IT Act as Civil and Criminal Legislation: Section 43 vs Section 66

The IT Act is sometimes described simply as India's cybercrime law, but that is only half the picture. The Act is a hybrid. It facilitates electronic commerce, regulates Certifying Authorities and intermediaries, provides a civil remedy of compensation decided by adjudicating officers, and creates criminal offences tried by the ordinary criminal courts. The same act, such as copying data without permission, can lead down both the civil and the criminal road. This note explains the hybrid character, the two tracks, how they differ, and how they run together.

1. Two Roads from One Wrong

When a car hits a pedestrian, two things can follow. The pedestrian may claim compensation before a tribunal, where he must show only that the driver was more likely than not at fault. And the State may prosecute the driver, where it must prove guilt beyond reasonable doubt. The two roads start from the same accident but lead to different places: one ends in money for the victim, the other in punishment for the wrongdoer. The IT Act builds the same two roads for wrongs done through computers.

2. The Hybrid Character of the Act

Figure 1: Four faces of the IT Act

• Facilitative. Chapters II to V give legal effect to electronic records, signatures, contracts and e-governance. They create no liability at all.
• Regulatory. Chapters VI to VIII and XII, and Sections 69 to 70B, regulate Certifying Authorities, subscribers and intermediaries, and give the State powers of interception, blocking and cyber security.
• Civil. Chapters IX and X provide penalties and compensation, adjudicated by officers with the powers of a civil court, with appeals to the Tribunal and the High Court.
• Criminal. Chapter XI creates offences punishable with imprisonment and fine, investigated by the police and tried by criminal courts.

3. The Civil Track

• Wrongs. The ten acts in Section 43, negligence in securing sensitive personal data (s.43A), failure to furnish information or maintain records (s.44), and residuary contraventions of the rules (s.45)
• Nature of Section 43. Often described as a 'cyber tort'. Like trespass, it requires no wrongful intention; doing the act without the owner's permission is enough.
• Adjudicating officer (s.46). An officer of the rank of Director to the Government of India or equivalent decides claims up to ₹5 crore after giving a reasonable opportunity of being heard. He has the powers of a civil court for summoning, discovery and evidence, and his proceedings are deemed judicial proceedings.
• Quantum (s.47). The amount of gain or unfair advantage, the loss caused to any person, and the repetitive nature of the default.
• Compounding (s.63). A contravention may be compounded by the Controller, an authorised officer or the adjudicating officer, before or after adjudication begins, but not where the person commits the same or a similar contravention within three years of an earlier compounding.
• Recovery (s.64). Unpaid penalty or compensation is recovered as arrears of land revenue, and the person's licence or electronic signature certificate is suspended until payment.
• Appeals. To the Appellate Tribunal, now TDSAT, within 45 days (s.57), except from an order made with the consent of the parties; then to the High Court within 60 days on any question of fact or law (s.62)
• Civil courts. Barred for matters within the officer's and Tribunal's jurisdiction (s.61), but claims above ₹5 crore go to the competent civil court.

4. The Criminal Track

• Offences. Sections 65 to 74, including Section 66, which converts every Section 43 act into an offence when done dishonestly or fraudulently (see Topic 7). Since 30 November 2023, Sections 67C, 68, 72 and 72A are civil penalties rather than offences.
• Investigation. By a police officer not below the rank of Inspector (s.78)
• Classification. Offences punishable with three years or more are cognizable, and those punishable with three years are bailable (s.77B)
• Trial. By a Magistrate or Court of Session according to the BNSS schedule for offences under other laws; cyber terrorism, punishable with life imprisonment, goes to the Court of Session.
• Compounding (s.77A). By a competent court, for offences punishable with up to three years, except where there is a previous conviction attracting enhanced punishment, or the offence affects socio-economic conditions or is committed against a child or a woman.
• Outcome. Imprisonment, fine and confiscation of the computer and accessories used (s.76)

5. The Two Tracks Compared

Figure 2: Civil and criminal tracks under the IT Act

• Aim. Civil: restoring the victim. Criminal: punishing the offender and deterring others.
• Initiated by. Civil: the affected person, by an application to the adjudicating officer. Criminal: the State, usually on an FIR.
• Mental element. Civil: none needed under Section 43; negligence under Section 43A. Criminal: dishonesty, fraud, knowledge or intention.
• Standard of proof. Civil: preponderance of probabilities. Criminal: beyond reasonable doubt.
• Outcome. Civil: compensation or penalty. Criminal: imprisonment, fine or confiscation.

Figure 3: One act, two roads

6. Parallel Proceedings

Figure 4: Why both tracks can run together

• Section 77. No compensation awarded, penalty imposed or confiscation made under the IT Act prevents the award of compensation or imposition of any other penalty or punishment under any other law.
• No double jeopardy. Article 20(2) bars a second prosecution and punishment for the same offence. A civil claim for compensation is not a prosecution, so civil and criminal proceedings can both proceed.
• M.S. Sheriff v. State of Madras, AIR 1954 SC 397. Civil and criminal proceedings arising from the same facts may proceed simultaneously; there is no hard rule that one must wait for the other, though criminal matters are ordinarily given precedence. Findings in one are not binding in the other.
• Practical effect. A company whose data is stolen may seek compensation from the employee before the adjudicating officer while the police prosecute the same employee under Section 66.

7. Assessment

• Strength. A victim gets a cheap, specialised forum for compensation without waiting for a criminal trial, and the State retains its power to punish.
• Weakness. Adjudicating officers are serving civil servants with other duties, awareness of the civil track is low, and many victims go only to the police.
• Future. The DPDP Act adds another civil-regulatory track, with penalties imposed by the Data Protection Board but no compensation for the individual.

8. Quick Revision and Memory Aids

• 'Two roads from one wrong'. Civil compensation and criminal punishment.
• 'Facilitate, regulate, compensate, punish'. The four faces of the Act.
• '43 is a cyber tort'. No intention needed.
• 'Officer, TDSAT, High Court: 45 and 60 days'. The civil appeal route.
• '63 compounds contraventions, 77A compounds offences'. Two different compounding provisions.
• '77 lets both run'. Parallel proceedings.

9. Frequently Asked Questions

Is the IT Act a civil or a criminal law?

Both, and more. It is facilitative (Chapters II to V), regulatory (Chapters VI to VIII and XII), civil (Chapters IX and X) and criminal (Chapter XI).

Can civil and criminal proceedings under the IT Act run at the same time?

Yes. Section 77 provides that compensation or penalty under the Act does not bar punishment under any other law, and civil and criminal proceedings on the same facts may proceed simultaneously (M.S. Sheriff v. State of Madras, 1954).

Who decides civil claims under the IT Act?

An adjudicating officer under Section 46 for claims up to ₹5 crore, with appeal to TDSAT and then the High Court; claims above ₹5 crore go to the competent civil court.

10. Related Topics

• Topic 7: Contraventions and Offences. The provisions of each track.
• Topic 11: IT Act as Special Legislation. How the Act relates to other laws.