Section 15 of IT Act 2000: Secure electronic signature

An electronic signature shall be deemed to be a secure electronic signature if—

(i) the signature creation data, at the time of affixing signature, was under the exclusive control of signatory and no other person; and

(ii) the signature creation data was stored and affixed in such exclusive manner as may be prescribed.

Explanation.— In case of digital signature, the “signature creation data” means the private key of the subscriber.

Explained:

Section 15 contains two essential conditions and one explanation. Both conditions must be satisfied for an electronic signature to receive the statutory status of a secure electronic signature.

Meaning of Secure Electronic Signature

A secure electronic signature is an electronic signature that satisfies the security conditions specified under Section 15.

The purpose is to establish confidence in electronic authentication by ensuring that the signature creation data remains under the control of the person signing the document and is used in the prescribed manner.

For example, when a company director digitally signs an official document using a valid digital signature mechanism, the security of the signing process becomes important in determining whether the signature qualifies as secure under the Act.

Clause (i): Exclusive Control of Signature Creation Data

Clause (i) provides that the signature creation data must be under the exclusive control of the signatory at the time the electronic signature is affixed.

The expression “exclusive control” is central to this provision. It means that the person signing the document must have control over the data used to create the signature, rather than allowing another person to use it independently.

For instance, if an individual uses a private cryptographic key to digitally sign a contract, that key should remain under that individual’s exclusive control during the signing process.

If the signing credentials are shared with employees, colleagues or unauthorised persons, questions may arise regarding the authenticity and security of the signature.

This condition helps reduce impersonation, unauthorised signing and disputes regarding responsibility for electronic documents.

Clause (ii): Storage and Affixing of Signature Creation Data

Clause (ii) requires the signature creation data to be stored and affixed in the prescribed exclusive manner.

This condition focuses on the secure handling of signature creation data. It is not enough that the signatory controls the data at the moment of signing; the data must also be stored and used in accordance with the prescribed security procedure.

For example, a digital signature system should use appropriate safeguards to protect private keys against unauthorised access, copying or misuse.

The purpose is to maintain the reliability of electronic authentication and reduce the possibility of fraudulent electronic signatures.

Explanation: Meaning of Signature Creation Data in Digital Signatures

The explanation specifically clarifies that, in the case of a digital signature, the expression “signature creation data” means the private key of the subscriber.

A digital signature generally operates through an asymmetric cryptographic system involving a private key and a corresponding public key.

• Private key: Used by the subscriber to create the digital signature and must be protected against unauthorised use.
• Public key: Used by others to verify the digital signature.
• Subscriber: The person in whose name the Digital Signature Certificate is issued.

The private key is particularly important because its security directly affects the reliability of the digital signature. If another person gains unauthorised access to it, the possibility of fraudulent signing increases.

Thus, the explanation connects the legal requirements of Section 15 with the technical functioning of digital signatures.

Importance of Section 15 in Digital Transactions

Section 15 plays an important role in maintaining trust in electronic transactions. Its practical significance can be understood in the following areas.

1. Electronic contracts: Secure electronic signatures help businesses and individuals execute agreements electronically while maintaining appropriate authentication safeguards.

2. Government e-filing: Digital signatures are used in authorised government filing systems, including applications, declarations and statutory submissions.

3. Banking and financial transactions: Protection of signature creation data helps reduce the risk of unauthorised financial approvals and fraudulent electronic authentication.

4. Corporate documentation: Directors, authorised representatives and professionals can use qualifying electronic signatures for permitted corporate documents and electronic filings.

5. Prevention of cyber fraud: Exclusive control over signature creation data helps establish accountability and reduces the risk of impersonation and unauthorised document execution.

Important Judgments

Judicial interpretation of secure electronic signatures is still developing. The following decisions provide relevant legal context. The distinction between a judgment directly applying Section 15 and one dealing with broader electronic authentication or evidence principles is important.

1. Shyam Lal v. Secretary, RPSC, Ajmer and Another (2017)

This case is identified in legal databases among the judgments associated with Section 15 of the Information Technology Act, 2000. The dispute arose in the context of recruitment and examination-related proceedings involving the Rajasthan Public Service Commission.

Relevance: The case is useful when researching the legal treatment of electronic authentication in administrative and recruitment-related matters. It should be read in its full factual and legal context before attributing a specific interpretation of the exclusive-control requirement to the Court. Information Technology Act, 2000

2. State of Maharashtra v. Dr. Praful B. Desai (2003)

Court: Supreme Court of India

The Supreme Court considered whether evidence could be recorded through video conferencing and recognised the use of technology in judicial proceedings.

Relevance: Although this case does not directly interpret Section 15, it demonstrates the judiciary’s acceptance of technology-based procedures in the administration of justice. It provides broader context for understanding the growing role of electronic systems in legal processes.

3. Anvar P.V. v. P.K. Basheer (2014)

Court: Supreme Court of India

The Supreme Court examined the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872.

Relevance: The judgment explains the importance of satisfying legal requirements when electronic records are produced as evidence. It is relevant to disputes involving electronically authenticated documents, although its principal subject is electronic evidence rather than secure electronic signatures under Section 15.

4. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

Court: Supreme Court of India

The Supreme Court clarified the requirements concerning certification of electronic records under Section 65B of the Indian Evidence Act, 1872.

Relevance: The decision highlights the importance of proper handling and authentication of electronic records in court proceedings. It should not be treated as a direct ruling on the two conditions prescribed under Section 15.

For current proceedings, the applicable evidentiary framework under the Bharatiya Sakshya Adhiniyam, 2023, should also be considered.

Difference Between Sections 14, 15 and 16 of the IT Act

These three provisions form an important part of Chapter V of the Information Technology Act, 2000.

Section 14 focuses on the security of electronic records, Section 15 focuses on the security of electronic signatures, and Section 16 provides the framework for prescribing relevant security procedures. legislations.in+1

Legal Consequences of Failure to Maintain Signature Security

Failure to maintain exclusive control over signature creation data can create serious legal and practical problems.

• Unauthorised signing: Another person may misuse the signatory’s private key or credentials.
• Disputes regarding authenticity: The parties may dispute whether the electronic signature was genuinely created by the person concerned.
• Security breaches: Compromised signature creation data can expose confidential business and financial information.
• Evidentiary difficulties: The person relying on the electronic document may face challenges in establishing its authenticity and reliability.

However, failure to satisfy Section 15 does not automatically make every electronic signature invalid. It means that the signature may not qualify for the special status of a secure electronic signature under this provision. Its legal validity must be assessed under the other applicable provisions and facts.

Conclusion

Section 15 of the Information Technology Act, 2000, provides an important legal framework for secure electronic signatures in India. By requiring exclusive control over signature creation data and compliance with prescribed storage and signing procedures, the provision promotes reliable electronic authentication.

The two conditions under Section 15 are particularly significant for businesses, government departments, financial institutions and individuals who regularly execute electronic documents.