Section 29 of IT Act 2000: Access to computers and data

(1) Without prejudice to the provisions of sub-section (1) of section 69, the Controller or any person authorised by him shall, if he has reasonable cause to suspect that [any contravention of the provisions of this Chapter] has been committed, have access to any computer system, any apparatus, data or any other material connected with such system, for the purpose of searching or causing a search to be made for obtaining any information or data contained in or available to such computer system.

(2) For the purposes of sub-section (1), the Controller or any person authorised by him may, by order, direct any person in charge of, or otherwise concerned with the operation of, the computer system, data apparatus or material, to provide him with such reasonable technical and other assistance as he may consider necessary.

Explained:

Section 29 contains two subsections. The first deals with access to computer systems and electronic information, while the second provides for obtaining technical assistance from persons responsible for operating those systems.

Section 29(1): Power to Access Computers and Data

Section 29(1) authorises the Controller or a person authorised by him to access a computer system, apparatus, data or other material connected with that system.

However, this power is not unlimited. The provision requires the existence of reasonable cause to suspect that a contravention of the provisions of Chapter VI has been committed.

The purpose of accessing the computer system is to search for information or data contained in or available through that system.

Important elements of Section 29(1):

• Authorised authority: Access may be exercised by the Controller or a person authorised by him.
• Reasonable suspicion: There must be reasonable cause to suspect a contravention covered by the provision.
• Computer system access: The authority may access relevant computer systems, apparatus and connected materials.
• Purpose of search: The access must be for obtaining information or data relevant to the suspected contravention.

For example, where there is reasonable cause to suspect that a Certifying Authority has violated regulatory requirements under Chapter VI, the Controller may access relevant computer systems and examine associated electronic records.

Section 29(2): Power to Require Technical Assistance

Section 29(2) supports the exercise of the power provided under subsection (1).

It authorises the Controller or an authorised person to issue an order directing a person responsible for operating or managing the computer system, data apparatus or connected material to provide reasonable technical and other assistance.

Such assistance may be necessary when the authority cannot independently access or understand the relevant electronic information.

For example, if relevant information is maintained in a specialised database, the person responsible for operating that system may be directed to provide appropriate technical assistance to facilitate the search.

The important conditions are:

• There must be an order issued by the Controller or an authorised person.
• The direction must be addressed to a person in charge of or otherwise concerned with operating the relevant system or material.
• The assistance required must be reasonable.
• The assistance must relate to the purpose of subsection (1).

This subsection helps ensure that technical difficulties do not prevent a lawful examination of relevant electronic records.

Importance of Section 29 in Cyber Law

Section 29 plays an important role in regulating Certifying Authorities and maintaining confidence in electronic authentication systems.

Its practical importance can be understood in the following areas:

1. Regulatory supervision of Certifying Authorities

Certifying Authorities perform important functions relating to the issuance and management of electronic signature certificates. Access to relevant computer systems helps the Controller examine whether these authorities comply with the statutory requirements under Chapter VI.

2. Investigation of electronic records

Electronic records may contain important information concerning the operation of a Certifying Authority. Section 29 provides a mechanism for accessing such information when the statutory conditions are satisfied.

3. Prevention of misuse

The provision helps regulatory authorities examine suspected violations involving electronic authentication systems and related infrastructure.

4. Technical cooperation

Modern computer systems often require specialised knowledge. Subsection (2) allows the authority to obtain reasonable technical assistance from persons responsible for operating the relevant systems.

5. Protection of trust in digital transactions

Proper regulation and supervision of electronic authentication systems help maintain confidence in digital transactions, electronic certificates and online services.

Important Judgments

There are limited reported judgments directly interpreting Section 29 of the Information Technology Act, 2000. However, the following Supreme Court decisions provide important constitutional principles concerning government access to private information, searches and informational privacy.

1. District Registrar and Collector, Hyderabad v. Canara Bank (2005)

The Supreme Court examined the validity of provisions permitting government authorities to inspect private documents held by banks. The Court considered the confidentiality of banking records and the privacy rights of customers.

Relevance: The judgment emphasises that government access to private records cannot become an unrestricted or arbitrary exercise of power. It is relevant when considering the need for safeguards while exercising statutory access powers over computer systems and electronic information.

2. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

The nine-judge Constitution Bench of the Supreme Court unanimously recognised the right to privacy as a fundamental right under the Indian Constitution.

The judgment explained that informational privacy is an important part of individual privacy and that government action affecting privacy must satisfy constitutional requirements.

Relevance: Section 29 involves access to computer systems and electronic data. The constitutional principles explained in Puttaswamy are important when considering whether an exercise of such statutory power is lawful, necessary and proportionate.

These decisions provide constitutional guidance; neither should be represented as a direct interpretation of Section 29. Indian Kanoon+2

Difference Between Section 28 and Section 29

Sections 28 and 29 operate together within the regulatory framework governing Certifying Authorities, but they serve different purposes.

Section 28 provides the investigation framework, whereas Section 29 specifically deals with accessing computer systems and obtaining electronic information.

Conclusion

Section 29 of the Information Technology Act, 2000, is an important provision for regulating Certifying Authorities and examining suspected violations involving electronic authentication systems. It empowers the Controller or an authorised person to access relevant computer systems and obtain information when there is reasonable cause to suspect a contravention of Chapter VI.

Subsection (1) establishes the power of access and search, while subsection (2) enables the authority to obtain reasonable technical assistance from persons responsible for operating the relevant systems.