Due Diligence to Be Observed by Social Media Intermediaries and Significant Social Media Intermediaries Under Information Technology Rules, 2021

The Government of India has notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 in supersession of the Information Technology (Intermediary Guidelines) Rules, 2011.

The new Rules have demarcated between ‘social media intermediary’ and ‘significant social media intermediary’.  Significant social media intermediaries, who have to observe additional due diligence are defined in the amended Rules as social media intermediaries with users above such threshold as may be notified by the Central Government. The Government has set Fifty Lakh (Five Million) registered users as the threshold.

The intermediaries have to observe due diligence, such as prominently publishing on its website or application or both, the rules and regulations, privacy policy and user agreement for access or usage of its computer resource by any person. They have to inform the users about the prohibited content. Also, upon receiving actual knowledge in the form of an order by a court of competent jurisdiction or on being notified by the appropriate Government or its agency, the intermediary shall not host, store or publish any prohibited information. If any such information is hosted, stored or published, the intermediary shall remove or disable access to that information within thirty-six hours from being notified. Intermediary shall also preserve such information and associated records for one hundred and eighty days for investigation purposes, or for longer period as may be required by the court or by Government agencies. Intermediaries are also required to expeditiously furnish information concerning verification of identity, or prevention, detection, investigation, or prosecution, of offences under any law or for cyber security incidents within seventy two hours of the receipt of a lawful order. The intermediary shall also publish the name of the Grievance Officer and his/her contact details as well as mechanism for complaint. Grievance Officer shall acknowledge the complaint within twenty four hours and resolve it within 15 days from the date of its receipt. Intermediaries are also required to remove or disable access to any content which exposes the private area of any person, or shows full or partial nudity or sexual act or conduct including artificially morphed images within twenty four hours from the receipt of a complaint.

Additional due diligence have to be observed by a significant social media intermediary such as appointing an Indian resident as Chief Compliance Officer, a nodal contact person for 24x7 coordination with law enforcement agencies and officers, and a Resident Grievance Officer; and publishing a monthly compliance report.

One of the most contentious Rules to be followed by a significant social media intermediary providing messaging services, is enabling the identification of the first originator of the information. If the first originator is located outside India, the first originator of that information within India shall be considered as the first originator of the information.

 Another major liability on significant social media intermediary is that they must endeavour to deploy technology-based measures such as automated tools to proactively identify prohibited information such as information depicting any act or simulation in any form depicting rape, child sexual abuse or conduct, whether explicit or implicit, or any information which is exactly identical in content to information that has previously been removed or access to which has been disabled.