Tech Ticker Issue 25: June 2021

Hi everyone! As the industry is abuzz with the action around IT Rules, murmurs about the PDP Bill, crypto regulations and more, we bring you a glimpse of everything that’s keeping the tech-law and policy wonks busy.

Digital media, online content and intermediary liability

The Ministry of Electronics and Information Technology (MeitY) gave Twitter ‘one last chance’ to comply with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules) as a ‘gesture of goodwill’, failing which its safe harbour protections will be withdrawn. Safe harbor is protection from liabilities arising from third-party content. The MeitY is not entitled to vest or take away safe harbour from a platform in this manner. It is empowered to frame rules which Twitter will have to follow to claim safe harbour under the Information Technology Act, 2000 (IT Act). The deadline for platforms with more than 50 lakh registered users in India such as Twitter, Facebook, WhatsApp, etc. to be compliant with the IT Rules lapsed on 25 May 2021. Without a notification extending this timeline, it is for a court to decide if these platforms can claim safe harbour as a defence.

Twitter’s compliance status was also subject to a challenge before the Delhi High Court, where one Amit Acharya (advocate) filed a petition claiming that he was unable to find the details of a resident grievance redressal officer on Twitter’s website for raising his complaint. The Court observed that Twitter will have to adhere to the IT Rules unless their operation is put on hold. Reports suggest that Twitter has appointed a lawyer in India as an ‘interim grievance officer’. The IT Rules say that the grievance officer must be an ‘employee’ of the company who is a resident in India. This case may clarify if it is possible to appoint external persons instead of employees as officers.

In a first by social media intermediaries, WhatsApp challenged the traceability rule under the IT Rules in the Delhi High Court. It argued that the requirement to identify the first originator of a message was unconstitutional and violated users’ fundamental right to privacy. In response, the MeitY acknowledged that it had ‘no intention’ of violating citizens’ privacy, but had to ‘maintain law and order and ensure national security’. Read Vijayant and Aman’s views for the Quint on what this means for users. Also, Nehaa spoke with ET Now on obligations of social media and other intermediaries, and Aman with ABP Network about the dispute between WhatsApp and the government and its implications for user privacy.

[/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_video link=”https://www.youtube.com/watch?v=-sFZb55-0XI”][/vc_column][/vc_row][vc_row][vc_column][vc_video link=”https://www.youtube.com/watch?v=ciIQuDm-5tQ”][/vc_column][/vc_row][vc_row][vc_column][vc_column_text]

Adding to the volley of cases against the IT Rules, musician TM Krishna filed a petition before the Madras High Court, and alleged that the IT Rules went beyond the scope of the IT Act. He argued that the obligations imposed on intermediaries under the IT Rules offended his right as an artist and cultural commentator. They imposed a chilling effect on his right to free speech, and impinged on his right to privacy- “which like music itself, is an experience”. So far digital news platforms – The Wire, Livelaw, etc. and WhatsApp have challenged the IT Rules. Krishna’s case is the first from a content creator.

In other news, the Ministry of Information and Broadcasting (MIB) rounded up OTT and digital news platforms and issued notices directing them to furnish information under the IT Rules. It also appointed Vikram Sahay, Joint Secretary (P&A) of the MIB as the Authorised Officer (AO), setting the foundation for the oversight mechanism administered by the MIB under the IT Rules. An AO can direct OTT platforms to modify or delete content, and block access to information in the interest of sovereignty, public order, security of State etc. Nehaa spoke at a Medianama panel discussion on the impact of the IT Rules on news. Read the key takeaways from this discussion here and here. Meanwhile, the Internet and Mobile Association of India (IAMAI) formed a Digital Publishers Content Grievance Council (DPCGC) as a Self-Regulatory Body (SRB) for OTT platforms. And, the TV broadcaster led ‘Indian Broadcasting Foundation’ (IBF) rechristened itself as ‘Indian Broadcasting and Digital Foundation’ to expand its ambit to include OTT platforms. It also set up its SRB called Digital Media Content Regulatory (DMCRC). OTT platforms are required to join an SRB at level two of the grievance redressal mechanism. While pure play OTT players such as Amazon Prime, Netflix, etc. have joined the IAMAI led SRB, platforms owned by broadcasters such as SonyLiv and Disney+Hotstar have decided to join the IBF led body. Reports speculate that two SRBs indicate a divide in the industry.

[/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_video link=”https://www.youtube.com/watch?v=tEb0YHQSWLo”][/vc_column][/vc_row][vc_row][vc_column][vc_column_text]

Data and privacy

In an interview, the IT minister Mr. Ravi Shankar Prasad indicated that the Joint Parliamentary Committee (JPC) on the Personal Data Protection Bill (PDP Bill) has submitted an ‘interim report’ to the government, and he expects the final report and the Bill to be tabled before Parliament in the monsoon session. Soon after, Mr. Jairam Ramesh, a Congress MP and JPC member took to Twitter to reveal that the JPC Chairperson Ms. Meenakshi Lekhi had assured that a draft report will be shared with the JPC members for comments, and that was still awaited. Mr. Prasad then said that the JPC is yet to finalise its report. Parliamentary procedure allows the JPC to share the ‘completed part’ of its report with the government before tabling it in Parliament. This could be done to ensure that the government and the JPC are on the same page, and the JPC’s version of the PDP Bill is passed smoothly when it’s tabled.

In other news, cybersecurity experts questioned the Indian Computer Emergency Response Team (CERT-In), on its failure to take action against Air India, Domino’s, Big Basket, and MobiKwik for suffering data breaches. They claim that since the passage of the IT Act 2000, no company has been penalised for a data breach. Experts are ‘exploring all options including legal’ against the cybersecurity regulator. Currently, the CERT-In is the national agency for incident response under the IT Act, and is required to collect, disseminate and analyse information on cyber incidents.