Tighter rules likely for social media firms, may supersede IT laws: Experts

Players stand to lose safe harbour provisions that protect them from third party content; platforms that do not act as intermediaries may be treated as publishers, held accountable for hosted content

The Personal Data Protection Bill, which according to news reports is likely to suggest that social media intermediaries be considered platforms, and those not identified as intermediaries be considered publishers, it could override the existing Information Technology Act and Rules, according to experts.

According to news reports, the Joint Parliamentary Committee deliberating the PDP Bill has suggested classifying social media intermediaries (governed by IT Rules and IT Act) as platforms, which could potentially make them lose safe harbour provisions that protect them from third party content. Further, the JPC is also reported to have considered that all social media platforms which do not act as intermediaries be treated as publishers and be held accountable for the content they host.

The committee was also reported to have favoured granting exceptions to smaller firms about the principle of privacy by design envisaged in the legislation.

The PDP Bill has been in the making since 2018, and some members of the JPC filed dissent notes earlier this week to the committee chairman, mostly because of the wide exemptions given to the government in the final draft of the legislation.

Experts say that the finer details would become clear only when the proposed personal data legislation is tabled in the Parliament.

"It may be noted that Clause 96 of the Personal Data Protection Bill, 2019 provided for the overriding effect of the provisions of the Bill with reference to other laws in India. Clause 97 also provides that the Central Government may notify through the Gazette any orders to remove any difficulty or inconsistency that might arise in terms of the implementation of the provisions of the Act. Besides, Clause 98 also provides for the amendment of the Information Technology Act in accordance with the manner specified in the Schedule to the Act. If these provisions are maintained in the final draft of the Bill, then the PDP Act could supersede the provisions of the IT Act and IT Rules, 2021 or clarifications to this effect will need to be issued vide orders from the Central Government," said Salman Waris, Partner, TechLegis Advocates & Solicitors.

On the issue of whether non-intermediary platforms will be held liable for third party content, Gayatri Roy, Partner, Saraf & Partners said it was necessary to see the language of the final PDP Bill.lose safe harbour provisions that protect them from third party content. Further, the JPC is also reported to have considered that all social media platforms which do not act as intermediaries be treated as publishers and be held accountable for the content they host.

"However, if the recommendation to impose on social media intermediaries (to be called social media platforms for purposes of PDPB) obligations with respect to content similar to those that are currently imposed on Publishers under the IT Rules 2021 is implemented then quite possibly yes, they would be liable for user generated content. It will then have to be seen to what extent the safe harbour provisions under Section 79 of the IT Act which is currently available to social media intermediaries (to be called social media platforms for purposes of PDPB according to the JPC) would be available to social media platforms/intermediaries with respect to user generated content given that various provisions of the IT Act and other laws impose direct liability on publishers for objectionable content," she said.

The government in February announced new IT Rules, called Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, to curb the misuse of social media platforms and digital publishers.

Until the PDP Bill is tabled in Parliament, most experts believe these conversations are in the realm of speculation.

"Fundamentally, an intermediary is a conduit for information between two parties, whereas a publisher is liable for the content it publishes, and is accountable for such information that it disseminates using its platform. I would not place any reliance on a report but rather wait for any definition proposed under upcoming laws or drafts thereof to comment on revisions to the definitions," said Akash Karmakar, Partner, Panag & Babu.

Intermediaries under the IT Act are provided some immunity under a safe harbour provision, which gives them some protection from content hosted by third parties on their platforms.

"If we take away the intermediary status from social media platforms, it would lead to a major disruption of the entire platform regulation jurisprudence as that may subject these entities to unwarranted liability for user generated content. The IT Act accords ‘safe harbour’ protection to intermediaries wherein they are provided immunity from such liability in absence of ‘actual knowledge’ regarding its illegality. This protection is considered to be the fundamental touchstone of online free speech. If this protection is taken away then social media entities in order to protect themselves from liability would censor online content and restrict the civil liberties of the citizenry," said Kazim Rizvi, Founding Director of think tank The Dialogue.

Under the IT Act, an intermediary refers to all digital media entities which store or transmit information on behalf of users. Accordingly, all social media platforms are intermediaries in so far as they host or transmit user generated content, he said.

"The IT Act and PDP Bill being legislations made by the Parliament supersede the IT Rules which are a piece of delegated legislation. However, the IT Act and PDP need to be harmoniously interpreted in line with overarching Constitutional principles to ensure a robust regulatory framework for digital platforms," Rizvi added.

What is clear is that there is likely to be a proposal for greater scrutiny of social media platforms. "Platforms like Twitter, Facebook, etc., are already liable for the content published by them under Regulation 3 of the Digital Media Ethics Code, 2021. With the PDP Act coming into effect, it is likely that platforms like Facebook and Twitter are subject to stricter compliance under the PDP Act in addition to that under the Digital Media Ethics Code, 2021," said Anu Monga, Partner, AnantLaw.

The JPC has also suggested an independent body like the Press Council of India for social media platforms, news reports suggested. It has also recommended that the Centre take concrete steps to ensure a mirror copy of Indians’ sensitive and personal critical data be brought to India.

Other suggestions include considering an alternative to the SWIFT mechanism of transferring funds between countries, certifying integrity of hardware equipment and has kept the previous suggestion of asking social media platforms to verify their users.