Introduction

The Central Government, on 25 February 2021, notified the Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules 2021 (Rules) under the Information Technology Act 2000 (IT Act), which will supersede the Information Technology (Intermediary Guidelines) Rules 2011 (2011 Rules). The Rules will regulate entities transmitting content through digital media and will also apply to intermediaries and publishers operating in India as well as overseas entities or platforms that target Indian users.

Due Diligence Requirements for Intermediaries

The Rules came into effect on 25 February 2021. However, the provisions pertaining to due diligence requirements for significant social media intermediaries have been given a lead time of three months from the date of notification of the threshold of a significant social media intermediary (i.e. 25 February 2021) to implement the prescribed measures. Non-compliance with the provisions of the Rules may disqualify the intermediary from seeking exemption of liability under the IT Act and the intermediary may be liable to punishment under any law for the time being in force, including the IT Act and the Indian Penal Code 1860.

  • Furnishing information to the government: The Rules state that intermediaries must provide information for verification of identity or assistance to any lawfully authorised government agency for prevention, detection, investigation and prosecution of offences or for cyber security incidents, no later than 72 hours of receiving a written order.
  • Preservation of records: The Rules require intermediaries to preserve, maintain, and/or store the following information for 180 days: (a) any information that has been removed or access to which has been disabled under certain provisions of the Rules; and (b) user's information regarding registration, after cancellation or withdrawal of such registration.
  • Disabling access: Intermediaries are not permitted to store, host or publish unlawful information which is prohibited under any law for the time being in force. In case such unlawful information is hosted, stored or published, the intermediary must remove or disable access to such information as early as possible, but within 36 hours of receiving a court order or being notified by a government agency.
  • Removal of/ disabling access to explicit content: The Rules require expeditious action from an intermediary to remove or disable, within 24 hours of complaint, access to any material exposing the private area of any person, material with any nudity or depiction of any sexual act or conduct, or impersonation in an electronic form. In addition, intermediaries must provide a mechanism for receipt of complaints from users to enable them to provide details in relation to such explicit content.
  • Grievance redressal: Under the Rules, intermediaries must prominently publish on website, mobile application or both- (a) the name and contact details of grievance officer and (b) the complaint mechanism. The grievance officer must acknowledge the complaint within 24 hours and dispose it off within 15 days and provide reasons to the complainant for any action / inaction.
  • Details to be published: Intermediaries must prominently publish rules and regulations, privacy policy and user agreement on its website, mobile based application or both. The users must be informed about types of information that are 'objectionable' which they shall not share, display, upload, etc. In addition to the types of objectionable information prescribed under the 2011 Rules, certain new types of information have been specified under the Rules. Therefore, intermediaries will have to consider revising the existing documents in this regard. Intermediaries must inform users at least once every year about (a) rules and regulations, privacy policy or user agreement and any changes thereunder; and (b) intermediary's right to terminate user's access or remove the non-compliant information from its platform in case of non-compliance with the rules and regulations, privacy policy or user agreement.

Additional Due Diligence Requirements for Significant Social Media Intermediaries

  • Significance threshold: Social media intermediaries with fifty lakh (five million) registered users or more have been classified as significant social media intermediaries and are subject to additional due diligence requirements beyond those prescribed for intermediaries in general. However, the Government may require any other intermediary to also comply with the rules applicable to significant social media intermediaries if services of such intermediary impose a material risk to the sovereignty or integrity of India, security of the State, etc. While in practice this could prove to be more of an enabling provision for the Government, at this initial juncture it appears that even relatively smaller social media platforms, could be brought under the ambit of stricter compliances under the Rules.
  • Officers and contact address in India: All significant social media intermediaries are required to appoint: (a) a Chief Compliance Officer; (b) a Nodal Contact Person; and (c) a Resident Grievance Officer, each of whom are to be employees residing in India. The Rules also necessitate significant social media intermediaries to have a physical contact address in India published on its website or mobile application or both. These mandatory requirements for all significant social media intermediaries, not only has significant implications in terms of setting up infrastructure and deployment of resources and employees in India but may also have significant commercial and tax implications for such intermediaries. However, absence of a mandatory incorporation requirement does leave flexibility for foreign intermediaries who do not have an incorporated entity in India.
  • Active monitoring: In a departure from the 2011 Rules, significant social media intermediaries shall endeavour to deploy technology-based measures, including automated tools to identify information that depicts rape, child sexual abuse or conduct, or information that has previously been removed. The Rules also require maintenance of appropriate human oversight, and periodic review of such automated tools. The measures deployed are required to take into consideration, the interests of free speech and expression, and privacy of users, including interests protected through the appropriate use of technical measures.
  • Compliance report: Significant social media intermediaries must publish a monthly report containing details of- (a) the complaints received; (b) action taken; and (c) number of links/ information removed or to which access is disabled, pursuant to any proactive monitoring by using automated tools or any other relevant information as may be specified.
  • Identification of first originator of information: Significant social media intermediaries which provide messaging services will be required to enable identification of the first originator of information if required by a court order or an order passed under Section 69 of the IT Act. In case the originator is outside the Indian territory, the first originator in India will have to be identified. The Rules mention that the contents of the message are not required, but the identity of the originator is required to be disclosed.
  • Voluntary verification: The Rules impose an obligation on significant social media intermediaries to enable users who register for their services from India, or use their services in India, to verify their accounts by using any appropriate mechanism, including the active Indian mobile number of such users, to verify their accounts and to provide a visible mark of verification. However, it is specified that the verification cannot be used for any other purpose unless consented by the user.
  • Grievance redressal: The grievance redressal mechanism of a significant social media intermediary is required to enable tracking of the grievance/complaint through a ticket number associated with such complaint. The intermediary is required to provide reasons for any action/inaction. The proposed mandatory grievance redressal mechanism may entail considerable overhaul of the existing grievance redressal mechanism.
  • Removal of/disabling access to information: In case any objectionable information is removed by an intermediary on its own accord, following steps need to be taken - (a) ensure that prior to the removal/ disabling access, the user who created, shared, uploaded such content is notified of such removal/ disabled access along with reasons; (b) provide adequate and reasonable opportunity to the user to dispute the action and request for reinstatement of such access; and (c) resident grievance officer to maintain appropriate oversight over the dispute resolution mechanism.

Compliances for OTT Platforms and News Portals

  • Code of Ethics: The Rules have introduced a Code of Ethics (Code) to be complied with by publishers of online curated content (OCC)/over-the-top platforms (collectively, OTT Platforms) and publishers of news and current affairs (News Portals), which lays down general principles, metrics for content classification and guidelines for classification of content. It may be relevant to note that the guidelines prescribed in the Code are similar to a notification issued by Ministry of Information and Broadcasting (MIB) dated 6 December 1991 guiding the Board of Film Certification to follow certain principles for sanctioning films for public exhibition.

The Code also prescribes age ratings and content descriptors and technology enabled access controls similar to the provisions of the Universal Self-Regulation Code for Online Curated Content Providers, issued by the Internet and Mobile Association of India in 2020.

  • Compliance with the Code: OTT Platforms have to comply with applicable law and consider the following aspects in respect of content - (a) sovereignty and integrity of India; (b) threatening, endangering or jeopardising the security of the State; (c) detriment to India's friendly relations with foreign countries; and (d) content which is likely to incite violence or disturb the maintenance of public order, and further, take into consideration India's multi-racial and religious context. Any violation or non-compliance with the Code will make OTT Platforms liable for consequential actions under the law which has been contravened.
  • Grievance redressal mechanism:

The Rules require OTT Platforms and News Portals to formulate a robust three-tier grievance redressal mechanism, as follows:

  1. First Level: Self-regulation by the OTT Platform/ News Portal itself through a grievance officer who will be based in India and whose contact details are to be placed on the platform's website and interface. The grievance officer is required to take decisions on every grievance registered, within 15 days of receipt of the grievance.
  2. Second Level: By an independent self-regulatory body constituted by publishers or their associations, of which the OTT Platforms/ News Portals need to be members. Such self-regulatory bodies will be comprised of industry experts and headed by a retired Supreme Court or High Court judge or other eminent personality in a relevant field, and is to be registered with the MIB within 30 days of notification of the Rules. The self-regulatory body is required to address grievances not resolved under the first level within 15 days and act as an appellate body against decisions made by the OTT Platform/ News Portal.
  3. Third Level: Oversight by MIB through an inter-departmental committee constituted by the Government (Committee). This Committee will hear violations of the Code of Ethics framed under the Rules, arising out of decisions taken at level two, and if a complaint is referred to the committee by MIB. At the third level, MIB will appoint an "Authorised Officer" authorised to issue directions for blocking access to any information/ content and submit recommendations of the Committee in respect of blocking of any content to MIB. On MIB's approval, the Authorised Officer can direct any OTT Platform/ News Portal to block relevant content.

Powers of the self-regulating body in the second level and the Committee in the third level, include recommending actions such as (a) warning, censuring, admonishing or reprimanding an entity; (b) requiring an apology; (c) including warning cards or disclaimer by an entity; (d) in case of OTT platforms, direct the platform to reclassify ratings/ edit synopsis/ or modify content descriptor/ age classification and parental control; and (e) referring content to MIB for consideration by the oversight mechanism, where the content may incite commission of a cognizable offence affecting public order.

While self-regulation mechanism by OTT Platform/ News Portal is retained as the foremost level of grievance redressal, and an institutional self-regulation mechanism may also enable citizens to have their grievances heard through a formal process within definite time frames; the oversight mechanism by the Government, though placed at the third tier and presumably intended to be the last resort only, definitely tightens the Government's grip on the overall operations of OTT Platforms.

  • Content classification:
  1. OTT Platforms are required to classify all content such as films, web-series or other shows based on age, themes, content, tone and impact, and target audience. Further, OTT Platforms will need to give due consideration to issues related to discrimination, psychotropic substances, liquor, smoking and tobacco, imitable behaviour, language, nudity, sex, and violence, while classifying content.
  2. The rating categories provided in the Rules are – "U" (suitable for all ages), U/A 7+ (suitable for person aged 7 years and above), U/A 13+ (suitable for persons aged 13 years and above), U/A 16+ (suitable for persons aged 16 years and above) and 'A' (restricted to adults). OTT Platforms are also required to implement parental controls for content classified as U/A 13+ or higher.

Going forward, apart from implementation of content classification by OTT Platforms as per the Rules, content makers will also have to consider such classification while producing any content and may need to choose the audience of their films, shows or series perhaps at the development stage itself. For OTT Platforms, another practical impact will be that content already existing on the platforms will also need to be classified /re-classified as per the Rules.

  • Disclosure: All OTT Platforms, News Portals and self-regulating bodies are required to make full disclosure of grievances received by them, manner of grievance disposal, action taken etc., publicly and updated monthly. OTT Platforms and News Portals are required to preserve records of content transmitted by them for a minimum of 60 days and make such records available to the self-regulating body/ central government/ government agency, as may be requisitioned for implementation of the Rules.

For News Portals

  • Notification: All News Portals and OTT Platforms that operate in India are required to inform MIB of details of their respective entities within 30 days of the notification of the Rules.
  • Compliance for news:
  1. In a move to level the playing field vis-à-vis print and television media, the Rules now require News Portals to comply with norms of Press Council of India (under the Press Council Act 1978), and the Programme Code under the Cable Television Networks Regulation) Act 1995.

Compliance with specific norms formulated by the Press Council of India is a welcome change for effective news dissemination and to tackle the evils of fake news and irresponsible reporting, and may also help ensuring that news content across all mediums follow certain principles such as accuracy and fairness, pre-publication verification, right to privacy, criticism of public figures, caution in criticising judicial acts, violence not to be glorified, etc.

  1. The term 'news and current affairs' content which was not previously defined under any legislation has now been defined under the Rules as newly received or noteworthy information, including analysis, especially about recent events primarily of socio-political, economic or cultural nature, available over the internet or computer networks. Further, any digital media will be considered news and current affairs content where the context, substance, purpose, import and meaning of such information is news and current affairs content.
  • Compliance Report: News Portals and OTT Platforms are required to submit periodic compliance reports every month setting out details of grievances received, and actions taken by them.
  • Power of MIB: With regards to furnishing of information, the MIB also additionally has the power to direct a News Portal/ OTT Platform to furnish any information for implementation of the Rules.

Comment

The massive growth of digital platforms and social media in India has largely been fuelled by a moderate regulatory framework under the IT Act and 2011 Rules, with the online curated content space being largely unregulated. However, given the growing concerns around the information and content available over social media and content platforms across both, domestic, and foreign owned platforms accessible in India, detailed regulations for digital media from the Government were imminent.

While the overall intent of the Government may not be to curtail constitutional freedoms, the Rules are certainly a significant departure from the existing framework and impose considerable compliances on intermediaries, OTT Platforms and News Portals – each of which will now have to establish prescribed procedures and mechanisms to comply with the Rules.

Specifically, in respect of social media intermediaries, the Rules have proposed a compliance-heavy model including the requirement to enable identification of the "first originator" of information by a significant social media intermediary. Such requirements of identification when put in practice are likely to require dilution of the existing privacy policies of various intermediaries and revamping of the end-to-end encryption models adopted by messaging platforms.

What remains to be observed is the manner in which the Rules and the Government's powers thereunder are practically implemented, and their overall implications not only vis-à-vis digital media players, but also for the Indian viewers in respect of the content/ information they consume and the manner in which they communicate over the internet. With the digital space and technology constantly evolving world over, the regulatory framework for digital media will also develop further. Keeping this in perspective, it is imperative that stakeholders, policy makers, and Governmental bodies continue to engage in consultations and dialogue, to eventually achieve a regulatory landscape that is effective yet balanced for everyone.

The content of this document do not necessarily reflect the views/position of Khaitan & Co but remain solely those of the author(s). For any further queries or follow up please contact Khaitan & Co at legalalerts@khaitanco.com