CHALLENGES AND CONTEMPORARY RELEVANCE

 THE REDWOOD JOURNAL  Website: www.the redwood journal.com VOLUME:-5 ISSUE NO:-5 , SEPTEMBER 2, 2026  ISSN (ONLINE):- 3139-7360  Email: theredwoodjournal@gmail.com  Digital Number : 2025-23534643  CC BY-NC-SA  Authored By:- Sneha Mishra   THE INFORMATION TECHNOLOGY ACT, 2000: EVOLUTION, CHALLENGES AND CONTEMPORARY RELEVANCE   DOWNLOAD FULL PAPER: THE INFORMATION TECHNOLOGY ACT, 2000 EVOLUTION, CHALLENGES AND CONTEMPORARY RELEVANCE   Abstract The Information Technology Act, 2000 was India’s first comprehensive attempt to give the law a place in electronic commerce and digital communication. It gave legal recognition to electronic records and digital signatures and, at the same time, created a set of computer-related offences. This article traces how the Act developed, starting from its roots in the UNCITRAL Model Law on Electronic Commerce and moving through the major amendment of 2008, which brought in provisions on cyber terrorism, the protection of sensitive personal data and the liability of intermediaries. The study is doctrinal. It reads the statutory text, the leading judicial decisions and the institutions set up under the Act, and it places them alongside the position in other jurisdictions. The main finding is that the Act still provides the legal base for India’s digital economy, but it has been slow to respond to artificial intelligence, crypto-assets, cloud computing and cross-border cybercrime, and that its relationship with the Digital Personal Data Protection Act, 2023 remains unsettled during the transition. The article ends with suggestions for reform, among them a clear handover of data protection to the new statute without losing the remedies the old one offered, statutory (rather than only rule-based) provisions for AI-related harms, and regular legislative review. Keywords: Information Technology Act 2000, cyber law, digital signature, intermediary liability, cybercrime. Introduction When Parliament passed the Information Technology Act, 2000, the internet was only beginning to change how Indians bought, sold and communicated. The Act had two main aims. The first was to make electronic transactions and digital signatures legally valid so that online commerce could grow with some certainty. The second was to provide a legal framework for punishing offences committed through computers and networks. Before 2000, Indian law had no way of recognising an electronic contract, an electronic record or a digital signature. Businesses that wanted to deal online could not be sure their agreements would hold, and computer misuse fell into a gap that existing criminal law had never been written to cover. The Act follows the UNCITRAL Model Law on Electronic Commerce, 1996, which the UN General Assembly commended to member states when they made or revised their own laws. The statute has been amended since, most importantly by the Information Technology (Amendment) Act, 2008. That amendment answered a growing list of problems, including cyber terrorism, identity theft and data breaches, and it set out the intermediary liability rules that still shape how online platforms are regulated in India. The subject deserves attention now because the Act is still central to digital governance even though newer laws have been layered over it. The Digital Personal Data Protection Act, 2023 is the clearest example. It covers ground that the IT Act touched only partly, and the two statutes will sit side by side until the transition is complete. This study has four objectives: to trace the legislative history of the Act; to examine its main provisions on electronic records, digital signatures, cybercrime and intermediary liability; to analyse how the courts have read them; and to ask whether the Act remains adequate for present-day technology. In doing so it asks how the Act has adapted, what gaps are left, and how India’s approach compares with that of other countries. The method is doctrinal, relying on statutory text, case law and secondary legal writing. It does not attempt an empirical assessment of how the Act is enforced. Evolution of the Act By the late 1990s the Government of India had accepted that growing electronic commerce needed a legal framework if businesses and consumers were to have any certainty. The Act was passed in 2000 and borrowed heavily from the UNCITRAL Model Law. Its first version was mostly about enabling transactions: it recognised electronic records and digital signatures and created the office of the Controller of Certifying Authorities to oversee digital signature certificates. A few offences, such as hacking and unauthorised access, were included, but over the next decade it became clear that these were too thin to deal with the many forms cybercrime was taking. The weakness was exposed most sharply in the Bazee.com episode, which showed how little the original Act said about an intermediary’s responsibility for content posted by others. That case, together with the report of an expert committee set up by the Ministry of Communications and Information Technology, led to the Information Technology (Amendment) Act, 2008, which came into force in 2009. The amendment widened the Act considerably. It added Section 66A on offensive messages sent through communication services, Section 66F on cyber terrorism, and Section 43A on the duty of body corporates to protect sensitive personal data. It also replaced the earlier provisions on interception and decryption with a wider Section 69, and it recast Section 79 into a conditional safe harbour for intermediaries who observe due diligence. With these changes the Act stopped being mainly a statute for facilitating commerce and became a broader cyber law. Its shape has kept changing since, most notably when Section 66A was struck down in 2015. The Indian Legal Framework The Act is built around a few main parts. Chapter II provides for the authentication of electronic records through digital and electronic signatures. Chapter III then lays down the principle of legal recognition: where any law requires information to be in writing or in a particular form, that requirement is met if the information is in electronic form and can be accessed for later reference. Computer-related wrongs are dealt with in two places. Section 43, in Chapter IX, imposes civil liability for acts such as unauthorised access, data theft, introducing viruses and denial of service. Chapter XI contains the criminal offences,