Section 18 IT Act: Functions of Controller

Section 18 of Information Technology Act: Functions of Controller

Official Bare Act Text

Override / Mandate Mens Rea (Intent) Actus Reus (Conduct) Punishment Limitation Monetary

The Controller may perform all or any of the following functions, namely:—

(a) exercising supervision over the activities of the Certifying Authorities;

(b) certifying public keys of the Certifying Authorities;

(c) laying down the standards to be maintained by the Certifying Authorities;

(d) specifying the qualifications and experience which employees of the Certifying Authority should possess;

(e) specifying the conditions subject to which the Certifying Authorities may conduct their business;

(f) specifying the contents of written, printed or visual materials and advertisements that may be distributed or used in respect of a Digital Signature Certificate and the public key;

(g) specifying the form and content of a Digital Signature Certificate and the key;

(h) specifying the form and manner in which accounts shall be maintained by the Certifying Authorities;

(i) specifying the terms and conditions subject to which auditors may be appointed and the fees to be paid to them;

(j) facilitating the establishment of any electronic system by a Certifying Authority either solely or jointly with other Certifying Authorities and regulation of such systems;

(k) specifying the manner in which the Certifying Authorities shall conduct their dealings with the subscribers;

(l) resolving any conflict of interests between the Certifying Authorities and the subscribers;

(m) laying down the duties of the Certifying Authorities;

(n) maintaining a database containing the disclosure record of every Certifying Authority containing such particulars as may be specified by regulations.

Legal Commentary & Landmark Judgments: Section 18

Section 18 enumerates the core statutory functions of the Controller of Certifying Authorities, vesting the CCA with comprehensive supervisory authority over Certifying Authorities, licensing standards, public key infrastructure, and national repository operations.

Supervision and Licensing of CAs: Empowers the CCA to license, monitor, and regulate the activities of all commercial Certifying Authorities operating in India.
Specification of Technical and Security Standards: Authorizes the CCA to prescribe standards for public key infrastructure, key pair generation, and cryptographic algorithms utilized in digital certificates.
National Repository and Interoperability Management: Mandates the maintenance of an electronic database of all Certifying Authorities and authorized certificates to guarantee cross-platform interoperability.

Key Landmark Precedents:

Cellular Operators Association of India v. TRAI (2016) 7 SCC 703: Supreme Court held that regulatory bodies vested with sector-wide supervisory functions must act transparently, reasonably, and within the substantive contours of the parent enactment.
PTC India Ltd. v. Central Electricity Regulatory Commission (2010) 4 SCC 603: Constitution Bench expounded the broad regulatory and supervisory remit of statutory regulators exercising power under governing legislation.
CCI v. Steel Authority of India Ltd. (2010) 10 SCC 744: Supreme Court held that statutory regulators possess inherent authority to issue administrative directions necessary to effectuate their regulatory mandate.

Courtroom Practice & Strategic Litigation Guidance:

In disputes involving digital signature validation or CA non-compliance, petition the CCA under Section 18 for a formal regulatory inspection; findings issued by the Controller carry persuasive weight in judicial and arbitral forums.

Section 18: Functions of Controller

Section 18 of Information Technology Act: Functions of Controller

Legal Commentary & Landmark Judgments: Section 18