A Question of Law For Social Media Data: Implications Of New IT Rules

The unprecedented uproar over multinational social media platforms like Twitter, Facebook and WhatsApp being subject to new rules and regulations have evolved from being a matter of contention ever since the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (or “new IT Rules”) were notified by the Government of India and came into effect from May to erupting into a controversial faceoff between the Indian state and the Indian subsidiaries of US-based tech companies. As per the latest information available in the public domain, WhatsApp has filed a suit against the Government while Twitter is mulling its options and has officially requested more time to comply with the new rules. In the meantime, we consider the legal and policy impact of the new regulations along with future implications on India’s digital media landscape. 

First and foremost, from the perspective of a sovereign state, matters of sovereignty and security are non-negotiable fundamental principles and have constitutional justification under Article 19. Every independent nation in the world has the absolute right and prerogative to determine its own interests and policies. For instance, Germany has a law that enables levying of hefty fines on internet companies in cases where any illegal or offensive content (as defined by their local laws) is not taken down. Several other countries such as Singapore, the Philippines and Russia also have similar regulations and prescribed norms for social media. It has been more than a decade since the Chinese government and its leaders upheld China’s sovereign right to make decisions in its own national interest and according to its own state policy. Chinese tech companies and media platforms - Baidu, SinaWeibo and Renren - replaced their American counterparts including Google which exited China lock, stock and barrel in 2010. Although from a purely regulatory point of view, the Chinese Government could have also banned or censored specific content instead of entire websites and social media platforms, the complete and unconditional ban of Google, Twitter and Facebook did not seem reasonable or proportionate at the time. 

Yet we have to bear in mind the realities of today’s internet media and the critical role they play in a democratic political system like India. The fact is that over time they have become like a basic utility service required by a large number of citizens and businesses for day-to-day activities and operations. And while a social media platform like Twitter or Facebook may see themselves as a mere “network” connecting millions of users, the fact is they also have powerful proprietary algorithms and vast troves of personal data available at their disposal. Which means they can and have exercised the right to decide who can use their platform and what content can be disseminated through them; So is it not fair and reasonable to expect that they should also bear the responsibility for the consequences of non-compliance of the applicable laws and for content that can have serious consequences for a nation’s security and stability? 

However, there are also geoeconomic and geopolitical realities that have to be taken into consideration, for just as “no man is an island”, neither is a country or its government. In this respect, the state and its law enforcement agencies need to ensure they balance the use of their powers to regulate while also enabling an ecosystem for the media to support collaboration on newer, better technologies. 

Now as far as regulatory policy is concerned, the issue of data privacy in relation to the issue of public interest and the fundamental rights of every individual to freedom of speech and expression under Article 19(1) of the Constitution is clearly justified. At the same time, religious and socio-economic differences across India have to be borne in mind along with the fact that Indian society is predominantly informal and traditional. This implies that while one can argue that social media is just a means to enable and uphold fundamental democratic rights and freedoms, it cannot completely escape any and all liability. Considering that Part II of the new IT rules sets out a specific exhaustive list of due diligence requirements to be carried out by all social media platforms and makes it mandatory for them to appoint a Chief Compliance Officer, it simultaneously ensures that they no longer remain exempt from liability (granted to them under section 79 of the IT Act) for any third-party data/information communicated via their platform. While this may seem stricter and can evoke a sense of a higher degree of censorship, we think it has been done to bring all forms of media at par in terms of responsibility for their content. 

The Data Protection law (at present the Personal Data Protection (PDP) 2019 Bill) if passed, applies only to the personal data of an individual person i.e. an Indian citizen and not to data in the public domain or the data of public or private institutions, non-government organisations, foreign companies, government agencies, departments etc. Therefore, determining the purpose for which the data or information is used is always the starting point. This is often easier said than done. A lack of specific regulations or guidelines on access to and use of data/information by a platform, company or third parties has led companies into self-drafted privacy policies at best, and, lawsuits for breach of data at worst. That is precisely why the Justice Srikrishna Committee set up by the Ministry for Electronics and Information Technology recommended passing the PDP bill before making further changes to the IT law. In our view, it is the best approach to integrate the data privacy policies of social media companies/intermediary platforms with the judgment of the Supreme Court in AADHAR and the international General Data Protection Regulations (GDPR) of the EU. 

Finally, the question about the impact of the new rules on the development and use of the tech itself on which social media apps are based is the one that will bother the tech companies more in the days and months to come. Practically speaking, there are legitimate IP issues related to the development and use of new cutting edge technologies, creating AI-based software etc. as well as strategic business issues related to continuing user experience, data privacy, data storage, data sharing, better-targeted advertising by businesses and so on. For the time being though, the likes of Twitter, Facebook, Instagram, WhatsApp et al are left with only two options - one, either to follow and adapt to the new rules or two, to seek a judicial review in the courts (in which case they will have to comply until the Supreme Court hears the case and passes the final judgment). In any case, the issue of a digital or social media intermediary’s liability will have larger implications for the circulation of fake news and matters of public order and safety. 

Of course, regulating big tech is still a work in progress. Not just in India but also worldwide. There is hardly any harmonisation of rules yet, be it the virtual world of social media apps or of cryptocurrencies. 

At the end of the day, for any policy or law to succeed in the long run, all the aspects viz. legal, technical, societal, economic, political, security and all stakeholders’ interests must be considered and balanced. Else, the gaps between our data, technology, laws and society may not be bridged for the better.