Information Technology Act Section 89 — Power of Controller to make regulations
CHAPTER XIII MISCELLANEOUS
Cyber Law
Summary
Sub-section (1) allows the Controller to create regulations to carry out the purposes of this Act. These regulations must be consistent with the Act and the rules made under it. The Controller can only make these regulations after consulting the Cyber Regulations Advisory Committee and getting the previous approval of the Central Government, and they must be published in the Official Gazette.
Sub-section (2) lists the specific matters for which the regulations may provide. Under clause (a), regulations may cover the details for maintaining a database that contains the disclosure record of every Certifying Authority, as referred to in clause (n) of section 18. Under clause (b), regulations may set the conditions and restrictions under which the Controller can recognise a foreign Certifying Authority, as mentioned in sub-section (1) of section 19. Under clause (c), regulations may specify the terms and conditions for granting a licence, as referred to in clause (c) of sub-section (3) of section 21. Under clause (d), regulations may cover other standards that a Certifying Authority must follow, as referred to in clause (d) of section 30. Under clause (e), regulations may determine the manner in which a Certifying Authority must disclose the matters specified in sub-section (1) of section 34. Under clause (f), regulations may specify the particulars of the statement that must accompany an application under sub-section (3) of section 35. Under clause (g), regulations may set the manner by which a subscriber must communicate the compromise of their private key to the Certifying Authority, as referred to in sub-section (2) of section 42.
Sub-section (3) requires that every regulation made under this Act be laid before each House of Parliament as soon as possible after it is made. It must remain before Parliament for a total period of thirty days, which can be in one session or across two or more successive sessions. If, before the expiry of the session immediately following those sessions, both Houses agree to modify the regulation or agree that it should not be made, the regulation will then have effect only in the modified form or have no effect at all. However, any such modification or annulment will not affect the validity of anything already done under that regulation before the modification or annulment.
Official Text
(1) The Controller may, after consultation with the Cyber Regulations Advisory Committee and with the previous approval of the Central Government, by notification in the Official Gazette, make regulations consistent with this Act and the rules made thereunder to carry out the purposes of this Act.
(2) In particular, and without prejudice to the generality of the foregoing power, such regulations may provide for all or any of the following matters, namely:–
(a) the particulars relating to maintenance of data base containing the disclosure record of every Certifying Authority under clause 1[(n)] of section 18;
(b) the conditions and restrictions subject to which the Controller may recognise any foreign Certifying Authority under sub-section (1) of section 19;
(c) the terms and conditions subject to which a licence may be granted under clause (c) of sub-section (3) of section 21;
(d) other standards to be observed by a Certifying Authority under clause (d) of section 30;
(e) the manner in which the Certifying Authority shall disclose the matters specified in sub-section (1) of section 34;
(f) the particulars of statement which shall accompany an application under sub-section (3) of section 35.
(g) the manner by which the subscriber shall communicate the compromise of private key to the Certifying Authority under sub-section (2) of section 42.
(3) Every regulation made under this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if, before the expiry of the session immediately following the session or the successive sessions aforesaid, both Houses agree in making any modification in the regulation or both Houses agree that the regulation should not be made, the regulation shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that regulation.