One Step At A Time: Regulating The Worlds Largest Social Media Market
An exploration into the creeping regulation of the worlds biggest social media market.
The worlds largest democracy, India, had 500 million smartphone users at the end of 2019 and the user base is expected to grow to 820 million by 2022, which would translate that smartphones would reach every corner of the country and not be restricted to urban/semi-urban areas. (Reference)
During a press conference while releasing the revised - "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021" - just a few days back, the Indian government revealed the number of social media users (here) and the highest numbers are registered with WhatsApp - a staggering 530 million - that's roughly half a billion users.
Add to that the numbers from Youtube (448 mil), Facebook (410 mil), Twitter (17 mil) and Instagram (210 mil) and you can imagine the scale of the messages and media that gets exchanged over these platforms - only from India.
Add to this list the subscription based over-the-top (OTT) media streaming services such as Amazon, Netflix, HotStar, etc. The proliferation of smartphones, cheap access to internet, rising income levels, low-value 'introductory' subscription fees are all aiding to the growth of OTT platforms. (more details about OTT here)
There has always been a growing concern (here) across the government and public to regulate these 'intermediaries' and 'digital media' content publishers, so that the usage of such platforms do not disturb the sanity of the society. Especially in India, where 'diversity' is evident in every aspect of human behavior - the regulation of these media platforms was long overdue and India - had to pave a way in this space.
Because, the needs of Indian audiences are far more complex than anywhere else in the world - given that there are 20+ official languages, 28 states and 8 union territories, an in-calculable mix of religions, castes and tribes and with social, religious and political beliefs blending in - finding a common denominator is a task on its own.
I believe these new rules - Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 - yet to be effective, have given the users and the government tools/mechanisms to regulate this sector. There's no time to wait for the rules to take the right shape, these can only be built and fine-tuned over time and through periodic and rigorous consultation in the right letter and spirit and more importantly in the larger benefit of the society.
Below I list, salient features of these rules and their potential impact and usage.
- As compared to the rules issued in 2011, this time around the government has done a fantastic job at defining the key terms of 'access control mechanism', 'access services', 'content descriptor', 'digital media', 'news and current affairs content', 'news aggregator', 'online curated content', 'social media intermediary', 'publisher', etc. The definitions are quite clear and relevant for the media that we all deal with today. e.g. ‘social media intermediary’ means an intermediary which primarily or solely enables online interaction between two or more users and allows them to create, upload, share, disseminate, modify or access information using its services;
- Part II of the rules focusses on due diligence by intermediaries and grievance redressal mechanism and shall be administered by Ministry of Electronics and IT. Whereas Part III of the rules relating to Code of Ethics and procedure and safeguards in relation to digital media shall be administered by the Ministry of Information and Broadcasting. This split of administration between the ministries clearly indicates the complexities, challenges and the multi-faceted need to regulate the social media and internet technologies.
- The following is now mandated as a part of the due dilligence rules:
(a) publishing of rules and regulations and their updates are to be communicated. These rules/reulations related to usage of the application of intermediary, along with user agreement, privacy agreements, etc.
(b) Restrictions to host, display, upload, modify, publish, transmit, store, update or share content
(c) Right of an intermediary to terminate a users access
(d) Intermediaries will have a maximum of 36 hours to remove content, from the time they receive orders from a government agency
(e) 180 days retention period defined for intermediaries to store the content related information for investigation purposes as well as after the registration information of a user, even after cancellation/withdrawal of the services. This means - none of our information is ever going to be deleted. :)
(f) Within 72 hours of receipt of notice, the intermediary has to provide all the information related with a cyber-security incident or any other violation/investigation. This means - most social media giants will need to host a big team in India to deal with these matters, given the scale, it's going to be a daily business.
(g) Plus other rules to adhere to the requirements of the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011
4. The following is now mandated as a part of the grievance redressal mechanism of an intermediary:
(a) Name of the Grievance Officer and his contact details as well as mechanism by which a user or a victim may make complaint against violation of the provisions of this rule or any other matters pertaining to the computer resources made available by a social intermediary and the complaint has to be resolved within 15 days
(b) Within 24 hours will have to take all reasonable and practicable measures to remove or disable access to such content as may be identified as objectionable in a complaint by the user. This is a powerful tool for the users and hope it is put to the right use by the users
5. The idea of 'significant social media intermediary' is quite unique in a sense to the Indian context and the names of such intermediaries will be identified by the government. There are additional obligations for such intermediaries as below:
(a) Appointment of a Chief Compliance Officer - a key managerial personnel or such other senior employee of a significant social media intermediary who is resident in India - to monitor the compliance of these rules and is liable for actions of any third-parties. This is a big move as well to force social media giants to open offices in India and have key personnel working.
(b) Appoint a nodal contact person for 24x7 coordination with law enforcement agencies to ensure compliance to their orders. This effectively leads to setting up a team in India and related functions.
(c) Publish monthly compliance reports
(d) Mandatory for an intermediary to identify the first originator of the information/message. if a first originator of any information on the computer
resource of an intermediary is located outside the territory of India, the first originator of that information within the territory of India shall be deemed to be the first originator. This is going to be difficult to implement technically and intermediaries will have to manage this as an extra-attribute for every message and this will lead to massive amount of data downstream.
However, this is a key move targeted to identify fake news and will help in controlling the spread of misinformation. A provision for counter protection has also been outlined as - 'no significant social media intermediary shall be required to disclose the contents of any electronic message, any other information related to the first originator, or any information related to its other users'.
(e) The rules provide an excellent provision for intermediaries to mark the content as being advertised, marketed, sponsored, owned, or exclusively controlled by an intermediary. We can now predict a slew of messages that are marked such.
(f) Deploy technology-based measures, including automated tools or other mechanisms to proactively identify information for objectionable content. Excellent move by the government, intermediaries can no longer wash their hands-off stating the content is not developed by them.
(g) Intermediaries will need a physical contact address in India
(h) Tracking of complaints is mandatory
(i) Verification of users of accounts is voluntary, but once done - verification mark is to be shown
(j) Provides the users the right to hearing before any content is removed or access is disabled.
(k) Ministry of Information and Broadcasting shall administer the content for news and current affairs to be disseminated through the intermediary - this is a powerful rule.
.... amongst others.
5. The Part III 'Code of ethics and procedure and safeguards in relation to digital media' is able to the following: (i) publishers of news and current affairs content; (ii) publishers of online curated content. Such publishers should be based in India and be targeting users in India.
6. A three tier structure as below is outlined for ensuring observance and adherence to the Code of Ethics by publishers and the grievances shall be escalated in that order by any user:
(a) Level I - Self-regulation by the publishers; (b) Level II – Self-regulation by the self-regulating bodies of the publishers; (c) Level III - Oversight mechanism by the Central Government.
7. As a part of the Level I measures, a publisher has to setup a grievance redressal mechanism and appoint a Grievance Officer based in India, who will also act as nodal officer, and ensure that all grievances are resolved in 15 days. Classification of curated content into the categories of "U", "U/A 7+", "U/A 13+”, "U/A 16+", and "A" is now mandatory.
8. As a part of the Level II measures, there could be one or more self-regulatory
bodies of publishers, an independent body constituted by publishers or their
associations. The composition of this body shall comprise of a head from an eminent related field and a 6 member committee being experts from related fields. The body has to register with the Ministry of Information and Broadcasting and has to provide second level functions to administer the oversight for adherence to the Code of Ethics. It's key functions and responsibilities are very well outlined in the Rules.
9. As a part of the Level III measures, the Ministry of Information and Broadcasting shall regulate Level I and II, through: publishing charters, established inter-department/ministerial committees, issue orders, guidance etc. to ensure adherence to the Code of Ethics. Composition and responsibilities of the inter-department/ministerial committees are outlined and a provision to appoint "authorised officer" to oversee the functions has also been outlined.
10. There's a key provision in Level III measures to block information/content in an emergency situation and the "authorised officer" will have the full rights to do so, followed by a review of a committee. We can only hope this is used only in extreme cases and not to curtail freedom-of-speech.
11. Then there are schedules outlining disclosure of information, code of ethics, guidelines for usage of rules, etc.
Overall I believe these rules are one step in the right direction, the efficacy of these rules shall only be seen over a span of 3-5 years. Following which I believe theses should be reviewed periodically and updated frequently. Potentially, the Level III authorised officer, should update these rules from time-to-time to keep abreast with the ever evolving landscape of social media and cyber.
