Key Highlights of the IT Rules, 2021 and its Impact

1) Governs many more stakeholders/ intermediaries

The IT Act, 2000 defines the term ‘intermediary’ as “any person, in respect of an electronic record, who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record and includes telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes”. Earlier, neither the IT Act, 2000, nor the preceding rules i.e. IT Rules, 2011, defined the terms Social Media Intermediaries (“SMI”) or Significant Social Media Intermediaries (“SSMI”) nor did they contain provisions relating to digital media. However, the IT Rules, 2021 have now brought within its ambit ‘digital media’ which includes intermediaries; publishers of news and current affairs content, such as the Wire and LiveLaw; and publishers of online curated content, such as Netflix and Amazon Prime.

The new IT Rules, 2021, also define SSMIs as intermediaries having registered users exceeding the threshold limit, which has been set at 5 million via a notification. Applications like Whatsapp and Facebook will now fall under the category of SSMIs. This change under the IT Rules, 2021, firstly, increases the ambit of stakeholders that will be now regulated under these Rules, such as the online news portals and OTT platforms; and secondly, by classifying intermediaries under the terms SSIs and SSMIs bring in additional regulations for these intermediaries.

2) Due Diligence by Intermediaries, SMI, SSMIs

Section 79 of the IT Act, 2000, contains a ‘safe harbour’ provision which provides that an intermediary shall not be liable for any third party information, data, or communication link made available or hosted by him, if the intermediary observes due diligence requirements as provided under the IT Rules. The new IT Rules, 2021, have included the due-diligence requirements that existed under the preceding IT Rules, 2011, but have also added many more obligations upon the intermediaries. Thus, Intermediaries will now have to comply with certain additional due diligence requirements to ensure that they can take advantage of the ‘safe harbour’ provision.

All three categories of intermediaries, including SSIs and SSMIs, will now have to follow the due diligence provisions as provided under Rule 3 of the IT Rules, 2021. An intermediary has an obligation not to host certain category of information as has been listed under the IT Rules, 2021; and also to inform its users not to host such information. Information that is patently false and untrue with intent to mislead or harass a person has been additionally introduced to the category of information that an intermediary cannot host. Thus, the IT Rules, 2021, seek to protect the interests of children by prohibiting paedophilic and pornographic content, and the interests of other users by prohibiting content that is infringing Intellectual Property Rights or impersonating another person.

There is also a duty cast upon the intermediaries to periodically inform users of the user terms and that consequently, their non-compliance with the user terms will lead to termination of access to the intermediary. Within 72 hours of receipt of a court order, the intermediaries are obligated to provide information to authorised government authorities for investigative, protective or cyber security activities. The intermediaries will also have to employ a grievance redressal mechanism, where the grievance officer must acknowledge a user complaint with 24 hours and dispose of the same within 15 days.

The intermediaries further, have to retain user information even post cancellation or withdrawal of registration, for a period of 180 days for investigative purposes. This provision may not only prove to be burdensome for intermediaries, but also raises serious privacy concerns.

3) Additional Due Diligence to be followed by SSMIs

The IT Rules, 2021 differ from its preceding rules, in terms that it creates additional due diligence requirements to be observed by SSMIs. SSMIs are required to appoint a Chief Compliance Officer, a Nodal Contact Person and a Resident Grievance Officer; and all of these officers must be residing in India.

SSMIs are also required to enable the identification of the first originator of the content. This means that platforms like Whatsapp which have end-to-end encryption will have to break such protocol to comply with the orders, and could potentially infringe upon the right to privacy of users. Further, in case the first originator is outside the territory of India, the first originator within the territory of India will be considered to be the first originator of that information.

SSMIs must have a physical contact address in India. Further, advertising content must be made clearly identifiable to users. The introduction of such additional provisions targeting SSMs, like

Whatsapp and Facebook, which have more than 5 million users will invariably increase the compliance burden upon such intermediaries.

4) Code of Ethics

Prior to the enactment of IT Rules, 2021, ‘Digital Media’, which includes both news portals and OTT platforms, was unregulated and there was no legal framework relating to such online platforms. However, ‘Print media’ and ‘Television News and Entertainment, were being regulated by the Press Council of India and Cable Networks Regulation Act, 2005, respectively. In October 2020, the Supreme Court of India, in response to a Public Interest Litigation filed seeking regulation of OTT platforms, had issued notice to the Central Government and the Internet and Mobile Association of India (“IAMAI”) to take appropriate steps. In the absence of any regulatory code, many OTT platforms had adopted a ‘toolkit’ for the implementation of the self-regulation code introduced back in 2020, with the aid of IAMAI. Disney+Hotstar, Amazon Prime Video and Netflix, were some of the signatories to this code.

In light of such lacunae, the Central Government had on November 9, 2020, issued a notification bringing digital/online media platforms under the ambit of the Ministry of Information and Broadcasting (“MIB”). The implication of the notification being, MIB was vested with the power to regulate online news portals and OTT platforms. In furtherance of this notification, the Government has introduced the Code of Ethics (“Code”) contained in Part III of the IT Rules, 2021, which seeks to regulate publishers of news and current affairs content and publishers of online curated content. The Norms of Journalistic Conduct of the Press Council of India under the Press Council Act, 1978 and the Programme Code under Section 5 of the Cable Television Networks Regulation) Act, 1995 have now been made applicable to publishers of news and current affairs content.

The Code also provides for a three-tier grievance structure to ensure observance and adherence to the Code. The three-tiers consist of self-regulation by the publishers at level-I, a self-regulating body of publishers at level-II and finally an oversight mechanism by the Central Government at level-III. As part of the last tier of the structure, an Inter-departmental Committee is to be formed consisting of representatives of various Ministries. The powers of the Inter-departmental Committee in case of a complaint against a publisher varies from a warning, admonishing such an entity; to requiring an apology from them; and even deleting or modifying content to prevent incitement of an offence. An authorised officer appointed as a part of the oversight mechanism may in case of emergency block certain content hosted by the intermediaries after considering whether it falls within grounds mentioned in Section 69 A and after providing for reasons in writing and following the due procedure.

Additionally, the Code of Ethics prescribes that publishers of online curated content, i.e. platforms like Netflix and Amazon Prime are not to host any content prohibited by law and are to exercise due caution and discretion while publishing or exhibiting content. All OTTs are also required to classify the content published based on theme and message, violence, nudity, language, sex, etc. Such classification must also be prominently displayed to advise viewer discretion. The Code also gives the Inter-departmental Committee the power to direct such platforms to reclassify ratings and edit synopsis of the content, and even make modifications in content descriptors, age classification and parental control. Therefore, such platforms will now also come under the scrutiny of the Inter-departmental committee in case of any complaints against such OTT platforms.

While the objective of the Code of Ethics is to ensure that the content hosted by the intermediaries is in compliance with the Indian laws, the extensive powers given to the Inter-departmental Committee to pull down content raises serious concerns with respect to freedom of speech. Further, the Inter-departmental Committee which consists of representatives of the government is also responsible for publishing a charter for the self-regulating body at level II of the grievance redressal mechanism which leads us to question the independence of this self-regulating body. Issues have also been raised regarding the rules relating to age classification of content, as these rules are not at par with the international standards. Thus, global OTT platforms will now have to bear the burden of reclassifying their content to comply with the new IT Rules, 2021. Thus, while some sort of regulation is needed, it is also important to ensure that the regulations under the IT Rules, 2021, support creative freedom and also are at par with the international norms to encourage global players to invest in India.