IT Rules | The Gradual Encroachment

New rules provide the government unaccountable power over free online speech, violating separation of power from an erstwhile judicial role

Photo by Thomas Windisch from Pexels

We live in unprecedented times, where technology is creating new and complex problems. Technology is changing the balance of power between governments, corporations, and individuals. A re-alignment is happening as we speak. Many competing interests are at play. Societies need to find fora where we can find a middle ground that is fair and equitable. The sole discretion of governments is clearly not that forum. Unfortunately, the new IT rules brought in by the Government of India don’t seem to believe that.

The IT rules seek to balance several competing interests — the hitherto unabated growth of internet companies, the new-found freedom of speech online, keeping the internet safe and law enforcement for offline crimes. Stakeholders will place differing importance on each of these goals. Which is why we need well-run institutions that can listen to various stakeholders, and try to reach consensus. However, the IT rules fail to create the right institutional architecture for a fair and equitable resolution to these competing goals. It violates the three foundational precepts of well-run institutions:

• Tightly-Written Law: A well-run institutional architecture requires a specific and comprehensive law, with minimal discretion to the government. These rules, however, are quite vague — they can be interpreted to include not just social media, but also business productivity apps and general SaaS companies. They also delegate too many decisions to the government — final decisions on complaints, code of practices for self-regulating bodies, emergency blocking orders, and ability to issue guidance to internet companies, among other things. Instead, these definitions should have been clarified and delegation to government reduced.
• Transparent Adherence to Law: A well-run institutional architecture requires all involved stakeholders to verifiably show that they are adhering to the law. The new IT rules do that well in the case of private actors. Significant social media intermediaries, online publishers and self-regulatory bodies are all required to publish monthly reports with details about complaints they receive. They are also obligated to respond to user complaints expeditiously. But these transparency measures are not applicable to the government. The rules should have mandated that the meeting minutes of the inter-departmental commitee (IDC) and the rationale behind the government’s decisions be placed before the public.
• Independent Oversight: A well-run institutional architecture requires that those bodies that have power also kept in check by an equally strong and independent body. This is where the IT rules are at their weakest. Typically, the judiciary is a check on government power. That is even more important when one needs to balance various interests, especially involving constitutionally-guaranteed fundamental rights (free speech). But the new IT rules do not do so. Instead, they should have made the judiciary or a new independent body (headed by a retired judge) the final arbiter of free speech issues.

If these three principles were met, it would have helped India balance a thriving internet economy, human rights, and national interests. No single stakeholder — government, corporation or individual — has all the answers. Which is why we need institutions that will incorporate the best that each offers, and come up with solutions that are fair to all. My notes below evaluate each of the stakeholders involved in the new IT rules, through the lens of institutional robustness.

Analysis of Institutional Architecture

1. Social Media Intermediary

• Identification: Any intermediary that primarily enables online interaction between two or more users and allows them to create, upload, share, disseminate, modify or access information using its servers.
• Role: (i) Publish user agreement and inform users at least once a year (ii) take down content voluntarily, on court or government (within 36 hours) or on user complaint (iii) preserve content for 180 days for investigations (iv) provide data to government within 72 hours (v) report cyber-security incidents to CERT-in (vi) acknowledge user complaint in 24 hours and respond in 15 days.
• Incentives: None. Instead, the dis-incentive is the threat of being in violation of the law and attracting fines and imprisonment.
• Accountability: Clear obligations and timelines for responses both to users and government. Any violation will invite punishment.

My Take: The new rules provide more clarity on existing functions and obligations of social media companies. Clarifying timelines for each of the processes is also useful. However, social media companies should be provided some discretion to contest government orders. Not giving them that opportunity will keep them fully open to government interference, and poison the economic environment in the country.

2. Significant Social Media Intermediary

• Identification: Social media intermediary with users above a threshold identified by the government (currently 5M users). Should have physical contact address in India.
• Role: All those for social media intermediaries, plus (i) appoint Chief Compliance Officer (ii) appoint nodal officer for 24x7 coordination with law enforcement (iii) appoint resident grievance officer (iv) publish monthly reports of complaints and proactive take-downs (v) identify first originator of a message upon court or government order (vi) identify advertised, marketed, sponsors or controlled content (vii) deploy automated tools to take down rape and child sex abuse content (viii) provide unique ticket number to complainants (ix) allow users to voluntarily verify themselves (x) notify users when it takes down content on its own, and give them a hearing.
• Incentives: Same as social media intermediaries.
• Accountability: Same as social media intermediaries.

My Take: Same as social media intermediaries. In addition, the definition of ‘significant’ social media intermediary is left completely to the discretion of the government. Instead, the rules should either have defined this better, or specified parameters based on which the government should define them.

3. Publisher of News and Current Affairs

• Identification: Publisher or news and current affairs content.
• Role: (i) acknowledge grievances within 24 hours, and respond to them in 15 days (ii) be part of a self-regulating body (iii) appear before and submit reply to IDC when asked (iv) publish monthly compliance reports of grievances received and action taken (v) supply information and documents to MIB (vi) maintain record of content for 60 days for self-regulatory body and government
• Incentives: Same as social media intermediaries.
• Accountability: Same as social media intermediaries.

My Take: The transparency and timelines imposed on publishers will help make them more accountable. However, the press has usually enjoyed high freedom in India. With more and more of the press moving online, digital news platforms should have enjoyed the same protections. However, there is a substantial erosion here because the government has sole discretionary authority over the digital press. This is among the most significant implications of these new rules.

4. Publisher of Online Curated Content

• Identification: Publisher of online curated content (e.g. Amazon Prime, Netflix)
• Role: All of those for publisher of news and current affairs, plus (i) classify content into categories specified by law, and display rating (ii) reclassify content, if directed by self-regulatory body (iii) ensure access control — e.g. parental lock — for content rated “U/A 13+” and above (iv) ensure reliable age verification for content rated “A”
• Incentives: Same as social media intermediaries.
• Accountability: Same as social media intermediaries.

My Take: The new rules will make online platforms more responsive and transparent about user grievances, which is good. They will also incorporate a rating system, but by the platform itself. This helps balance freedoms and safety. However, the rules could have gone one step further in providing ‘safe harbours’ to streaming services if they meet these regulations. This will help prevent the everyday harassment that these services have to undergo, thereby helping the online content economy grow faster.

4. Self-Regulatory Body:

• Identification: Formed by publishers or their associations. Not more than seven members, all experts from media, child rights, etc.. Headed by eminent person from these fields or retired SC/HC judge. To be registered with MIB within 30 days.
• Role: (i) Respond to user grievances — unaddressed by publisher or disputed by user - within 15 days, and issue guidance/advisory to publisher (ii) ensure adherence to Code of Ethics (iii) provide guidance to publishers about code (iv) recommend take-down of content to Ministry (v) report non-compliance by publishers to ministry within 15 days (v) publish monthly report of grievances received and action taken
• Incentives: Needs to be created by its members to ensure compliance with the new rules.
• Accountability: Need to be recognised by the Government and meet code of ethics laid out by the latter. Unstated assumption is that government can withdraw recognition at its own discretion.

My Take: Delegating authority to non-governmental bodies could be because of two reasons — (i) the government doesn’t have the capacity to regulate, and hence expands its span of control through delegation (ii) decisions need to be kept insulated from the government, and hence an independent body is created. Under the IT rules, the self-regulatory bodies are not independent because the government can unilaterally determine their registration and code of practices. Hence, these bodies are meant to expand the span of control for the government. The proposed structure will likely do that well, though the title of ‘self-regulatory’ might be a misnomer in that case.

5. Ministry of Information and Broadcasting (MIB)

• Identification: N/A
• Role: (i) publish charter and code of practices for self-regulating bodies (ii) establish inter-departmental committee (iii) refer unaddressed or suo moto grievances to committee (iv) issue guidance, advisories, order and directions to publishers (v) issue emergency blocking orders, and place before IDC in 48 hours
• Incentives: None
• Accountability: None

My Take: The lack of accountability of the ministry is the weakest link in the institutional framework underlying these rules. All powers of the self-regulatory bodies converge in the ministry, which has few institutional safeguards.

6. Inter-Departmental Committee (IDC)

• Identification: Appointed by MIB. Representatives of ministries of information & broadcasting, women and child development, law and justice, home affairs, electronics and IT, external affairs, defense, and others. Chaired by representative of MIB.
• Role: (i) hear unaddressed grievances or those referred to by the Ministry (ii) recommend action to MIB, incl. takedown (iii) review emergency blocking orders of MIB
• Incentives: None
• Accountability: To MIB

My Take: The IDC seems to be designed as a forum for the MIB to seek inputs from other ministries. Apart from that, it is a purely advisory body whose orders are not binding on the government. This is a missed opportunity. A truly empowered and independent body (instead of the IDC) could have helped find the right balance between competing interests at play here. An ideal structure for such a body would have included:

• Composed primarily of retired Supreme Court or High Court judges, with members from academia and civil society, and ex officio representation from government. The non-government members’ removal should require a two-thirds majority from Parliament.
• Orders binding on the government, self-regulatory bodies, and publishers.
• Orders could be challenged in an appellate tribunal. Under limited circumstances, orders of the tribunal could be challenged in High Court.
• Detailed minutes of the meeting should be released publicly. Annual reports should be placed before Parliament. These should be done for the IDC as well.