Changes to the Intermediary Guidelines

The Intermediary guidelines and Digital media  ethics  rules of 25th  February 2021  had attracted a  lot of criticism from the industry and has even been questioned in a Court.

A case is also going on in Karnataka High Court where Twitter is trying to fight some of these intermediary guidelines  (refer here)

Now the Government has come up with an amendment of the rules of 25/02/2021 through an amendment notification dated 28th October 2022.

The essential part of the  amendment is captured  below.

  1.  Constitution of the Grievance Appellate  Committee

The new  notification states as under:

In the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (hereafter referred to as the said rules), in rule 2, in sub-rule (1), after clause (k), the following clause shall be inserted, namely:—

(ka) Grievance Appellate Committee‟ means a grievance appellate committee constituted under rule 3A;.

4. After rule 3 of the said rules, the following rule shall be inserted, namely:—

3A. Appeal to Grievance Appellate Committee(s).—(1) The Central Government shall, by notification, establish one or more Grievance Appellate Committees within three months from the date  of commencement of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2022.
(2) Each Grievance Appellate Committee shall consist of a chairperson and two whole time members appointed by the Central Government, of which one shall be a member ex-officio and two shall be independent members.
(3) Any person aggrieved by a decision of the Grievance Officer may prefer an appeal to the Grievance Appellate Committee within a period of thirty days from the date of receipt of communication from the Grievance Officer.
(4) The Grievance Appellate Committee shall deal with such appeal expeditiously and shall make an endeavour to resolve the appeal finally within thirty calendar days from the date of receipt of the appeal.
(5) While dealing with the appeal if the Grievance Appellate Committee feels necessary, it may seek assistance from any person having requisite qualification, experience and expertise in the subject matter.
(6) The Grievance Appellate Committee shall adopt an online dispute resolution mechanism wherein the entire appeal process, from filing of appeal to the decision thereof, shall be conducted through digital mode.
(7) Every order passed by the Grievance Appellate Committee shall be complied with by the intermediary concerned and a report to that effect shall be uploaded on its website.

Presently any grievance arising out of ITA 2000 goes to the Adjudicating officer  appointed under Section 46 of ITA 2000 and the appellate Tribunal appointed  under Section 48.

Now a new “Grievance Appellate Committee” will be established for addressing the disputes arising out of the rules under the 25/02/2021 notification. The powers of  this committee  is  restricted  to  this limited extent.

The committee will consist of a  Chairperson and one member both  of whom  will be non Government persons. One would be an official. Probably the Chairperson could be judicial person like the Press Council so that the decisions of the Committee will have sufficient weight.

The  committee is expected to  resolve the appeal within 30 days from the  receipt of the communication from the Grievance Officer who is expected to complete his resolution process within 15 days of  receiving the complaint from the member of the public.

The Grievance Committee may if required take assistance of suitable experts.

Another  point to be noted is that the rule states that the “Grievance Appellate Committee” shall adopt  ODR where in the entire appeal process shall be  conducted online.

Naavi.org has been advocating ODR since around 2005 when the website www.arbitration.in was put up as a platform which could be used. This was later called ODR  Global (www.odrglobal.in). Some proposals were also  discussed  with the Technical committee of the Supreme Court. All these efforts were in the era when online court proceedings were unacceptable to the judiciary and hence did not progress. Now FDPPI has a “Data Disputes Mediation and  Arbitration Center” (DDMAP) ready to provide a platform for such online dispute  resolution.

It is good to note that ODR would be  a mandatory process for this  Grievance Committee,

We may note that the rules donot mention any further remedy beyond the appeal committee. However this will be tested in a Court at some point of time later.

As regards the procedures to be followed

Further, some changes have also been made to  the functioning of the platform as per the following revised provisions.

3. In rule 3 of the said rules,—
(a) in sub-rule (1),—

(i) for clauses (a) and (b), the following clauses shall be substituted, namely:—

“(a) the intermediary shall prominently publish on its website, mobile based application or both, as the case may be, the rules and regulations, privacy policy and user agreement in English or any language specified in the Eighth Schedule to the Constitution for access or usage of its computer resource by any person in the language of his choice and ensure compliance of the same;
(b) the intermediary shall inform its rules and regulations, privacy policy and user
agreement to the user in English or any language specified in the Eighth Schedule
to the Constitution in the language of his choice and shall make reasonable efforts
to cause the user of its computer resource not to host, display, upload, modify,
publish, transmit, store, update or share any information that,—
(i) belongs to another person and to which the user does not have any right;
(ii) is obscene, pornographic, paedophilic, invasive of another‟s privacy including bodily privacy, insulting or harassing on the basis of gender, racially or ethnically objectionable, relating or encouraging moneylaundering or gambling, or promoting enmity between different groups on the grounds of religion or caste with the intent to incite violence;
(iii) is harmful to child;
(iv) infringes any patent, trademark, copyright or other proprietary rights;
(v) deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates any misinformation or information which is patently false and untrue or misleading in nature;
(vi) impersonates another person;
(vii) threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, or public order, or causes incitementto the commission of any cognisable offence, or prevents investigation of any offence, or is insulting other nation;
(viii) contains software virus or any other computer code, file or program designed to interrupt, destroy or limit the functionality of any computer resource;
(ix) violates any law for the time being in force;”;

(ii) for clause (f), the following clause shall be substituted, namely:—

“(f) the intermediary shall periodically, and at least once in a year, inform its users in English or any language specified in the Eighth Schedule to the Constitution in the language of his choice of its rules and regulations, privacy policy or user agreement or any change in the rules and regulations, privacy policy or user agreement, as the case may be;”;

(iii) after clause (l), the following clauses shall be inserted, namely,—

“(m) the intermediary shall take all reasonable measures to ensure accessibility of its services to users along with reasonable expectation of due diligence, privacy and transparency;(n) the intermediary shall respect all the rights accorded to the citizens under the Constitution, including in the articles 14, 19 and 21.”;

(b) in sub-rule (2), in clause (a), for sub-clause (i), the following sub-clause shall be substituted, namely:—

“(i) acknowledge the complaint within twenty-four hours and resolve such complaint within a period of fifteen days from the date of its receipt:
Provided that the complaint in the nature of request for removal of information or communication link relating to clause (b) of sub-rule (1) of rule 3, except sub-clauses (i), (iv) and (ix), shall be acted upon as expeditiously as possible and shall be resolved within seventy-two hours of such reporting;
Provided further that appropriate safeguards may be developed by the intermediary to avoid any misuse by users;”.

As regards “publishing of the privacy policy” and “User agreement”, they should be in English or any language specified in the Eight schedule of the  constitution. It is better to read this as “English and any…” otherwise there will be problems in obtaining the consent. Further  the  intermediary shall make “Reasonable efforts” to cause  the  user  not do what  is prohibited. Under  this “Reasonable” requirement perhaps  we need interpret that the policies should be in English  and one of the other languages.

The rule also suggests reasonable efforts to be taken to ensure “Accessibility” to the impaired individuals.

As regards the time line for addressing the grievances the following has been specified.

a) Complaint shall be acknowledged within 24 hours

b)Complaint shall be resolved within 15 days

c) Complaints regarding removal of content shall be resolved within 72 hours

These rules will come into effect in 3 months if there is no judicial intervention.

We need to wait and see how the industry responds.

Naavi

Posted in Cyber Law | Leave a comment

FDPPI to adopt “LedgerMail” a unique Secure E Mail System

 

 

FDPPI signed an MOU today with LedgerFi IT solutions for a LedgerMail corporate Secure E Mail solution.

LedgerFi is a UAE based company with a development center in Bangalore which has developed a unique blockchain based e-mail solution which does not use the insecure SMTP protocol.

The system provides end to end encryption with a PKI based digital signature system with the private key being in the control of the user.

The solution comes with two versions. In one version (B2C version) the e-mail server works on distributed systems which consists of a public blockchain and public decentralised storage.

In the other version (B2B version) the server is maintained by the corporate entity (on premise or private cloud). The system comes with an admin level control for decryption in case of law enforcement requirements. Hence the solution meets the requirements of security envisaged under the Indian law enforcement requirements and the CERT In regulations.

The solution can be used by a company or a Government department for internal e-mails where the users are on-boarded to the system as members of a closed community.

In the event e-mails are to be sent and received to or from persons outside the closed system, an invitation to be onboarded can be sent and the outsider can be brought into the system.

The system can be configured to use the current e-mail ID of a user such as xyz@gmail.com and hence the user who is onboarded onto the system does not have to make any change of identity with his contacts. All the contacts who are in the LedgerMail system can use the ID xyz@gmail.com to send and receive the e-mails through the system from or to other persons within the system.

The system is likely to be a big boon to Banks to prevent phishing if they onboard all their customers as a part of their account opening process. Similarly the Government of India which has been trying to move people out of Gmail can also use this system with an inhouse server which is secure and free from SMTP protocol deficiencies.

FDPPI expects this system to catch on with Privacy Conscious but Cyber Law Compliant users. FDPPI is proud to be the first Indian Corporate to adopt the system.

 

Naavi
Posted in Cyber Law | Leave a comment

Pensioners… Beware of Jeevanpramaan clones

The Government of India has introduced a scheme for simplifying the issue of life certificates for pensioners through an online service through the website www.jeevanpramaan.gov.in.

However there are  many clones of “Jeevan Praman”  that have  come online and pensioners have to be wary of them. They may either be an unfair exploitation of pensioners or a major scam.

Look at the following two web pages.

The one on the left side is the Government website and the second on the right side belongs to some Noida organization which uses the domain name jeevanpraman.online and the same pictures used by the Government website. It offers similar service but at a price.

This service involves providing aadhaar number and uses face recognition so that vital biometrics have to be provided for using the services offered. Most customers would do so thinking that this is a Government website.

This underscores the responsibility of organizations to guard against  a “Confusingly similar Website”  operating  in violation of trademark rights and causing a potential fraud risk to the community.

Not taking remedial action to bring down such  sites could be an abetment of any crime that may be committed by the alternate website using the similar domain name.

We recall the case of www.cgtmse-govt.in which was a fraudulent website which impersonated www.cgtmse.in which belonged to the Government. This fraud was brought to the notice of the public in 2013 but no action was taken by the authorities till in 2016 an adjudicator of Chattisgarh gave an award of compensation in a fraud case.

While it is open for any private sector company to offer a service to enable a citizen to make use of the Government service and also charge a reasonable fee, there should be clear indications that the company is not to be confused with the Government department.

A mere disclaimer at the bottom of the page that stating “Please be informed that this site serves content solely for knowledge purposes and is not affiliated with any pension agency or state institution. Your interaction with this site is subject to our terms of services, privacy, refunds and grievance policy. “For any questions, please email us at info@jeevanpraman.online.” in small print is not sufficient.

It should carry a bold visible mark “This is not a Government Website” or something similar.

Naavi introduced the service under “lookalikes.in” precisely for this purpose where a third party certified disclaimer can be visibly posted on the website.

This system will be effective if both websites post that he information that they are not related to the other.  At present the other  companies who are using the “Naavi” in their domain names have not yet posted the disclaimers on their websites.

I hope that such disclaimers are an obligation to the society and is a measure to ensure that regulatory authorities donot confuse one for the other.

It is time that such disclaimers are made part of the “Due Diligence” under Section 79 of ITA 2000.

Naavi

 

 

 

Also refer:

Domain Name Regulation in ITA 2000..to be amended

 

Posted in Cyber Law | Leave a comment

Emotional Analysis Techniques pose a Profiling Risk

Emotional Analysis Techniques are a new age techniques used in Data Analytics  to process data such as gaze tracking, sentiment analysis, facial movements, gait analysis, heartbeats, facial expressions and skin moisture. Emotion analysis can also be applied to the use of textual data.

Other examples include monitoring the physical health of workers by offering wearable screening tools or using visual and behavioural methods including body position, speech, eyes and head movements to register students for exams.

Emotions are also gathered and analysed using EEG signals and sub conscious data which falls in the Neuro Rights domain.

These techniques are also related to Sentiment analysis or Opinion Mining which is a Machine learning and NLP technique used by some survey agents to assess the feedback on goods and services. The data gathered in this process is used for marketing.

These techniques have now attracted attention of ICO-UK, which has warned that “Immature biometric technologies could be discriminating against people”

The UK Commissioner has stated that a “Biometric guidance” may be released by the ICO-UK in the next year. For the time being the ICO-UK (Stephen Bonner) has said that  they  are concerned that incorrect analysis of data could result in assumptions and judgements about a person that are inaccurate and lead to discrimination.

It is recognized that the inability of algorithms which are not sufficiently developed to detect emotional cues, means there’s a risk of systemic bias, inaccuracy and even discrimination.

ICO has noted that the technique may be used along with many face recognition technologies used by Financial Companies who analyse photo IDs and Selfies, airports where passengers are scanned by facial recognition and use of voice recognition for access.

In view of the above all organizations who are using biometrics may come under a special watch to understand if they are using emotional analysis and if so responsibly.

Naavi

 

Posted in Cyber Law | Leave a comment

Life Imprisonment under ITA 2000/8

In a first occurrence of its kind, a person was convicted by the Mumbai sessions court for life under Section 66F of ITA 2000/8.

The accused, one Anees Ansari had been arrested in October 2014 and was planning to attack an American school in Bandra with a thermite bomb.

Refer here

Naavi

 

 

 

Posted in Cyber Law | Leave a comment

Amendment to Schedule I of ITA 2000 -Conflicts with NI Act and New Fraud Risks

At a time there are discussions about ITA 2000 being revamped and replaced with a new version of a Digital India Act, a major amendment has been made to the ITA 2000 through a Gazette Notification

Though this appears to be a small notification, it significantly expands the applicability of the ITA 2000.

Presently Schedule I of ITA 2000 lists the following 5 types of documents to which the act does not apply:

  1. A Negotiable Instrument (Other than a cheque) as defined in Section 13 of the Negotiable Instruments Act 1881 (26 of 1881
  2.   A Power of Attorney as defined in section 1A of the Power of Attorney Act 1882 (7 of 1882)
  3. A trust as defined in section 3 of the Indian Trusts Act, 1882 (2 of 1882)
  4.  A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925 (39 of 1925) including any testamentary deposition whatever name called
  5. Any contract for the sale or conveyance of immovable property or any interest in such property

The Modified Schedule I states as follows:

  1. A negotiable instrument (other than a cheque, a Demand Promissory Note or a Bill of Exchange issued in favour of or endorsed by an entity regulated by the Reserve Bank of India, National Housing Bank, Securities and Exchange Board of India, Insurance Regulatory and Development Authority of India and Pension Fund Regulatory and Development Authority) as defined in section 13 of the Negotiable Instrument Act, 1881 (26 of 1881).”
  2. A Power of Attorney as defined in section 1A of the Power of Attorney Act 1882 (7 of 1882), “but excluding those power of attorney that empower an entity regulated by the Reserve Bank of India, National Housing Bank, Securities and Exchange Board of India, Insurance Regulatory and Development Authority of India and Pension Fund Regulatory and Development Authority to act for, on behalf of, and in the name of the person executing them.”
  3. A trust as defined in section 3 of the Indian Trusts Act, 1882 (2 of 1882)
  4.  A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925 (39 of 1925) including any testamentary deposition whatever name called
  5. (Omitted)

Implications

The type of documents mentioned in this schedule are excluded from the applicability of the Act. Since the Act includes section 4 on  “Recognition ” of documents as equivalent to paper documents, those documents omitted from the Act through this schedule have no legal recognition in electronic form.

The documents which are “Excluded” from Schedule I are within the provisions of the Act and will carry legal recognition.

Hence when Schedule I stated “Negotiable Instrument” as an excluded item in the original ITA 2000, it meant that Cheque, Bill of Exchange and Promissory Note in electronic form were not recognised in law. In February 2003, Negotiable Instruments Act 1881 was amended to introduce Truncated Cheques and Cheques in Electronic form. Simultaneously the Schedule I of ITA 2000 had been amended to include the words (Other than the cheque) in item 1. Hence Cheques in electronic form and Truncated cheques (scanned form of written cheques) were considered legally equivalent to  the corresponding physical instruments.

With this amendment, a class of one class of Demand Promissory Notes and Bill of Exchange namely those

Issued in favour  of ” or  “Endorsed by”

an entity regulated by” RBI, NHB, SEBI, IRDAI, Pension Fund Regulatory and Development Authority (PFRDA)

have been brought into the category of legally valid electronic documents.

However, Demand Promissory Notes and Bills of Exchange issued or endorsed by other entities still remain outside the Act. Similarly a Promissory Note which is not a “Demand Promissory Note” (Payable after a date of maturity) could be considered as not a “Demand Promissory Note under this schedule” (Subject to interpretation).

If an instrument (Bill of Exchange or Promissory Note has been issued by an entity other than the privileged entities mentioned in the schedule, if “Endorsed” by a privileged entity (RBI, SEBI, NHB, IRDAI, PFRDA etc) becomes legally recognized.

This part of the impact of this amendment (A Midas touch !) appears to be legally debatable and provides an authority to these agencies to give a “recognition as a negotiable instrument” to an instrument which was earlier not a negotiable instrument (A document which by wording was a promissory note or bill of exchange but expressed as an electronic document).

This notification requires an amendment of NI Act to introduce a new category of instruments as Negotiable Instruments under Section 13 of NI Act.

We must remember that the Negotiable Instruments Act does not end with the definition of Promissory Note, Bill of Exchange and Cheque under Sections 4, 5 and 6 read with Section 13.

A Negotiable Instrument is characterised by the property of being able to create a “Holder in Due Course” which incorporates the principles of “Indorsement” and “Delivery”. It involves “Possession” of the instrument,  and transfer of possession with an intention to make the transferee, owner there of. The definition of an “Indorsement” under Section 15 of NI act itself is dependent on “Signing on the back of the cheque or on a piece attached thereto (allonge)”.

Concept of “Endorsement” of an Electronic Promissory Note or Bill of Exchange (as per the schedule I) is therefore  inconsistent with NI Act.

Further Bills of Exchange  are documents which are compulsorily required to be stamped and an instrument in electronic form but considered as Bill of Exchange needs further changes in other laws.

A Bill of exchange is also associated with concepts of  “Presentment” and “Acceptance” to determine the due date and “Presentment” involves “Delivery” and hence in an electronic  form, there are several other issues which need to be taken together to interpret an electronic negotiable instrument and how it can be used.

“Holder’s Right to a duplicate Bill” also may create a conflict when electronic copies may be available of the Bill.

The Government appears to have not considered the impact of this notification on Negotiable Instruments Act and whether a new class of negotiable instruments can be created through a notification under ITA 2000 instead of an amendment to NI Act.

In other words, it can be argued that this notification is ultra vires the NI Act

Again, the amendment to the notification regarding Power of Attorney creates a category of Powers of Attorney that empower the privileged entities namely the RBI, NHB, SEBI ,IRDAI and PFRDA.

This could have been better addressed through an amendment of the Power of Attorney Act.

It is also surprising that TRAI (which may be replaced by a new Telecom Regulator) is missing from the list of privileged institutions.

The removal of serial item number 5 opens up the use of electronic documents in transactions involving immovable properties and transfer of interest there-in. This introduces a serious element of Fraud risks in registration of property documents since many of the practices used by the Registration department donot meet the security and legal requirements of authentication and evidentiary recording of the transactions.

In summary it appears that the Notification has not taken into consideration the legal validity of the notification and the new risks that will introduce on the community.

Criminals will now focus on how to get properties transferred in the Registrar’s office without a genuine authentication from the erstwhile owners and there will be a chaos in the real estate market bigger than the Telgi Scam.

I wish the Government re-thinks on this notification to avoid the complications.

Naavi

Posted in Cyber Law | Leave a comment