IFF’s submission to the UN Human Rights Committee ahead of India’s 4th periodic review

tl;dr

India’s move towards large-scale digitalisation has necessitated a critical look at law and policy instruments governing the space—which commonly appear to be vague, arbitrary, exclusionary, or fail to place human rights at their core. New laws and digital interventions seem to share the lack of public consultations and stakeholder participation. A spike in public-private partnerships across sectors is weakening transparency and accountability mechanisms. The 2019-2024 window is a crucial time for a deep assessment of the state of privacy, dignity, free speech, and several other constitutional guarantees of Indian citizens, their interpretation in Indian courts, and the need for rights-based legislation in the digital sphere. We noted all these concerns and more in our report to the United Nations Human Rights Committee ahead of their 4th periodic review of India.

Important documents:

IFF’s written contribution to the UNHRC periodic review of India (dated 03.06.2024) (link) 

Issue-wise analysis as enlisted by the Committee

An introduction to “Digital India”

At the outset, we set context for the report by tracing India’s push towards digitalisation in the last five years. Here, we spanned a few themes:

1. The digital divide: India suffers from a gaping digital divide, where factors of low literacy and unfamiliarity with emerging technological tools can impede many population groups from reaping the benefits of the internet and digital technologies recreationally as well as for better quality of life. This was especially seen during the COVID-19 pandemic, where increased digitalisation and reliance on online tools across sectors like education, labour, and health, forced many to fall through the cracks (see here, here, here).
2. Connectivity: Recent government data reveals that 95.66% of total broadband subscribers (wired and wireless) and ~60% of the Indian population access the internet through their wireless devices (mobiles and dongles). Access to smartphones and internet is lower within women, especially rural women (see here, here, here). Read IFF’s Connectivity Tracker for more analysis on this issue. Union government’s efforts to enhance connectivity, namely PMGDISHA and BharatNet, significantly lag behind in fulfilling their targets.
3. Data protection law: The lack of an adequate (or active) data protection law is a big concern. The Digital Personal Data Protection Act (“DPDPA”), 2023 was passed and notified in 2023 after a long and winding journey through committees and consultations. Yet, its final version seemed unrecognisable and was never opened up for public scrutiny and consultation. In its present form, the Act falls short on many counts.
4. Digital India: Our ‘Digital India’ programme envisions large-scale digitalisation across sectors, which also means large-scale data collection and processing. The programme does not properly address foundational encumbrances like infrastructural capacity, tech-preparedness, and digital divide, and operates without an adequate data protection regime in place. Our concerns around the programme include socio-economic exclusion cast by welfare sector digitalisation, ‘IndiaStack’ and the lack of transparency and accountability within it, and a worrying roll-out of digital public infrastructures.

Gendered Harms on the Internet

We noted that persistent incidents of sexual harassment and doxxing have made social media platforms highly unsafe and toxic for women in the last five years, which may lead some of them to disengage from social media altogether. Most notably, the ‘Boiz Locker Room’ incident targeting school-going girls in 2020 (read our analysis here) and the Sulli and Bulli Deals incident targeting Muslim women in 2021 (read our analysis here) point to the prevalent gendered harms online, and lack of adequate action by authorities, and sometimes even platforms. As per a recent Global Witness and IFF investigation, content that targeted women on the basis of gender (including Islamophobic, racist, and casteist hate), was kept live on YouTube and Koo in both the US and India despite violating companies’ own policies. 

Censorship of Communal Speech Online

We noted two significant instances. In August 2023, tweets related to a video showing a school teacher in Muzaffarnagar, Uttar Pradesh instructing students to abuse and physically harm a fellow Muslim student, were reportedly taken down from X (formerly Twitter) pursuant to orders sent by the Ministry of Information and Broadcasting. When asked, the Ministry denied access to blocking orders, citing the national security exemption under different laws, which we have analysed in depth in this post. Secondly, in May 2024, an X post by the Bharatiya Janata Party’s Karnataka unit triggered nationwide outrage due to its communal attack on the Indian National Congress. The Karnataka Police, after being directed to do so by the Election Commission of India, asked X to take down the controversial post. 

State of Privacy, Data Protection, and Surveillance

In this section, we summarised issues in relation to the following sub-themes pertaining to data privacy and protection:

1. The Puttaswamy standard: We underlined the significance of Justice (Retd.) K. S. Puttaswamy v. Union of India [(2017) 10 SCC 1], or the Puttaswamy judgement—where a nine-judge bench of the Indian Supreme Court unanimously affirmed that the right to privacy is a fundamental right guaranteed under Part III of the Constitution of India, and prescribed the five-pronged Puttaswamy standard that any privacy-infringing measure must meet: (a) existence of a legitimate state interest; (b) suitability (rational nexus between the measure and goal); (c) necessity (least restrictive way of achieving the goal); (d) proportionality stricto sensu (balance between the extent of infringement and strength of the goal); (e) the existence of procedural safeguards.
2. Weak foundations of Aadhaar: There is strong evidence from the last decade to suggest that Aadhaar linkage has instead led to exclusion, potential citizen surveillance and profiling, and a range of privacy concerns. While optional on paper, Aadhaar has been thrust upon populations and made mandatory in practice across sectors through the years. In this section, we spanned themes of Aadhaar integration in public and private sectors and lawfulness thereof, and the long list of vulnerabilities of Aadhaar data and inadequacy of state response thereto.
3. An inadequate data protection law: As noted above, we expanded on the shortcomings of the present DPDPA, 2023.
4. Surveillance through CMS: The Centralised Monitoring System (“CMS”) enables state e-surveillance and monitoring of text messages, social-media engagement, and phone calls on landlines and cell phones, among other communications, which severely jeopardises privacy. We explored how CMS does not meet transparency and accountability standards.

State of Free Speech in India

1. The right to peaceful protests: Indian citizens have the fundamental right to protest, drawing from the right to free speech and expression i.e. Article 19(1)(a) and freedom of peaceful assembly i.e. Article 19(1)(b) of the constitution. While this right is not absolute and can be limited by reasonable restrictions, such restrictions must be necessary, proportionate, and follow procedures established by law. We noted many instances of digital repression (by censorship and internet shutdowns) and protest surveillance, which have a chilling effect on this right without meeting necessity or proportionality standards.
2. Internet shutdowns: As India emerged as the country with the highest number of internet shutdowns in 2023, we trace our five-year history of such suspensions, exploring the statutory basis for internet shutdowns in India and the compliance mandate laid down in Anuradha Bhasin v. Union of India [AIR 2020 SC 1308]. We studied how shutdowns play out in practice with a focus on human rights violations associated with cutting off access to digital resources and briefly highlight an ongoing challenge to the validity of the legal instrument legitimising internet shutdowns. 
3. Digital censorship: Over the last five years, we have seen concerning trends in online content blocking, website blocking, and social media account blocking, and how judicial interpretation of existing legal provisions giving the government powers to censor do not remedy the situation vastly. We also noted that existing online censorship practice in India falls afoul of prevailing legal norms, specifically the precedent set by the Supreme Court in Shreya Singhal v. Union Of India, [AIR 2015 SC 1523]. We reiterated our concerns on the Broadcasting Services (Regulation) Bill, 2023 and new attacks on journalistic expression and creative freedom. 
4. Deficiencies in the IT Rules: Platforms are governed in India through a network of laws, including three notable amendments to the Information Technology (“IT”) Act, 2000. These are the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Amendment Rules, 2022 to the IT Rules, 2021, and Amendment Rules, 2023 to the IT Rules, 2021. We charted their regulatory mechanisms and impact on free speech online, covering the arbitrary content blocking and takedown powers they confer and their misguided attempt to tackle “misinformation” by mandating Grievance Appellate Committees (read our analysis here) or setting up state-backed Fact-Check Units (read our response here). 
5. Threats to end-to-end encryption: India’s intent to build backdoors to end-to-end encrypted platforms for access to law enforcement agencies presents an undemocratic and unconstitutional framework for the regulation of online content. We traced the mandate of Rule 4(2) of the IT Rules, 2021, which can require messaging services (such as WhatsApp) to enable identification of the “first originator” of a message, the Cyber Security Directions issued by Indian Computer Emergency Response Team which can require VPNs and other specified entities to maintain logs for up to five years, and the new Telecommunications Act, 2023.
6. Press harassment and intimidation: We noted the alarming use of spyware or threats of use of spyware by state authorities on the devices of journalists, researchers and opposition leaders, which reportedly happened at least twice in these five years. The lax response of Indian authorities to Pegasus and allegations of planted evidence during criminal proceedings against human rights defenders was deafening, but was also seen when Apple, Inc. recently sent threat notifications to journalists and opposition leaders about potential state-sponsored attack on their devices.
7. Sedition: In the past five years, there has been a notable misuse of Section 124-A of the Indian Penal Code, 1860 which criminalises the vague offence of ‘sedition.’ We noted the recurrent FIRs filed under the provision even as the Supreme Court, while hearing a pending challenge to the constitutional validity of Section 124-A, has issued a historic order suspending all pending trials, appeals, and proceedings under it until the law is re-examined. 

This is a (very) concise summary of our report to the UNHRC ahead of their 4th periodic human rights review of India. We thank the Committee for undertaking this significant and timely exercise and giving civil society organisations like IFF the opportunity to draw from their work and provide diverse perspectives to the process.