Information Technology (Guidelines for Intermediaries & Digital Media Ethics Code) Rules, 2021

The Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules of 2021 (hereinafter referred to as ‘the Rules’) has been enacted by the Central Government under the powers conferred to it by Sections 69A(2), 79(2)(c) and 87 of the Information Technology Act, with thorough coordination with the Ministry of Electronics and Information Technology and the Ministry of Information and Broadcasting. The formulation of these Rules is in response to the growing criticism against the government, while it recognizes the right to criticize and disagree as an essential element of democracy. It aims to provide a robust complaint mechanism for social media and OTT platform users to address their grievances, a mechanism earlier inexistent.

The proposed framework has been quoted to be progressive, liberal and contemporaneous, as it lays a special emphasis on the protection of women against the progression of sexual offences on social media. It emphasizes on the need of social media intermediaries and online content providers, whether for entertainment or informative purposes, to strictly comply with the Constitution and domestic laws of India. It extends its approach to instill a sense of accountability against misuse and abuse by social media users and is the first of its kind to bring social media use under the regulatory framework of the Information Technology Act.

These rules have been in light of the recent run-down on the OTT platforms by the government, which have been actively, rather vehemently, lobbying for stronger and more stringent regulations in place. However, contrary to such a view, as per the PIB, the Rules have been formulated keeping in mind the importance of free speech and journalistic and creative freedoms. Regardless of the political connotations, the enactment of these Rules puts India at par with international regimes on digital media regulation, providing a more comprehensive and holistic protection to its users.

Obligation of Due Diligence on Intermediaries

General Guidelines for All Intermediaries

These general guidelines extent their scope over all intermediaries, including social media intermediaries as well as significant social media intermediaries. Rule 2(1)(z) omits from the scope of social media intermediaries those intermediaries that facilitate commercial or business transactions, provide access to networks, search-engines and certain other types as specified.

Due Diligence: Rule 4 enlists certain due diligence obligations of an intermediary, which include the duty to publish their rules and regulations, privacy policies and user agreements for access, either on its website and/or application, to allow its users to access the same. The material so published must crystalize the user’s responsibility not to “host, display, upload, modify, publish, transmit, store, update or share”[1] any form of information which:

• Belongs to another person
• Is defamatory, obscene, pornographic, pedophilic, invasive of one’s privacy, libelous, or inconsistent to the laws of the land
• Is dangerous for minors
• Results in the infringement of any intellectual property right
• Is deceiving or misleading regarding the origin of the message
• Impersonates another person
• Hampers the integrity, defense, security or sovereignty of the country, friendly relations with foreign states, public order or results in the incitement of any cognizable offence
• Contains any software virus or any program designed to corrupt or interrupt the functionality of any computer resource
• Or is patently false and untrue, regardless of its form is published or in order to mislead or harass a person

Notifications provided to the User: Apart from merely publishing such obligations, the intermediary must notify the user that non-compliance with the above mentioned may result in the termination of their access or usage rights.[2] Also, these rules and regulations, privacy policies or user agreements may be subject to periodical amendments, which ought to be notified to the users in due time.[3]

Enforcement Action to be Undertaken: Intermediaries are amenable to halt the hosting, storage or publication of any information prohibited by law, in the interest of national sovereignty, integrity, security, etc., as prescribed under Rule 4(1)(d), on the knowledge of the same through an order of a court of competent jurisdiction or a Government notification. The intermediary has been provided a strict time limit of thirty-six (36) hours to remove or restrict access to such information. Following the removal of such information, the evidence collected must be preserved for one hundred and eighty (180) days for investigative purposes.[4] Further, the process has been prescribed under Rule 4, with respect to the intermediaries’ duty to fully cooperate with Government and law enforcement agencies. In order to address the complaints raised by users or victims, the intermediaries must appoint a Grievance Officer, whose details must be made public, who would acknowledge and resolve such complaints within a period of one month.[5]

Additional Compliance Measures for Significant Social Media Intermediaries

Due Diligence: A peculiar feature about the Rules is that it creates a distinction between social media intermediaries and significant social media intermediaries. The demarcation is based on the user size and once it has been defined through the notification of the Government, it would act as the threshold between the two.[6] The reason behind this is clarified through Rule 5 which provides additional compliance measures for significant social media intermediaries due to the large volume of users and content that they process. Barring the criteria of the user size, the Government can prescribe the provisions of Rule 5 on any other intermediary as well through a notification.[7] The following due diligence ought to be observed by such intermediaries within three months of publication of these rules:[8]

• Appointment of a Chief Compliance Officer, assuming the responsibility to ensure compliance and oversight of the functions of significant intermediaries
• Appointment of a nodal person of contact, who would act as a link between law enforcement agencies
• Appointment of a Resident Grievance Officer, whose responsibilities would lay parallel to that of the Officer appointed under Rule 4(1)(n)
• Publishing the compliance report on a periodical basis of six months, containing the details and contents of complaints handled and information removed or interrupted by intermediaries in pursuit of their monitoring activities

In order to facilitate the processing of complaints, with respect to the violations mentioned under this Rule, an appropriate mechanism shall be developed by the significant intermediary under Rule 5(6). In such a process, the intermediary must notify the complainant of the extent of action taken.

First Originator: Rule 5(2) provides an additional responsibility on significant social media intermediaries involved in providing messaging services to assist the law enforcement agencies to identify and track the first originator of any contentious or problematic information. This can only be executed through an order of a competent court or the Competent Authority under Section 69 of the Act. This power can only be exercised in order to curb any offence threatening the integrity or security of the State, inciting the commission of rape, child sexual abuse or other grievous offences. However, this may not be resorted to on the availability of less intrusive means and must be employed as a measure of last resort.

Special Measures for Sexual Offences: Other means have been provided to significant intermediaries in order to curb the commission or instigation of the offences of rape or child sexual abuse, such as under Rule 5(4). Such intermediaries must deploy certain technology-based measured to promptly identify any material that may depict or simulate such offences. This must be done in the absence of any bias or discrimination, with the highest regard to privacy and free speech.

Voluntary Verification of Users: Users of significant social media intermediaries must be provided a facility to voluntarily verify themselves under Rule 5(7). The verification can take place on the basis of their number or account and would provide the user with a visible mark of verification. This method to regulate the users has been undertaken to eliminate the misuse of these services and provides a greater level of surveillance over their activities.

Notification to Originators on Removal of Information: In the situation that a significant intermediary has removed or restricted access to any information or data, they must ensure that the originator is made aware of the same, including the grounds for such action, after providing them a reasonable opportunity. Further, Rule 5(8) provides that this process must be overseen by the Resident Grievance Officer.

Procedure and Safeguards for Digital/Online Media

Digital media, as defined under Rule 2(1)(k), represents any digitized content transmittable through the internet or other networks and includes the same content as stored or transmitted by intermediaries as well as publishers of news or online curated content. It includes:[9]

• news and current affairs publishers,
• intermediaries enabling the transmission of news and current affairs,
• online curated content publishers, and
• intermediaries enabling the transmission of online curated content,

which operate in India and conduct their business activities by making content available in India, targeting Indian users[10]. However, these following rules applicable to such entities would only come into force after the lapse of a three month period from the publication of these rules.[11]

Grievance Mechanism

An Online Grievance Portal, established by the Ministry within three months of the commencement of the rules, would act as the central repository for accepting and disposing of grievances, with respect to the Code of Ethics, as per Rule 9(1). In pursuance to this, the Rules provides a three-tiered grievance mechanism, consisting of:

• Level I: Self-regulation by the applicable entity
• Level II: Self-regulation by the self-regulating bodies of the applicable entities
• Level III: Oversight mechanism by the Central Government

Level I: Under Rule 9(4), the applicable entity would be informed of the grievance and encouraged to address it themselves, while keeping the complainant and the Grievance Portal in the loop. In exercise of such a power, the applicable entity is required to appoint a Grievance Redressal Officer, who would be governed by the Code of Ethics.[12] The applicable entity is to classify the online curated content that it transmits, granting it with an appropriate certificate, as per the Schedule.[13] The certification may take place on the basis of the content, its impact, target audience, etc. and must be displayed in a conspicuous place, allowing the users to be notified of the same before accessing the content[14].

Level II: If the procedure under the first level does not take place within 15 days, the matter would escalate with the appeal of the complaint to a Self-regulating Body, of which the entity is a member. Such bodies ought to be independently constituted by such entities or their association and headed by a retired judge of the Supreme Court or a High Court.[15] This body would provide guidance on the Code of Ethics and decide on the grievances passed on from the first level. For the enforcement of such decisions, a self-regulating body can issue warnings, censoring, require an apology, reclassify ratings of online curated content, make appropriate modifications in the content descriptor, or refer the matter to the Oversight Mechanism under Rule 12.[16]

Level III: In case the Self-regulating bodies fail to offer any solace to the complainant, they have the last resort of the Oversight Mechanism of the Central Government for a resolution, under Rule 12. Such a measure would be coordinated by the Ministry, who would constitute an Inter-Departmental Committee for addressing grievances, under Rule 13. This committee would consist of representatives from the Ministry of Information and Broadcasting, Ministry of Women and Child Development, Ministry of Law and Justice, and other relevant Ministries as mentioned.[17] The purpose of this Committee is to obtain a holistic and all-encompassing view on the violations under the Rules. The violations may arise through grievances of Level I and II, on a suo motu basis, or those referred by the Ministry.[18] Similar powers granted under Rule 11(5) would be applicable, including the right to initiate the procedure under Rule 14. This allows the Committee to take action to ascertain the creator of violative content and block the same content.

Code of Ethics

The underlying thread that binds the whole Rules together is the Code of Ethics, mentioned under the Appendix. This spans over News and Current Affairs, Online Curated Content and Advertisements.

Online Curated Content

Providing a comprehensive and an in-depth take on regulating online curated content, the Code makes reservation for the multi-racial and multi-religious sphere of India, where due caution and respect ought to be paid in the depiction of their activities, beliefs or practices. It classifies content on the basis of its target audience, assigning a:

• ‘U’ rating for content suitable for children and people of all ages
• ‘U/A 7+’ for content that can only be viewed by a person below the age of 7 years with parental guidance
• ‘U/A 13+’ which requires parental guidance for viewers below the age of 13 years
• ‘U/A 16+’ for persons below 16 years requiring parental guidance, and
• ‘A’ for content solely reserved for viewing by adults

Further classifications may be made on the basis of themes and messages, violence, sex, nudity, drug and substance abuse, etc. These classification ratings must be displayed in a conspicuous and unambiguous manner and place, allowing the user to be aware and informed. Provisions for access control mechanisms, such as parental locks, ought to be made for content classified as U/A 13+ or higher, and in spirit of the same, establishing a reliable verification mechanism of the age of the viewer for content rated ‘A’.

Criticism

The introduction of the concept of tracking the first originator under Rule 5(2) has been perceived as rather contentious and worrisome. It enables significant social media intermediaries providing messaging services to allow the enforcement mechanism to access the originator of any information. This is attempted towards curbing the spread of fake news and illegal activities taking place over messaging applications. However, cyber experts fear that this would eventually result in the overriding of the end-to-end encryption, allowing for the formation of a surveillance state. This may result in a major privacy breach, which most messaging applications wear on their sleeve as a badge of honor. The authority of tracking the originator can also be enforced in order to prevent or investigate into an offence relating to the sovereignty, integrity and security of the State. What the Rules fail to identify is the unimaginable scope of misuse of such a wide and discretionary power.

In addition to this, members of the media fraternity emphasize on the Rule’s implementation to dissolve the freedom of speech. While analyzing the grievance redressal mechanism, the executive has been authorized to rule over the suitability of content published by the media through the Oversight Mechanism, an unprecedented move that may be perceived as ultra vires of the Constitution. The inter-ministerial committee of bureaucrats have been granted the authority to adjudicate on matters relating to free speech and journalistic freedoms, which may in turn prove not to be conducive for the same.

References :

[1] Rule 4(1)(b), Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021.
[2] Rule 4(1)(c).
[3] Rule 4(1)(f).
[4] Rule 4(1)(g).
[5] Rule 4(1)(n).
[6] Rule 2(1)(y).
[7] Rule 6(1).
[8] Rule 5(1).
[9] Rule 7(1).
[10] Rule 7(2).
[11] Rule 7(4).
[12] Rule 10(2) & (3).
[13] Rule 10(4).
[14] Rule 10(6).
[15] Rule 11 (1) & (2).
[16] Rule 11(5).
[17] Rule 13(1).
[18] Rule 13(3).