Internet Regulation in India

Internet Regulation in India pertains to the passage of laws, both at the national and the state level, to regulate and control internet activity inside India. This includes definitions of cybercrimes, rules governing content on social media platforms, national security considerations, and data storage regulations on servers hosted inside the country.

India was home to more than 749 million internet users in 2020, with that number projected to double by 2040. The incredible large-scale internet operations within the country consequently face many challenges, including an increase in cybercrime occurrences , that require ample legislation to both define rules and rights for citizens.

As a result, governments at the federal level have drawn up numerous laws to provide frameworks to contextualize discourse around digital rights, national security, and privacy. Some of the laws have stringent compliance requirements for private sector operators, however, the government itself is not subject to many of the same oversight requirements. This has raised certain ethical concerns relating to governmental surveillance and internet freedoms.

Background

Information Technology Act

The Information Technology Act (IT Act) of 2000 established the Government of India’s primary rules on cybercrime and electronic commerce. In the wake of the 26/11 Mumbai terrorist attacks, a substantial amendment to the law was passed, introducing new sections giving the government the power of “interception or monitoring or decryption of any information through any computer resource,” penalizing “offensive messages,” and formally addressing pornography and cyber terrorism. Consequently, the IT Act provides a comprehensive legal framework to tackle vast swaths of online activity.

Subsequent Legislation

OTT Legislation

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 is a piece of secondary legislation with roots in section 87 of the IT Act. This piece of legislation was geared towards providing guidelines for Over-The-Top (OTT) media platforms and rules for social media intermediaries with a set of digital ethics. The government described the new rules as a “soft-touch oversight” aimed at dealing with issues like the proliferation of fake news, image morphing, and abuse of social platforms.

CERT-In and VPN Legislation

The IT Act appointed an “Indian Computer Emergency Response Team (CERT-In)” to serve as a national agency dealing with certain matters of cybersecurity with powers vested in it to both receive data from and direct internet service providers, data centers, and other bodies.

CERT-In posted a national directive in April 2022, requiring all virtual private network companies operating within India to store and maintain customer data — including their names, email addresses, and IP addresses — for a period of at least five years, even in cases where a customer ends their subscription. CERT-In cited national security concerns, with an eye to combatting cybersecurity threats including data breaches, along with assurances that data would only be sought on a case-by-case basis. Additionally, enforcement of data collection requirements is to be done based on provider compliance when faced with an information request issued by the government.

Internet Shutdowns

Number of Internet Shutdowns in India from Jan. 2012 – Jun. 2022

In the last decade, India has enacted the most internet shutdowns of any country in the world. Between January 2012 and June 2022, India instituted 647 internet blocks. The Government of India also formally codified into law the power to direct telecom service providers to shut down internet services within any region inside India in 2017 due to matters of public safety or emergency. Prior to this, the Government of India would apply the Indian Telegraph Act of 1885 to direct service providers to stop service.

In 2020, the Supreme Court of India ruled that access to internet was a fundamental right, also adding that government-enacted internet shutdowns in the region of Jammu and Kashmir were illegal. India’s internet shutdowns have not abated with 100 shutdowns in 2021 alone, including one to curb cheating in examinations for civil service positions in the state of Rajasthan. Some shutdowns have been contested in court by industry groups opposed to the disruptions in service, with the Supreme Court ordering the Ministry of Electronics and Information Technology (MEITY) to reveal its criteria for approving shutdowns.

Proposed Legislation

Indian Data Privacy Legislation

India’s Supreme Court ruled, in 2017, that privacy was a fundamental right for all of its citizens. However, legislation outlining data privacy policies was missing at this time. In 2019, the Personal Data Protection Bill was introduced in Parliament, seeking to introduce wide-sweeping regulations about the flow and storage of personal data. It included provisions mandating that companies collect user consent for most uses of a person’s data and requiring companies to enact storage of certain forms of sensitive data within the country. It also proposed setting up a new entity, the Data Protection Authority, to make rules and oversee corporate compliance and conflicts.

But the Personal Data Protection Bill was withdrawn in 2022. The Bill was subject to multiple amendments and recommendations from a parliamentary panel after its unveiling, with many recommendations “falling outside the scope of a modern digital privacy law.” Citing the increasing complexity, the government withdrew the bill, with the goal of creating a legal framework and present a new bill to describe India’s data privacy policies.

Digital India Act

The proposed Digital India Act, expected to release in early 2023, is slated to replace the IT Act of 2000 to become the preeminent digital law within India. It is expected to introduce a dedicated regulatory body, similar in nature to the Telecom Regulatory Authority of India (TRAI), to oversee internet companies. The government has expressed a vision of a more principle-based piece of legislation as opposed to being overly prescriptive.

Ethical Concerns

Privacy

While privacy was ruled a fundamental right, the lack of a comprehensive data privacy legal framework after the shelving of the Data Protection Bill has left a legal grey area. Experts have professed an urgent need to enact data privacy legislation to protect the privacy of citizens.

In addition, many pieces of digital law in India lend protection to the Indian Government. The directive from CERT-In mandating VPN providers to maintain and store users’ data for a period of at least 5 years, with the legal obligation to provide the data to the government on request, has concerned experts. In addition, many VPN providers have moved physical operations out of the country, removing physical servers to prevent undermining their security protocols. However, the data collection requirements go beyond VPN providers — affecting all cloud service providers operating servers within India.

In the case of the VPN legislation, the government has stated that it wouldn’t infringe on its citizens’ privacy, assuring the use of their authority only on a “case-by-case basis” in matters concerning security. However, critics of the new policy cite the Indian government’s history of surveillance, including revelations that it used Pegasus spyware to snoop on journalists, activists, and opposition politicians, as a cause for concern, especially with increased legal authority.

This poses ethical concerns about user privacy and governmental surveillance. On the one hand, increases in cybercrime incidences in recent years and an increasingly vocal need for data localization for more streamlined law enforcement operations and preventing foreign surveillance are cited as justifications for the legislative direction. On another, the elevation of privacy to be a fundamental right and growing suspicion over governmental surveillance poses a need to balance the current powers of the state.