Intermediary Liability and Platform Gatekeeping in India: Safe Harbour, Due Diligence and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2023

Question 1 Trace the evolution of intermediary liability in India under Section 79 of the Information Technology Act, 2000. Explain how the Supreme Court in Shreya Singhal v. Union of India (2015) read down Section 79(3)(b) and clarified the 'actual knowledge' standard that triggers an intermediary's obligation to remove unlawful content.

Answer 1 Intermediary liability law in India has seen considerable development in recent years: 2000 Framework:

Considering the initial provisions of Section 79 of the IT Act, 2000, safe harbour provisions were limited and strict. To avail protection from liability, an intermediary needed to prove that the offense or contravention occurred without his knowledge and that he had taken due diligence to prevent such offense. Post the notorious Avnish Bajaj v. State (NCT of Delhi) (2005) (relating to the sale of an explicit video clip on Baazee.com), where the managing director was found guilty of criminal acts despite having no direct active involvement, the need for a proper "safe harbour" was made quite evident.

2008 Framework:

Through the Information Technology (Amendment) Act, 2008, Section 79 was redefined in conformity with global practices (like the EU E-Commerce Directive and US Section 230). Under Section 79(1), any intermediary is exempted from liability with respect to any third-party information, data or communication link which is made available by him provided that the intermediary fulfils certain conditional provisions as specified under Section 79(2) and Section 79(3)(b):

a Section 79(2): The role of an intermediary should be confined only to the provision of access to a communication system, should neither initiate the transmission nor select the addressee of the transmission, should neither choose the information to be transmitted nor alter the information while transmitting and should exercise due diligence as may be required by the Central Government.

b Section 79(3)(b): Immunity would be forfeited where, after being provided "actual knowledge" or being informed by the government or its agencies that any information, data or communication link is stored or hosted in a computer resource controlled by it, the intermediary does not take immediate measures to remove such material.

2011 Framework:

Under this set of guidelines, the government established a "notice-and-takedown" system that would involve sending takedown notices privately to the intermediary. Once the intermediary received the notice, according to Rule 3(4), it had 36 hours within which to remove the material, or else face loss of immunity. The reason why this model came under heavy
criticism is that private intermediaries were being asked to adjudicate on complex legal issues such as defamation or blasphemy.

Shreya Singhal v. Union of India (2015):

a The Court noted that the interpretation of "actual knowledge" to include all private notices would impose an unreasonable burden on intermediaries, making them arbiters of free speech. Intermediaries deal with millions of notices daily, and they do not have the legal competency to assess the legality of the material posted.

b Section 79(3)(b) of the Information Technology Act, was, therefore, read down by the Supreme Court to interpret that an intermediary gets "actual knowledge" only when he is informed of an order of the court or a directive by the appropriate Government or its agencies that the content needs to be taken down.

c The grounds for the court's order or the government's notification shall be limited to the reasonable restrictions prescribed under Article 19(2) of the Constitution of India only.

d This judgment ensured that the safe harbour provision was protected and that intermediaries were immune from liability based on private takedown notices alone (with exception being made for specialized regimes such as copyright cases as decided in later cases).

Question 2 Examine the due diligence obligations imposed on intermediaries under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended in 2023, including the grievance redressal mechanism, the appointment of Grievance Officers, and the Grievance Appellate Committee. Discuss the constitutional challenges raised against the Fact Check Unit provision for government-related content (including Kunal Kamra v. Union of India) and its present status.

Answer 2 The “Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021” put several strict duties on all intermediaries as per Rule 3:

a Rule 3(1)(a) & (b) – User Agreements: The intermediary must post its rules, privacy policy, and user agreement for not publishing defamatory, obscene, pornographic, privacy-invasive, hate speech, and intellectual property violating information.

b Rule 3(1)(c) – Annual Reminders: The intermediary must remind its users annually of the consequences of non-compliance (including termination of access/account).

c Rule 3(1)(d) – Takedown Time Limits: The intermediary must stop access to such information which has been declared as unlawful by a court or the government within 36 hours. The below explains the Grievance Redressal Mechanism & Grievance Appellate Committee (GAC):

d Grievance Officer [Rule 3(2)(a)]: All intermediaries must designate a Grievance Officer based in India, disclose the name and contact details of the Grievance Officer, and develop a redressal system. The Grievance Officer must respond to the complaint within 24 hours and address the complaint within 15 days (72 hours in case of complaints regarding specific categories such as sexually explicit material without consent).

e Grievance Appellate Committee (GAC) [Rule 3A, added in 2022]: Established by the Central Government, the Grievance Appellate Committee operates as an administrative appellate body. Any user who is aggrieved by the decision of the Grievance Officer of the intermediary can file an appeal to the Grievance Appellate Committee within 30 days. The Grievance Appellate Committee must decide the matter within 30 days.

f Constitutional Challenges to Fact Check Unit (FCU): The amendment of rule 3(1)(b)(v) 2023 stated that intermediaries should take reasonable efforts to make sure that information which has been notified by the FCU of the government as fake, false, or misleading "in relation to any business of the Central Government" is neither hosted nor displayed by the user on the platform. The intermediary will have to delete the information to avoid liability under section 79 of ITA.

Kunal Kamra v. Union of India (2024): Satirical actor Kunal Kamra and various media organizations challenged the FCU regulation in the Bombay High Court on the grounds that it contravened Article 14 and 19(1)(a) and 19(1)(g). High Court Split Verdict (January 2024): Justice G.S. Patel declared the FCU provision to be unconstitutional since it is ambiguous and a threat to free speech. However, Justice Neela Gokhale agreed to uphold the FCU regulation and opined that preventing misinformation in the public interest was a permissible state objective.

Interim Stay Granted by the Supreme Court (March 2024): The Supreme Court stayed the FCU notification issued by the Central Government until further orders of the tie-breaker judge.

Decision on Tiebreaker (September 2024): A.S. Chandurkar, J. (Third Judge) declared Rule 3(1)(b)(v) ultra vires of the IT Act 2000. He noted that words such as "fake, false, or misleading" are vague terms, that citizens have no obligation under the Constitution to receive only "government-approved truth," and that making the Executive judge of truth in its own case is an infringement of Article 14 and Article 19(1)(a).

Current Position: FCU order pertaining to content relating to government continues to be invalid / not operational, pending the appeal of Union of India in the Supreme Court.

Question3 Distinguish between the obligations of an ordinary 'social media intermediary' and a 'significant social media intermediary' (SSMI) under the IT Rules, including the additional requirements of traceability, appointment of compliance and nodal officers, and voluntary user verification. Critically examine the privacy and encryption concerns raised by the traceability requirement for end-to-end encrypted platforms.

Answer 3 Under the IT Rules, 2021, there is a two-tier classification of SMIs that depends upon the size of user base:

a Ordinary Social Media Intermediary (SMI): An SMI that allows interactions between two or more users through the internet.

b Significant Social Media Intermediary (SSMI): It is an SMI that has registered users in India exceeding the number fixed by the government (50 lakh).

Traceability Requirement & Encryption Issues

As per the provision of rule 4(2) of IT Rules, 2021, the SSMI offering messaging service would be required to facilitate the tracking of the first originator of the information in India based on receipt of a judicial or a government order under section 69 of the IT Act.

a Conflict Between Privacy and End to End Encryption (E2EE): WhatsApp and Signal use E2EE technology where the message and metadata get encrypted at the client's device level and none other than the sender or receiver of the message can trace it.

b Argument of Breaking Encryption (WhatsApp LLC v. Union of India): In its appeal at the Delhi High Court, WhatsApp maintained that in order to determine the "first originator" of the message, it would have to break E2EE for all messages across the network, store the fingerprints/traces in billions of private conversations, and make irreversible changes to its systems infrastructure. Such an approach infringes upon the principles of data minimization as well as the rights enshrined under Article 21 of Justice K.S. Puttaswamy v. Union of India.

c Proportionality Test: Petitioners assert that Rule 4(2) does not meet the three-pronged proportionality test (legality, need, and proportionality) enunciated in the landmark judgment of Justice K.S. Puttaswamy v. Union of India because there are fewer invasive methods available (such as metadata collection by a court warrant).

Question 4 Discuss the consequences for an intermediary that fails to observe due diligence under the IT Rules, including loss of the 'safe harbour' protection under Section 79. How do courts and quasi-judicial authorities assess whether an intermediary exercised due diligence, particularly in the context of complaint and takedown requests filed under the Digital Media Ethics Code?

Answer 4 Immunization under Section 79(1) depends on strict compliance with Section 79(2) and Section 79(3). According to Rule 7 of the IT Rules, 2021, in case an intermediary does not comply with due diligence obligations as per the rules:

a Loss of Safe Harbor Protection: The provisions of Section 79(1) do not apply to the intermediary.

b Direct Common Law and Statutory Liability: The website is subjected to civil liability, injunctions, and prosecution under any applicable Indian laws (Indian Penal Code/Bharatiya Nyaya Sanhita, Copyright Act, 1957, and Trademarks Act, 1999), as if it was itself the publisher or author of the illegal material. An analysis is done regarding the due diligence of an intermediary, based on active versus passive intermediation:

c Test of Active vs Passive Intermediary (Christian Louboutin SAS v. Nakul Bajaj): In this case, the Delhi High Court observed that an intermediary can never invoke its right to safe harbour when it is actively involved in promoting, controlling, cataloguing, verifying, and manipulating user-generated material. If an e-commerce website is actively involved in such orchestration like verification of authenticity, packing, and tagging, then it becomes an active participant.

a Automated Participation vs. Manual Participation (Myspace Inc. v. Super Cassettes Industries Ltd.): Conducting automated processes does not constitute participation or losing the benefit of safe harbour, if the automated process is free from human intervention and alteration.

b Adherence to Procedural Time Limits: Courts consider whether Grievance Officers have recognized complaints in 24 hours, redressed grievances in the statutory timelines, and enforced any court order or government directive for taking down material issued under Section 79(3)(b).

Question 5 Compare the complaint and takedown mechanism available under the IT Rules with statutory remedies available for defamation, intellectual property infringement, or other unlawful content hosted on digital platforms. When should a complainant approach the intermediary's grievance mechanism as opposed to initiating civil or criminal proceedings, and can both routes be pursued simultaneously?

Answer 5 There exist two remedies to address such content which are made unlawful by virtue of being hosted on digital platforms in the legal framework of India. The process of grievance handling in accordance with IT Rules, 2021/2023 and the conventional remedy in terms of civil or criminal litigation.

The following parameters for comparison between IT rules grievance redressal, statutory civil remedies and statutory criminal remedies is understood and explained below:

1. Forum

In IT Rules, the grievance redressal mechanism involves approaching the intermediary’s Grievance Officer/Grievance Appellate Committee (GAC). The aggrieved party needs to approach a Civil Court like District Court/High Court for Statutory Civil Remedies. In case of Statutory Criminal Remedies, the party needs to file an FIR at a Police Station according to Section 154 of CrPC/BNSS or take it to a Magistrate.

2. Speed & Efficiency

IT Rules involve grievance redressal mechanism which is supposed to be swift with 24-hour acknowledgment within 72 hours to 15 days. In Statutory Civil Remedies, things are slow as there need to be civil trials, but interim relief can be received relatively quickly. In Statutory Criminal Remedies, time varies depending on the investigation process.

3. Remedies Available

Under the IT Rules Grievance Redressal process, only administrative remedies such as content removal, account suspension, and blocking of links can be sought. Under the Statutory Civil Remedies, legal remedies such as injunctive reliefs, monetary damages, compulsory removal of content and an apology can be sought. Under the Statutory Criminal Remedies, formal action by the State includes taking cognizance, investigations by police, search and seizure, arrest and conviction.

4. Situations Appropriate

IT Rules Grievance Redressal process is appropriate for situations relating to invasion of privacy, objectionable content and violation of platform’s terms of service. Statutory Civil Remedies are often sought for violation of trademarks, copyrights and severe defamation cases. Statutory Criminal Remedies are appropriate for cybercrimes, identity theft, criminal defamation and online harassment.

Grievance Redressal: When it comes to the time to initiate a remedy through Grievance Redressal: The aggrieved party must approach Grievance Redressal when he wants to get the unlawful material taken off instantly, without any litigation, because it offers him a cost-effective and speedy solution without involving the judiciary.

Statutory Judicial Proceedings: When it comes to initiating Statutory Judicial Proceedings: It is important for one to initiate civil and criminal proceedings when he needs financial compensation, an international and worldwide injunction, complex issues pertaining to ownership of the property (such as the validity of a trademark or patent), or the criminal prosecution of the originator. In light of Shreya Singhal, it is possible for the private party to obtain an interim court order to prove the "actual knowledge" of the intermediary.

Simultaneous Pursuit: It is possible to pursue both remedies simultaneously. Initiation of Grievance does not prevent one from approaching civil or criminal courts. In fact, the filing of the complaint or obtaining interim court order while pursuing the Grievance enhances the claim of legal notice received by the intermediary under Section 79(3)(b).

Case 1 — Safe Harbour under Section 79, IT Act: Foundational Jurisprudence

Case 2 — IT Rules, 2021/2023: Due Diligence, Grievance Redressal & Fact Check Unit Challenges

Case 3 — Significant Social Media Intermediaries: Traceability, Encryption & Platform Accountability

CHRONOLOGICAL ORDER OF THE LANDMARK JUDGMENTS

Nandhika Betty