Section 28 of IT Act 2000: Power to investigate contraventions

Section 28(1)

The Controller or any person authorised by him in this behalf shall take up for investigation any contravention of the provisions of this Act, rules or regulations made thereunder.

Section 28(2)

The Controller or any person authorized by him in this behalf shall exercise the same powers which are conferred on the Income-tax authorities under Chapter XIII of the Income-tax Act, 1961 and shall exercise such powers, subject to such limitations laid down under that Act.

Explained:

Section 28 contains two subsections. The first deals with the authority to investigate contraventions, while the second explains the investigative powers available to the Controller and authorised officers.

Section 28(1): Power to investigate contraventions

Section 28(1) authorises the Controller or an officer specifically authorised by the Controller to investigate violations of the Information Technology Act, 2000, and the rules and regulations made under it.

The purpose of this provision is to ensure that persons and organisations operating within the regulatory framework comply with their statutory responsibilities.

For example, if a licensed Certifying Authority fails to follow prescribed security procedures, issues certificates without complying with applicable requirements or violates regulatory obligations, the Controller may take up the matter for investigation.

The important elements of this subsection are:

• Controller: The Controller of Certifying Authorities is the regulatory authority responsible for functions assigned under the Act.
• Authorised officer: An officer must have the necessary authorisation to exercise investigative powers under this provision.
• Contravention: An investigation may concern a violation of the Act, its rules or regulations.
• Investigation: The provision enables examination of the alleged violation and collection of relevant information.

This subsection helps maintain regulatory discipline and accountability among entities involved in electronic authentication.

Section 28(2): Powers similar to Income-tax authorities

Section 28(2) gives the Controller and authorised officers powers similar to those conferred on Income-tax authorities under Chapter XIII of the Income-tax Act, 1961.

This is an important provision because an investigation may require access to records, documents, financial information and other relevant material.

The powers are not unlimited. They must be exercised subject to the limitations and conditions prescribed under the Income-tax Act.

The purpose of this subsection is to provide the investigating authority with effective legal powers while ensuring that the exercise of those powers remains within the statutory framework.

Important: Section 28 does not independently confer every power of a civil court. It specifically incorporates the relevant powers of Income-tax authorities under Chapter XIII, subject to statutory limitations.

Objectives and Importance of Section 28

Section 28 is important for maintaining transparency and accountability in the electronic signature certification system. Its major objectives include:

1. Regulatory compliance: It enables the Controller to investigate violations of statutory requirements by entities operating under the Act.

2. Protection of electronic transactions: Investigation of regulatory violations helps maintain confidence in electronic signature certificates and authentication services.

3. Accountability of Certifying Authorities: Certifying Authorities must comply with the applicable licensing conditions, security requirements and regulatory obligations.

4. Prevention of misuse: Investigative powers help identify irregularities, improper certification practices and other violations affecting the reliability of electronic authentication.

5. Effective enforcement: By incorporating specified investigative powers under the Income-tax Act, Section 28 provides a mechanism for examining alleged contraventions.

Important Judgments

The following decisions are relevant to understanding the investigation and regulatory powers under the Information Technology Act.

1. Hero MotoCorp Ltd. v. Controller of Certifying Authorities and Another (Delhi High Court, 23 February 2016)

This matter was decided by the Delhi High Court in W.P. (C) No. 3478 of 2014. It is specifically indexed among decisions concerning Section 28 of the Information Technology Act.

Legal relevance: The case is useful when researching the exercise of regulatory authority by the Controller of Certifying Authorities and the legal issues arising from the administration of the electronic certification framework. The precise observations and final findings should be checked in the complete judgment before relying on it for a particular interpretation of Section 28. Information Technology Act, 2000

2. Shreya Singhal v. Union of India (2015)

The Supreme Court examined the constitutional validity of provisions of the Information Technology Act, particularly Section 66A, and considered the relationship between online expression and constitutional freedom of speech.

Legal relevance: Although this case did not directly interpret Section 28, it is important for understanding that powers exercised under the Information Technology Act must remain consistent with constitutional protections, including Article 19(1)(a) and the permissible restrictions under Article 19(2).

3. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872.

Legal relevance: Investigations involving electronic records may require the collection and preservation of digital material. This judgment is important for understanding the evidentiary requirements applicable to electronic records. It does not directly interpret the investigative powers under Section 28.

4. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements relating to certification of electronic evidence under Section 65B of the Indian Evidence Act, 1872.

Legal relevance: The judgment highlights the importance of proper handling and production of electronic records in legal proceedings. It is relevant to the evidentiary aspects of digital investigations, rather than being a direct ruling on Section 28.

Note: The judgments listed above have different degrees of relevance. Only the Hero MotoCorp matter is specifically indexed in connection with Section 28; the other decisions provide broader legal context.

Difference Between Section 28 and Section 29 of the IT Act, 2000

Both provisions deal with regulatory investigation, but they address different aspects of the investigative process.

Section 29 is particularly relevant to obtaining electronic information during an investigation. Section 28 establishes the broader investigative authority.

Practical Examples of Section 28

The application of Section 28 can be understood through the following examples:

• Violation by a Certifying Authority: If a Certifying Authority fails to comply with statutory requirements while issuing electronic signature certificates, the Controller may investigate the alleged violation.
• Improper maintenance of records: If an organisation fails to maintain records required under applicable regulations, the matter may be examined by the authorised authority.
• Regulatory non-compliance: If a Certifying Authority fails to follow prescribed procedures or regulatory directions, the Controller may initiate an investigation.
• Suspected misuse of certification services: Where there are allegations of irregularities in electronic certification activities, the Controller may examine the relevant records and circumstances.

Relationship with Other Provisions of the Information Technology Act

Section 28 should be understood alongside other provisions governing Certifying Authorities.

These provisions collectively establish the regulatory framework for electronic signature certification in India.

Conclusion

Section 28 of the Information Technology Act, 2000, is an important provision that empowers the Controller of Certifying Authorities and authorised officers to investigate violations of the Act, its rules and regulations.

Its two subsections establish the authority to investigate contraventions and provide investigative powers similar to those available to Income-tax authorities under Chapter XIII of the Income-tax Act, 1961, subject to the applicable statutory limitations.

The provision helps maintain accountability among Certifying Authorities and supports the reliability of India’s electronic signature infrastructure. Understanding Section 28 is particularly important for legal professionals, cyber law practitioners, Certifying Authorities, businesses and individuals dealing with electronic authentication and digital certification.