Section 31 of IT Act 2000: Certifying Authority to ensure compliance of the Act, etc.

Every Certifying Authority shall ensure that every person employed or otherwise engaged by it complies, in the course of his employment or engagement, with the provisions of this Act, rules, regulations and orders made thereunder.

Explained:

Section 31 contains a single statutory provision. It does not have separate numbered subsections or clauses. However, its wording establishes important responsibilities for Certifying Authorities.

1. Responsibility of Every Certifying Authority

The section places a mandatory responsibility on every Certifying Authority to ensure compliance with the Information Technology Act, 2000.

A Certifying Authority is an organisation licensed to issue electronic signature certificates under the applicable legal framework. It must ensure that its operations follow statutory requirements and prescribed security standards.

2. Compliance by Employees

The provision specifically covers every person employed by a Certifying Authority.

Employees involved in certificate issuance, identity verification, technical operations and record maintenance must follow the applicable legal requirements while performing their duties.

3. Persons Otherwise Engaged

Section 31 also covers individuals who are engaged by a Certifying Authority but are not necessarily its direct employees.

This may include contractual personnel, consultants and other authorised service providers working on behalf of the organisation. The purpose is to prevent an organisation from avoiding compliance responsibilities merely because certain functions are performed by external personnel.

4. Compliance with Rules, Regulations and Orders

The provision requires compliance not only with the main Act but also with the rules, regulations and orders made under it.

This includes applicable requirements under the Information Technology (Certifying Authorities) Rules, 2000, and directions issued by the Controller of Certifying Authorities.

Importance of Section 31

Section 31 helps maintain accountability within Certifying Authorities. Its practical importance includes:

• Ensuring employees follow applicable cyber law requirements.
• Promoting responsible electronic certificate management.
• Reducing the possibility of unauthorised activities.
• Strengthening compliance with security and authentication procedures.
• Extending compliance obligations to persons engaged through contractual arrangements.

Important Judgments

There is no widely recognised Supreme Court judgment directly interpreting Section 31. However, the following decisions provide useful context concerning electronic records, authentication and compliance.

1. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872. The judgment is relevant to understanding the importance of reliability and proper handling of electronic information.

2. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements for producing electronic evidence under Section 65B of the Indian Evidence Act, 1872. The decision highlights the importance of following prescribed legal procedures when electronic records are relied upon in court.

These judgments are relevant to the broader electronic-record framework but should not be treated as direct interpretations of Section 31.

Conclusion

Section 31 of the Information Technology Act, 2000, establishes an important compliance responsibility for Certifying Authorities. It requires organisations to ensure that their employees and other engaged persons follow the Act, rules, regulations and applicable orders.