The New IT Rules and Its Constitutional Validity

Reading time : 6 minutes

India came up with new rules to regulate the workings of social media in India by forcing the companies to make favorable changes for the sake of safety and peace of the users and the larger community as a whole. It was done to address the growing concerns of lack of transparency, accountability, and rights of users of digital media. Consultations were made with various stakeholders along with the public at large. On February 25, 2021, the union government notified the ‘The Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021’ in the Official Gazette. These rules are meant for social media companies, which shall be referred to as intermediaries, as mentioned in the Section 2(1) (w) of the Information and Technology Act 2000.

It is called the ‘The Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021’, hereafter referred to as the Notification. Rule 1 gives a basic introduction and applicability of the rules and Rule 2 gives the basic definitions of the terms used in the Notification. Rule 3 states that a social media intermediary or a significant social media intermediary, as defined under Rule 2(v), must fulfil all the obligations mentioned henceforth. They must publish the user agreement, rules and regulations and privacy policy on its website or mobile application or both. These rules and regulations must inform the user to not host, display, upload, modify, publish, transmit, store, update or share any information that goes against the public policy by violating the intellectual property laws or invading someone’s privacy or by any other means. They must not impersonate another person or publish false information that can be perceived as a fact. They must not share any file that contains a software virus or something that can harm a computer resource. The intermediary must inform the users once a year that if they violate any of the agreements or regulations, their accounts can be terminated. When the intermediary receives a court order or an order from the government under Sec 79(3)(b) of the Information Technology Act to take down a post for violating the public policy of India or threatening its integrity and sovereignty. Such a post must be removed within 36 hours. The intermediary shall keep the record of such post for 180 days for assisting investigation if the need to do so arises. When a government agency asks for any such for investigation, then they shall provide those records within 72 hours. The intermediaries are supposed to inform any cyber rime activity they find to Indian Computer Emergency Response Team in accordance with the policies and procedures as mentioned in the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013. The intermediary shall prominently publish the name, contact details of the Grievance Redressal Officer as well the procedure to make a complaint. The Officer shall acknowledge the complaint within 24 hours and dispose of it within 15 days. The intermediary shall remove any nude content on from the site within 24 hours of receiving any complaint of such being made.

A significant social media intermediary under Rule 4[1] must appoint a Chief Compliance Officer within 3 months from the date of the notification being made official. This officer will be responsible for ensuring that the intermediary complies with the said guidelines and shall be liable in cases related to relevant third-party information, data or communication link made available or hosted by that intermediary that should have been taken down in case they fail to make sure that the intermediary observes due diligence. This officer must be a resident of India. No liability will be imposed without the intermediary being given a chance of being heard. They must also appoint a nodal contact officer, who must be a resident of India and works with the intermediary company. Their job is to be in contact with the law enforcement agencies 24×7 so that all compliance requests from the government agencies are followed. The need to appoint a Resident Grievance Officer who is in charge of managing the grievances of the users and the compliance of the rules related to grievance redressal. The intermediary must publish in detail every month the status of their compliance to the rules in way that shows how they dealt with all the complaints, which users and posts were removed, what the complaints were, what requests were made by the government. Those who provide services related to messaging must have a system that makes it possible to enable the identification of the first originator of the message on their computer resource as may be required by a judicial order or an order passed under section 69 by the Competent Authority as per the Information Technology (Procedure and Safeguards for interception, monitoring and decryption of information) Rules, 2009. Such an order shall only be passed when the message has something that threatens the sovereignty or unity or safety of the country or public order or is related to crimes of rape or containing sexually explicit material or child abuse, where the imprisonment is not less than 5 years. No order will be passed in cases where less intrusive methods of finding the originator are at the disposal of the authorities. If the first originator of the message is outside India, then the first Indian resident to share the message becomes the first originator of the message. A significant social media intermediary shall take all necessary steps to employ technology that allows for automatic identification of any information that depicts any act or simulation of rape, child abuse or such, or any information that has been previously removed or violates any of the previously mentioned rules. If any user wants to access such information, then a message must be displayed to the user that the information is violative of the said rules. Such measure taken by the intermediary must be proportionate to the interests of the right of free speech and privacy of the users. There must be proper human oversight to the technology so that they do not go out of control and harm the users in a method not in the purpose of creating the technology. Such technology should be periodically reviewed on aspects like accuracy and fairness and other similar aspects.

The significant social media intermediary shall have their physical contact address in India posted on their website or mobile application. They should enable a system where users are able to track the status of their grievances and their redressals by providing a unique redressal number to the grievances and complaints. They should also provide for reasons to the complainant for any action taken or not taken by them to a reasonable extent. It mandates that users who register from India can get their accounts verified with other information like with phone numbers of their Indian phones. Once verified, those accounts must show that they have been verified. The information given for verification must not be used for any other purposes unless the user has specifically willed for it to be used for any other purpose. When a significant social media intermediary removes or disables access to any information, data, or communication link on their own accord, they must provide with the users who used such data or information a notification of why it was being taken down prior to the actual takedown. They must ensure that such users have enough time to dispute the action and ask for reinstatement of said data. The Residence Grievance Officer must maintain proper oversight over the process and the resolution. The Ministry may call for additional information from the intermediary as they require.

Rule 5 of the Notification states that when the intermediary has an publishers of news and current affairs among its users, they need to give details of their user accounts to the Ministry of Information and Broadcasting as may be required under Rule 18. The intermediary can give such publishers a mark of verification if it deems fit. Rule 6 states even those intermediaries which are not significant social media intermediaries can be made to follow all obligations under Rule 4 if the services of that intermediary permits the publication or transmission of information that may create a material risk to the sovereignty and integrity of India, security of the State, or problems related to public order. The Ministry needs to pass an order against such intermediary for the rules to take effect. The risk of harm to the mentioned areas will be judged according to the interactions between users. Also, the number of user who share the information would also be taken into account. An order under this rule could be about a specific part of the website or the app if that is the nature of the intermediary. They can even make the intermediary obey only specific parts of Rule 4 instead of the whole of it. When the intermediary fails to comply, they will not be protected by Section 79(1) of the Information Technology Act and can be liable under any law applicable at the time, including the Indian Penal Code. Rule 7 of the Notification states that if the intermediary does not comply with eh rues, they will lose the safe harbour protection granted to them under Section 79 of the Information and Technology Act 2000.

Part III[2] is called the Code of Ethics. Under Rule 8 of the Notification, for publishers of news and current affairs as well as online curated content, Part III of the notification applies. They must operate or conduct business and have a systematic activity of making the content available in India. They must have a physical presence in the territory of India. Systematic presence means any “element of planning, method, continuity or persistence” according to Rule 8(2)(Explanation (b)). The rules under these parts must not be in derogation of any other law applicable in the time being. Rule 9 of the Notification states that the publishers must obey the obligations in the appendix attached to the notification. Anyone who disobeys the Code of Ethics wont just be liable under the notification but all other laws applicable that they may have violated. For ensuring adherence to the Code and for managing grievances related to such publishers, there will be a three-tier system. Level I will have self-regulation by the publishers, Level II will have self-regulation by the self-regulating bodies of the publishers, Level III will have oversight mechanism by the Union Government. Each of these levels will be explained under Rules 11 to 13. Rule 10 of the Notification states that any person having a grievance regarding content published by a publisher in relation to the Code of Ethics may furnish his grievance on the grievance mechanism established by the publisher under rule 11. The publisher shall issue an acknowledgement of the grievance for the within twenty-four hours of it being furnished. The publisher shall address the grievance and inform the complainant of its decision within 15 days of the registration of the grievance if the decision of the publisher is not communicated to the complainant within the stipulated time, the grievance shall be escalated to the level of the self-regulating body of which the publisher is a member. Where the complainant is not satisfied with the decision of the publisher, it may prefer to appeal to the self-regulating body of which such publisher is a member within 15 days of receiving such a decision. The self-regulating body shall address the grievance referred to itself and convey its decision as a guidance or advisory to the publisher and inform the complainant of such decision within 15 days where the complainant is not satisfied with the decision of the self-regulating body, it may, within 15 days of such decision, prefer an appeal to the Oversight Mechanism.

Rule 11 of the Notification talks about the self-regulating mechanism that was part of Level-I. It states that the news publisher shall establish a grievance redressal mechanism and shall appoint a Grievance Officer based in India, who shall be responsible for the redressal of grievances related to his work. The detail of the officer needs to be given at an appropriate place. They must ensure that the officer takes care of the complaint within 15 days and communicates it to the complainant. They must be a member of the Level II self-regulating body and abide by all its rules. They must be the contact point related to complaints about the Code of Ethics and at the nodal point in the communications with the complainant, the self-regulating body and the Ministry. Any online curated content shall be classified according to the guidelines given in the schedule and the publisher must display the rating of that content. Rule 12 of the Notification talks about the Level-II self-regulating body. There may be one or more of them, it should consist of publishers or members of their associations. The body must be headed by a retired judge of the Supreme Court, a High Court, or an independent eminent person from the field of media, broadcasting, entertainment, child rights, human rights, or such other relevant field, and have up to 6 more members from the relevant fields. The body, after its formation, must register with the Ministry within 30 days. The functions of the body include overseeing and ensuring the adherence by the publisher to the Code, providing guidance to publishers on various aspects of the Code, addressing grievances which have not been resolved by publishers at Level-I or any complaint to the decision given at Level-I issue such guidance or advisories to such publishers as needed to comply with the Code. When addressing the appeal from the complainant, the body can warn, or censure the publisher or make them put up a warning or a disclaimer.  When dealing with online curated content, they make ask for reclassifying the rating or make appropriate modifications. When they feel that the content itself is illegal under any law, then they must inform the Ministry. If they believe that there was no violation of the Code, then they must convey this to the complainant. When the publisher fails to comply with the directions, then they must refer the matter to the Level-III mechanism. The Ministry shall recognise the body only when it has been constituted according to the rules and has agreed to perform all their functions.

Rule 13 of the Notification talks about the oversight mechanism set up by the Ministry. They must publish a charter of the self-regulating bodies and a Code of Practices for such bodies. They must establish an Inter-Departmental Committee for hearing grievances and refer to them any appeals to the decisions of the regulatory bodies or if the bodies have not taken a decision within the stipulated time, or any other complaints regarding the Code of Ethics. They can issue appropriate guidelines and orders to publishers for upholding the Code of Ethics. For the Committee, they must appoint someone as the Authorized Officer who is not below the rank of Joint Secretary to the Government of India. Under Rule 14 of the Notification, the Committee must have representatives from the Ministry of Information and Broadcasting, Ministry of Women and Child Development, Ministry of Law and Justice, Ministry of Home Affairs, Ministry of Electronics and Information Technology, Ministry of External Affairs, Ministry of Defence, and such other Ministries and Organisations. The Authorized Person must be the Chairperson of the Committee. They should meet periodically and look at the complaints as mentioned above in Rule 13. Any complaint made to the Committee must be in writing and may be sent either by mail or fax or by e-mail signed with electronic signature of the authorised representative of the entity referring the grievance, and the Committee shall ensure that such reference is assigned a number which is recorded along with the date and time of its receipt. They must take all effort to identify the publisher mentioned in the complaint and ask them to appear or submit their clarification. They give directions to the Ministry which include warning, or censuring, the publisher, requiring an apology, or making them put a warning card or a disclaimer. In case of online curated content, they can ask the publisher to alter the ratings or make modifications in the content. In case the content violates Section 69A(1) of the Act, then they must recommend the appropriate action. The Ministry may, after looking at the advises, make orders related to them. No order shall be issued without the approval of Secretary, Ministry of Ministry of Information and Broadcasting.

Rule 15 of the Notification states that in cases related to deletion of online curated content or violation of Sec69A(1) of the Act, the Authorised Officer shall place the matter before the Secretary, Ministry of Information and Broadcasting. Once the Secretary gives the approval, the Authorized Officer can take action. It can be on a part of piece of content or on a set of contents. If the Secretary does not give the authorization, it would be communicated to the Committee. Rule 16 of the Notification talks about when the content of a nature that needs to have action taken on immediately. In such an emergency, if the Authorized Officer feels that the violation to Sec 69A(1) is present, they submit a direct recommendation to the Secretary to remove or block the content. The Secretary may issue such directions they may consider necessary and record the reasons in writing, without giving the publisher an opportunity to present their side of the case. Authorised Officer must bring the case up in front of the Committee within 48 hours of issuing directions. If the Committee does not recommend blocking the content, then the block is removed. Rule 17 of the Notification states that the Authorised Officer must keep complete records of the proceedings of the Committee and of the recommendations made to the Secretary and the Ministry. The  Review Committee, as formed under Rule 419A of the Indian Telegraph Rules, 1951, must meet every once in two months to review all blocking recommendations and if they feel that the violations do not give rise to blocking of content under law, then unblock the contents and give other directions as necessary.

Rule 18 of the Notification states that the publishers of current affairs or online curated content, who are operating in India, shall furnish the information about its entity as specified to the Ministry for the purpose of communicating and coordinating with them. Such information must be given with 30 days of the publication of this Notification. The publishers must periodic compliance reports every month and mention the complaints and how they have been dealt with. The Ministry may call for additional information from the publisher as it may seem necessary under this rule. Rule 19 of the Notification states that a publisher must make full disclosure of all grievances received and how they were dealt with. It shall be displayed publicly and updated monthly. The publisher needs to maintain records of any content transmitted by it for 60 days and make it available for any government authority when they require it to implement the rules.

WhatsApp has claimed that their chatting services are end to end encrypted and trying to find the first originator of a message as mentioned under Rule 4 would mean breaking the encryption would mean breaking the encryption, hence violating the right to privacy of the users.[3] Right to privacy is a fundamental right under Article 21 of the Constitution of India, as was given in the Justice K S Puttaswamy (Retd.), And Anr v Union Of India And Ors[4]. Hence, it won’t be possible for them to comply with those regulations and filed a petition in the Delhi High Court. There is also the problem that there are many ways to become untraceable using various computer programs that are available to the ones who understand the basics of the software.[5] The other case of how the notification might be challenged is the chilling effect it puts on freedom of speech and expression, like Sec66A of the Information and Technology Act 2000, which was struck down as unconstitutional in the Shreya Singhal vs U.O.I[6]  judgement as having a chilling effect and being vague. These are the two main constitutional challenges to The Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021.[7] Failure to comply with the rules will mean that the intermediary status under Section 2(1) (w) of the Information and Technology Act 2000 will be revoked removing the ‘Safe harbour’ protections granted to them under Section 79 of the Information and Technology Act 2000, hence they are nearly forced to obey.[8] The fact that there won’t be criminal sanctions immediately and an opportunity to be heard at the intermediary level to the users however makes it different from the Sec66A of the Information and Technology Act. WhatsApp’s application is based on their own technology as well, so the question of privacy arising in the overall Notification is also unsure. The courts would need to come up with answers to these questions and only then can it be certain how the whole of the Notification would apply.


[1] The Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021.

[2] The Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021.

[3] Joseph Menn, “WhatsApp sues Indian Government over Privacy Rules – Sources” Reuters, May 26, 2021.

[4] AIR 2017 SC 4161.

[5] Vinay Arvind, “From Social To Antisocial: How The New It Rules Will Accelerate India’s Democratic Decline” Newslaundry, May 29, 2021.

[6] Writ Petition (Criminal) No.167 Of 2012.

[7] Yuthika Bhargava, “As new IT rules come into force on May 26, Facebook says it aims to comply” The Hindu, May 25, 2021.

[8] Yuthika Bhargava, “New IT rules | Centre seeks compliance report from intermediaries” The Hindu, May 26, 2021.

Author: Aryaman Sinha, Jindal Global Law School, OP Jindal Global University

Editor: Kanishka VaishSenior Editor, LexLife India.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s