The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("Intermediary Rules") provides for the due diligence required to be followed by the Intermediaries, including social media intermediaries, and lays down the duties of an intermediary with respect to data protection along with laying guidelines for the regulation of online news content and over-the-top (OTT) platforms. The Intermediary Rules establish a due diligence framework for intermediaries to follow when hosting or publishing material on any of their computer resources.

The Information Technology (Intermediary Guidelines) Rules, 2011 were notified in the exercise of the power conferred on it by section 87 read with section 79(2) of the Information Technology Act, 2000(hereinafter called "IT Act").

Important definitions:

• Rule 2(i) defines "digital media" as means digitized content that can be transmitted over the internet or computer networks and includes content received, stored, transmitted, edited or processed by
  1. an intermediary; or
  2. a publisher of news and current affairs content or a publisher of online curated content.
      
• Rule 2(q) defines "online curated content" as any curated catalogue of audio-visual content, other than news and current affairs content, which is owned by, licensed to or contracted to be transmitted by a publisher of online curated content, and made available on demand, including but not limited through subscription, over the internet or computer networks, and includes films, audio visual programs, documentaries, television programmes, serials, podcasts and other such content.
   
• Rule 2(v) defines "significant social media intermediary" as social media intermediary having number of registered users in India above such threshold as notified by the Central Government.

Rule 2 (w) defines "social media intermediary" "means an intermediary which primarily or solely enables online interaction between two or more users and allows them to create, upload, share, disseminate, modify, or access information using its services". A social media intermediary is further defined to include a significant social media intermediary if such social media intermediary has users above such threshold as may be notified by the Central Government. Recently the Union Ministry of Electronics and Information Technology has notified this threshold as 50 lakhs (Fifty lakhs) registered users.

Due diligence to be followed by the Intermediaries:
Rule 3 of the Intermediary Rules provides information about the due diligence to be followed by the Intermediaries while sharing the data with the users.

The following due diligence is to be observed:

1. The Rules to prohibit users from hosting certain information: The rules provide that the Intermediary, including the social media intermediary (hereinafter called "intermediary"), must publish the rules and regulations, privacy policy, and user agreement to the users of the computer resource. Further, such rules must prohibit the users from hosting, displaying, uploading, modifying, publishing, transmitting, updating or sharing any information that:
   • belongs to any other person which the user does not have the right to use,
   • is harmful, blasphemous, harmful, harassing, obscene, hateful, racial, or unlawful
   • harms minors in any way
   • infringes any trademark, copyright, etc.
   • violates any law.
   • impersonates any other person
   • deceives or misleads the addressee about the origin of such messages, or fake information, or communicates information that is grossly offensive, etc. (hereinafter called "such information")
   • threatens the unity, integrity, and sovereignty of the Union of India.
   • is an online game that is not in conformity with any law for the time being in force in India,
2. Further, the Intermediary shall inform the users that on non-compliance with such rules, privacy policy, and user agreement, the Intermediary has the right to terminate the access to such computer resource and remove non-compliant information (Rule 3 (b)).
3. The Rules prohibiting the Intermediary from hosting such information: The Rules further provide that the Intermediaries shall not use, host, transmit, modify, or select such information as given above. However, the following acts would not amount to the storage, transmission, or hosting of such information by the Intermediary:
   • such information was automatically and temporarily stored within the computer resource as part of the intrinsic feature of the computer resource.
   • if the Intermediary removes such information after such information comes to the actual knowledge of a person authorized by the intermediary pursuant to any order or direction as per the provisions of the Act. (Rule 3(5)).
4. The rules further provide that the Intermediary on whose computer such information has been stored, shall either himself or if it's brought to the notice of the Intermediary by any other person in writing or through the mail, shall disable such information and preserve such information for the purpose of investigation for 180 days (Rule 3(g)).
5. Upon a court or government order, the intermediary shall block access to illegal information within 36 hours (Rule 3(d)).
6. Within 24 hours of receiving a complaint, the intermediary shall take all appropriate steps to disable access to material that is non-consensual and sexual in nature (Rule 3 (2)).
7. The social media shall identify the First Originator of Information as required by judicial order (Rule 4 (2)).
8. A grievance Officer shall oversee victim complaints must be appointed and his information should be published on the intermediary's website or application. (Rule 3 (2)).
9. Mandatorily publishing a Monthly Compliance Report containing details of complaints received and action taken thereon.(Rule 4 (1) (d)).
10. As per the rules the intermediaries must appoint Chief Compliance Officer, who shall be responsible for compliance with the Act and the Rules and shall be made liable if he fails to ensure that the Intermediary follows due diligence, a Nodal Contact Person, and a Resident Grievance Officer (Rule 4 (a)).
11. Additionally, social media intermediaries shall enable users to voluntarily verify their accounts (Rule 4 (7)).
12. Significant Social Media Intermediary shall deploy technology-based measures such as automated tools or other frameworks for proactively identifying any information that depicts any act or stimulation, whether explicit or implied with regards to rape, child sexual abuse or conduct and information identical to the content that has been removed/disabled. (Rule 4 (4)).
13. The intermediary must inform its users at least on an annual basis (a) of any change in the privacy policy terms or rules or regulation of such intermediary; and (b) in case of any non-compliance with the privacy policy, it has the right to terminate the access of the users.
     
14. Duties of Intermediaries:
    
    1. The Intermediaries shall take all reasonable measures to secure their computer resource and information contained therein (Rule 3 (i)).
    2. The Intermediary shall within, not later than 72 hours, on the receipt of an order, provide information under its control or possession, or assistance to the Government agency, which is lawfully authorized for investigation, prevention, and verification of identification.
    3. The Intermediary shall report cyber security incidents and related information to the Indian Computer Emergency Response Team.
    4. The Intermediary shall publish the name and contact details of the Grievance Redressal officer who shall acknowledge any complaints received by it within 24 hours and resolve within 15 days. (Rule 3(2)).

Code of Ethics:
Publishers of digital media, such as OTT platforms and producers of news and current affairs information, are subject to the Code of Ethics outlined in the Rules. According to the 2021 Rules, news publishers in digital media are required to follow the Cable Television Networks Regulation Act of 1995 and the Norms of Journalistic Conduct.

Separating material into age-appropriate categories [Universal, U/A 7+, U/A 13+, U/A 16+, and Adult], implementing an age verification mechanism for access to adult content, and ensuring that content is accessible to those with disabilities are critical considerations for OTT platforms. Publishers of news and current affairs content and online curated content must supply the Ministry with information about their entities, as well as the necessary documentation and information. (Rule 8 and 9).

Grievance Redressal Mechanism:
Level 1- Self Regulation by the Publishers (Rule 11):
The Publishers shall establish a self-regulation mechanism and shall be responsible for the redressal of grievances received by them. Rule 11 provides that an applicable entity must appoint a Grievance Redressal Officer who must resolve the grievance received by it within 15 days. The said officer would also serve as a point of contact for complaints related to the Code of Ethics.

Level -II – Self-Regulating Body (Rule 12):
Rule 12 provides that there may be one or more self-regulatory bodies consisting of publishers. These bodies must be registered with the Ministry of Information and Broadcasting. This body will monitor the publisher's compliance with the Code of Ethics, resolve complaints that have not been settled by the publisher within 15 days, and hear appeals lodged by complainants against the publisher's decision.

Level III- Oversight Mechanism (Rule 13):
The Ministry shall coordinate and facilitate the adherence to the Code of Ethics and enable them to develop an oversight mechanism. This mechanism initiates an Inter-Departmental Committee (Rule 14) for hearing grievances. The officer authorized under this Rule shall hear the grievances from Level I and Level II.

Power of Authorized Officer to block the information:
Rule 16 provides that in case of an emergency, the authorized officer shall, if it thinks fit, block such information and submit specific recommendations in writing to the Secretary, of the Ministry of Information and Broadcasting.

Other Provisions:
Rule 18 provides that the publisher of news and current affairs content and a publisher of online curated content shall inform the ministry of the details of its entity within 30 days of the publication of these rules. Further Rule 19 requires the publisher to disclose the information of all the grievances received by it.

Conclusion:
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 seek to regulate the intermediaries and the digital media, and to preserve customer privacy by preventing data breaches. These rules are a part of the new framework that the government seeks to create for protecting data privacy.