Jan Vishwas Act, 2023 and the IT Act: Decriminalisation and New Penalties

The Jan Vishwas Act, 2023 is a single statute that edited 42 others. For the IT Act it did three things at once: it removed the void Section 66A, turned five minor offences into civil penalties, and made fines for corporate and platform defaults large enough to matter. Topic 38 placed these changes in the wider story of the Act's rationalisation. This note is the close reading: each amended section with its before and after position, how the new penalties are enforced, which provisions stayed criminal, and the questions that arise for cases pending on 30 November 2023.

1. Chains to Fences

A school once punished every late arrival with detention, whether the pupil was five minutes late or had skipped a week. The new principal keeps detention for bullying and cheating, but switches lateness and missing homework to fines paid by the parents, and raises the fines so that nobody ignores them. That is the logic of Jan Vishwas: trust the citizen, fine the lapse, prosecute only the wrong.

2. The Legislative Journey and Commencement

Figure 1: From Bill to commencement

• The Act. Act 18 of 2023, amending 183 provisions in 42 Central Acts administered by 19 Ministries. The Bill was examined by a Joint Parliamentary Committee before passage.
• IT Act entries. Serial number 32 of the Schedule to the Act amends eleven sections of the IT Act.
• Commencement. Each entry takes effect on a date the Government appoints. For the IT Act, notification S.O. 4745(E) dated 31 October 2023 appointed 30 November 2023.

Figure 2: Five kinds of change to the IT Act

3. Section-by-Section Amendments

Figure 3: The IT Act before and after 30 November 2023

Section 33: surrender of licence

A Certifying Authority whose licence is suspended or revoked must surrender it to the Controller. Failure was an offence punishable with up to six months or ₹10,000 or both; it is now a penalty of up to ₹5 lakh.

Section 44: failure to furnish information, returns or books

All three limbs were multiplied by ten: failure to furnish documents or reports, up to ₹15 lakh per failure; failure to file returns or information on time, up to ₹50,000 per day; failure to maintain books of account or records, up to ₹1 lakh per day. Section 44 was already civil; only the amounts changed.

Section 45: residuary penalty

For a contravention with no separate penalty, the old cap was compensation or penalty of ₹25,000. Now the person is liable to a penalty of up to ₹1 lakh and, in addition, to compensation to the affected person of up to ₹10 lakh where the contravener is an intermediary, company or body corporate, or up to ₹1 lakh for any other person. The split puts the heavier burden on platforms and companies.

Section 46: power to adjudicate

The adjudicating officer earlier adjudged contraventions 'under this Chapter' (Chapter IX). The words now refer to contraventions 'under this Act', so the officer can impose the new penalties under Sections 33, 67C, 68, 72 and 72A, which sit outside Chapter IX. Without this change the decriminalised provisions would have had no forum.

Section 66A: omitted

Struck down in Shreya Singhal (2015) and the subject of the PUCL directions (2022), the section is now formally omitted (see Topic 38).

Section 67C: preservation and retention by intermediaries

An intermediary must preserve and retain information as prescribed. Contravention carried up to three years and fine; it now attracts a penalty of up to ₹25 lakh. The retention duty itself is unchanged.

Section 68: directions of the Controller

Failure by a Certifying Authority or its employee to comply with the Controller's order was punishable with up to two years or ₹1 lakh or both; it is now a penalty of up to ₹25 lakh.

Section 69B: traffic data monitoring

An intermediary that intentionally or knowingly fails to assist the agency authorised to monitor and collect traffic data (s.69B(4)) faced up to three years and an unlimited fine. It now faces up to one year or fine up to ₹1 crore or both. Imprisonment is shorter, but the fine is large and can be imposed alone. This remains an offence.

Section 70B(7): directions of CERT-In

Failure to provide information or comply with CERT-In directions was punishable with up to one year or ₹1 lakh or both. The prison term is unchanged but the fine is now up to ₹1 crore, putting real force behind the 2022 CERT-In Directions (six-hour reporting, 180-day logs). This remains an offence.

Sections 72 and 72A: confidentiality and disclosure

• Section 72. Disclosure, without consent, of any electronic record or information obtained in exercise of powers under the Act: formerly up to two years or ₹1 lakh or both; now a penalty of up to ₹5 lakh.
• Section 72A. Formerly up to three years or ₹5 lakh or both; now a penalty of up to ₹25 lakh. The mental element (intent or knowledge of wrongful loss or gain) remains part of the provision.

Figure 4: Section 72A: from offence to civil penalty

4. How Decriminalised Defaults Are Now Enforced

Figure 5: Which track does a default take?

• Forum. The adjudicating officer under Section 46, an officer not below the rank of Director to the Government of India, with the powers of a civil court, after giving the person a reasonable opportunity of being heard.
• Quantum. Section 47 factors: gain or unfair advantage, loss caused, and repetitive nature of the default. The figures in the Act are ceilings, not fixed sums.
• Compounding. Contraventions may be compounded under Section 63 by the Controller or the adjudicating officer, subject to the three-year bar on repeat compounding.
• Appeal and recovery. Appeal to TDSAT within 45 days (s.57) and then to the High Court within 60 days (s.62); unpaid penalty is recovered as arrears of land revenue (s.64)
• Proof. Preponderance of probabilities, with no arrest, no police investigation and no criminal record.

5. What Remains Criminal

• Untouched offences. Tampering with source code (s.65), computer related offences (s.66), Sections 66B to 66F, obscene, sexually explicit and child abuse material (ss.67 to 67B), non-compliance with interception and blocking orders (ss.69, 69A), unauthorised access to protected systems (s.70), and misrepresentation and false certificates (ss.71, 73, 74)
• Recast but still criminal. Sections 69B(4) and 70B(7), now punishable with up to one year or fine up to ₹1 crore or both.
• Parallel liability. A dishonest or fraudulent disclosure of data may still be prosecuted under Section 66 read with Section 43, or under Section 66C, even though Section 72A itself is now civil.

6. Transitional Questions

• Pending prosecutions. Unless the amending law provides otherwise, Section 6 of the General Clauses Act, 1897 preserves liabilities incurred and proceedings pending under the provision as it stood before the change. Whether courts will continue prosecutions under the old Sections 72 or 72A for acts before 30 November 2023 is therefore a live argument.
• Beneficial change. Where an amendment reduces punishment, the accused may be given the benefit in a pending case (T. Barai v. Henry Ah Hoe, (1983) 1 SCC 177). This supports applying the lighter regime to old acts.
• Heavier change. Article 20(1) bars a penalty greater than that in force when the offence was committed. The ₹1 crore fine under Section 70B(7) cannot be imposed for a default committed before 30 November 2023.
• Civil increases. The higher civil penalties in Sections 44 and 45 should, on ordinary principles against retrospectivity, apply only to defaults after commencement.

7. Assessment

• In favour. Removes the fear of prosecution for officials and employees over technical lapses; fits the principle that criminal law is a last resort; and makes penalties large enough to deter platforms.
• Against. Individuals whose data is leaked lose the option of a criminal complaint under Section 72A; the adjudicating machinery is thinly staffed; and the ₹1 crore fines strengthen State demands on intermediaries without matching safeguards.
• Balance. The Act moved the IT Act toward a regulatory model: prosecute dishonesty and danger, penalise default.

8. Quick Revision and Memory Aids

• 'Trust the citizen, fine the lapse, prosecute the wrong'. The philosophy.
• 'Eleven sections, one date: 30 November 2023'. Scope and commencement.
• 'Five and five, twenty-five times three'. ₹5 lakh (ss.33, 72); ₹25 lakh (ss.67C, 68, 72A)
• 'Crore for CERT-In and traffic'. ss.70B(7) and 69B(4)
• 'Chapter to Act'. The change in Section 46.

9. Frequently Asked Questions

When did the Jan Vishwas amendments to the IT Act come into force?

On 30 November 2023, under notification S.O. 4745(E) dated 31 October 2023.

Who imposes the new penalties under Sections 72 and 72A?

The adjudicating officer under Section 46, whose jurisdiction now extends to contraventions under the whole Act, with appeal to TDSAT.

10. Related Topics

• Topic 7: Contraventions and Offences. The full scheme of Chapters IX and XI.
• Topic 38: Subsequent Amendments. The wider rationalisation of the Act.