Amendment to Intermediary Guidelines-Grievance Appellate Committee

The MeitY had announced Intermediary Guidelines and Digital Media Ethics guidelines on 25th February 2021 which had evoked the Anti-CAA kind of response from the industry. Several High Courts (Kerala, Bombay and Madras)came up with their own interim orders  truncating the notification and the matter landed up in Supreme Court.

Now an amendment notification has been issued on 6th June 2022 for which public comments have been invited. A public consultation meeting with stakeholders was also conducted yesterday by the honourable minister Mr Rajeev Chandrashekar.

The window for public comments will be open upto July 6th.

The amendment mainly related to the Grievance Appellate Committee to be set up under the following rule:

Appeal to Grievance Appellate Committee(s): –

(a) The Central Government shall constitute one or more Grievance Appellate Committees, which shall consist of a Chairperson and such other Members, as the Central Government may, by notification in the Official Gazette, appoint;1

(b) Any person aggrieved by an order made by the Grievance Officer under clause (a) and clause (b) of sub-rule (2) of rule 3 may prefer an appeal to the Grievance Appellate committee having jurisdiction in the matter within a period of 30 days of receipt of communication from the Grievance Officer;

 (c) The Grievance Appellate Committee shall deal with such appeal expeditiously and shall make an endeavour to dispose of the appeal finally within 30 calendar days from the date of receipt of the appeal;

 (d) Every order passed by the Grievance Appellate Committee shall be complied by the concerned Intermediary.

The objective of this appellate committee is to address the complaints about content removal received by an intermediary when its decision to remove or not remove a content may be dissented to by a platform user or member of public.

During the public consultation, several thoughts were exchanged. However the discussion failed to address the action that can follow the decision of the Grievance Appellate Committee.

Also some of the discussions revolved around the constitution of the committee and whether it has to be managed by legal/judicial officers or members of the Government.

It appeared that no thought has been spared on the acceptability of the proposal without amendment to the ITA 2000 itself.

At present ITA 2000 has a statutory mechanism of grievance redressal which includes the Adjudicator and the Appellate Tribunal. Though the effectiveness of this system may be questioned, the fact remains that these are part of the law and cannot be superseded by the notification.

However before the dispute reaches the Adjudication, any effort at resolving the dispute through ADR process including Ombudsman, Mediation or With recourse Arbitration can be tried. However at the end of such process if the dispute remains unresolved, it has to be referred to the statutory grievance redressal system which in this case is the Adjudication under Section 46 of ITA 2000.

Hence the proposed Grievance Appellate Committee has a subordinate relationship with the Adjudication process and need not be manned by a high level committee with judicial officers. It can be handled by the officials of Meity with or without some representation from outside experts. If the Meity adopts an ODR approach, it can involve experts from the industry and resolve disputes like a sub committee of the Meity subject to further appeal lying before the Adjudicator.  It would be sufficient if the sub committee is headed by an officer of the rank equivalent to the IT Secretaries of the State or below.

Any attempt to make this committee’s decision binding on the Adjudicators would be ultra-vires the Act. A clarification that appeals about the decision of the committee lies with the Adjudicator would be in order.

I hope the Meity takes this view into consideration.

Naavi

Posted in Cyber Law | Leave a comment

Understanding why Bank Frauds are increasing

It was a great pleasure for me to read the article today written by Advocate Dr Mahendra Limaye of Nagpur highlighting the need to strengthen the recipient side process of digital payments.

As many of the readers know, Naavi has been pursuing the historical case of S Umashankar Vs ICICI Bank since 2008 in which some money was lost due to unauthorized access of an NRE account at Tuticorin and laundered through another current account of ICICI Bank at Fort Mumbai branch.

In this case the deficiency of security at ICICI Bank at both branches were clearly highlighted. The negligence of the account holding branch at Tuticorin and the negligence and complicity of the Fort Branch were presented with evidence gathered from the Bank’s own records.

The Adjudicator of Tamil Nadu gave the award in favour of the customer based primarily on the negligence of the Tuticorin branch while highlighting the deficiencies of the Fort Branch.

In the appeal, TDSAT highlighted the negligence of the Fort Branch and dismissed the appeal of the Bank once again confirming the award in favour of the customer and against the Bank.

Now the matter is before the Madras High Court and in the final stages of a decision on the further appeal of ICICI Bank. For the time being it is inappropriate to discuss the issues as being presented in the Madras High Court and as we wait for the final decision of the honourable Court.

But what Mr Limaye has written will  surely come for further discussion in the Court.

Naavi

Posted in Cyber Law | Leave a comment

SEBI adopts 6 hour norm for data breach notification

According to a report in Economic Times, SEBI has reportedly advised all mutual fund AMCs to report any information on Cyber incidents within 6 hours to CERT IN and SEBI, within 6 hours of noticing such incidents.

This is keeping with the CERT IN data breach guidelines released on 28th April 2022.

With this the Six hour norm has been set for data breach notification by CERT IN, RBI and SEBI as against the DPA 2021 suggesting a 72 hours window.

Naavi

Posted in Cyber Law | Leave a comment

Youtube has a responsibility to remove offending videos..says Madurai Bench of Madras High Court

Madurai Bench of Madras High Court cancelled the bail grated earlier to a youtuber Sattai Durai Murugan for posting an offending video. The Court (Justice B Pugalendhi) observed that the records show Mr Durai Murugan to be a habitual offender in posting videos with derogatory comments against political personalities.

Though political sensitivities were involved in this case, in the process of adjudging the bail cancellation petition filed by the Police, the Court observed ” Intermediaries Duty bound to regulate content”.

The Court has inter-alia stated

“It is duty of the intermediaries to ascertain whether those videos are in accordance with their policies and guidelines and in terms of the contract and to block the channels if the videos are not in accordance with the terms and policies. … If it is not blocked or removed even after it was brought to their knowledge, the intermediaries are committing the offence under Section 69A (3) of the Information Technology Act,”

In delivering the judgement which related to a political comment, the Court referred to the possibility of posting of videos related to making of Bombs and Obscenity etc and quoted Albert Einstein on Atom Bomb.

The Court was assisted in the case by an amicus curie advocate K K Ramakrishnan. The amicus pointed out to the community  guidelines formulated by the platforms and indicated that the action to block offending videos is part of the guidelines and the terms of the platform usage.

At a time when the Intermediary Guidelines of the Central Government are being vigorously challenged as being against the  constitutionally guaranteed freedom of speech, this judgement making sweeping observations beyond the specifics of the case could raise further controversies.

Copy of  the Judgement

The allegation involves comments made in Tamil and has certain political connotations and hence we would not like to comment on the same at this point.

However,  it appears that invoking Section 69A(3) for the order was not perhaps  appropriate. This section empowers the Government to issue certain directions in the interest of sovereignty and integrity of the nation etc… It does not automatically empower the police to act without such directions. Such directions can be issued by a “Designated Officer” who is the group coordinator of the Cyber law division

Recently, on June 1st, the Government had issued a draft amendment to the Intermediary Guidelines of February 25th , later withdrew it and again requested for comments on 6th June 2022

The essence of these guidelines (with respect to Digital Media) which are opposed in several courts including Madras High Court was to oppose the self regulatory and administrative mechanism suggested for regulating the digital content and imposing a code of ethics.

In the light of these developments at the national level, the judgement of the Madurai Bench appears to stick out as an aberration.

Further whether a judgement related to certain basic principles of constitution were relevant to be made in the cancellation of bail plea is also a point of debate.

Providing power of “Censorship” to the channel has its own counter applications and has to be therefore viewed more closely. The platform of twitter is already accused of biased decisions to block some messages and not block some other messages and the license for such arbitrary action is taken from the assumed power of regulation of the content.

Any such powers will convert the platform into “Not an Intermediary” as per ITA 2000 and hence will invoke the “Digital Media Ethics Code” which is now under scrutiny of the Supreme Court. Hence the current decision appears to interfere with an ongoing broader debate.

It would therefore be interesting to observe if this decision gets appealed against in a division bench or in Supreme Court.

In this bail related petition, the Court appears to have focussed more on the Intermediary liability. It would have been more appropriate if the Court had focussed on the grounds for cancelling the bail application.

Also there appears to be a confusion between the “Designated Officer” under rule 3 of the GSR 781 (E) notification and the nodal officer of an organization. The power of the nodal officer is only to make recommendations to the Designated officer requesting for blocking of any service. However, the judgement quotes provisions of Information Technology (Procedure and Safe guards for Blocking for Access of Information by Public) Rules, 2009, vide G.O(D)No.20, Information Technology (B4) Department, dated 18.03.2020. [The notification was not found on the website (Government of Tamil Nadu : Government Orders | Tamil Nadu Government Portal (tn.gov.in).] and indicates that the SP has been nominated as the nodal officer. The authority for such appointment at the state level may not be binding under Section 69A. Also if YouTube cannot be persuaded to remove any content, it cannot be considered as a ground for denial of bail to a person who has posted the content. The case against the YouTuber ought to have been made out only with his not meeting the earlier bail conditions if any.

By alluding to Section 69A, 79 and 84B, the judgement seems to have placed some confusion in the minds of the cyber law observers about the intermediary responsibilities which was perhaps avoidable.

(A detailed discussion on this may be taken up later)

Naavi

 

Posted in Cyber Law | Leave a comment

Now the real impact of Data Localization has come out for open discussion

For a long time, there has been a set of vested interests in India who have been opposing the “Data Localization” concept. They succeeded in diluting PDPB 2018 to PDPB 2019/DPA2021 and removed the need for a copy of non sensitive personal data being retained in India.

One of the arguments that Naavi.org had placed is the potential positive impact of the data localization on the business of creating new data centres and data centre professionals.

The argument based on the law enforcement needs was easy to understand but the objections raised in the form of “No facilities exist in India”, “There is a shortage of professionals” etc continue to make rounds in the sponsored media.

However, it appears that the trend is slowly changing and now we are seeing a series of stories which try to highlight the economic benefits in the Data Center domain though  it is yet to be linked to the DPA 2021 as an expected benefit.

Today’s article in economic times titled “Infra status to data centers may spur Rs 700-720 billion investments over 5-10 years”

Money Control reports “How Data centres could spur a wave of investments  in infrastructure”that the demand for data centres will spur the growth in real estate as well as power sectors.

Mint in its article “Data Centre boom to spur talent race” says,.. “India’s data centre boom is expected to generate thousands of jobs and fuel a race for talent in the years ahead, in a repeat of the talent hunt now playing out in the country’s information technologies services sector”.

The sudden spurt of the many articles indicate that a powerful sponsor has joined the race of data centres in India which has woken up all the journalists to write about data centres.

Is it the Jio? or Google? or Microsoft? or Tatas?…. or a new entity?… We should know soon.

But it appears that the resistance to data localization in DPA 2021 is likely to now decrease since one part of the industry would significantly benefit from the Act.

Naavi

Posted in Cyber Law | Leave a comment

“Not possible” is now possible….WhatsApp message tracking

For a long time, WhatsApp and its supporters argued that technically it is not possible to track the origination of messages. When the Government introduced the provision as a notification under ITA 2000, technology experts in India endorsed the claim of WhatsApp.

Naavi.org time and again called out for firm action against such pseudo techies who wanted to oppose regulations in support of security. Some of the articles that discussed this are

Court has to nip this foreign media revolt against the Indian Government in the bud

WhatsApp petition deserves to be rejected at admission stage itself.

But recently, it appears that WhatsApp has agreed to make the necessary changes to enable identification of the origin of a message.

The above article in Zeenews suggests that WhatsApp has now agreed to introduce a message ID in the form of a unique hash which will travel with the message when it is forwarded.

This will go a long way in reducing the misuse of WhatsApp for spreading fake news.

Techies who once supported the views of WhatsApp need to eat their  words and change their attitude to oppose all security measures suggested by the Government and spread internet anarchy.

Naavi

Posted in Cyber Law | Leave a comment