Difference between revisions of "Internet Regulation in India"

Revision as of 18:35, 26 January 2023

Internet Regulation in India pertains to the passage of laws, both at the national and the state level, to regulate and control internet activity inside India. This includes definitions of cybercrimes, rules governing content on social media platforms, national security considerations, and data storage regulations on servers hosted inside the country.

Background

Information Technology Act

The Information Technology Act (ITA) of 2000 established the Government of India’s primary rules on cybercrime and electronic commerce. In the wake of the 26/11 Mumbai terrorist attacks, a substantial amendment to the law was passed, introducing new sections giving the government the power of “interception or monitoring or decryption of any information through any computer resource,” penalizing “offensive messages,” and formally addressing pornography and cyber terrorism. Consequently, the ITA provides a comprehensive legal framework to tackle vast swaths of online activity.

Subsequent Legislation

OTT Legislation

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 is a piece of secondary legislation with roots in section 87 of the ITA. This piece of legislation was geared towards providing guidelines for Over-The-Top (OTT) media platforms and rules for social media intermediaries with a set of digital ethics. The government described the new rules as a “soft-touch oversight” aimed at dealing with issues like the proliferation of fake news, image morphing, and abuse of social platforms.

CERT-In and VPN Legislation

The ITA appointed an “Indian Computer Emergency Response Team (CERT-In)”[] to serve as a national agency dealing with certain matters of cybersecurity with powers vested in it to both receive data from and direct internet service providers, data centers, and other bodies.

CERT-In posted a national directive in April 2022, requiring all virtual private network companies operating within India to store and maintain customer data — including their names, email addresses, and IP addresses — for a period of at least five years, even in cases where a customer ends their subscription. CERT cited national security concerns, with an eye to combatting cybersecurity threats including data breaches, along with assurances that data would only be sought on a case-by-case basis

Controversy

Regulation of the Cloud

A review from the Journal of Internet Law found that cloud computing is a powerful enabler of technology for consumers. Additionally, regulators should use existing rules where possible so that the industry can develop. There are many laws and regulations in India that sufficiently protect consumers from breach of data, from breach of contract, theft, and from misuse of data.

References

(Ryan, Patrick Spaulding and Merchant, Ronak and Falvey, Sarah, Regulation of the Cloud in India (July 30, 2011). Journal of Internet Law, Vol. 15, No. 4, p. 7, October 2011, Available at SSRN: https://ssrn.com/abstract=1941494)