Section 34 of ITA, 2000 : Section 34: Disclosure

Bare Act

(1) Every Certifying Authority shall disclose in the manner specified by regulations:

• (a) its electronic signature Certificate;
• (b) any certification practice statement relevant thereto;
• (c) notice of the revocation or suspension of its Certifying Authority certificate, if any;
• (d) any other fact that materially and adversely affects either the reliability of an electronic signature Certificate, which that Authority has issued, or the Authority's ability to perform its services.

(2) Where in the opinion of the Certifying Authority any event has occurred or any situation has arisen which may materially and adversely affect the integrity of its computer system or the conditions subject to which an electronic signature Certificate was granted, then, the Certifying Authority shall:

• (a) use reasonable efforts to notify any person who is likely to be affected by that occurrence; or
• (b) act in accordance with the procedure specified in its certification practice statement to deal with such event or situation.

Simplified Act

Simplified Explanation:

(1) Every organization that issues digital certificates (Certifying Authority) must publicly share:

• (a) its own digital certificate;
• (b) any official guidelines or policies it follows related to certification;
• (c) an announcement if its own certificate has been revoked or suspended;
• (d) any other information that significantly impacts the trustworthiness of the digital certificates they've issued or their ability to issue these certificates.

(2)...

Explanation using Example

Let's consider a hypothetical example of a company called SecureSign, which is a Certifying Authority under the Information Technology Act, 2000. SecureSign issues electronic signature certificates to its clients for secure online transactions.

According to Section 34, SecureSign is obligated to:

• (a) disclose its own electronic signature certificate to the public;
• (b) publish any certification practice statement relevant to its operation;
• (c) announce any revocation or suspension of its own Certifying Authority certificate, if such a situation arises;
• (d) disclose any other fact that significantly affects the reliability of an electronic signature certificate it has issued or its capability to perform its services.

If SecureSign identifies a security breach that could potentially compr...