WhatsApp moves Delhi HC against traceability clause in IT rules, calls it is unconstitutional

Introduction

Faced with a deadline to comply with the Indian government’s new rules for social media intermediaries, which needs them to make provisions for “identification of the first originator of the information”, Facebook-owned messaging platform WhatsApp has moved the Delhi High Court challenging this aspect of the new rules. The petition was filed on May 25, the final date of compliance alleging that the aforesaid clause is violative of a person’s right to privacy as enshrined in the Supreme Court judgment of KS Puttuswamy v. Union of India.

Whatsapp Arguments

The Whatsapp Spokesperson said that “Requiring messaging apps to ‘trace’ chats is the equivalent of asking us to keep a fingerprint of every single message sent on WhatsApp, which would break end-to-end encryption and fundamentally undermines people’s right to privacy,” 

He further added that “We have consistently joined civil society and experts around the world in opposing requirements that would violate the privacy of our users. In the meantime, we will also continue to engage with the Government of India on practical solutions aimed at keeping people safe, including responding to valid legal requests for the information available to us,”

WhatsApp argues that “traceability inverts the way law enforcement typically investigates crimes”. “In a typical law enforcement request, a government requests technology companies provide account information about a known individual’s account. With traceability, a government would provide a technology company a piece of content and ask who sent it first,”

The post titled, ‘What is traceability and why does WhatsApp oppose it?’ says: “In order to trace even one message, services would have to trace every message. That’s because there is no way to predict which message a government would want to investigate in the future. In doing so, a government that chooses to mandate traceability is effectively mandating a new form of mass surveillance.”

Government Response

The Indian government said that it respects the “Right of Privacy” and has no intention to violate it when WhatsApp is required to disclose the origin of a particular message.

The statement released by the Ministry of Electronics and IT (MEITY) comes hours after the social messaging app filed a lawsuit in Delhi High Court challenging the government’s new digital rules saying the requirement for the company to provide access to encrypted messages will break privacy protections.

The statement added that “Such requirements are only in case when a particular message is required for prevention, investigation or punishment of serious offences such as sexually explicit content,” furthermore they said that, “The Government of India recognises that ‘Right to Privacy” is a Fundamental right and is committed to ensure the same to its citizens, Such requirements are only in case when a particular message is required for prevention, investigation or punishment of serious offences such as sexually explicit content,” the statement added.

However, it also added that as per all established judicial dictum, “no Fundamental Right, including the Right to Privacy, is absolute and it is subject to reasonable restrictions. The requirements in the Intermediary Guidelines pertaining to the first originator of information are an example of such a reasonable restriction.”

On this issue, IT minister Ravi Shankar Prasad has said, “the Government of India is committed to ensuring the Right of Privacy to all its citizens but at the same time it is also the responsibility of the government to maintain law and order and ensure national security.” He also stated that “none of the measures proposed by India will impact the normal functioning of WhatsApp in any manner whatsoever and for the common users, there will be no impact.”

Conclusion

The new 2021 IT Rules will now at least mandate reasons for such takedowns to be debated, and provided the three-tier grievance redressal mechanism works, it will provide material for the High Courts and Supreme Court to examine them, in the event Government actions are challenged. Intermediaries now have enhanced due diligence and monitoring burdens, and are also expected to continuously educate users on what can and cannot be posted. This will assist in establishing a trend of self-regulation, especially in relation to social media intermediaries, thanks to tools provided by artificial intelligence.

The post WhatsApp moves Delhi HC against traceability clause in IT rules, calls it is unconstitutional appeared first on Bhatt & Joshi Associates.

Introduction

India’s digital transformation has brought unprecedented challenges in regulating online content and ensuring user safety while preserving fundamental freedoms. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 represent a watershed moment in India’s approach to governing digital platforms. These rules fundamentally reshape how social media intermediaries operate in India, establishing comprehensive frameworks for content moderation, user grievance redressal, and government oversight [1].

The rules came into effect on February 25, 2021, replacing the earlier Information Technology (Intermediary Guidelines) Rules, 2011. Framed under Section 87 of the Information Technology Act, 2000, these regulations emerged against the backdrop of growing concerns about misinformation, hate speech, and the misuse of social media platforms for activities that threaten national security and public order [1].

Constitutional and Legal Framework

Foundation Under the Information Technology Act, 2000

The Information Technology Act, 2000 serves as the parent legislation enabling these rules. Section 87 of the Act empowers the Central Government to make rules for carrying out the provisions of the Act. Specifically, sub-section (2) clause (zg) authorizes the government to prescribe due diligence requirements for intermediaries to claim exemption from liability under Section 79 [2].

The constitutional validity of these rule-making powers has been subject to scrutiny. Legal experts have argued that some provisions in the 2021 Rules may exceed the delegated legislative authority under the parent Act, particularly regarding the creation of new categories of intermediaries and the imposition of additional obligations not explicitly contemplated in the original legislation [3].

Intersection with Fundamental Rights

The rules operate within the complex matrix of fundamental rights guaranteed under the Constitution of India. The landmark judgment in Justice K.S. Puttaswamy v. Union of India (2017) established privacy as a fundamental right under Articles 14, 19, and 21 of the Constitution [4]. This decision has become central to challenges against certain provisions of the IT Rules, particularly the traceability requirements for messaging services.

In the Puttaswamy judgment, the Supreme Court held that “the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution.” The Court also established that any interference with privacy must meet the test of proportionality, requiring the state to demonstrate compelling public interest and adopt the least restrictive means [4].

Regulatory Structure and Due Diligence Requirements

General Obligations for All Intermediaries

The Information Technology Rules 2021 impose several baseline obligations on all intermediaries operating in India. These include the requirement to inform users about prohibited content categories, provide grievance redressal mechanisms, and comply with government requests for information or content takedown within specified timeframes [1].

Intermediaries must publish their rules and regulations, privacy policies, and user agreements prominently on their platforms. The rules specify that such information must be available in English or any language specified in the Eighth Schedule of the Constitution as per user preference. This represents a significant expansion from the 2011 Rules, which did not mandate multilingual accessibility [1].

The content restrictions have been expanded to include categories such as information that is “harmful to child,” “insulting on the basis of gender,” and content that “knowingly and intentionally communicates any information which is patently false or misleading in nature but may reasonably be perceived as a fact.” Critics argue that these categories are overly broad and could have a chilling effect on free speech [3].

Enhanced Requirements for Significant Social Media Intermediaries

The rules create a distinct category of “Significant Social Media Intermediaries” (SSMIs) – platforms with more than fifty lakh (five million) registered users in India. This threshold-based approach represents a novel regulatory strategy, recognizing that larger platforms pose greater risks and should bear proportionate responsibilities [1].

SSMIs must appoint three key personnel, all of whom must be residents of India: a Chief Compliance Officer responsible for ensuring compliance with the Act and Rules, a Nodal Contact Person for coordination with law enforcement agencies, and a Resident Grievance Officer for addressing user complaints. This requirement has significant implications for global technology companies, forcing them to establish meaningful operations within Indian jurisdiction [1].

The rules also mandate that SSMIs maintain a physical contact address in India, published on their websites or mobile applications. While the rules do not require mandatory incorporation of a separate legal entity in India, they effectively compel foreign intermediaries to establish substantial operational presence within the country.

Technology-Based Content Monitoring

One of the most controversial aspects of the SSMI obligations is the requirement to deploy technology-based measures for proactive content identification. SSMIs must endeavor to identify content depicting rape, child sexual abuse, or information identical to previously removed content using automated tools [1].

The rules acknowledge the tension between automated content moderation and fundamental rights by requiring that such measures be proportionate to the interests of free speech and privacy, include appropriate human oversight, and undergo periodic review. However, the practical implementation of these requirements has raised concerns about over-censorship and the accuracy of automated detection systems.

The Traceability Controversy

Legal Requirements and Constitutional Challenges

Perhaps the most contentious provision in the Information Technology Rules 2021 is Rule 4(2), which requires SSMIs that primarily provide messaging services to enable identification of the first originator of information on their platforms. This requirement applies only when ordered by a court or competent authority under Section 69 of the IT Act, and only for specified grounds including prevention, detection, and investigation of offences related to sovereignty, security, public order, and sexual violence [1].

WhatsApp LLC challenged this provision before the Delhi High Court in May 2021, arguing that the traceability requirement violates the fundamental right to privacy established in Puttaswamy v. Union of India. The company contended that enabling traceability would require breaking end-to-end encryption, fundamentally altering the nature of its service and compromising user privacy [5].

In its petition, WhatsApp argued that the rule is “manifestly arbitrary” under Article 14 of the Constitution, citing the Supreme Court’s decision in Shayara Bano v. Union of India, which held that laws are manifestly arbitrary when they are “obviously unreasonable, capricious, irrational, without adequate determining principle, or excessive and disproportionate” [5].

Privacy Implications and Technological Challenges

The traceability requirement raises fundamental questions about the balance between national security and individual privacy. Legal experts argue that enabling message traceability would require platforms to maintain permanent logs of message metadata, potentially violating the principle of data minimization recognized in privacy jurisprudence [3].

The technical implementation of traceability is equally complex. End-to-end encryption ensures that only the sender and recipient can read message content, with the service provider unable to access the information. Implementing traceability would require either breaking this encryption or maintaining additional metadata that could be used to identify message originators, both of which have significant privacy implications [5].

During hearings before the Delhi High Court, WhatsApp’s counsel argued that no other country in the world has implemented similar traceability requirements, emphasizing the unprecedented nature of India’s approach. The company has maintained that it would “exit India” rather than compromise the privacy and security of its global user base [6].

Regulation of Digital Media and OTT Platforms

Three-Tier Grievance Redressal Mechanism

The Information Technology Rules 2021 extend regulatory oversight to online publishers of news and current affairs content, as well as curated audio-visual content providers (commonly known as OTT platforms). This represents the first attempt by the Indian government to regulate digital media through a systematic framework [1].

The rules establish a three-tier grievance redressal mechanism for digital media. The first level involves self-regulation by publishers themselves, requiring them to establish internal complaints mechanisms and respond to grievances within fifteen days. Publishers must also adhere to the Programme Code under the Cable Television Networks Regulation Act, 1995, and the norms of journalistic conduct formulated by the Press Council of India [1].

The second tier consists of self-regulatory bodies formed by associations of publishers. These bodies must be headed by a retired judge of the Supreme Court, High Court, or an independent eminent person, with no more than six members. They address grievances that remain unresolved at the publisher level and must register with the Ministry of Information and Broadcasting [1].

The third tier involves oversight by the Ministry of Information and Broadcasting, which can constitute inter-departmental committees to review complaints and take appropriate action. This mechanism has raised concerns about government control over media content and potential threats to press freedom.

Content Classification and Age Verification

For OTT platforms, the rules mandate content classification based on age appropriateness, with categories including content suitable for those above 13 years, 16 years, and adults. Platforms must implement parental controls and age verification mechanisms to restrict access to age-inappropriate content [1].

This self-classification system differs significantly from the pre-censorship model applied to theatrical releases through the Central Board of Film Certification. The rules explicitly state that the government does not intend to impose censorship on OTT content, instead relying on industry self-regulation within a defined framework.

Implementation Challenges and Industry Response

Compliance Timeline and Initial Reactions

The original compliance deadline of May 25, 2021, proved challenging for major technology companies. While platforms like Twitter, Facebook, and Google began implementing various aspects of the rules, full compliance remained elusive for several months [1].

Indian microblogging platform Koo was among the first to announce full compliance, highlighting its advantage as a domestic platform designed with Indian regulatory requirements in mind. International platforms faced greater challenges in adapting their global systems to meet India-specific requirements [1].

The appointment of India-resident personnel proved particularly challenging for companies that previously operated through global teams. The requirement for physical addresses in India also necessitated establishing or expanding Indian operations, with associated costs and administrative complexities.

Legal Challenges and Ongoing Litigation

Beyond WhatsApp’s challenge to the traceability provisions, various other aspects of the IT Rules have faced legal scrutiny. The Foundation for Independent Journalism and The News Minute filed petitions challenging the rules’ application to digital news media, arguing that such regulation exceeds the scope of the Information Technology Act [3].

The Delhi High Court has consolidated various challenges to the IT Rules, with proceedings ongoing. The Supreme Court has also transferred related petitions from different High Courts to ensure unified adjudication of the constitutional questions involved [6].

Constitutional Analysis and Legal Precedents

Separation of Powers and Delegated Legislation

The IT Rules 2021 raise important questions about the limits of delegated legislation and the separation of powers doctrine. Critics argue that several provisions go beyond the rule-making authority granted under Section 87 of the IT Act, particularly the regulation of digital news media and the creation of new categories of intermediaries with distinct obligations [3].

The Supreme Court has consistently held that subordinate legislation cannot alter the scope or principles of the enabling statute. In Agricultural Market Committee v. Shalimar Chemical Works Ltd. and other precedents, the Court emphasized that rules must remain within the four corners of the parent Act [3].

Balancing National Security and Individual Rights

The rules attempt to balance competing interests: national security, public order, and individual safety on one hand, and freedom of expression, privacy, and innovation on the other. This balance reflects the broader challenge facing democratic societies in the digital age.

The proportionality test established in Puttaswamy v. Union of India requires that any restriction on fundamental rights must be necessary for achieving a legitimate aim, suitable for achieving that aim, and not impose an excessive burden relative to the benefit gained [4]. Critics argue that several provisions in the IT Rules fail this proportionality test.

Impact on Digital Innovation and Investment

Market Dynamics and Competitive Effects

The IT Rules have significant implications for the Indian digital market, which represents one of the world’s largest internet user bases. Compliance costs and operational complexity may favor larger platforms with greater resources, potentially creating barriers to entry for smaller competitors.

The requirement for local personnel and infrastructure could benefit the Indian IT services sector while imposing additional costs on international platforms. This aligns with broader government policies promoting domestic manufacturing and services under initiatives like “Make in India.”

Data Localization and Sovereignty

While the IT Rules do not explicitly mandate data localization, the practical requirements for local personnel, grievance officers, and physical addresses create pressure for increased local data processing and storage. This reflects broader global trends toward digital sovereignty and local control over data flows.

Future Outlook and Recommendations

Emerging Technologies and Regulatory Adaptation

As artificial intelligence, blockchain, and other emerging technologies reshape the digital landscape, the regulatory framework established by the IT Rules 2021 will need continuous adaptation. The rules already recognize this challenge by empowering the government to notify additional requirements and adjust thresholds as technology evolves [1].

The integration of AI-based content moderation systems with human oversight requirements presents ongoing challenges. Platforms must balance automated efficiency with the nuanced judgment required for contextual content decisions, particularly in a linguistically and culturally diverse market like India.

Recommendations for Balanced Governance

Effective digital governance requires ongoing dialogue between government, industry, civil society, and users. The IT Rules represent an important step in establishing regulatory frameworks for the digital age, but their implementation must remain sensitive to fundamental rights and innovation imperatives.

Regular review mechanisms, transparency in enforcement actions, and clear appeals processes can help ensure that the rules achieve their stated objectives without unnecessarily restricting legitimate expression or hampering technological innovation.

Conclusion

The Information Technology Rules 2021 mark a significant evolution in India’s approach to digital governance. While they address legitimate concerns about content moderation, user safety, and platform accountability, their implementation raises important questions about the balance between regulation and rights.

The ongoing legal challenges, particularly regarding traceability requirements and digital media regulation, will likely shape the final contours of India’s digital regulatory framework. As courts examine these provisions against constitutional benchmarks established in landmark cases like Puttaswamy v. Union of India, the rules may undergo significant modifications.

The global significance of India’s approach cannot be understated. As one of the world’s largest digital markets, India’s regulatory choices influence global technology governance and may serve as a model for other jurisdictions grappling with similar challenges.

Success in implementing these rules will ultimately depend on maintaining the delicate balance between protecting legitimate government interests and preserving the fundamental freedoms that underpin democratic society. The ongoing legal and policy discourse surrounding these rules will be crucial in achieving this balance and ensuring that India’s digital future remains both secure and free.

References

[1] The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 

[2] Ministry of Electronics and Information Technology. “Information Technology Act, 2000.  

[3] Sharma, Moksha and Pendyal, Keerti. “Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 – Protection from Malicious Content or Chilling Free Speech.” SSRN, November 2021. Available at: https://ssrn.com/abstract=3967857 

[4] Supreme Court of India. “Justice K.S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors.” (2017) 10 SCC 1. Available at: https://indiankanoon.org/doc/91938676/ 

[5] LiveLaw. “Delhi High Court Issues Notice To Centre On WhatsApp’s Plea Challenging Traceability Clause Under IT Rules 2021.” August 27, 2021. Available at: https://www.livelaw.in/top-stories/delhi-high-court-notice-centre-whatsapps-plea-challenging-traceability-clause-under-it-rules-2021-180387 

[6] India TV News. “WhatsApp tells Delhi High Court it will ‘exit India’ if forced to break encryption.” April 26, 2024. Available at: https://www.indiatvnews.com/amp/technology/news/whatsapp-tells-delhi-high-court-it-will-exit-india-if-forced-to-break-encryption-latest-updates-2024-04-26-928068 

Editor: Adv. Chandni Joshi

Download Booklet on Social Media Laws in India – Compliance & Cybercrime Prevention

The post Information Technology Rules 2021 and Their Impact on Social Media Platforms: Regulating Digital India appeared first on Bhatt & Joshi Associates.