Professional Documents
Culture Documents
It Rules - Highighted
It Rules - Highighted
Citations:
Please note: citations are provided as a general guideline. Users should consult their preferred
citation format's style manual for proper citation formatting.
-- Your use of this HeinOnline PDF indicates your acceptance of HeinOnline's Terms and
Conditions of the license agreement available at
450 I Reports EDPL 312021
India
An analysis of this provision from the IT Rules (iv) infringes any patent, trademark, copyright or
2021 - not relying on section 79 anymore - shows other proprietary rights;
that the central government indicated that social me- (v) violates any law for the time being in force;
dia intermediaries will be held liable for hosting con- (vi) deceives or misleads the addressee about the ori-
tent which is not desirable under constitutional prin- gin of the message or knowingly and intentional-
ciples. Rule 7 of the IT Rules 2021 quite clearly states ly communicates any information which is patent-
that the intermediary would be held liable, if its plat- ly false or misleading in nature but may reason-
form is utilised for hosting content prohibited under ably be perceived as a fact;
the IT Rules 2021 and the intermediary has not fol- (vii) impersonates another person
lowed these rules to ensure its removal. 4 (viii) threatens the unity, integrity, defence, security
Thus, a lot of intermediaries have expressed criti- or sovereignty of India, friendly relations with for-
cism for the new IT Rules 2021 in light of their manda- eign States, or public order, or causes incitement
tory nature. Similarly, not only have social media in- to the commission of any cognisable offence or
termediaries been subjected to additional obligations prevents investigation of any offence or is insult-
under the provisions of the IT Rules 2021, but pub- ing other nation;
lisher of news and current affairs content and pub- (ix) contains software virus or any other computer
lishers of online curated content. 5 code, file or program designed to interrupt, destroy
Under rule 3 of IT Rules 2021, the social media in- or limit the functionality of any computer resource;
termediary, including SSMI, needs to prominently (x) is patently false and untrue, and is written or pub-
publish on its website or mobile based application, lished in any form, with the intent to mislead or
the rules and regulations, privacy policy and user harass a person, entity or agency for financial gain
agreement for access or usage of its computer re- or to cause any injury to any person;
sources while clearly highlighting the terms and con-
ditions about which content cannot be posted on the Further, under Rule 3 (2) the social media intermedi-
platform. The social media intermediary, under Rule ary needs to appoint a Grievance Officer (GO) to en-
3 (1) (b), shall also inform the user not to post, host, sure that complaints can be addressed to the GO
display, modify, publish, transmit, store, upload or against the violation of these provisions. In order for
share on its platform content: appropriate action to be taken in accordance with the
(i) [which] belongs to another person and to which provisions of the IT Rules (Rule 3 (1) (c)) and if the
the user does not have any right; action is not taken by the intermediary within a lim-
(ii) is defamatory, obscene, pornographic, pae- itedtimeframe (Rules 3(2) (i) and 3(1) (d)), action will
dophilic, invasive of another privacy's including be taken against the intermediary as if the content
bodily privacy, insulting or harassing on the basis was posted by the intermediary itself (Rule 7). In this
of gender, libellous, racially or ethnically objec- regard the IT Rules seem similar to the German Net-
tionable, relating or encouraging money launder- work Enforcement Act (NetzDG) 6 to a certain extent
ing or gambling, or otherwise inconsistent with or which obligates online platforms to remove illegal
contrary to the laws in force; content (content that violates the German Criminal
(iii) is harmful to child; Code) from their platforms within a certain period
of time, otherwise they face a hefty fine of Euro five
million (Section 4 (2) NetzDG). However, the NetzDG
4 Rule 7 is worded 'Where an intermediary fails to observe these does not itself impose deletion obligations on social
rules, the provisions ofsub-section (1) ofsection 79 of the Act
shall not be applicable to such intermediary and the intermediary
networks (but only sets tight deadlines; the deletion
shall be liable for punishment under any law for the time being in obligations result from other laws), nor does it itself
force including the provisions of the Act and the Indian Penal
Code' determine when content is deemed illegal (but only
5 According to Rule 9 (2) notwithstanding anything contained in refers to German criminal law) and, finally, is also
this rules, a publisher referred to in rule 8 who contravenes any limited solely to content relevant under criminal law,
law for the time being in force, shall also be liable for consequen-
tial action as provided in such law which has so been contra- in contrast to the IT Rules 2021 where substantial
vened. obligation is coming from the rules itself. This pro-
6 Network Enforcement Act of 1 September 2017 (Federal Law
motes the institutionalising of the concept of the per-
Gazette I p. 3352), as last amended by Article 1 of the Act of 3
June 2021 ( Federal Law Gazette I p. 1436). formance of sovereign tasks by private entities ('pri-
452 I Reports EDPL 312021
vatisation of supervision'), as the social media plat- cy, but instead uses the formulation 'legitimate state
forms have billions of users and it would be hard for interest or public interest'. Similarly, Justice Sanjay
the government to control each and every account in Kishan Kaul also accepts the three-fold test for re-
order to 'censor' the content posted. straining privacy, but instead refers to 'democratic
society' for a legitimate aim.13 Justice Chelameswar
and Justice Bobde word it 'compelling state inter-
III. IT Rules and the Right to Privacy est'.14 It is not entirely clear what these terms used
by the judges legally underpin. One needs to analyse
One of the key issues concerning the legal validity of them carefully in order to reflect the degree of scruti-
the IT Rules 2021 is about Rule 4 (2) which requires ny each term invokes. However, the approach was
a SSMI to reveal the first originator of the informa- strengthened in the K.S. Puttaswamy-II judgment15.
tion on its computer resource, if required by a judi- Justice Sikri delivering the majority opinion stated
cial order passed by a court of competent jurisdiction that apart from two judges in K.S. Puttaswamy-I(Jus-
or an order of a competent authority. This provision tice Chelameswar & Justice Bobde) the remaining
is specifically problematic for messaging applica- ones relied on the term 'legitimate state interest' be-
tions which use end-to-end encryption. It is therefore ing a more lenient test for restricting individuals' pri-
not surprising that WhatsApp challenged the IT vacy rights compared to the criteria of public inter
Rules already before the Delhi High Court.7 The main est and larger public interest.
argument raised against this provision is its ability In light of this jurisprudence, the provision of Rule
to allow for surveillance concerning every message 4(2) needs to be analysed. It reads:
exchanged through the messaging platform. This sur Rule 4 (2) A significant social media intermediary
veillance would be regarded as a direct violation of providing services primarily in the nature of mes-
privacy rights. saging shall enable the identification of the first
However, the question is whether this violates the originator of the information on its computer re-
standards of the right to privacy in terms of balanc- source as may be required by a judicial order
ing with competing interests. The decision in K.S. passed by a court of competent jurisdiction or an
Puttaswamy-I8 has clearlylaid down the guideline for order passed under section 69 by the Competent
delineating the scope of the right to privacy and on Authority as per the Information Technology (Pro-
the limitations applicable to it. First, the majority cedure and Safeguards for interception, monitor-
opinion delivered by Justice Chandrachud sets out ing and decryption of information) Rules, 2009,
three reasons for limiting privacy9: which shall be supported with a copy of such in-
(i) There has to be a law in existence formation in electronic form.
(ii) There has to be a legitimate State Aim
(iii) the law must be proportionate to the objective
pursued. 7 Arpan Chaturvedi, 'WhatsApp moves Delhi High Court against IT
Rules 2021' Bloombergquint, (261s May 2021) <https://www
.bloombergquint.com/law-and-pol icy/whatsapp-moves-delhi-high
Justice Chandrachud derives the origin of these three -court-against-it-rules-202 1> last accessed on 311T July 2021.
criteria from the procedural and substantive man- 8 K.S. Puttaswamy v. Union of India (2017) 10 SCC 1, case number
dates of Article 21 of the Constitution of India (Pro- W.P.(C) No.-000494-000494 / 2012, available at <https://sci.gov
.in/supremecourt/201 2/35071/35071 2012judgement_24-Aug
tection of life and personal liberty).' The first re- -2017.pdf>. Cf. on this already Ashit Kumar Srivastava 'Data
Protection Law in India: The Search for Goldilocks Effect' (2019)
quirement of an existing law is the basic premise of 5(3) EDPL 408, 414 et seq..
Article 21. The second criterion of legitimate state in- 9 ibid Justice Chandrachud) [180] 254.
terest ensures that the restrictions imposed by the 10 Constitution of India, English version available at <https://
law are within reasonable limits. The third criteria of legislative-gov.in/sites/default/files/COIl.pdf>.
proportionality is a necessary element to protect 11 ibid (n 9).
It is interesting to note that one of the terms used 13 ibid Justice Sanjay Kishan Kaul) [71] 533
14 ibid Justice Chelameswar) [43] 308 & Justice Bobde) [39] 344
by Justice Chandrachud within the three-fold test is
15 K.S. Puttaswamy v. Union of India (2019) 1 SCC 1, available at
'legitimate state interest', while Justice Nariman also
<https://main.sci.gov.in/supremecourt/2018/45777/45777_2018
agrees with the three-fold test for restraining priva- 5_1001 _25344judgement_l 1 -Jan-2021.pdf>.
EDPL 312021 Reports |453
Rule 4(2) puts an obligation on the SSMI providing relating to the above or in relation with rape, sexual-
services primarily as messaging application, to reveal ly explicit material or child sexual abuse material,
the identity of the originator of a message if ordered punishable with imprisonment for a term of not less
to do so by the competent authority. SSMI argue that than five years'. In addition, a second proviso limits
this single provision is capable of calling their entire the area of order by clearly laying down that the or
business model into question. Firstly, the end-to-end der shall not be passed in cases where less intrusive
encryption makes it hard for the intermediary to de- means are effective in identifying the originator of
duce what information has been shared and who the information. Additionally, the third proviso states
shared it.1 6 Secondly, in order to follow the orders of that no SSMI is required to disclose the content of
competent authorities, the intermediary has to keep any electronic messages, any other information relat-
track not only of the account-user against whom the ed to the first originator or any information related
order is (indirectly) directed but also all other ac- to its user.
counts.17 Furthermore, this kind of surveillance In this light Rule 4(2) does provide for sufficient
would create a fear in the mind of the user before safeguard for ensuring that there is no abuse of the
sharing anything, and is a clear violation of the pri- power bestowed onto the authorities. However, with
vacy rights.18 regard to the test laid down by K.S. Puttaswamy-I, al-
However, Rule 4 (2) clarifies further that the order though the first criteria is fulfilled, the second crite-
can only be passed by the competent authorities '... ria of a 'legitimate state interest' needs to take into
for the purposes of prevention, detection, investiga- account the objective of the policy behind the law.1 9
tion, prosecution or punishment of an offence relat- In this case, various interests can be found that are
ed to the sovereignty and integrity of India, the se- reflected in the second condition cited, such as the
curity of the State, friendly relations with foreign protection of public safety and order, which may al-
States, or public order, or of incitement to an offence so cover the dissemination of dis/misinformation un-
der certain conditions which has become a cause of
social problems. Thus, there surely is a 'legitimate
16 Megha Mandavia & Surabhi Agarwal, India Messaging App Rules:
WhatsApp sticks to its stance on end-to-end encryption, Econom-
state interest'.
ic Times (2"d March 2021) <https://economictimes.indiatimes With regard to the third criterion of proportional-
.com/tech/technology/india-messaging-app-rules-whatsapp-sticks
-to-its-stance-on-end-to-end-encryption/articleshow/81 237981 ity, Justice Sikri in K.S. Puttaswamy-II discussed dif-
.cms?from=mdr> last accessed on 31S July 2021>. ferent elements of the proportionality test, however,
17 Ketan Pratap, WhatsApp says India's new IT Rules that ask for much of the remarks were drawn from the judgment
message tracing will end privacy for users, India Today, (26n May
2021) < https://www.indiatoday.in/technology/talking-points/sto- of Modern Dental College2 0 . In this decision, three as-
ry/whatsapp-says-india-s-new-it-ru les-that-ask-for-message-trac- pects were identified as concretising proportionali-
ing-will-end-privacy-for-users-1 807130-2021-05-26> last ac-
cessed on 311 July 2021. ty: legitimate aim, suitability of the measure to
18 ibid. achieve this aim (linked to the question if there are
19 K.S. Puttaswamy-II (n 15) Justice A.K. Sikri) [121] 211. any less intrusive means) and the necessity of the ac-
20 Modern Dental College and Research Centre & Ors. V. State of tion.21
Madhya Pradesh & Ors. (2016) 7 SCC 353
The first sub-criterion needs to be read within the
21 K.S. Puttaswamy-II (n 15) Justice A.K. Sikri) [125 (c)].
social context of the grievance that the law is intend-
22 BBC, 'How WhatsApp helped turn an Indian village into a lynch
mob', BBC (191h July 2018) <https://www.bbc.com/news/world ed to redress. There is no denying that messaging
-asia-india-44856910> last accessed on 31ST July 2021; Pretika applications in India have been utilized for purpos-
Khanna, Abhiram Ghadyalpatil, Shaswati Das, 'Death by Social
Media' LiveMint, (2nd August2018) <https://www.livemint.com/ es which are not desirable. In fact, cases of mob
Politics/jkSPTSf6IJZ5vGC1 CFVyzl/Death-by-Social-Media.html>
last accessed on 31"'July 2021.
lynching, often linked with the sharing of misinfor-
23 The Guardian, 'WhatsApp murders': India Struggles to combat mation, have increased only in the last years.2 2 A ter-
crimes linked to messaging services, The Guardian (3 rd July 2018) rible example was the case of the rumours of a group
<https://www.theguardian.com/world/201 8/jul/03/whatsapp
-murders-india-struggles-to-combat-crimes-I inked-to-messaging of child abductors wreaking havoc in India which
-service> last accessed on 31s July 2021. was spread through messaging services and led to
24 Rohan Venkataramakrishnan, 'India wants WhatsApp to break many people getting killed due to this misinforma-
encryption and trace inflammatory messages. Should it?', The
Scroll (301h September 2018) < https://scroll.in/article/895645/ tion.2 This is fostered also due to end-to-end encryp-
ind ia-wants-wh atsapp-to-break-encryption-and-trace
-inflammatory-messages-should-it> last accessed on 31' July
tion models of messaging applications, where users
2018. interact in anonymous security.24 Therefore, there
454 I Reports EDPL 312021
surely is a legitimate aim to deal with this growing rows down the scope of the restrain imposed by the
menace. law and ensures that privacy rights are restricted on-
With regard to the second sub-criterion of suitabil- ly in certain cases mentioned in the first proviso
ity of the action, the approach of Rule 4(2) of tracing where the originator of the information will be traced
the originator of the information seems to be a suit- and no other information is required to be disclosed,
able solution in light of protecting the legitimate aim thereby ensuring that the essence of the right is rec-
with regard to the end-to-end encryption model.25 In onciled with the legitimate aim of the law. Thus if
fact, a recent report came to the conclusion that it is tested on the premise of the three-fold test developed
difficult if not impossible to trace the originator of by the K.S. Puttswamy-I decision and further elabo-
an information due to end-to-end encryption for the rated under K.S. Puttaswamy-II,the law seems to com-
purposes of academic research without the help of ply with it.
providers.2 6
Another question linked to the suitability is the
third criterion of the necessity of action, in particu- IV. IT Rules and Freedom of Speech
lar, whether the 'revelation of the first originator of
information'is the least intrusive means or not. This The other measure on which the viability of IT Rules
must be seen in the light of the proviso that Rule 4(2) 2021 has been questioned is the question of freedom
itself imposes which quite clearly says that the reve- of speech, in particular that the limitations provid-
lation of the first originator does not need to be pur- ed for in Rules 3 and 4 have a chilling effect on the
sued if there are other less intrusive and effective free speech.33 Although the focus of this contribu-
means available for tracing the originator of an in- tion is not on issues related to freedom of expres-
formation. This certainly makes the provision less sion, it is worth highlighting that Rule 3 of the IT
strict and probably hints towards the possibility of Rules 2021 specifically provides for reasons content
accumulation of meta-data in order to trace the first should be removed and the implementation of a com-
originator. plaint mechanism. Read in conjunction with Rule 7,
The last sub-criterion for the proportionality test the intermediary is liable when it has 'actual knowl-
is a balancing of rights, which assesses whether the edge' 34 about any of the prohibited content posted
measure adopted for restraining the right to privacy on its platform and it does not take 'appropriate' ac-
is disproportionate or not. 2 7 As Robert Alexy28 ar tion. This formulation leads to the criticism that in-
gued, norms are based on principles, which means
they must be realised to the greatest extent possible.
When structuring a fundamental right, the core
25 Shweta Ganjoo, 'WhatsApp maintains its stand on govt's request
essence of the principle of which those rights are a for message traceability in India' India Today, (181 June 2019) <
https://www.indiatoday. in/technology/news/story/whatsapp
reflection, needs to be given space in such a way to -main tains-i ts-stand-on-govt-s-request-for-message-traceabil ity-i n
accommodate space for restrain.2 9 Mattias Kumm de- -india-1 551098-2019-06-1 8> last accessed on 31sTJuly 2021.
fines proportionality as an opportunity for citizens 26 Shakuntala Banaji, Ram Bhat, Anushi Agarwal, Nihal Passanha,
Mukti Sadhana Pravin, 'WhatsApp Vigilantees: An exploration of
to get a public-reason based justification, 30 what he citizen reception and circulation of WhatsApp misinformation
calls a 'Socratic Contestation'. In a law-based propor linked to mob violence in India', London School of Economics
and Political Science, <https://www.lse.ac.uk/media-and
tionality review, the questioning individual is given -com mun ications/assets/documents/research/projects/WhatsApp
an opportunity of contesting the viability of the law -Mis information-Report.pdf>.
27 K.S. Puttaswamy-II (n 18) (Justice A.K. Sikri) [125 (d)] 216.
and thus in response receiving fine-tuned reasons.31
28 Robert Alexy, A Theory of Constitutional Rights (Oxford Universi-
This element of proportionality, therefore, provides ty Press, 2009).
the opportunity to address the 'thoughtlessness' 32 or 29 ibid.
inadequacies associated with the law. In this light, 30 Mattias Kumm 'The idea of Socratic Contestation and the Right to
the third proviso of Rule 4(2) seems to be of rele- Justification: The Point of Rights-based Judicial Review' (2010)
Law & Ethics of Human Rights.
vance. It ensures that while tracing the originator of
31 ibid.
the information, the content of any of the electronic
32 K.S. Puttaswamy-II (n 11) (Justice A.K. Sikri) [125 (d)] 216.
messages is not disclosed or any other information
33 A chilling effect test was contrived from 'Shreya Singhal v. Union
related to the first originator, or any information re- of India AIR 2015 SC 1523'.
lated to other users. Thus, this proviso certainly nar 34 Cf. on this Shreya Singhal v. Union of India AIR 2015 SC 1523.
EDPL 312021 Reports |455