private key corresponding to the public key in the Digital Signature Certificate and to prevent its disclosure. If the private key is compromised, the subscriber must communicate the compromise without delay in the prescribed manner. Liability continues until the compromise is communicated.

Acceptance of a Digital Signature Certificate is deemed where a subscriber publishes or authorises publication to persons, places it in a repository, or otherwise manifests approval. By accepting it, the subscriber certifies to reasonable relying persons that they hold and are entitled to hold the corresponding private key, and that representations, relevant material information, and certificate information within their knowledge are true.

Where a subscriber accepts a Digital Signature Certificate whose public key corresponds to the subscriber's private key intended for inclusion in that certificate, the subscriber must generate the corresponding key pair by applying the security procedure. This creates a subscriber obligation concerning cryptographic key generation for an accepted Digital Signature Certificate.

Notice of suspension or revocation of a Digital Signature Certificate must be published by the Certifying Authority in the repository identified in the certificate for that purpose. Where more than one repository is identified, notice must be published in each specified repository.

Digital Signature Certificates may be revoked on request, death, insolvency, dissolution or winding up of a subscriber, false or concealed material information, failure to meet issuance requirements, or compromise of the issuing authority's private key or security system affecting certificate reliability. The subscriber must receive an opportunity of being heard before revocation, and the revocation must then be communicated to the subscriber.

A Digital Signature Certificate may be suspended on the request of the named subscriber or a duly authorised person, or where suspension is considered necessary in the public interest. Suspension beyond fifteen days requires that the subscriber be given an opportunity of being heard. Following suspension, the Certifying Authority must communicate the suspension to the subscriber.

Issuance of a Digital Signature Certificate requires certification of statutory compliance, publication or availability of the certificate to a relying person, and subscriber acceptance. The subscriber must hold a private key corresponding to the listed public key; the private key must create a digital signature and the public key must verify it. The key pair must function properly, certificate information must be accurate, and no known material fact may adversely affect the reliability of these representations.

Applications for electronic signature Certificates must be made in the prescribed form, with the prescribed fee and a certification practice statement or regulatory-compliant statement of particulars. The Certifying Authority may consider the accompanying statement and conduct enquiries before granting or rejecting a certificate. Any rejection must record written reasons and follow a reasonable opportunity for the applicant to show cause against the proposed refusal.

Section 34 requires every Certifying Authority to disclose its electronic signature certificate, relevant certification practice statement, certificate revocation or suspension, and material adverse facts affecting certificate reliability or service capacity. Where events or situations may adversely affect computer-system integrity or certificate conditions, the Authority must reasonably notify likely affected persons or follow its certification practice statement procedure.

Licence surrender is immediately required when a Certifying Authority's licence is suspended or revoked. Failure to surrender the licence to the Controller is an offence by the person in whose favour the licence was issued and attracts a penalty that may extend to five lakh rupees. The monetary penalty framework replaced the earlier sanction of imprisonment, fine, or both from 30 November 2023.

Every Certifying Authority must conspicuously display its licence at the premises where it carries on business. This requirement ensures that the authority's authorisation is visibly available at its operational location.