Dearest Gentle Leaders… IFF wrote to the newly appointed Union Ministers on key digital rights issues

This post was updated on July 02, 2024.

tl;dr

After securing the requisite number of Lok Sabha seats to form the government for the 2024-2029 term, the National Democratic Alliance appointed members to the Council of Ministers on June 09, 2024. Following a reshuffle in certain Union Cabinet roles, we wrote to the appointed Ministers of MeitY, MIB, DoT, Ministry of Corporate Affairs, Ministry of Civil Aviation, and Ministry of Consumer Affairs, welcoming them to their new role and highlighting key areas that need consideration. This post summarises our initial suggestions and areas of focus highlighted in the three letters to the above-mentioned Ministries.

Important documents

1. IFF’s letter (IFF/2024/041) to MeitY dated June 13, 2024. (Link)
2. IFF’s letter (IFF/2024/042) to MIB dated June 13, 2024. (Link)
3. IFF’s letter (IFF/2024/043) to DoT dated June 15, 2024. (Link)
4. IFF’s letter (IFF/2024/047) to Corporate Affairs Ministry dated June 27, 2024. (Link)
5. IFF’s letter (IFF/2024/048) to Ministry of Civil Aviation dated July 02, 2024. (Link)
6. IFF’s letter (IFF/2024/049) to Ministry and Department of Consumer Affairs dated July 02, 2024. (Link)

Background

Amidst the reshuffle in the Union Cabinet earlier this month, the following appointments stood out for us:

1. Ministry of Electronics and Information Technology (“MeitY”): Ashwini Vaishnaw retained his post as the Union Minister. Rajeev Chandrasekhar was replaced as the Minister of State (“MoS”) (by Jitin Prasada.  
2. Ministry of Information and Broadcasting (“MIB”): Anurag Singh Thakur was replaced as the Union Minister by Ashwini Vaishnaw. Dr. L. Murugan retained his position as the MoS.
3. Department of Telecommunications (“DoT”), Ministry of Communications: Ashwini Vaishnaw was replaced as the Union Minister by Jyotiraditya M. Scindia. Devusinh Chauhan was replaced as the MoS by Dr. Chandra Sekhar Pemmasani.
4. Ministry of Corporate Affairs: Nirmala Sitharaman retained her post as the Union Minister. Rao Inderjit Singh was replaced as the MoS by Harsh Malhotra.
5. Ministry of Consumer Affairs, Food and Public Distribution: Pralhad Joshi replaced Piyush Goyal as the Union Minister, and B.L. Verma and Shrimati Nimuben Jayantibhai were appointed the new MoS’.
6. Ministry of Civil Aviation: Kinjarapu Rammohan Naidu replaced Jyotiraditya M. Scindia as the Union Minister, and Murlidhar Mohol was appointed the new MoS.

Digital technologies play a key part in the lives of everyday Indians, and so ensuring that the use of such technologies is geared towards the needs of citizens is an important task. The Ministries mentioned above can play a vital role in protecting user interests and safeguarding our freedoms and rights, through informed and transparent policy decisions. While the Ministers may have changed, our underlying demands to them have not.

Thus, we have written to the new Ministers, offering our assistance on such matters and helping advance India’s digital revolution in a manner that enshrines fundamental constitutional rights at its core. Below, we delineate some of the core concerns and issues we believe the Ministries must address.

The Ministry of Electronics and Information Technology 

The most pressing issues facing the new Minister for Electronics and IT are:

1. On balancing digitalisation efforts with data privacy: MeitY’s flagship ‘Digital India’ programme envisions large-scale digitalisation across sectors, including the welfare sector, and erecting ‘digital public infrastructure’ (“DPI”) for collaborative public-private provisioning of digital services. Efforts to bring digital interventions to the National Rural Employment Guarantee Act, 2005 as well as the introduction of ‘AgriStack’ and ‘HealthStack’ have become entrenched with issues around access, inaccuracy in benefit delivery, exclusion, privacy, and administrative coercion. While the adoption of technologies in society is inevitable, an exercise of this magnitude will entail large-scale data collection and processing. Without adequate data literacy and empowerment, and in the face of a large digital divide in India, improper data sharing and collection practices may prevail. The non-operational Digital Personal Data Protection Act (“DPDPA”), 2023 and the underlying Rules, which are yet to be notified, further exacerbated the concern. 
2. On the ‘Digital India Act’ replacing the IT Act, 2000: The ‘Digital India Act’ (“DIA”), slated to replace the Information Technology (“IT”) Act, 2000 has become a subject of great discussion and speculation in the last few years, despite its draft not being released for public consultation yet (see our analysis on the ‘DIA’ here). We have previously, in letters addressed to MeitY and the Parliamentary Standing Committee on IT, stressed on the urgent need to update the IT Act, 2000 (see here, here, and here). We have also written to MeitY requesting them to invite civil society organisations (including IFF) for the meetings it organised on the ‘DIA’ on March 09 and on May 23 in Bengaluru and Mumbai respectively [See our analysis of the ‘DIA’ discourse here]. We have also reiterated the need for a truly open, transparent, deliberate, and broad-based public consultation, in line with the Pre-legislative Consultation Policy, 2014, so the existing lacunae and inadequacies of the IT Act, 2000 are not replicated. 
3. On the DPDPA, 2023 and the upcoming Rules: In our letter, we highlighted the lack of consultation process, non-meaningful parliamentary discussion, and disregard for parliamentary rules and procedure during the introduction and passing of DPDPA, 2023. We urged MeitY to amend the Act by addressing the numerous recurring shortcomings and inculcating several meaningful recommendations and feedback raised by civil society stakeholders so far (read out concerns with the Act in detail here). We wrote to MeitY in November 2023, urging them to provide adequate time for the public consultation process for the forthcoming draft Rules in light of concerns emerging from some reporting around a 45-day public consultation timeline for 21 draft Rules. Given recent reporting around the potential release of draft Rules within the initial 100 days of the formation of a new Union government, we hope that MeitY will reduce friction in the consultation process and make it as open, accessible, and democratic as possible. 
4. On consultation process frictions: As proponents of an open and fair public consultation process, we have monitored past instances wherein MeitY has not adopted consistent or transparent practices for public consultations (see here, here, and here). Such restrictive practices and arbitrary actions reduce public trust in the policy consultation process and make it harder for interested stakeholders to meaningfully engage with the government. We urge MeitY to respect several healthy precedents for public consultations set in the past, including making the comments publicly available and allowing for counter comments. 
5. On internet restrictions and content blocking: We have noted and pushed back against several instances of arbitrary censorship or content takedowns initiated by MeitY over the past few years (see here, here, here, here, here, and here). In most of these cases, the reasons for withholding accounts are not made public, and it has also often remained unclear if blocking orders and an opportunity to be heard were provided to the affected persons. We believe that arbitrary blocking is harmful not only to operational transparency but also to India’s democratic ethos. Reasonable restrictions on the fundamental right to freedom of speech may only be imposed based on the eight specifically enumerated grounds under Article 19(2) of the Constitution. The Supreme Court, in Shreya Singhal v. Union of India, clarified that blocking under Section 69A of the IT Act and the IT (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009 (“2009 Blocking Rules”) must adhere strictly to these grounds. MeitY has historically cited the confidentiality requirement under Rule 16 of the 2009 Blocking Rules to withhold blocking orders from aggrieved persons. As the nodal ministry for the implementation of the IT Act, 2000, MeitY is encouraged to put into place a structure under which these orders can be proactively disclosed. False information should be addressed with counter-speech as opposed to suppressing the speech altogether. 
6. On amendments to the IT Rules, 2021: The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“IT Rules, 2021”), whose legality is contentious, undermines the fundamental right to freedom of speech and expression and privacy for millions of internet users in India and have been unequivocally criticised by international experts, civil society, digital rights groups, industry bodies, technology companies, technical groups and members of the press (see our letter urging the withdrawal of the IT Rules, 2021 here and our detailed analyses here, here, and here). The IT Amendment Rules, 2022 introduced vague, arbitrary, and undefined phrasing in Rule 3(1)(b) such as “knowingly and intentionally communicates any misinformation or information” without defining misinformation or specifying criteria for determining intent. The Rules establish Grievance Appellate Committee(s) (“GAC”) i.e. an executive-constituted committee, with the ostensible aim of providing users additional avenues for grievance redressal apart from Courts, making the Union government the arbiter of permissible speech on the internet. Since GACs will adjudicate any appeal raised by aggrieved persons against decisions of intermediary-level grievance officers, it may also incentivise intermediaries to suppress any speech unpalatable to the government (Read our detailed analysis here). GACs do not have any legislative basis and empower the government to censor speech on vague grounds, which are also not stated under Section 69A of IT Act, 2000 or Article 19(2) of the Constitution. Their operations have also been shrouded in secrecy—despite beginning operations on March 01, 2023, as of June 19, 2024, the GAC has received 1013 appeals and resolved 916 appeals, but no GAC reviews or orders have been released so far. IT Amendment Rules, 2023 legitimises the establishment of State-run fact check units (“FCU”) tasked with identifying ‘fake or false or misleading’ online content related to the government [Rule 3(1)(b)(v)]. Vague terms like ‘fake or false or misleading’ content are not grounds enumerated in Art. 19(2) or Section 69A of the IT Act, 2000, and can cement the chilling effect on the fundamental right to speech and expression, particularly on news publishers, journalists, activists, etc. Failure to take action against content identified by such FCU may result in the loss of their safe harbour protections, making the IT Amendment Rules 2023 ultra vires Section 79 of the IT Act. 
7. On emerging technologies such as generative AI: As deepfakes took centre stage in 2023, MeitY shared several (albeit conflicting) statements on their approach to addressing the emerging issue – including legislation on deepfakes, advisory, and amendments to the IT Rules, 2021. Through a formal advisory sent on December 26, 2023, MeitY urged all intermediaries to follow the due diligence obligations listed under the notified IT Amendment Rules, 2023 and reminded them of the legal consequences for non-compliance, i.e. loss of safe harbour. Given these conflicting statements, rushed policy interventions, and troubling suggestions, we wrote to MeitY highlighting concerns of hurried policy or regulatory actions, definitional inadequacies in the IT Rules, challenges in accurately identifying synthetic media, and threats to media freedom and legitimacy. For a deeper and uniform understanding of harms including but not limited to deepfakes, MeitY must clearly state its conception of ‘user harms’ in the Indian context, including the various harms arising from the use of synthetic media. On March 01, 2024, MeitY issued another advisory, directing intermediaries to take “explicit permission” of the Union government before making available “under-testing/ unreliable Artificial Intelligence model(s)/LLM/Generative AI, software(s) or algorithm(s)”. After receiving heavy criticism from industry stakeholders and others for being too vaguely phrased and stifling innovation, MeitY issued a revised advisory on March 15, in which it did away with the requirement to seek government approval. The criticism further prompted the former MoS to clarify that the direction would not apply to startups and was restricted to significant platforms. 
8. On increasing cybersecurity incidents risking personal data: Due to the increased digitisation of valuable personal data, data breaches and cyber attack incidents have become increasingly common (see here, here, here, and here). Indian firms and organisations have witnessed some high profile data breaches including even sensitive medical and financial data. More recently, leaks in the servers of the  SPARSH portal, Hyundai Motor India, FreshMenu, boAt, and the website of the Uttar Pradesh Marriage Assistance Scheme have put into question the governance mechanisms that exist in the event of such breaches. A non-exhaustive list of data breaches that occurred in the country since 2020 is available on a publicly accessible database, PlugTheBreach, aimed at covering, reporting, and tracking data breaches in India to increase transparency and public awareness. 
9. On targeted and mass surveillance in India: Potential use of spyware and malware against journalists and activists has emerged as a key concern requiring urgent consideration from MeitY. In 2021, 300 Indian phone numbers, including those belonging to Ministers, politicians, activists, researchers and journalists, were among the 50,000 reportedly targeted with an Israeli military-grade spyware, Pegasus. Statutory surveillance powers under the Telegraph Act, 1885 and Rules, and the IT Act, 2000 and Rules, do not permit the installation of spyware or hacking of mobile devices. In fact, such acts are criminalised under the IT Act, 2000. The investigation into Pegasus was delayed, non-transparent, contradictory to global evidence, and provided no opportunity to corroborate the claim through independent fact-checkers.  On October 30, 2023, Apple, Inc. sent a threat notification to the mobile phones of opposition leaders, journalists, and researchers in India, claiming that this notification system detects ‘state-sponsored attacks’ using the threat intelligence signals it receives, and is designed to inform and assist users who may be individually targeted owing to “who they are or what they do.” The Hon’ble Union Minister called the notification a “vague and non-specific advisory” and mentioned that it had been sent to 150 countries. A CERT-In investigation had been ordered to unravel it, however, we believe that as with Pegasus, MeitY may have undermined the gravity of alleged targeted surveillance. CERT-In’s investigation capabilities in such complex matters may also be questioned. There is a pressing need for surveillance reform in India. We urge the Ministry to view this matter as a key governance priority and initiate multi-stakeholder conversations before legislating upon it.

The Ministry of Information and Broadcasting

1. On the draft Broadcasting Bill, 2023: The Broadcasting Bill extends the MIB’s regulatory ambit to any person who broadcasts news and current affairs programs through a digital medium. Concerns over how “news and current affairs” is currently defined and uncertainty over the scope of application of this provision augment concerns around the erosion of online free speech, journalistic expression as well as a user’s right to access diverse points of view, especially in the environment of high penalties for non-compliance with prescribed ethical codes and government orders (Read our detailed comments on the draft bill here). MIB has proposed the expansion of the regulatory framework currently applied to traditional broadcasters to “OTT” (“Over-the-top”) broadcasters, without sharing any basis or reasoning for having the traditional broadcasting rules and codes applied to “OTT broadcasting services”. Exerting executive control over online curated content may stifle innovation and growth; increase financial and compliance burden; negatively impact user experience, choice, and even costs; create entry barriers; and lead to censorship, both imposed and self-applied (for previous instances of such censorship, see here, here, here, and here). As per recent reporting, MIB invited companies such as Google, Meta, and X (formerly Twitter), Netflix, and Amazon to “inform them of their new proposal to include user-generated content on the internet put out by “professionals” under the new Broadcasting Bill” without defining “professional content creators” or outlining threshold/ criteria for classifying creators as such. Any attempt to further include “professional content creators” under the ambit of the draft bill will lead to further implications for free speech online. On February 23, 2024, we wrote to MIB requesting the publication of all the comments on the Ministry’s website. In response to an RTI application we also filed, MIB claimed that the comments could not be disclosed without their consent as that would violate their privacy and “intellectual property rights”. Despite this, MIB did share a physical copy of the comments with us after we duly paid the requested sum. Reportedly, MIB met with the industry stakeholders in early June to discuss contentious provisions under the draft bill. It was also reported that several industry bodies have consented to publicly sharing their consultation comments but MIB has not done so yet. We urge the Ministry to open up such discussions to other relevant stakeholders such as civil society and to proactively share all responses received through this consultation process. 
2. On regulatory powers under the IT Rules, 2021: Part III of the IT Rules, 2021 regulates digital media by laying down a Code of Ethics and a 3-tier grievance redressal mechanism with the MIB. The 3-tier grievance redressal mechanism puts an officer of MIB on the top tier of regulation who can impose sanctions for any violations of the Code, including directing the removal of news articles. MIB has invoked Rules 16 and 69A of the IT Rules, 2021 and IT Act, 2000 respectively to issue directions to intermediaries to block content online such as the BBC documentary ‘India: The Modi Question’, tweets sharing the documentary, YouTube news channels ‘Bolta Hindustan’ and ‘National Dastak’, an article by ‘The Caravan’, etc. The secrecy and opacity surrounding the blocking order have made it difficult to ascertain the reasons and what component of the content triggers Rule 16 or other invoked provisions. Since the non-publication of official blocking orders leads to the denial of the opportunity to challenge such orders, we urge MIB to publish all future blocking orders proactively. Despite the stay of the operation of Rules 9(1) and 9(3) by the Bombay and Madras High Courts, digital news media publishers have received notices under Rule 18 of the IT Rules from the MIB requesting information about their entities. Although Rule 18, which allows the MIB to request this information, has itself not been suspended, the Rules outlining the 3-tier regulatory mechanism and the Code of Ethics have been stayed and a holistic reading of Part III of the IT Rules, 2021 indicates that the purpose of Rule 18 is to enable the MIB to identify news publishers and thereby regulate them under the IT Rules, 2021. After we filed an RTI application, a first appeal, and approached the Central Information Commission, the MIB furnished a list of 3,101 digital news media publishers and 57 “OTT” platforms that submitted their details to MIB. We are indeed grateful for their disclosure of this information and urge MIB to reconsider its power under Rules 18 in light of the stay imposed.

The Department of Telecommunications

We requested the DoT to consider the following:

1. On the Telecom Act: DoT introduced what is now the Telecommunications Act, 2023 in the Lok Sabha during the Parliament’s Winter Session. It was passed in both houses—with over 140 opposition Members of the Parliament suspended and amid a state of chaos, disarray, protest, and walkouts in the Parliament, and received Presidential assent on December 26, 2024. In our letter to the newly appointed Union Minister, we flagged that the Act is a repackaged version of the colonial Indian Telegraph Act, 1885, which it meant to overhaul. The Act retains certain provisions of the 1885 law that confer government authorities with unbridled powers and infringe on individual privacy. Key problematic provisions relating to surveillance and internet suspension have been replicated verbatim from the 1885 law. A contested provision of the draft Telecommunication Bill, 2022, i.e. licensing, has been replaced, only in name, by a concept of “authorisation” in the Act. The fundamental function of issuing authorisation is still an exclusive right of the Union government. Reliance on “public safety” and “national security” grounds to empower the Union government with powers to temporarily possess, suspend, intercept, and detain any telecommunication service or network from an authorised entity, too, is reminiscent of the dated 1885 law (Read our detailed first read of the Act for detailed analysis). Most confusingly, we do not know whether internet services like WhatsApp will be regulated under the Act due to vague definitions. Given how certain industry stakeholders are pushing for internet services to be regulated under this Act as well, we urged DoT to clear this up and exclude such services from its ambit.
2. On net neutrality: As proponents of a free and fair internet, we have proactively engaged with DoT and sectoral regulators on safeguarding net neutrality. In 2022, we wrote to DoT requesting the establishment of a Multi-Stakeholder Body to ensure that internet service providers adhere to provisions of net neutrality in their licence, and we reiterate our request in this letter. Since we have been engaging with TRAI on its consultation paper on regulating internet services, we expressed to DoT that the current definition of ‘OTT’ services adopted by TRAI, and any classification of such services, is unable to reflect the complexity arising from the multiple functions performed by a service. Hence, on principle, we hold a preliminary view against the licensing and registration of ‘OTT’ services, and believe that such sectoral intervention may violate net neutrality principles and user choice and freedom. We have also traced and rebutted the ‘fair share’ arguments made by telcos as there are inherent structural differences between telcos and ‘OTT’ content providers, the primary one being that the latter are essentially internet-based apps, which do not own or operate telegraph equipment or enjoy the exclusive permissions enjoyed by telcos. We requested DoT to a) avoid the use of the phrase ‘OTT’ as it is reductionist which limits the vibrant, innovative pace of applications and services; b) compare the regulatory or licensing norms applicable to telcos and ‘OTT’s; c) prioritise public welfare rather than protecting profit interests of telcos. 
3. On shutdowns and suspensions: IFF has monitored and pushed back on several counts of internet and telecom shutdowns across India over the years. India continues to be the country with the most number of internet shutdowns in the world. We have provided legal assistance to petitioners before the Hon’ble Supreme Court in Anuradha Bhasin v. Union of India, (2020) 3 SCC 63 and Foundation of Media Professionals v. Union Territory of Jammu & Kashmir, (2020) 5 SCC 746. In both cases, the Hon’ble Supreme Court recognised that the right to speech and the right to carry on any trade through the medium of the internet is constitutionally protected, and laid down strict requirements to be followed in case of a shutdown or suspension. We urged DoT to adhere to legal and judicial compliances pertaining to telecom suspensions at every instance. Further, we have made requests to DoT in the past to publish executive orders issued to Internet Service Licensees for blocking URLs. We conveyed to DoT that we were pleased to note that court orders containing directions for blocking URLs that were issued to various Internet Service Licensees, as well as judicial orders for blocking notifications/ instructions, were duly published on the DoT website.

The Ministry of Corporate Affairs

The Ministry released the Digital Competition Law Report and draft Digital Competition Bill, 2024 on March 12, 2024, for which we submitted our comments on May 15, 2024. In our submissions, we highlighted and offered recommendations on four broad areas of concern: friction in the consultation process; inadequacies of the data protection law; potential regulatory overlap with existing and upcoming legislations; and the regulatory approach proposed under the Bill. A more descriptive summary of our submissions can be read here. We reiterated our concerns to the Ministry and urged them to make suitable revisions.

The Ministry of Civil Aviation

We urged the Ministry to withdraw the Digi Yatra scheme from Indian airports owing to its large gamut of concerns relating to privacy, surveillance, exclusion errors, and lack of institutional accountability and transparency, coupled with the highly disturbing manner in which it has recently been deployed at airports – with reports of coercion and deception, at the cost of passengers’ dignity, privacy, and autonomy. We drew attention to our sustained advocacy on the privacy and transparency concerns of Digi Yatra and reiterated primary arguments covering a) deficiencies of existing law-policy frameworks, b) Digi Yatra’s data practices and privacy concerns, c) lack of institutional transparency and accountability, d) socio-legal perils of using FRT, and e) inefficiency and errors associated with facial authentication systems at airports.

The Ministry and Department of Consumer Affairs

We wrote to the Ministry/Department highlighting our concerns around the (now revised) Guidelines on the Prevention and Regulation of Dark Patterns released by the Ministry in September, 2023. We summarised our comments on the initial guidelines in the letter, but also reiterated persistent gaps in the now revised policy which we flagged to the Ministry more recently. These include addressing the lack of penalty provisions in the guidelines, widening their ambit to curb dark patterns in physical spaces, and making all policy consultation processes more transparent and participative.

A new term, some fresh faces, several old hopes

With these letters, we wish to foster a dynamic and mutually enriching relationship between civil society and the Ministries. Considering our sustained engagement with and interest in many issues in the Ministries’ roster, we hope that the Ministries engage with civil society stakeholders such as IFF, and invite them to public consultations and conversations. Further, we hope that such public consultations remain truly open and accessible to the public and no person is denied participation, regardless of their affiliation or status. The combined efforts and voices of civil society can assist the Ministries in developing robust governance frameworks for India’s digital revolution.