📜 Part 7.1

Section 46 IT Act — Civil Liability Foundation

"Where Criminal Law Ends, Civil Law Begins"

Understand the foundation of civil remedies under IT Act — when Section 43 contraventions lead to Section 46 adjudication, and strategic choices between criminal prosecution and civil compensation.

1.1

Section 43 — Civil Contraventions

📖 Section 43 — Penalty for Damage to Computer System
The Foundation of Civil Liability
"If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network—
(a) accesses or secures access to such computer...
(b) downloads, copies or extracts any data...
(c) introduces or causes to be introduced any computer contaminant or computer virus...
(d) damages or causes to be damaged any computer...
(e) disrupts or causes disruption of any computer...
(f) denies or causes the denial of access...
(g) provides any assistance to any person to facilitate access...
(h) charges the services availed of by a person to the account of another person...
(i) destroys, deletes or alters any information...
(j) steals, conceals, destroys or alters any source code...
he shall be liable to pay damages by way of compensation to the person so affected."
📋 Section 43 Contraventions — Complete List
ClauseActExample
43(a)Unauthorized accessHacking into competitor's server
43(b)Unauthorized download/copyCopying customer database
43(c)Introducing virus/contaminantPlanting ransomware
43(d)Damaging computerDeleting critical files
43(e)Disrupting computerDDoS attack
43(f)Denying accessLocking out legitimate users
43(g)Assisting unauthorized accessSharing passwords
43(h)Charging to another's accountUsing stolen credit card
43(i)Destroying/altering informationModifying records
43(j)Source code theftStealing proprietary code
1.2

Section 46 — Adjudication Framework

📖 Section 46 — Power to Adjudicate
Establishing Adjudicating Officers
"(1) For the purpose of adjudging under this Chapter whether any person has committed a contravention of any of the provisions of this Act or of any rule, regulation, direction or order made thereunder... the Central Government shall, subject to the provisions of sub-section (3), appoint any officer not below the rank of a Director to the Government of India or an equivalent officer of a State Government to be an adjudicating officer..."
💰 Compensation Under Section 43A (Body Corporate)

Section 43A: Where a body corporate possessing, dealing or handling any sensitive personal data and is negligent in implementing reasonable security practices → liable to pay compensation.

Key Elements:

• Body corporate handling sensitive personal data

• Negligence in implementing security practices

• Wrongful loss or wrongful gain to any person

Compensation: No upper limit specified — quantum based on actual damages + consequential losses

1.3

Civil vs Criminal — Strategic Choice

FactorCriminal (S.66, 66C etc.)Civil (S.43, 46)
ObjectivePunishment (imprisonment/fine)Compensation to victim
BurdenBeyond reasonable doubtPreponderance of probability
ForumCriminal Court/MagistrateAdjudicating Officer
SpeedSlower (years)Faster (6-12 months)
ControlProsecution controlsComplainant controls
SettlementLimited (compounding)Parties can settle
AppealSessions → HC → SCTDSAT → SC
Best ForDeterrence, serious harmFinancial recovery
📌 Real-Life Example — When to Choose Civil

Scenario: ABC Corp discovers that a departing employee copied its entire customer database (50,000 records) before joining a competitor.

Criminal Route: FIR u/S 66 IT Act + S.43/379 BNS → Investigation, trial, years of litigation, uncertain conviction, no direct compensation.

Civil Route: Complaint before Adjudicating Officer u/S 43(b) + Section 46 → Faster adjudication, compensation for loss of business, injunction preventing competitor from using data.

Best Strategy: File civil complaint first for quick compensation + injunction. Criminal FIR can be filed in parallel if deterrence needed. Civil case not dependent on criminal outcome (per Supreme Court in several cases).

1.4

Compensation Computation

💰 Heads of Compensation Under Section 43

1. Direct Loss: Value of data/information lost or damaged

2. Restoration Costs: Expenses to restore systems, data recovery

3. Business Interruption: Revenue lost during downtime

4. Consequential Damages: Loss of contracts, customers, reputation

5. Investigation Costs: Forensic analysis, expert fees

6. Legal Costs: Attorney fees, filing costs

7. Punitive/Exemplary: Where conduct particularly egregious

NASSCOM v. Ajay Sood & Ors.
(2005) Delhi High Court — 119 DLT 596
Facts: Defendants were "phishing" — sending emails pretending to be from reputed companies to extract personal/financial information. NASSCOM sued for declaration that phishing is illegal and injunction.
Held: Court declared phishing illegal. Coined the term "phishing" in Indian jurisprudence. Established that cyber torts actionable under civil law even beyond specific IT Act provisions. Injunction granted. Significance: First major civil cyber case; expanded scope beyond criminal provisions.
1.5

Jurisdictional Framework

🗺️ Choosing the Right Forum
1Claim ≤ ₹5 Crore: Adjudicating Officer under Section 46 (preferred — specialized, faster)
↓
2Claim > ₹5 Crore: Civil Court with pecuniary jurisdiction (District/High Court)
↓
3Urgent Injunction Needed: High Court original side (where available) — faster interim orders
↓
4Government Action Challenge: High Court Writ under Article 226
↓
5Appeal from AO: TDSAT under Section 57 (45 days limitation)
🏛️ Territorial Jurisdiction — Section 46(2)

The Adjudicating Officer has jurisdiction where:

• The computer system is located, OR

• The contravention occurred, OR

• The person affected ordinarily resides/has business

Practical Tip: For corporate victims, file where company has registered office — easier evidence production and witness appearance.

🎯 Key Takeaways — Part 7.1

  • Section 43 lists 10 specific contraventions (a to j) — civil liability for compensation
  • Section 43A adds body corporate liability for data breach due to negligent security
  • Section 46 establishes Adjudicating Officers — Director-level officers adjudicate claims
  • Civil route: Faster, complainant controls, compensation-focused, preponderance standard
  • Criminal route: Slower, prosecution controls, punishment-focused, beyond doubt standard
  • Compensation heads: Direct loss, restoration, business interruption, consequential, forensic, legal
  • NASSCOM v. Ajay Sood: First major civil cyber case — phishing declared tort
  • Claim ≤ ₹5 Cr: Adjudicating Officer; > ₹5 Cr: Civil Court with jurisdiction
  • Territorial: Where computer located, contravention occurred, or victim resides
  • Strategy: Civil for compensation, criminal for deterrence — can file both in parallel

📝 Assessment — Part 7.1 (10 Questions)

1. Section 43 of IT Act deals with:
Section 43 establishes civil liability for various contraventions related to unauthorized access, damage, etc.
2. Section 43(b) covers:
Section 43(b) specifically covers downloading, copying or extracting data without permission.
3. Under Section 46, Adjudicating Officer must be:
Section 46(1) specifies the Adjudicating Officer must be Director-rank or equivalent.
4. Section 43A applies to:
Section 43A creates liability for body corporates negligent in implementing security practices for sensitive data.
5. Standard of proof in civil proceedings under IT Act:
Civil proceedings require preponderance of probability — balance of probabilities.
6. NASSCOM v. Ajay Sood is significant for:
NASSCOM v. Ajay Sood was the first major civil cyber case — court declared phishing illegal.
7. Section 43(j) covers:
Section 43(j) specifically deals with stealing, concealing, destroying or altering computer source code.
8. Territorial jurisdiction of Adjudicating Officer includes:
Section 46(2) provides multiple bases for territorial jurisdiction.
9. Appeal from Adjudicating Officer lies to:
Section 57 provides for appeal to TDSAT from Adjudicating Officer's order.
10. Key advantage of civil over criminal in cyber matters:
Civil proceedings give complainant control, faster resolution, and focus on compensation.