Information Technology Rules 2021- Analysis

Introduction

• The Government issued a set of rules under the Information Technology Act, noting that it was superseding rules issued under Section 79 of that statute in 2011.

Issues

• Increased censorship of Internet content and mandating compliance with government demands regarding user data collection and policing of online services in India.
• Absence of open and public discussion of the full swathe of regulatory powers the government has sought to exercise
• Lack of detailed parliamentary study and scrutiny.
• The Union Government has chosen to pass these rules under the requirement to outline the due diligence that Internet intermediaries — ranging from telecom providers, search engines, Internet platforms hosting user generated content to cloud providers — have to follow in order to be able to claim their qualified legal immunity under Section 79 of the IT Act.

Curious stand

• The government’s gazette notification has further claimed that the rules were also issued under the legal authority to specific procedures for blocking web content under Section 69A of the IT Act.
• The ability to issue rules under a statute — i.e. to frame subordinate legislation — is by its nature a limited, constrained power.
• When the Union Government issues subordinate rules, it is limited to the substantive provisions laid out by Parliament in the original act passed by the latter — the executive branch is subordinate to what Parliament has permitted it and cannot use its rule-making power to seek to issue primary legislation by itself.

Directives and mandates

• Obligation to use Section 79: Instead of specifying the basic due diligence requirements intermediaries had to perform in order to make use of the Section 79 safe harbour provision, the executive branch has created new rules that apply only to “significant social media intermediaries” — a term that appears nowhere in the Information Technology Act.
• Retention of user data: It has included mandates for retention of user data by such intermediaries for use by government agencies
• Tracking the original creator:  Clauses on how popular messaging services have to enable the tracing of the original creator of a message (which is regarded as not possible for end-to-end encrypted messaging services without introducing flaws in their systems) even though the sections in the law cited by the government do not give them that power.
• Registration of digital news media: The digital news sites have to be registered before the Ministry of Information and Broadcasting
• Self Regulatory system:  Online streaming video sites featuring original content (which are generally not regarded as intermediaries for the purposes of Internet law) have to agree to a government-supervised “self regulatory system”.
  • This, even though digital news service registration is not required under the IT Act and streaming video content has not been included under the ambit of the Cinematograph Act.

The message is clear

• It appears that the government wants to send a message to all Internet ecosystem players that they desire compliance with their desires — formal or informal — regarding what content should be taken down, along with a removal of any push back against over broad demands for user data and other surveillance orders by government agencies.

Conclusion

• In advancing Internet content control interests and increased requirements around government demands for user data, while not advancing surveillance law reform or enacting a strong statutory data protection framework, it appears that the interest is more in advancing Big Government and trying to force technologists to fall in line, no matter the cost to our fundamental rights in our Internet age.