In a major change for internet regulation in India, the government notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021  on 25 February, 2021. These rules, made by the government under the Information Technology Act, 2000, has implications for three distinct internet services commonly used by Indian internet users: social media, OTT streaming services and digital news. Social media companies will be regulated by the IT ministry, and OTT and digital news services will be regulated by the information and broadcasting ministry.

All intermediaries will now need to enable a mechanism for grievance redressal on their platforms. Under the rules, social media companies who have more than a threshold number (which is yet to be notified) of Indian registered users will be considered ‘significant social media intermediaries’. These companies will need to mandatorily appoint a compliance officer who resides in India and will be responsible for ensuring compliance with the law. They will also need to appoint a nodal contact person who will have to be available 24×7 to coordinate with law enforcement agencies. These requirements are an improvement over the government’s proposal in the earlier draft of the guidelines which were released in 2018. The 2018 draft mandated that these companies would have to necessarily incorporate themselves in India.

In a move to tackle fake news on messaging services, they will be required to enable law enforcement to identify the ‘first originator’ of a message. It remains to be seen whether this is technically feasible in the case of end-to-end encrypted messaging services like WhatsApp or it will require encryption to be broken.

Social media platforms will also have to give Indian users the option of verifying their profiles, for instance by linking them with their mobile numbers. This requirement raises significant privacy concerns. India is yet to finalise its personal data protection law and the provisions for verification of social media profiles forms a part of the Personal Data Protection Bill which is being examined by a joint parliamentary committee.

The propriety of introducing such obligations through executive rules when the Parliament is examining the same provisions is questionable. Apart from traditional social media companies, other services that allow for the publication or transmission of information can also be subject to these obligations if the ministry determines that they may “create a material risk of harm to the sovereignty and integrity of India, security of the State, friendly relations with foreign States or public order.” In our reading, this could potentially apply to collaborative document editing services or online file sharing sites.

All OTT platforms and digital news services operating in India need to enrol themselves with the I&B ministry for the purposes of “communication and coordination” within 30 days. At the press conference announcing these rules, I&B minister Prakash Javadekar stressed that this was not a registration requirement. Both types of services will now be required to follow codes of ethics prescribed by the I&B ministry. Digital news services will need to comply with the norms prescribed by the Press Council of India and the programme code applicable to TV programs.

OTT streaming services will have to apply age-appropriate based classification for all content on their platforms and enable access controls such as parental locks. This is something that OTT platforms had already committed to doing under a self-regulatory code that they adopted earlier this year through the Internet and Mobile Association of India (IAMAI).

The bigger change is the grievance redressal model imposed through these rules. The I&B ministry requires both sets of services to enable a mechanism to address user complaints about their content and its classification. The grievance redressal model will entail a three-tier system with the first level being at the company itself, the second level being a self-regulatory industry association which will be chaired by a retired judge and the third level being a government oversight body consisting of an inter-ministerial committee.

The government oversight body will hear appeals from the decisions taken at the first two levels but also matters directly referred to it by the I&B ministry. The level two self-regulatory body will be able to censure the content company and ask it to modify the content or its classification. The level three oversight mechanism also allows for content to be taken down entirely.

Ever since the I&B ministry assumed charge over online content and digital news through a change in the government’s allocation of business rules in November 2020, there has been speculation about how the ministry will exercise this power. By joining hands with the IT ministry and issuing these guidelines under the IT Act, they have avoided the need to bring in fresh legislation to regulate this field. In the days to come, it is almost certain that the legal validity of these rules will be challenged in court. A major question will be if the government’s rulemaking power under the IT Act is wide enough to allow them to issue these rules in the manner that they have.

The author is a senior associate at Ikigai Law