The Legal Slugfest Between Digital BigTech and the Government of India
Published: Jun 01, 2021
By Advait M Sethna, Counsel Special Public Prosecutor
A. Prologue: As The Curtain Rises.
By way of background to this intriguing legal battle set in the echelons of the Hon'ble Delhi High Court, pertinent it is to mention about the Information Technology (Guidelines For Intermediaries and Digital Media Ethics Code) Rules, 2021 ("the Rules" for short). The said Rules dated 25th February, 2021 have been framed under S.87(1)1 of the Information Technology Act, 2000 ("IT Act" for short).
The said Rules have been introduced to regulate the publication and transmission of online content. They lay down certain requirements to be complied by Social Media Intermediaries2, particularly Significant Social Media Intermediaries 3, as defined under the IT Act. The Central Government has notified a threshold of more than 50 lakh users for a Social Media Intermediary to be classified as a Significant Social Media Intermediary. Hence, colossals like Facebook, Twitter, WhatsApp, Signal, Instagram among others qualify as Significant Social Media Intermediary.
The said Rules are dovetailed with several clauses, the relevant one being Rule 4(2)4, i.e., Additional Due Diligence to be Observed by Significant Social Media Intermediary. Such is also referred to as the Traceability Clause. Aggrieved by the said Rules, more particularly the said Clause, WhatsApp has taken the Government of India (through the Ministry of Electronics and Information Technology) to the Hon'ble Delhi High Court, mainly on the ground that the requirements under the said Clause are onerous. These violate the valuable right of Privacy, an integral part of Fundamental Right under Article 215 of the Indian Constitution, in light of which such Rules/Clause be declared as unconstitutional by the Hon'ble Court.
B. Tryst with the Law.
These Rules contemplate a compliance period of 3 Months from the date of its publication as far as the Significant Social Media Intermediaries are concerned. The Government of India made it clear that it will be well within its right under Rule 76 of the said Rules to take appropriate action against such BigTech if they fail to comply with the said Rules. Consequently, the safe harbor regime as contemplated under Section 79(1) of the IT Act protecting them against liability for content posted on their platform would cease to apply. Such companies would be liable for punishment including criminal prosecution under the provisions of the IT Act and the Indian Penal Code, 1960 ("IPC" for short).
Under Rule 4(2) of the said Rules, the originator of any data/information can be traced, identified in a scenario where other remedies have proven to be ineffective. This, in other words, can be used by the Government of India as a measure of last resort. The first originator under Rule 4(2) can be traced only for the purposes of prevention, investigation, punishment, etc. of, among others, an offence relating to sovereignty, integrity, and security of India, public order, incitement to an offence relating to rape, sexually explicit material, or child sexual abuse material punishable with imprisonment for more than five years. Moreover, as an intrinsic and inbuild safeguard under the said Rules such information can be sought from the Social/Significant Social Media Intermediary Companies, only under an order passed by the competent authority under S. 697 of the IT Act in the prescribed form and manner.
Our readers may note that under Rule 4(2) when the first originator of any information /data posted on the computer resource of any Social/Significant Social Media Intermediary is located outside India, the first originator, i.e., who shares or forwards such information within the territory of India shall by deeming fiction, be treated as First Originator of such information for the purposes of this Rule.
C. The Debate Unfolds.
According to WhatsApp, Traceability under Rule 4(2) would force private companies like them to retain and store all content shared in form of messages transmitted through such platform. Such companies apprehend that under the garb of such Rule, the Government of India may prevail upon them to handover user data under the pretext of law enforcement. The anxiety also is that such rule will dilute the end-to-end encryption of messages which platforms like WhatsApp ensure to its users. By such safeguards, platforms like WhatsApp assure its users of data privacy and protection of the same.
In the above backdrop WhatsApp has challenged the said Rule, i.e., the Traceability Clause being violative of Fundamental Right under Article 21 of the Indian Constitution, as such Rule impinges upon privacy which is sacrosanct and inviolable. Gainful reliance is placed on the celebrated decision of the Hon'ble Supreme Court in the case of K.S. Puttuswamy v. Union of India8. The Hon'ble Supreme Court by this landmark decision recognized the Right to Privacy as an integral and indestructible right embedded in Article 21 of the Indian Constitution.
The Government of India as stated in a Press Release issued, primarily contends that the said Rule is not a measure in isolation. The said Rules have been framed after consultation with various stakeholders and Social Media Intermediaries, including WhatsApp.
According to the Government of India, it is important to note that, the said Rule 4(2) shall only apply for the purposes of prevention, investigation, punishment, etc. of an offence against sovereignty, integrity, and security of India, public order, incitement to an offence relating to rape, child abuse, sexually explicit material punishable with a jail term exceeding five years. Thus, the said Rule springs into operation only on such conditions which shall be specified under an Order issued by the Competent Authority under S.79 of the IT Act and not otherwise. The Government of India is concerned about the fact that it cannot deny as to how in cases of mob lynching, riots, etc. repeated WhatsApp messages are circulated of content which is already in public domain. In view thereof, the role of tracing the originator of the message, particularly in India becomes inevitable. According to the Indian Government, the entire debate on whether encryption would be maintained or not, is misplaced. Further, whether Right to Privacy is ensured by using encryption technology or some other technology is entirely the concern and prerogative of such Social/Significant Social Media Intermediary company. Thus, the thrust and crux of the Government of India in enforcing these Rules is larger public interest which is paramount and the laws of the land ought to be respected, specially by private corporations/organisations.
D. Global Scenario.
Our readers may note that the Governments of United Kingdom, United States, Australia, New Zealand, Canada, issued a communique to the effect that tech companies should include mechanisms in the design of their encrypted products and services whereby governments acting with appropriate legal authority, can gain access in certain situations to such date in readable and usable format.
Brazil is also expecting WhatsApp to provide suspect's I.P. Addresses, Customer Information, Geolocation Data, and Physical Messages.
The above seem to suggest that the said Rules framed by the Government of India are in consonance with the prevailing international standards.
E. On This Gordian Knot: My Perspective.
Considering the importance, complexity, and ramifications of the issue above, and calibrating the response of the contesting parties I pen down my thoughts briefly as under:
1. According to me, the Rules provide for in-built safeguards to ensure checks and balances vis-à-vis user's data privacy on one hand and national interest on the other. The said Rules which have been formulated after discussions with several stakeholders and reference to international practices, seems to be premised on the touchstone of "Bahujan Sukhay, Bahujan Hitay", i.e., in larger public interest, which is centrifugal to policymaking for a welfare state like ours.
2. The said Rules require such companies falling under its purview to appoint officers like Compliance Officer, Redressal Grievance Officer, Nodal Officer among other for detection of misuse and smooth implementation of the said Rules. They were given a time-frame of three months, which seems to be reasonable to comply with the said Rules. Considering that such companies intend to abide by such Rules, asking for some further extension to comply with such Rules appears to be reasonable.
3. There is no quarrel to the proposition that Privacy is an integral part of our Fundamental Right guaranteed under Article 21 of the Indian Constitution. Having said that, the judgment of the Hon'ble Supreme Court in the Puttuswamy Case (supra) categorically holds that the Right to Privacy is not without any restrictions, fetters. Thus, such right, though Fundamental, is not an Absolute right and is circumscribed by a procedure established by law. Such restriction is justified where invasion to Privacy meets the threefold requirement of Legality, Need in terms of legitimate claim of the State, and Proportionality.
4. Data privacy is no doubt of paramount importance. However, demand of some Significant Social Media Intermediary Companies to the effect that they would retain rights to relay all such data/information to its parent company is also cause of grave concern. The privacy argument then becomes paradoxical. The said Rules and Clause 4(2) thereof finds justification in instances of cyber terrorism, fake news surrounding the present pandemic situation, rumors around vaccination and its effects including resulting death as also a recent message widely floating on social media purportedly by a Nobel Laureate to the effect that all those vaccinated would expire in a period of two years. The Government of India has no alternative but to step in to prevent such misuse/abuse of date/information.
5. Last but not the least, I believe that it will be a hyperbole to doubt the object and rationale behind the said Rules, more particularly Rule 4(2) if the same is read in totality and not in isolation.
F. Epilogue: The Road Ahead….
It is learnt that platforms that Google-YouTube has expressed its inclination in accepting the said Rules considering its overwhelming user base in India. Admittedly, a new policy of any government of a welfare state cannot be sans ridges. Thus, during Court Hearings as they play out, if such creases are ironed out with a pragmatic approach pursuant to dialogue and discussions that transpire, the said Rules which are well-intended ought to be effectively implemented and enforced.
___________________________________________________________________________________________________________________________________________________________________________________________
1 S. 87(1) of Information Technology Act, 2000 - The Central Government may, by notification in the Official Gazette, make rules to carry out the provisions of this Act.
2 Rule 2(w) of Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 - 'social media intermediary' means an intermediary which primarily or solely enables online interaction between two or more users and allows them to create, upload, share, disseminate, modify or access information using its services.
3 Rule 2(v) of Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 - 'significant social media intermediary' means a social media intermediary having number of registered users in India above such threshold as notified by the Central Government
4 Rule 4(2) of Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 - "A significant social media intermediary providing services primarily in the nature of messaging shall enable the identification of the first originator of the information on its computer resource as may be required by a judicial order passed by a court of competent jurisdiction or an order passed under section 69 by the Competent Authority as per the Information Technology (Procedure and Safeguards for interception, monitoring and decryption of information) Rules, 2009, which shall be supported with a copy of such information in electronic form:
Provided that an order shall only be passed for the purposes of prevention, detection, investigation, prosecution or punishment of an offence related to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or of incitement to an offence relating to the above or in relation with rape, sexually explicit material or child sexual abuse material, punishable with imprisonment for a term of not less than five years:
Provided further that no order shall be passed in cases where other less intrusive means are effective in identifying the originator of the information:
Provided also that in complying with an order for identification of the first originator, no significant social media intermediary shall be required to disclose the contents of any electronic message, any other information related to the first originator, or any information related to its other users:
Provided also that where the first originator of any information on the computer resource of an intermediary is located outside the territory of India, the first originator of that information within the territory of India shall be deemed to be the first originator of the information for the purpose of this clause."
5 Article 21 of Constitution of India 'Protection of Life and Personal Liberty': No person shall be deprived of his life or personal liberty except according to procedure established by law
6 Rule 7 of Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 - Non-observance of Rules.- Where an intermediary fails to observe these rules, the provisions of sub-section (1) of section 79 of the Act shall not be applicable to such intermediary and the intermediary shall be liable for punishment under any law for the time being in force including the provisions of the Act and the Indian Penal Code.
7 Section 69 of Information Technology Act, 2000 - Power to issue directions for interception or monitoring or decryption of any information through any computer resource by Competent Authority.
8 K.S. Puttuswamy v. Union of India; 2017 10 SCC 1.
