The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (the “Intermediary Rules”) fundamentally change the way the internet will be experienced in India. We provide you with an overview of its contents, the “safeguards” it seeks to establish, how they affect your internet usage experience, and your fundamental rights. Most notably, the Rules now will bring government control rather than regulation over digital news platforms and OTT video content providers. Several requirements under them suffer from unconstitutionality and undermine the free expression and privacy for millions of internet users in India.
What are the rules of the intermediary?
Check out this video for a detailed explanation
Yesterday evening, these rules were notified in the Official Gazette as "Regulations on Information Technology (Intermediate Guidelines and Digital Media Ethics Code), 2021." Let's just call them the Intermediate Rules for convenience. The Intermediate Rules have replaced the Rules on Information Technology (Intermediate Guidelines) in 2011. (or the 2011 Rules). In this post, we present a much more in-depth and legal analysis of the Intermediate Rules that breaks down the top 5 changes in each chapter that affect your digital rights.
What is the structure of the Intermediate Rules of Procedure?
While the definitions of terms are laid down in Part I of the Intermediate Rules, Part II and Part III contain actual compliance and requirements. Part II concerns the regulation of intermediaries, including social media intermediaries. Social media outlets include messaging-related intermediaries such as WhatsApp, Signal, and Telegram, and media-related intermediaries such as Facebook, Instagram, and Twitter. This section is administered by the Ministry of Electronics and Information Technology (MeitY).
Part III deals with the regulation of digital news media (although there is a lack of clarity as to which news media these Rules apply) and OTT platforms, such as Netflix, Amazon Prime, and Disney+Hotstar. Part III shall be administered by the Ministry of Information and Broadcasting.
Below are a more in-depth dive and an initial analysis of new compliance with brief comments on possible impacts. We invite you to use the comments feature to let us know your thoughts, opinions, and yes, we remain open to any and all corrections. We intend to move forward with a public debate on these massive changes to our freedom of the Internet, which appear to hurt our privacy and freedom of expression enormously.
Social media and messaging related intermediaries
1. Creation of differential obligations: new classes have been created, including 'social media intermediary' [Rule 2(w)] and 'significant social media intermediary' [Rule 2(v)]. The threshold for the social media intermediary to be considered and regulated as a "significant social media intermediary" was notified on 26 February 2021 as fifty lakh (5 million) registered users. These categories provide a high level of government discretion in determining which platforms are required to comply with which regulations. That power is further reinforced by Rule 6, which provides that the government may, by order, require *any intermediary* to comply with the obligations imposed on a 'significant social media intermediary' pursuant to Rule 4. To do so, the threshold of "material risk of harm" must be met. This threshold is vague and allows the Central Government to enforce discriminatory compliance.
2. Requirement of Nanny: Do you hate email spam? Do you hate even more incomprehensible terms of service and privacy policies? Well, get ready to be delivered to them more than once a year. Under the new rules, you will have to be notified by each intermediary at least every year [Rule 3(c)]. This means that virtually any host of web services will send you periodic emails reminding you not to do anything "illegal" or to terminate your account.
3. Grievance redress mechanism: while in the 2011 version, an intermediary was required to appoint a grievance redress officer (Rule 11), a whole host of compliances are now required and have been additionally placed. Previously, the Grievance Officer was responsible for receiving and remedying complaints from users about the rules within a month. It is now the responsibility of the Grievance Officer to acknowledge and resolve complaints within 24 hours within a reduced time limit of 15 days [Rule 3(2)(a)(i)]. It is also the responsibility of the Grievance Officer to receive and acknowledge any order, notice, or direction issued by the appropriate government, any competent authority, or court of competent jurisdiction [Rule 3(2)(a)(ii)]. However, the grievance officers for intermediaries other than significant social media intermediaries are not required to provide the reasons for the decision taken on the complaints they have received. They do not have to give reasons either to the complainant or to the user whose contents may have been deleted as of a result of the Intermediate Rules. This will be discussed in more detail below.
4. Significant Social Media Intermediaries get a full grievance redressal team: In addition to the obligations imposed on intermediaries, significant social media intermediaries, which is a distinct class, have an additional requirement to appoint three officers with different responsibilities [Rule 4(1)]. The officers are:
a Chief Compliance Officer, responsible for ensuring compliance with the Information Technology Act, 2000 (the IT Act) and the Rules made thereunder, and liable for proceedings in this regard;
a nodal person of contact, for “24x7 coordination” with law enforcement agencies; and
a Resident Grievance Officer, with similar responsibilities as the Grievance Officer for intermediaries described above.
The Resident Grievance Officer of a significant social media intermediary is also required to inform the user of the reasons given before removing the content posted by that user, to give them the opportunity to contest such action, and to give the complainant the reasons for the decision taken in response to their complaint [Rules 4(6)] and 4(8)]. Notably, the grievance officers for other intermediaries do not have these requirements.
As noted above, all three officers appointed by major social media intermediaries are now legally required to reside in India. Significant social media outlets are also required to have a physical contact address in India [Rule 4(5)]. The details of the officer and the physical contact address must be published prominently on his website or on a mobile Internet application. It is important to note that the Home Ministry has meetings with all social media organizations in India on a fortnightly basis. We may expect this list to grow now, with designated Chief Compliance Officers required to attend.
5. Contracted timelines for assistance to law enforcement agencies: The obligation on the intermediaries in the 2011 Rules was to “act within thirty-six hours and where applicable, work with the user or owner of such information” to take it down. Under the new Intermediaries Rules, intermediaries must *complete* the takedown process under Section 79(3) of the IT Act, within 36 hours. Further, the 2011 Rules did not specify a timeline within which intermediaries were required to provide information or assistance to law enforcement agencies. The Intermediary Rules have provided intermediaries with a 72-hour limit for providing such information or assistance [Rule 3(2)(j)]. Additionally, a new takedown requirement has been added, wherein specific scenarios, such as nudity, the depiction of sexual conduct or impersonation, the intermediary is required to take down such content, upon request of the concerned user, within 24 hours [Rule 3(2)(b)].
6. Hi, my big brother! Expansion of mandatory retention of data: The period of retention of data has been doubled and intermediaries are now required to retain information for 180 days (6 months!) for investigative purposes [Rule 3(1)(h)]. The data must be maintained even after the user has deleted their accounts. It is important to consider this requirement in the absence of data protection legislation and any kind of supervision of how surveillance operates in India (side note: IFF is a litigant challenging it in the Supreme Court).
7. "Voluntary" verification of social media users: Significant social media providers must also allow their users to "voluntarily" check their accounts using any appropriate mechanism, including an active Indian user mobile number. A visible and demonstrable mark identifying such verification shall also be provided by a significant social media intermediary [Rule 4(7)]. This could lead to a scenario where voluntary service becomes mandatory, as is the case with many other technologies that have been introduced as "voluntary" but ultimately made mandatory in an indirect way. It would then have serious implications for anonymity and privacy (imagine linking your Aadhaar to your social media accounts without which government may not respond to you!), which are essential for users of social media intermediaries, such as political dissidents. Moreover, much more worryingly, without data protection legislation, this means that social media entities will collect data from our government IDs without any regulatory body, such as a data protection authority, to ensure that it is used solely for verification purposes.
8. End of end-to-end encryption: Significant social media providers must allow the originator of information to be tracked on their platform if requested by a court of competent jurisdiction or competent authority pursuant to Section 69A of the IT Act [Rule 4(2)]. While the Intermediaries Rules make it clear that the traceability order can only be passed for serious offenses, some categories are open-ended. For example, the "public order" grounds are relatively broad in operation and can give rise to many demands. The Intermediaries Rules also make it clear that, in doing so, there is no obligation on a significant social media intermediary to disclose the content of any electronic message, any other information relating to the first originator, or any information relating to its other users. However, the Information Technology Decryption Rules contain the power to make demands on the content of the message. Used together, the government will break any type of end-to-end encryption in order to gain knowledge of who sent the message and also to get to know its contents. In addition, this specific requirement will break existing protocols for the deployment of end-to-end encryption that has been built through rigorous cybersecurity testing over the years!
9. AI automated censorship: Significant social media intermediaries are now also required to develop and deploy technology-based measures. These include automated tools or other mechanisms to proactively identify information that depicts any act or simulation in any form depicting rape, child sexual abuse, or conduct [Rule 4(4)]. We have highlighted how even the best effort deployment of such filtering technologies (such as Photo DNA) can lead to function creeps. For instance, the Delhi Police has sought for it to be used at least once in criminal investigations entirely unconnected to rape or child sexual conduct.
10. Penalty provisions: the 2011 rules did not specify any consequences for intermediaries for failing to comply with the provisions of the Rules of Procedure; the consequences were relatively direct-they lost immunity! The Intermediaries Rules 2021 expressly set out the loss of immunity and set out the degree of severity of the consequences, including potential criminal prosecution under the provisions of the IT Act and the Indian Penal Code [Rule 7].
Digital Media News and Video Streaming Platforms
The most significant development in the Rules of Procedure is the regulation of OTT platforms and digital news media when they use other intermediary sites/apps, such as Twitter or Facebook, and when they host news media content on their own website/app. It is worth mentioning that the 2011 Regulations did not regulate digital news media and OTTs. Before going into the specifics, I would like to make a few comments on the broader framework and its legality.
1. Power of administration conferred on MI&B: the rules have been laid down in the Information Technology Act, 2000, and, as such, MeitY is the nodal ministry responsible for administering these rules. However, as provided for in the Interim Rules, Part III shall be administered by the Ministry of Information and Broadcasting [Rule 8(1)].
2. The scope of regulation under the IT Act has been extended: digital news media and OTT platforms have not been previously regulated under the provisions of the IT Act. This has been changed by notification under the Business Allocation Rules. However, this notification only confers administrative clarity on which ministry the sector is to be administered. It does not create the power to exercise that power. A clear parliamentary enactment is necessary for this. However, instead of going to Parliament, the Intermediate Rules set out in the IT Act seek to extend the scope of the IT Act regulation to include digital news media and OTT platforms. This is an executive amendment to the legislation of Parliament and is not permitted under the Constitution.
3. Excessive delegation of powers: the Rules of Procedure are subject to an excessive delegation of powers. For example, the Rules set out a non-judicial adjudication process to resolve complaints about content published by Digital News Media and OTTs. They have also set up an adjudicative body, which is the Oversight Committee. This is despite the fact that the IT Act does not specifically empower the Government to do so. This non-judicial adjudication process was discussed in detail below.
In addition to the above, the noteworthy aspects of this part have been discussed below.
1. A wide sweep. Not only major digital news websites: No threshold requirement for users or readers to differentiate between digital news media on the basis of size and scale has been considered, as has been done in Part II in the case of social media intermediaries and significant social media intermediaries. The Intermediaries Rules shall apply to all publishers of news and current affairs content as long as they have a physical presence in India or engage in systematic business activities to make their content available in India [Rule 8(1)].
Since ‘news and current affairs content‘ has been defined as “newly received or noteworthy content, including analysis, especially about recent events primarily of socio-political, economic or cultural nature, made available over the internet or computer networks” [Rule 2(m)], the Intermediaries Rules will arguably seek to regulate a large number of internet users that engage in producing similar content on a very small scale.
2. Regulation of foreign news media: while territorial presence is one of the requirements for digital news media to be regulated by the Intermediaries Rules, it is not a necessary condition [Rule 8(2)]. If the digital news media organization makes its content available in India in a systematic and continuous manner, they will be subject to the provisions of the Intermediaries Rules. In the case of significant social media intermediaries, the Intermediaries Rules made it mandatory for them to establish a physical presence in India by appointing officers resident in India and providing an Indian address for correspondence; however, it is unclear how foreign news media organizations are sought to be regulated by Indian authorities.
3. Code of Ethics: Digital News Media and OTTs must abide by the Code of Ethics set out in the appendix to the Rules of Procedure. The criteria set out in the Code of Ethics are vague, over-extended, and will have a chilling effect on publishers' freedom of speech and the right of consumers to access information on content.
As applicable to Digital News Media: Digital News Media has to comply with Norms of Journalistic Conduct of the Press Council of India and Programme Code, and ensure that content which is prohibited under any law is not published or transmitted (Paragraph I of Appendix)
As applicable to OTTs: This is important because OTTs have now been mandated to classify content based on the type of content as ‘U’, ‘U/A 7+’, ‘U/A 13+’, ‘U/A 16+’ and ‘A’ (Paragraph II(B) of Appendix). The OTTs must ensure that content classified as U/A13+ or higher has access control measures and content classified as A (adult-restricted) has a reliable age verification mechanism for viewing such content, in addition, to access control measures, which restrict minors from accessing such content (Paragraph II(C) and II(D) of the Appendix). In addition, the Code of Ethics also mandates OTTs to take into account the multi-racial and multi-religious context of India and to 'exercise due caution and discretion while performing the activities, beliefs, practices, or views of any racial or religious group. This is likely to have a chilling effect on speech as it provides formal validity to the concerns which have been raised by certain groups against artistic content.
4. Grievance Redressing Mechanism: In order to ensure compliance with the Code of Ethics, a three-tier mechanism has been introduced by the Intermediate Rules. The Union Minister for Information and Broadcasting, at a press conference on 25 February 2021, unveiling these Rules, argued that the three-tier mechanism was self-regulation by publishers with minimal government interference. Looking more closely, it is clear that the rules envisage much more than 'minimal government interference.'
First level: at the first level, similar to the requirement for intermediaries under Rule 3, digital news media and OTT platforms must establish a grievance redress mechanism and appoint a grievance officer resident in India. The Grievance Officer is required to take a decision on any grievance received within 15 days. If the complainant fails to receive a satisfactory response within 15 days, the complainant may appeal to Level II, i.e. the self-regulating body. (Rules 10 and 11 of the Rules)
Second Tier: At the second level, the “self-regulating” body is to be an independent body constituted by publishers or their associations, and headed by a retired judge of the Supreme Court, a High Court, or an independent eminent person from media, broadcasting, entertainment, child rights, human rights or other relevant fields. This body must be registered with the MI&B, and the MI&B will “satisfy itself” that the self-regulating body has been constituted properly. The self-regulating body is empowered to warn/censure/admonish/reprimand the publisher, require an apology, reclassify ratings, or even censor the content as it deems fit. If the publisher fails to comply with the directions of the self-regulating body, the matter may be referred to the Central Government at the third tier. (Rule 12)
Third Tier: Level III is the oversight mechanism for self-regulation by digital news media and OTT platforms. The oversight mechanism is an “Inter-Departmental Committee”, consisting of representatives from the Ministry of Information and Broadcasting, Ministry of Women and Child Development, Ministry of Law and Justice, Ministry of Home Affairs, Ministry of Electronics and Information Technology, Ministry of External Affairs, Ministry of Defence, and such other Ministries and Organisations (Rule 14). The Chairman of the Inter-Departmental Committee will be a Joint Secretary of the MI&B [Rule 13(2)]. This Committee will hear complaints regarding decisions taken at Levels I and II and is empowered to delete or modify content for preventing incitement to the commission of a cognizable offense relating to public order. [Rule 14(5)].
5. Encouraging self-censorship: While publishers are expected to self-regulate at the first tier, the provisions of the Rules are too onerous for self-regulation to effectively be complied with. Any person is empowered to make a complaint with the publisher, and the publisher must respond within 15 days or risk censure. In terms of what this means for the regular internet-user, digital news media will have to edit their coverage to keep in mind the arbitrary manner in which overbroad restrictions are applied, particularly when the news is not favorable to the government. Further, OTT platforms, such as Netflix, Amazon Prime, and Disney+Hotstar, will be forced to adhere to similar censorship norms as prevail in offline movies and television content.
6. Excessive government control over digital news and OTT content: while Level II of the 3-tier mechanism is framed as the second layer of self-regulation, it is actually the first layer of government control. The chairman of the self-regulatory body is suggested to be a retired judge of the High Court or Supreme Court, and even though the body is apparently expected to be appointed/elected by the media community, the MI&B retains the power to approve the composition of the body.
7. Executive exercise of judicial powers: the supervisory mechanism, consisting of the Inter-Departmental Committee, consists entirely of members of the Executive Committee, i.e. officials from different ministries, and is chaired by the Joint Secretary, the Ministry of Information and Broadcasting, who, in turn, is overseen by the Secretary, MI&B. The Inter-Departmental Committee is responsible for hearing complaints arising out of a three-tier grievance mechanism. In particular, when news or OTT content is sought to be deleted or modified, the Secretary, MI&B, is empowered to take such action on the recommendation of the Joint Secretary.
8. Emergency blocking powers: The Intermediary Rules provide emergency powers to the MI&B in cases where “no delay is acceptable”. The Secretary may if she/he is satisfied that it is necessary or expedient and justifiable issue directions for blocking of online content to persons, publishers or intermediary in control of hosting such information, without giving them an opportunity of hearing. (Rule 16)
9. Range of punitive measures: the Level II self-regulatory body and the Level III Inter-Departmental Committee have been given wide-ranging punitive powers over digital news media and OTT platforms, including the power to warn/censor/admonish/reprimand publishers, to require a warning card or disclaimer, to apologize, to reclassify ratings, or even to censor content as such.
10. Registration with the Government: while taking questions from the press at the press conference, Union Minister Prakash Javadekar admitted that the government did not know who digital news media and OTT platforms are. In order to correct this information gap, the Intermediate Rules require digital news media and OTT platforms to provide MI&B intermediaries with details of their entity and their accounts (Rules 5 and 18).We are of the view that the Intermediaries Rules have far-reaching consequences on online privacy, freedom of speech and expression, and access to information, in addition to the constitutional issues that the Rules suffer from. We invite you to use the comments feature to let us know your thoughts, views, and any and all corrections.
Important links
Information Technology (Guidelines For Intermediaries And Digital Media Ethics Code) Rules, 2021 (link).
The Information Technology (Intermediaries guidelines) Rules, 2011 (link)
Latest Draft Intermediary Rules: Fixing big tech, by breaking our digital rights? (link)
Union Ministers Prakash Javadekar and Ravi Shankar Prasad address a press conference (link to YouTube video recording).
The article has been edited over an article published by https://internetfreedom.in/intermediaries-rules-2021/
Comments