• Introduction

On 25 February 2021, the Central Government, through the Ministry of Electronics and Information Technology (“MeitY”) has notified Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“2021 Guidelines”). These guidelines have been framed in exercise of powers under Section 87(2) of the Information Technology Act, 2000 (“the Act”), which includes rules in relation to the guidelines to be followed by intermediaries, and blocking of access to content under the Act.

These guidelines supersede the earlier Information Technology (Intermediary Guidelines) Rules, 2011 (“2011 Guidelines”), as well as the Draft Information Technology [Intermediaries Guidelines (Amendment) Rules], 2018, which had been released for public consultation (“2018 Draft Guidelines”) [collectively, “Erstwhile Guidelines”].

The 2011 Guidelines deal with the due diligence to be performed by the intermediaries, and the 2018 Draft Guidelines expand on these due diligence obligations. However, with the advent of the 2021 Guidelines, not only are there additional due diligence obligations imposed on intermediaries under Part II, but new rules, specifically in Part III, have been introduced to govern Over-the-Top (“OTT”) content providers, as well as digital news platforms.

• Overview of the 2021 Guidelines

• Part I of the 2021 Guidelines – Definitions

Part I of the 2021 Guidelines provides certain new definitions such as that of – “News and Current Affairs”, “Online Curated Content”, “Publisher of News and Current Affairs”, “Publisher of Online Curated Content”, “News Aggregator”.

1. Part II of the 2021 Guidelines – Due Diligence by Intermediaries and Grievance Redressal Mechanism

Part II of the 2021 Guidelines will be administered by MeitY, and it applies to social media intermediaries and significant social media intermediaries (the two groups in which social media platform intermediaries have been divided, on the basis of number of users; such distinction exists for encouraging innovations and enabling growth of new social media intermediaries, without subjecting smaller platforms to significant compliance requirement).

Under Rule 3(1) of the 2021 Guidelines, due diligence must be followed by both groups of intermediaries. In case the due diligence is not followed by intermediaries, safe harbour provisions will not apply to them. It must be noted that safe harbour provisions have been defined under Section 79 of the Act; these provisions protect social media intermediaries by giving them immunity from legal prosecution for any content posted on their platforms.

1. Obligations on Intermediaries

The 2021 Guidelines expand on due diligence requirements that existed under the Erstwhile Guidelines (such as the requirement to prominently publish the terms of use, privacy policy and user agreement), and prescribe the following:

1. Periodic Updates

All intermediaries must periodically, and at least once every year, inform its users of any change to the rules and regulations, terms of use or privacy policy and the consequences of non-compliance (such consequences include the termination of the access/usage rights of the user and/or the removal of non-compliant information).

The 2021 Guidelines expand the list of prohibited information under the Erstwhile Guidelines to include any information that “(i) is patently false and untrue and has been written or published with the intent to harass or mislead for financial gain, or cause injury to any person; (ii) is patently false or misleading, but is knowingly and intentionally communicated and can be reasonably perceived as a fact; and (iii) is invasive of a person’s bodily privacy and is insulting or harassing on the basis of gender.”

1. Take-down Process

In consonance with Section 79(3)(b) of the Act, the 2021 Guidelines provide that – “upon receipt of actual knowledge in the form of a court order or upon being notified by the appropriate government or its agency, the intermediary should not host, store or publish any unlawful information, and must remove or disable access to unlawful content within 36 hours from the receipt of such order or direction. They may also voluntarily take down any prohibited information. It is to be noted that compliance with take down requests or voluntary removal of information will not dilute safe harbour protections.”

Further, as a limited exception to the requirement of a court order as mentioned above, on receipt of any complaint from an individual or person on their behalf regarding content which is prima facie in the nature of any material depicting nudity or any sexual act, or the impersonation of any person including artificially morphed images, the intermediary must take all reasonable measures to remove or disable access to such content within 24 hours of receipt of the complaint.

However, this will not apply to information that is temporarily or transiently stored by the intermediary in an automatic manner, and which does not involve any human, automated or algorithmic editorial control.

1. Grievance Redressal Mechanism

Not only does there exist the requirement to appoint a grievance officer and publish their name and details as provided under the Erstwhile Guidelines, the 2021 Guidelines also require an intermediary to constitute a grievance redressal mechanism and to acknowledge receipt of user complaints within 24 hours and resolve them within 15 days (as compared to the earlier requirement of 30 days).

The grievance officer must receive and acknowledge any order, notice or direction issued by the appropriate government, competent authority or a court.

1. Retention of Records

Intermediaries are mandated to retain information and user registration records for 180 days (as compared to the earlier requirement of just 90 days) from (i) date of removal or disabling access to any unlawful information pursuant to receipt of actual knowledge, or on voluntary basis or upon receipt of any grievances received by it; and (ii) additionally in case of any cancellation of registration or withdrawal of a user.

1. Assistance to the Governmental Agencies

Although the requirement to provide any information or assistance to authorised government agencies for verification of identity, prevention, detection, investigation or prosecution of unlawful offences or for cyber security incidents has always existed, the 2021 Guidelines require this information to be provided within 72 hours from the receipt of the order.

2. Obligations on Significant Social Media Intermediaries

Under Rule 4 of the 2021 Guidelines, additional due diligence for the significant social media intermediaries have been provided.

Further, it is mandatory to appoint a Chief Compliance Officer, a Resident Grievance Officer, and a Nodal Contact Person; they should all be residents in India. The intermediary must also implement appropriate mechanisms for grievance redressal.

Significant social media intermediaries providing services primarily in the nature of messaging, shall enable identification of the first originator of the information.

There also exists the need to use technology-based and automated tools, as well as publish a monthly compliance report mentioning the details of complaints received and action taken on those complaints, as well as the details of contents removed.

Further, if the significant social media intermediary must clearly indicate if any particular information is being advertised, sponsored or exclusively targeted to the recipient.

3. Obligations on News and Current Affairs content

Under Rule 5 of the 2021 Guidelines, any intermediary which transmits News and Current Affairs (defined in Part III) content on behalf of publishers, such as an entity aggregating and displaying News and Current Affairs created by publishers on its platform, must (i) publish a clear and concise statement on its website and/or mobile application, informing publishers to furnish details of their user accounts to the Ministry of Information and Broadcasting (“MIB”); and (ii) provide a demonstrable mark visible to all users of the compliance by the publisher of the requirement to share information with the MIB.

Further, under Rule 6 of the 2021 Guidelines, the Ministry may require any intermediary, which is not a significant social media intermediary, “to comply with all or any of the obligations mentioned under Rule 4, if the services of that intermediary permits the publication or transmission of information in a manner that may create a material risk of harm to the sovereignty and integrity of India, security of the State, friendly relations with foreign States or public order.”

4. Penalty

In case of any non-compliance with this Part, intermediaries may lose safe harbour protection and be subject to the various liabilities as provided under the Act, as well as other laws such as the Indian Penal Code, 1860.

1. Part III of the 2021 Guidelines – Rules for News Publishers and OTT Platforms and Digital Media

Part III of the 2021 Guidelines deals with the Code of Ethics and Procedures and Safeguards in relation to Digital Media, and it shall be administered by the MIB. It applies to –

(i) publishers of news and current affairs content including news aggregators, news agencies, and individual news reporters to the extent they are transmitting content in the course of a systematic business, professional or commercial activity, and;

(ii) publishers of online curated content, which appear to include publishers (including individual creators) transmitting content in the course of a systematic business, professional or commercial activity.

The aforementioned publishers are mandated to adhere to the Code of Ethics laid down in the Appendix annexed to these guidelines. Further, for ensuring adherence to the Code of Ethics by such publishers, as well as for addressing the grievances made in relation to such publishers, there shall be a three-tier structure (as described in Chapter I, II, and III).

1. General Obligations

Publishers shall exercise due caution and discretion in relation to content affecting the sovereignty and integrity of India, the security of the State, the maintenance of public order, as well as the diverse racial and multi-religious context.

2. Content-Classification Obligations on OTT Platforms

OTT platforms, being the publishers of online curated content in the Intermediary Guidelines, must self-classify the content into five age based categories – U (Universal), U/A 7+, U/A 13+, U/A 16+, and A (Adult). They are required to implement parental locks for content classified as U/A 13+ or higher, and reliable age verification mechanisms for content classified as “A”. Further, they must prominently display the classification rating specific to each content or programme, together with a content descriptor informing the user about the nature of the content, and advising on viewer description (if applicable) at the beginning of every programme enabling the user to make an informed decision, prior to watching the programme.

3. Obligations on Publishers of News on Digital Media

They would be required to observe Norms of Journalistic Conduct of the Press Council of India, and the Programme Code under the Cable Television Networks Regulation Act, 1995, thereby providing a level playing field between the offline (Print, TV) and digital media.

4. Grievance Redressal Mechanism

Under Chapter I, a three-level grievance redressal mechanism has been established under the 2021 Guidelines, with different levels of self-regulation –

• Level-I: Self-regulation by the Publishers (Chapter II)

Under this, the publisher shall appoint a Grievance Redressal Officer based in India who shall be responsible for the redressal of grievances received by it. The officer shall take decision on every grievance received by it within 15 days.

• Level-II: Self-regulation by the Self-Regulating Bodies of the Publishers (Chapter III)

Under this, there may be one or more self-regulatory bodies of publishers. Such a body shall be headed by a retired judge of the SC, a High Court or independent eminent person and have not more than six members. Further, such a body will have to register with the MIB. This body will oversee the adherence by the publisher to the Code of Ethics and address grievances that have not been resolved by the publisher within 15 days.

• Level-III: Oversight Mechanism (Chapter IV)

The MIB shall formulate an oversight mechanism. It shall publish a charter for self-regulating bodies, including Codes of Practices. It shall establish an Inter-Departmental Committee for hearing grievances.

5. Furnishing of Information

Under Chapter V, the publisher, operating in the territory of India, is required to furnish certain information (such as details of the entity) to the MIB within 30 days of publication of the 2021 Guidelines. These publishers are also required to publish monthly compliance reports with the details of the grievances received.

6. Disclosure Requirements

Under Chapter VI, publishers operating in India are mandated to publicly disclose, and display details of all grievances received by it, the manner in which they are disposed of, the action taken on them, replies sent, orders or directions received, and the action taken. Such information must be updated monthly.

Further, publishers are required to preserve the records of content transmitted by it for a minimum period of 60 days and make this information available to the self-regulating body or the Central Government or other government body, if requisitioned.

7. Penalty

In extreme circumstances, content may be taken down under Section 69A of the Act, by means of issuing take-down orders, either to the publisher or the intermediary.

• Analysis and Conclusion

As mentioned earlier, the 2021 Guidelines have been notified under the Act. However, these guidelines do not provide any clarity regarding the statutory basis for Part III.

As per the recent amendment to the Allocation of Business Rules, 1961 (“Business Rules”), digital media, news and Online Curated Content fall within the ambit of the MIB, and under neither the MeitY nor the Act. Hence, it is unclear as to how the MeitY has issued guidelines on the regulation of digital media, news and Online Curated Content, or whether the MIB can even enforce rules issued by MeitY.

Further, while the regulation of content hosted by intermediaries might be necessary, the notification of the 2021 Guidelines could have enormous consequences on data privacy laws, the internet usage experience, access to information, and fundamental rights of the citizens of India.