IT RULES 2021 AND THE CHALLENGE FACED BY SOCIAL MEDIA PLATFORMS

ABSTRACT

The authors have discussed the provisions of the IT Rules 2021 and the challenges faced by prominent social media platforms because of this. By analyzing the ‘traceability clause’ and its impact on the social media platforms, the authors have tried to point out that there are various human rights that can be breached as a result of this and that these guidelines violate tenets of privacy as well. With a special reference to WhatsApp’s challenge in the Delhi HC, the authors try to give the readers a bird’s eye view of the entire issue from WhatsApp’s perspective as well by pointing out and analyzing some of their arguments as well. Finally, the authors conclude by discussing what would happen to the social media platforms if they fail to comply, and how the failure to comply results in an unnecessary burden on them.

INTRODUCTION

May 25^th was the last date for social media intermediaries to comply with the new IT Rules, 2021. There were a lot of rumors in the media and online stating that as Facebook, WhatsApp, etc. have not complied with these rules, they would be banned. This is far from the truth.

The new IT Rules 2021 were released by the Indian government way back in February 2021. There are some compliance provisions in these rules that WhatsApp, Facebook, Instagram, Twitter, etc. are skeptical about. This article will critique the provisions sought to be enforced by these new rules and how the intermediaries have responded to it.

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 were released by the Ministry of Electronics and Information Technology on the 25^th of February 2021. It provided 3 months’ time to all social media platforms to comply. The major changes that these rules seek to enforce are twofold. Firstly, they want these intermediaries to appoint specific individuals to ensure compliance with these norms, like the Chief Compliance Officer, Grievance Redressal Officer, nodal contact person, Resident Grievance Officer as a part of a larger Grievance Redressal Mechanism. The time frame involved to register and solve complaints of users has significantly been decreased and the standards set for these officers to maintain are high. Secondly, the most controversial provision of this legislation which is the reason why WhatsApp has approached the Delhi HC as well, is that it requires the intermediaries to enable identification of the first originator of information on their platforms. This is in direct contravention to its privacy policy and the system of ‘end to end user encryption’.

CONCEPT

The traceability Clause in Rule 4(2) of the new IT Act, 2021 primarily deals with significant social media intermediaries (platforms with more than 5 million users) that deal with messaging services. This clause has outrightly demanded the intermediaries to identify the first originator of the information that has been transmitted by way of a text message by using their technological resources as and when required by a judicial order passed by a competent court or by an order passed under Section 69 of IT Rules, 2009. This Rule 4(2) which seeks to impose such a requirement is not a valid law as it is a subordinate legislation, passed by a Ministry and not the Parliament, making it ultra vires to its parent statute, section 79 of the IT Act, 2000.²

This clause has presented a great deal of challenges in front of the intermediaries such as WhatsApp, Signal, Telegram, etc as this clause can lead to privacy infringement for their users. Identifying the first originator of the information will require these companies to breach their end-to-end encryption and keep a track of the messages sent from one person to the other. The argument made by WhatsApp in its challenge to this provision in the Delhi HC is that even keeping track of one of the messages as requested by the Central Government would be tantamount to keeping a track of all messages. By complying to this, the fundamental rights of privacy and freedom of speech and free expression will be tremendously affected. Another major fallacy in this clause is that the intermediaries have to furnish the information as and when required by a judicial decree or let alone by an order passed under Section 69, IT Rules, 2009 which can result in arbitrary decisions and governmental misuse. Moreover, the traceability clause has not gained any momentum in the parliament. The legislature has not enacted any laws authorizing social media intermediaries to comply with such rules.

This clause also imposes criminal liability through the IPC on the employees of the social media intermediaries, if they fail to comply with the rules. This mechanism is completely vague because the entire blame is shifted on an employee of the company i.e., the Chief Compliance Officer and not the company itself. Moreover, them being just a facilitator of this information cannot take the liability for the alleged act in question at all.

Companies like WhatsApp, Signal, Telegram have expressed their concerns and challenges

w.r.t the traceability clause. In order to highlight the loopholes of this traceability clause, WhatsApp has moved to the Delhi HC contending that the clause is unconstitutional and should be struck down as it violates the fundamental rights of the people. According to WhatsApp, finding out the first originator of an information will require the company to end their end-to- end encryption mechanism and store the data of each and every user for a long time. End-to-end encryption helps the intermediary in maintaining the privacy of its users by ensuring that the messages sent cannot be opened by anyone but the originator and the receiver. This helps in securing the privacy and security of millions of users. WhatsApp also contended that many of the messages sent are just forwarded ones, so in-order to find out the originator, they have to store each and every information from the beginning. It says that “It will be like putting a permanent identity stamp or effectively ‘fingerprint’ each message, which it says will be like a mass surveillance program”.³ It also states the fact that this clause requires them to weaken the encryption mechanism or find any backdoor to access the user information and furnish it to the authorities as and when there is a reasonable need. WhatsApp claims that it has a dedicated team of professionals looking and assisting the law enforcement mechanisms on a regular basis and it has always complied with valid agency requests while balancing the rights of its users.

In order to put more stance in its argument, WhatsApp has cited the landmark judgement of Justice K.S Puttaswamy (retd) v UOI⁴on ‘Right to Privacy’. It contends that the traceability

clause is unconstitutional as it doesn’t pass the litmus test of reasonability and proportionality as mentioned in the Puttaswamy case. Another important point raised against this clause was that it can be used by the governmental agencies in a mala fide way and can frame innocent people easily.

The proviso in this Rule states that if the originator of a message is outside India, the first person who receives this message and forwards it in India will be termed as the originator of the message. This is an arbitrary clause as a person forwarding a message or a screenshot can also be termed as an originator and in this way many innocent persons can be easily targeted by the governmental agencies. The traceability clause can enormously jeopardize the privacy and security of the journalists and politicians as the sensitive information can be accessed by anyone with no encryption or weak encryption. WhatsApp says that millions of its users will hesitate to share information on this platform because of the fear of infringement of their privacy and other security related issues and this will severely undermine the main objective of this social media intermediary.

Failure to comply with these provisions are addressed under Rule 7. It states that these intermediaries would not be offered protection from liability as they were getting under Section 79(1) of the IT Act, 2000. This section gave intermediaries exemption from liability towards any third-party information which was being circulated and disseminated on the internet. More specifically, these intermediaries are now subject to criminal provisions as well under these new rules as applicable under the IPC. This is unjust as it is holding the intermediaries responsible for the activities of its users. It undermines the freedom of speech of these users and encroaches upon their privacy as well.

What the Delhi HC would say is anyone’s guess at this moment. One thing is for sure, privacy and freedom of speech is something that is as important as any other fundamental right and it cannot be undermined under the garb of ‘national interest’. This government’s track record with respect to data privacy has also not been great of late. The massive leak of Aadhar details of citizens for as low as Rs.500 came as a shock to the nation. These rules that the government seeks to implement in the name of the protection of its sovereignty, national interest, etc will bring catastrophic impacts on the IT regime. If these rules are implemented, it would harm the intermediaries and the freedom of the people. The intention of the government might be at the best interest of the people, but they will need to come up with a more legally and technically suitable way to achieve the same.

Recommended Readings for further information-

¹Nikhil Javali, National Law University, Odisha Pratikshya Mohanty, National Law University, Odisha

²https://www.livemint.com/opinion/online-views/opinion-draft-it-rules-will-have-a-serious-impact-on-the-privacy-

of-citizens-11574814696619.html

³https://indianexpress.com/article/explained/whatsapp-india-it-rules-traceability-clause-case-explained-7331039/

⁴https://indiankanoon.org/doc/127517806/