Delegated legislation in cyber law
📘 What is Delegated Legislation?
Delegated Legislation (also called subordinate or secondary legislation) refers to laws or rules made by an authority other than the legislature, but with the legislature's authorization. This is done through enabling statutes that delegate certain legislative powers to executive bodies or regulatory agencies.
🔹 Why Delegated Legislation is Needed in Cyber Law:
Cyber law is a highly technical and fast-evolving field. Parliament cannot foresee or regulate every detail, so it delegates power to experts and government departments to:
Frame rules, regulations, and notifications
Define technical standards
Respond to emerging threats (e.g., new hacking techniques, data breaches)
Enforce compliance with data protection, digital signature norms, etc.
⚖️ Constitutional Basis for Delegated Legislation in India
Article 245: Empowers the legislature to make laws.
Article 246: Distribution of legislative subjects.
The legislature can delegate rule-making power under a statute, as long as it does not delegate essential legislative functions (like deciding policy or rights).
📜 Delegated Legislation under the Information Technology Act, 2000
The IT Act, 2000 is India’s primary cyber law. It contains broad provisions, while delegated legislation fills in the technical and procedural details.
Examples:
Section 87 of the IT Act empowers the Central Government to make rules.
Rules regarding digital signatures, cybersecurity practices, data protection, etc. are framed under delegated authority.
📚 Important Case Laws on Delegated Legislation in Cyber Law
1. Shreya Singhal v. Union of India (2015) 5 SCC 1
Facts:
The case challenged Section 66A of the IT Act, 2000, which criminalized sending “offensive” messages online. The petitioners argued that the provision was vague and violated freedom of speech under Article 19(1)(a).
Delegated Legislation Issue:
Though Section 66A was itself part of the statute, its implementation depended heavily on executive interpretation and circulars, making it prone to abuse due to lack of clear guidelines.
Held:
The Supreme Court struck down Section 66A as unconstitutional. The Court criticized the overbreadth and arbitrariness in delegated powers without clear standards.
Significance:
Set limits on how vague and sweeping powers can be delegated in cyber legislation, especially when they infringe fundamental rights.
2. PUCL v. Union of India (2017) 10 SCC 1
Facts:
This case challenged the legality of Section 69 of the IT Act and Rules under it, which allowed government agencies to intercept, monitor, or decrypt digital information.
Issue:
Was the delegated legislation (IT (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009) consistent with the Constitution?
Held:
The Court upheld the section but emphasized that safeguards must be strictly followed. Delegated legislation cannot violate Article 21 (right to privacy).
Significance:
Laid down the standards for valid delegated legislation under cyber laws — must be proportionate, reasonable, and constitutionally compliant.
3. Internet and Mobile Association of India v. RBI (2020) 10 SCC 274
Facts:
The Reserve Bank of India issued a circular banning banks from dealing with cryptocurrency businesses. The circular was based on delegated authority under the RBI Act and Banking Regulation Act.
Issue:
Whether the RBI’s circular (delegated legislation) could restrict crypto trading platforms from using banking services?
Held:
The Supreme Court quashed the circular, holding that the RBI’s action was disproportionate and lacked empirical backing. It had exceeded the delegated authority in this context.
Significance:
Showed that delegated legislation in cyberspace and digital economy must be based on clear rationale and cannot be arbitrary. The Court upheld the need for judicial review of such rules.
4. Anuradha Bhasin v. Union of India (2020) 3 SCC 637
Facts:
Petitioners challenged the indefinite internet shutdown in Jammu and Kashmir following the abrogation of Article 370.
Issue:
Whether delegated powers under the Telegraph Act and IT Act were lawfully exercised in suspending internet services?
Held:
The Court held that internet access is a part of the right to freedom of speech, and delegated powers must be exercised proportionately and transparently. It directed the government to publish shutdown orders and review them regularly.
Significance:
This case placed judicial limits on delegated executive power, especially when it affects fundamental rights via cyber regulation.
5. K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 (Right to Privacy Case)
Facts:
The constitutional validity of Aadhaar and related digital surveillance measures was challenged.
Issue:
Could the government frame rules under delegated legislation that potentially invade privacy through digital means?
Held:
The Court declared privacy a fundamental right and held that any delegated legislation affecting privacy must meet tests of legality, necessity, and proportionality.
Significance:
Though not directly about cyber laws, this case had a major impact on delegated rule-making under the IT Act, especially in areas like data protection, surveillance, and biometric authentication.
📊 Summary Table
| Case | Issue | Ruling on Delegated Legislation |
|---|---|---|
| Shreya Singhal (2015) | Vague powers under Section 66A | Declared unconstitutional due to excessive discretion |
| PUCL (2017) | Surveillance under Section 69 and Rules | Upheld with safeguards; delegation must be constitutional |
| IAMAI v. RBI (2020) | Crypto ban by RBI circular | Circular struck down; delegation must be proportionate |
| Anuradha Bhasin (2020) | Internet shutdown under IT Act | Delegated powers must be transparent and justified |
| Puttaswamy (2017) | Privacy and data under Aadhaar | Delegated powers must meet necessity and legality tests |
🔚 Conclusion
Delegated legislation in cyber law is both necessary and inevitable due to the technical nature of cyberspace and the need for swift responses to digital threats. However, as shown in the case laws:
Delegated powers must be exercised fairly, proportionately, and in conformity with constitutional rights.
There is judicial oversight to prevent abuse or overreach.
Cyber rules and regulations must strike a balance between governance and civil liberties.
RELATED Blog
0 comments