Section 51 of the Information Technology Act, 2000, concerning the term of office and conditions of service of the Chairperson and Members of the Appellate Tribunal, stands omitted.

Section 50 of the Information Technology Act, 2000 stands omitted with effect from 26 May 2017, leaving no statutory qualifications in that provision for appointment of the Chairperson and Members of the Cyber Appellate Tribunal. Previously, the Chairperson required High Court judicial eligibility, while Members required specified professional expertise and senior government-service experience. Judicial Members required senior Indian Legal Service experience.

Composition of the Cyber Appellate Tribunal under section 49 of the Information Technology Act, 2000 was omitted with effect from 26 May 2017 through the Finance Act, 2017. Before omission, the Tribunal consisted of one person, described as its Presiding Officer, appointed by the Central Government through notification.

Section 48 designates the Telecom Disputes Settlement and Appellate Tribunal as the Appellate Tribunal for purposes of the Information Technology Act, 2000, from commencement of Part XIV of Chapter VI of the Finance Act, 2017. The Tribunal exercises the jurisdiction, powers and authority conferred under that framework. Its jurisdiction is exercised only in relation to matters and places specified through Central Government notification.

Compensation quantum under the Information Technology Act, 2000 is adjudged by the adjudicating officer with due regard to quantifiable gain or unfair advantage from the default, loss caused to any person by the default, and the repetitive nature of the default. These factors guide assessment of compensation within the penalties, compensation and adjudication framework.

Section 46 provides for adjudicating officers to inquire into information technology contraventions that may attract penalties or compensation. Their jurisdiction extends to damage claims not exceeding five crore rupees, with higher claims assigned to the competent court. Appointment requires prescribed information technology and legal or judicial experience. Following a reasonable opportunity for representation, an officer may impose penalty or award compensation upon finding a contravention. Officers have specified civil-court powers, and their proceedings carry judicial and civil-court status for prescribed purposes.

Section 45 creates a residuary penalty for contravention of rules, regulations, directions or orders where no separate penalty is prescribed. The contravener is liable for a penalty up to one lakh rupees, in addition to compensation payable to the affected person. Higher compensation applies to an intermediary, company or body corporate than to any other person.

Section 44 of the Information Technology Act, 2000 imposes penalties for failures to furnish required documents, returns or reports, file returns or provide information within prescribed time limits, and maintain books of account or records. Non-furnishing may attract a penalty up to fifteen lakh rupees for each failure, while delayed filings and record-keeping failures may attract daily penalties up to fifty thousand rupees and one lakh rupees respectively during the continuing default.

Section 43 imposes compensatory liability on a person who, without permission of the owner or person in charge, interferes with a computer, computer system, computer network or computer resource. Covered conduct includes unauthorised access, data extraction, introduction of contaminants or viruses, damage or disruption, denial of authorised access, facilitating prohibited access, manipulation of service charges, harmful alteration of information, and intentional theft, concealment, destruction or alteration of source code to cause damage.

Subscribers must exercise reasonable care to retain control of the private key corresponding to the public key recorded in their Digital Signature Certificate and prevent its disclosure. If the private key is compromised, they must notify the Certifying Authority without delay in the prescribed manner. Liability continues until the Certifying Authority receives notice of the compromise.

Acceptance of a Digital Signature Certificate is deemed where a subscriber publishes or authorises publication to persons, places it in a repository, or otherwise manifests approval. By accepting it, the subscriber certifies to reasonable relying persons that they hold and are entitled to hold the corresponding private key, and that representations, relevant material information, and certificate information within their knowledge are true.

Where a subscriber accepts a Digital Signature Certificate whose public key corresponds to the subscriber's private key intended for inclusion in that certificate, the subscriber must generate the corresponding key pair by applying the security procedure. This creates a subscriber obligation concerning cryptographic key generation for an accepted Digital Signature Certificate.

Notice of suspension or revocation of a Digital Signature Certificate must be published by the Certifying Authority in the repository identified in the certificate for that purpose. Where more than one repository is identified, notice must be published in each specified repository.

Digital Signature Certificates may be revoked on request, death, insolvency, dissolution or winding up of a subscriber, false or concealed material information, failure to meet issuance requirements, or compromise of the issuing authority's private key or security system affecting certificate reliability. The subscriber must receive an opportunity of being heard before revocation, and the revocation must then be communicated to the subscriber.

A Digital Signature Certificate may be suspended on the request of the named subscriber or a duly authorised person, or where suspension is considered necessary in the public interest. Suspension beyond fifteen days requires that the subscriber be given an opportunity of being heard. Following suspension, the Certifying Authority must communicate the suspension to the subscriber.

Issuance of a Digital Signature Certificate requires certification of statutory compliance, publication or availability of the certificate to a relying person, and subscriber acceptance. The subscriber must hold a private key corresponding to the listed public key; the private key must create a digital signature and the public key must verify it. The key pair must function properly, certificate information must be accurate, and no known material fact may adversely affect the reliability of these representations.

Applications for electronic signature Certificates must be made in the prescribed form, with the prescribed fee and a certification practice statement or regulatory-compliant statement of particulars. The Certifying Authority may consider the accompanying statement and conduct enquiries before granting or rejecting a certificate. Any rejection must record written reasons and follow a reasonable opportunity for the applicant to show cause against the proposed refusal.

Section 34 requires every Certifying Authority to disclose its electronic signature certificate, relevant certification practice statement, certificate revocation or suspension, and material adverse facts affecting certificate reliability or service capacity. Where events or situations may adversely affect computer-system integrity or certificate conditions, the Authority must reasonably notify likely affected persons or follow its certification practice statement procedure.

Licence surrender is immediately required when a Certifying Authority's licence is suspended or revoked. Failure to surrender the licence to the Controller is an offence by the person in whose favour the licence was issued and attracts a penalty that may extend to five lakh rupees. The monetary penalty framework replaced the earlier sanction of imprisonment, fine, or both from 30 November 2023.

Every Certifying Authority must conspicuously display its licence at the premises where it carries on business. This requirement ensures that the authority's authorisation is visibly available at its operational location.