Internet Regulation in India

Internet Regulation in India pertains to the passage of laws, both at the national and the state level, to regulate and control internet activity inside India. This includes definitions of cybercrimes, rules governing content on social media platforms, national security considerations, and data storage regulations on servers hosted inside the country.

India was home to more than 749 million internet users in 2020, with that number projected to double by 2040. The incredible large-scale internet operations within the country consequently face many challenges, including an increase in cybercrime occurrences , that require ample legislation to both define rules and rights for citizens.

As a result, governments at the federal level have drawn up numerous laws to provide frameworks to contextualize discourse around digital rights, national security, and privacy. Some of the laws have stringent compliance requirements for private sector operators, however, the government itself is not subject to many of the same oversight requirements. This has raised certain ethical concerns relating to governmental surveillance and internet freedoms.

Background

Information Technology Act

The Information Technology Act (IT Act) of 2000 established the Government of India’s primary rules on cybercrime and electronic commerce. In the wake of the 26/11 Mumbai terrorist attacks, a substantial amendment to the law was passed, introducing new sections giving the government the power of “interception or monitoring or decryption of any information through any computer resource,” penalizing “offensive messages,” and formally addressing pornography and cyber terrorism. Consequently, the IT Act provides a comprehensive legal framework to tackle vast swaths of online activity.

Subsequent Legislation

Social Media and OTT Legislation

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 is a piece of secondary legislation with roots in section 87 of the IT Act. This piece of legislation was geared towards providing guidelines for Over-The-Top (OTT) media platforms and rules for social media intermediaries with a set of digital ethics. The government described the new rules as a “soft-touch oversight” aimed at dealing with issues like the proliferation of fake news, image morphing, and abuse of social platforms.

The new rules required social media intermediaries to help law enforcement in identifying and investigating the originators of “unlawful” messages, along with a new legal need for platforms to take down these messages (within 36 hours of receiving a request) and set up grievance redressal mechanisms. Notably, the IT Act’s Section 79 previously provided “safe harbor” protections (where a social media intermediary was not legally liable for any information posted on their platform by a third party), which have now been diluted with the new regulatory framework. The new rules also introduced new classifications for intermediaries based on the number of users into social media intermediaries and significant social media intermediaries, with significant social media intermediaries that provide messaging services also required to comply with the new tracking rules for the origins of unlawful messages on their messaging platforms.

The IT Rules’ grievance redressal mechanism mandated that social media intermediaries appoint a grievance officer, who would be responsible for acknowledging the receipt of a complaint within 24 hours and to resolve the complaint within 15 days. There are future amendments drafted to expand this mechanism, centered around creating a framework to appeal decisions made by grievance officers. The amendments would seek to set up Grievance Appellate Committees (GAC) to address any user complaints against a grievance officer’s decision. Each GAC is to be a panel of three individuals — one of whom would be a government officer while the other two are independent representatives.

CERT-In and VPN Legislation

The IT Act appointed an “Indian Computer Emergency Response Team (CERT-In)” to serve as a national agency dealing with certain matters of cybersecurity with powers vested in it to both receive data from and direct internet service providers, data centers, and other bodies.

CERT-In posted a national directive in April 2022, requiring all virtual private network companies operating within India to store and maintain customer data — including their names, email addresses, and IP addresses — for a period of at least five years, even in cases where a customer ends their subscription. CERT-In cited national security concerns, with an eye to combatting cybersecurity threats including data breaches, along with assurances that data would only be sought on a case-by-case basis. Additionally, enforcement of data collection requirements is to be done based on provider compliance when faced with an information request issued by the government.

Internet Shutdowns

Number of Internet Shutdowns in India from Jan. 2012 – Jun. 2022

In the last decade, India has enacted the most internet shutdowns of any country in the world. Between January 2012 and June 2022, India instituted 647 internet blocks. The Government of India also formally codified into law the power to direct telecom service providers to shut down internet services within any region inside India in 2017 due to matters of public safety or emergency. Prior to this, the Government of India would apply the Indian Telegraph Act of 1885 to direct service providers to stop service.

In 2020, the Supreme Court of India ruled that access to internet was a fundamental right, also adding that government-enacted internet shutdowns in the region of Jammu and Kashmir were illegal. India’s internet shutdowns have not abated with 100 shutdowns in 2021 alone, including one to curb cheating in examinations for civil service positions in the state of Rajasthan. Some shutdowns have been contested in court by industry groups opposed to the disruptions in service, with the Supreme Court ordering the Ministry of Electronics and Information Technology (MEITY) to reveal its criteria for approving shutdowns.

Proposed Legislation

Indian Data Privacy Legislation

India’s Supreme Court ruled, in 2017, that privacy was a fundamental right for all of its citizens. However, legislation outlining data privacy policies was missing at this time. India’s government has also vocally outlined a need for data localization policies — requiring that “sensitive and super-sensitive data” should not leave the nation’s borders, and instead, be stored in servers located within the country — with an eye on four major objectives. The government contends that data localization will streamline law enforcement operations, prevent foreign surveillance, boost economic growth, and aid the enforcement of data privacy legislation.

In 2019, the Personal Data Protection Bill was introduced in Parliament, seeking to introduce wide-sweeping regulations about the flow and storage of personal data. It included provisions mandating that companies collect user consent for most uses of a person’s data and requiring companies to enact storage of certain forms of sensitive data within the country. It also proposed setting up a new entity, the Data Protection Authority, to make rules and oversee corporate compliance and conflicts.

The Bill would also introduce data localization requirements , initially adding a “data mirroring” requirement — a stipulation that a copy of all data on Indian citizens be stored within India — that was later softened to requiring only certain forms of data to be stored locally. The new rules created two protected classes of data — “critical personal data” that must only be stored and processed locally and “sensitive personal data” that must be stored locally but could be copied elsewhere conditionally.

But the Personal Data Protection Bill was withdrawn in 2022. The Bill was subject to multiple amendments and recommendations from a parliamentary panel after its unveiling, with many recommendations “falling outside the scope of a modern digital privacy law.” Citing the increasing complexity, the government withdrew the bill, with the goal of creating a legal framework and present a new bill to describe India’s data privacy policies.

In 2022, the government also softened its stance on its data localization requirements . The new drafted rules would now allow for the transfer and storage of data within “trusted geographies.” It also removed criminal penalties for companies involved in data breaches, opting to instead impose proportional financial penalties. These rules are part of the revision to the withdrawn Personal Data Protection Bill to form the Digital Data Protection Bill, which was introduced in the nation's parliament in 2022 . This revision also follows extensive lobbying efforts from foreign governments and companies to reduce data localization requirements in service of strategic open cross-border data flows and added costs for additional local storage infrastructure.

Digital India Act

The proposed Digital India Act, expected to release in early 2023, is slated to replace the IT Act of 2000 to become the preeminent digital law within India. It is expected to introduce a dedicated regulatory body, similar in nature to the Telecom Regulatory Authority of India (TRAI), to oversee internet companies. The government has expressed a vision of a more principle-based piece of legislation as opposed to being overly prescriptive.

Controversy

Social Media Regulation

Section 66A of the IT Act — dedicated to outlining punishments for sending “offensive messages” including a fine and imprisonment for a term up to three years — caused controversy when applied to criticism of politicians. Notable cases include a cartoonist satirizing corruption , a businessman alleging corruption on Twitter , and a teenager with a Facebook post insulting a state politician , all arrested after complaints were filed with the police citing this section. The Supreme Court in 2015 struck down the section, ruling it unconstitutional in spite of the government justifying the law citing the need to respect religious sentiments .

Bans on Chinese apps

In June 2020, the government banned TikTok and nearly 60 other Chinese apps using powers bestowed by section 69A of the IT Act , justifying the decision by citing national security concerns. In the following months and years, additional bans were also placed on more Chinese apps, with an estimated 224 apps banned by February 2022 . Experts cite China’s National Intelligence Law, which requires Chinese companies to cooperate with China’s intelligence gathering apparatus, as a concern that data collected by Chinese apps could be used by the Chinese government. The Chinese government has opposed the move with expressions of concern about the impact on Chinese businesses.

These measures have followed a breakdown in diplomatic relations between the two nations, and a border dispute in 2020 that resulted in 20 Indian casualties .

Ethical Concerns

Privacy and Governmental Surveillance

While privacy was ruled a fundamental right, the lack of a comprehensive data privacy legal framework after the shelving of the Data Protection Bill has left a legal grey area. Experts have professed an urgent need to enact data privacy legislation to protect the privacy of citizens.

In addition, many pieces of digital law in India lend protection to the Indian Government. The directive from CERT-In mandating VPN providers to maintain and store users’ data for a period of at least 5 years, with the legal obligation to provide the data to the government on request, has concerned experts. In addition, many VPN providers have moved physical operations out of the country, removing physical servers to prevent undermining their security protocols. However, the data collection requirements go beyond VPN providers — affecting all cloud service providers operating servers within India.

In the case of the VPN legislation, the government has stated that it wouldn’t infringe on its citizens’ privacy, assuring the use of their authority only on a “case-by-case basis” in matters concerning security. However, critics of the new policy cite the Indian government’s history of surveillance, including accusations that it used Pegasus spyware to snoop on certain citizens and the confirmation of malware on some devices connected to that case by special judicial committee , as a cause for concern, especially with increased legal authority.

This poses ethical concerns about user privacy and governmental surveillance. On the one hand, increases in cybercrime incidences in recent years and an increasingly vocal need for data localization for more streamlined law enforcement operations and preventing foreign surveillance are cited as justifications for the legislative direction. On another, the elevation of privacy to be a fundamental right and growing suspicion over governmental surveillance poses a need to balance the current powers of the state.

Freedom of Speech

The amended IT Act included a controversial new section — section 66A. Section 66A, added in 2008, specified that individuals found to send “offensive messages” through any communication service could be subject to a punishment of a fine and even imprisonment of up to three years. This brought great concerns about the infringement of the constitutional right to freedom of expression, with the Supreme Court repealing the section in 2015, however many arrests were made until that point quoting the section.

However, after the striking down of these laws, the new IT Rules introduced in 2021 added regulations on social media, requiring platforms to acquiesce to requests for the removal of posts and aid in identifying posters. These new rules have been subject to criticism from experts who express fears of over-compliance leading to lawful speech being suppressed. Platforms like Whatsapp, which released a public statement about the traceability of messages , have expressed concerns about the viability of tracing with the presence of end-to-end encryption obscuring messages from even the platforms. Removing such encryption protocols would severely undermine security according to experts. Additionally, the Editors Guild of India issued a statement stating that the new law would “fundamentally alter how publishers of news operate over the internet,” with fears that this could undermine the freedom of the press.

Notably, the judiciary has also penalized citizens that have posted criticisms of the court online. Prominent lawyer, Prashant Bhushan was found to be in contempt of the court because of his tweets criticizing the some of the judges. This raises concerns about the judiciary policing posts online that aren’t agreeable to it.

In a draft proposal of new internet rules, the government recently proposed that any information identified as "fake or false" by the Press Information Bureau (PIB) or other governmentally-approved fact checking agency would be prohibited. Social media providers would then have to ensure that such content, once identified, must not be shared or posted by users on their platforms.

Governments, both at the state and federal levels, have also continued to exercise their power to direct internet service providers to shut down access to the web in large parts of the country. All of these measures raise ethical concerns about the restrictions placed on the freedom of speech and expression in the country. The government has justified these measures as necessary to support law enforcement and prevent the proliferation of “fake” news or rumors.