Background
On February 25, 2021, the Indian government unveiled the Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021 (the “New Rules”). Once notified in the Official Gazette, the Intermediary Rules will supersede the decade old Information Technology (Intermediary Guidelines) Rules, 2011 (the “Intermediary Guidelines”) as the Indian government strives to keep up with the rapid digitization in India.
Divided into three (3) parts, the New Rules aim to achieve two (2) primary goals, namely, increase accountability for intermediaries, and regulate the publication and transmission of online content. In this update, we highlight the key changes intended to be introduced by the New Rules and analyse their impact on India’s digital market.
Key Changes for Intermediaries
The New Rules retain the definition of intermediaries introduced under the Information Technology Act, 2000 (the “IT Act”). However, in contrast to the Intermediary Guidelines, the New Rules specifically apply to all websites, blogs, online discussion forums and other such functionally similar intermediaries.
Part II of the New Rules aims to rejig the due diligence obligations of intermediaries and specifies a tiered approach in this regard. A set of common obligations are imposed on all intermediaries. However, “significant social media intermediaries” (defined as an intermediary with more than five (5) million registered users in India) are required to comply with additional obligations.
Common Due Diligence Obligations
- An intermediary will be required to annually inform users that in case of non-compliance with the terms and conditions of use, the intermediary has the right to, both, terminate access or usage rights and remove non-compliant information. The obligation to inform users of the intermediary’s rights also exists under the Intermediary Guidelines. As such, the emphasis seems to be for intermediaries to periodically reinforce the message to its users. However, it is questionable whether a mere periodic reiteration will be more effective in discouraging belligerent users.
- Upon receipt of actual knowledge in the form of a court order or government notification, an intermediary will be required to not host, store or publish any information prohibited by any law in relation to, inter alia, the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality. Importantly, the intermediary will be mandatorily required to remove such information or disable access to such information within thirty-six (36) hours of receipt of the court order or government notification. The obligation to be mindful of the information hosted, stored or published by the intermediary also exists under the Intermediary Guidelines. However, previously the intermediary was free to exercise its discretion on whether the information needed to be taken down. Now, this freedom has been curtailed through government censorship rights.
- Upon receipt of a complaint relating to any content which is in the nature of non-consensual transmission of any material which exposes the private area of any person, shows such person in full or partial nudity, shows or depicts such person in any sexual act or conduct or is in the nature of impersonation in an electronic form, including artificially morphed images, the intermediary will be required to remove or disable such content within twenty-four (24) hours. This is a welcome move which will help in combating online harassment, intimidation, and abuse of users.
- In respect of any information which has been removed or disabled pursuant to the New Rules, the intermediary will be required to preserve such information and associated records for investigation by lawfully authorized bodies for a period of one hundred and eighty (180) days. The increase of the retention period from ninety (90) days under the Intermediary Guidelines to one hundred and eighty (180) days under the New Rules will significantly increase the compliance burden for intermediaries.
Apart from the foregoing obligations, the New Rules retain several aspects of the Intermediary Guidelines, including, the type of information sought to be regulated, obligations to publish rules, privacy policies and user agreements, and obligation to provide information to lawfully authorized agencies for the purpose of verification of identities and for prevention, detection, investigation or prosecution of offences.
Additional Obligations for Significant Social Media Intermediaries
These intermediaries will, inter alia, be required to
- appoint a resident Indian citizen as a Chief Compliance Officer, a nodal person of contact, and a resident grievance officer within three (3) months of notification of the New Rules;
- publish compliance reports every six (6) months mentioning information such as the details of complaints received and action taken thereon. This requirement will also become effective three (3) months from the notification of the New Rules; and
- when providing messaging services, enable the identification of the first originator of the information if required by a judicial order or an order under Section 69 of the IT Act. This requirement can create significant issues for companies such as WhatsApp and Telegram which strive to encrypt any transmission. From the perspective of users, such identification will, both, act as a deterrent and fuel concerns around individual privacy.
The intent to introduce more stringent obligations for social media platforms enjoying wider reach is a welcome move in the context of the current global problems created by the anonymous abuse of social media. However, the extent of compliance and enforcement of these obligations will be the key to determine whether these measures produce any tangible benefits.
Regulation of Digital Content
The provisions of Part III of the New Rules are applicable to: (i) publishers of news and current affairs content; (ii) publishers of online curated content; and (iii) intermediaries which primarily enable the transmission of such content (the “Part III Entities”). In the form of illustrations, the New Rules clarify that Part III entities will include news aggregators and video streaming platforms.
The New Rules require the Part III Entities to adhere to a new Code of Ethics. Additionally, the New Rules enable the establishment of an online grievance portal for receiving and processing grievances from the public in relation to the Code of Ethics.
The New Rules establish a three (3) tier regulation mechanism for the Part III Entities:
- At the first level, the Part III Entities shall regulate themselves by appointing a grievance redressal officer and establishing a grievance redressal mechanism. Additionally, entities publishing and/or transmitting online curated content (streaming platforms such as Netflix, Amazon Prime Video, etc.) will be required to self-certify their content into five (5) different categories akin to censorship certificates issued to movies.
- At the second level, self-regulating and independent body/bodies shall be established by the Part III Entities to oversee the adherence to the Code of Ethics by the Part III Entities.
- At the third level, India’s Ministry of Information and Broadcasting shall establish an oversight mechanism by constituting an interdepartmental committee of government officials to regulate the publication of digital content.
The Indian government, in its press release, sought to distinguish the censorship of movies from the soft-touch regulatory approach being adopted for online curated content. However, the establishment of an interdepartmental committee and the powers granted to such committee under the New Rules, including powers to issue directions to block content, suggests that digital content will be subject to much greater scrutiny than before. Further, the oversight of a committee appointed by the executive, especially in the context of news publishers, sets a dangerous precedent as, constitutionally, the power to restrict such publications is reserved for the judiciary.
Conclusion
Identifying the appropriate approach to regulate digital and social media is a challenge being faced by governments around the world. Legislators must walk a fine line to adequately protect citizens from harm and, at the same time, guarantee the right to privacy and freedom of speech and expression for the same citizens. The changes introduced by the New Rules point to greater regulation in this regard in the coming years. However, it remains to be seen whether such regulation will enable better governance or simply pave the way for clamping down on constitutional rights.
About the Author
N. Raja Sujith has more than 23 years of experience in corporate and commercial law, including foreign investment, technology, outsourcing, joint ventures, M&A, restructuring and insolvency, and real property law. He also represents private equity and venture capital funds, and start-up companies in their financial investments, due diligence, and documentation. He has been recognized as one of the leading corporate/M&A practitioners in India. He has co-authored this update with Sinjini Majumdar, Associate at Majmudar & Partners.