The Union Ministry of Communications and Information Technology notified new rules under the Information Technology Act, 2000, to regulate the use of the Internet on 11th, April, 2011. This led to widespread apprehensions that the government and private persons might gain free access to sensitive personal information concerning Internet users. The government, however, clarified in a press release that the intent of the rules was to protect sensitive personal information and not to give the government undue powers to access such information. The government added that wide public consultations had been held before finalising the rules and that the rules had been endorsed by the stakeholders.
As the government is empowered to make rules in order to carry out the purposes of an Act, it is necessary to examine whether the rules have a nexus with such purposes. Among the four sets of rules notified on April 11, The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, caused serious concern in civil society.
Rule 3 in this set defines sensitive personal data or information as “such personal information which consists of information relating to password; financial information such as bank account or credit card or debit card or other payment instrument details; physical, physiological and mental health condition; sexual orientation; medical records and history; biometric information; any detail relating to the above clauses as provided to body corporate for providing service; and any of the information received under above clauses by body corporate for processing, stored or processed under lawful contract or otherwise”.
Rule 3 has an important proviso, which says that any information that is freely available or accessible in the public domain or furnished under the Right to Information Act, 2005, or any other law, shall not be regarded as sensitive personal data.
Rule 2(b) defines “biometrics” as technologies that measure and analyse human body characteristics, such as “fingerprints”, “eye retinas and irises”, “voice patterns”, “facial patterns”, “hand measurements”, and DNA for authentication purposes.
The controversial provision is Rule 6, which deals with disclosure of information. Rule 6(1) lays down that disclosure of sensitive personal data by a body corporate to any third party shall require prior permission from the provider of such information, unless such disclosure has been agreed to in the contract between the body corporate and the provider of information, or where the disclosure is necessary for compliance of a legal obligation.
Rule 6(1) carries a key proviso, which, its critics say, can be misused. It lays down that such information shall be shared, without obtaining prior consent from the provider of information, with government agencies mandated under the law to obtain information, including sensitive personal data for the purpose of verification of identity, or for prevention, detection, investigation, including cyber incidents, prosecution, and punishment of offences. The government agency, under this proviso, shall send a request in writing to the body corporate possessing the sensitive personal data or information, stating clearly the purpose of seeking such information. The government agency shall also state that the information so obtained shall not be published or shared with any other person. Many consider Rule 6(2) to be even more draconian. It says that notwithstanding anything contained in Rule 6(1), any sensitive personal data shall be disclosed to any third party by an order under the law. The safeguards in Rule 6(3) and 6(4) that the body corporate or the third party receiving such sensitive personal data shall not publish or disclose them further are considered weak.
Rule 7 elaborates on this. As the bar on the body corporate is only against publishing sensitive personal data, it may transfer such data to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these rules. The rule says that the transfer of such data may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and the provider of information or where such person has consented to data transfer. Critics ask whether these safeguards will be complied with absolutely, and if not, what the remedies available to a victim are.
Rule 3 (2) requires that such rules and regulations, terms and conditions or user agreement shall inform users not to host, display, upload, modify, publish, transmit, update or share any information that belongs to another person and to which the user does not have any right to, and is grossly harmful, blasphemous, defamatory, obscene, pornographic, invasive of another's privacy, hateful, or racially, ethnically objectionable, disparaging, relating or encouraging money laundering or gambling, or otherwise unlawful in any manner whatever.
Concerns have been expressed over another set of rules, too. The Information Technology (Intermediaries guidelines) Rules, 2011, impose certain duties on intermediaries such as Facebook, Google and Twitter to observe due diligence. Rule 3 in this set requires that the intermediary shall publish the rules and regulations, privacy policy and user agreement for access or usage of the intermediary's computer resource by any person.
Rule 3 (2) (i) requires the intermediary to ensure that the content posted by the user does not threaten the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign states, or public order or cause incitement to the commission of any cognisable offence or prevent investigation of any offence or is insulting to any other nation. Again, this rule is loosely phrased, and does not explain how the intermediary can conclude that a particular post “threatens to…”.
Rule 3(4) is even more mischievous. It requires that the intermediary, upon obtaining knowledge by itself or being brought to actual knowledge by an affected person in writing or through e-mail signed with electronic signature about any such information as mentioned in Rule 3(2), shall act within 36 hours and work with the user or owner of such information to disable it. Further, the intermediary has also to preserve such information for at least 90 days for investigation.
Rule 3(11) provides the remedy for an aggrieved user. It requires the intermediary to publish on its website the name of the grievance officer and his contact details as well as the mechanism by which users or any victim who suffers as a result of access or usage of computer resource by any person in violation of Rule 3 can notify their complaints. The grievance officer has been asked to redress such complaints within one month from the date of receipt of a complaint. Ironically, the rules do not provide content writers a means to defend their work or appeal a decision by the intermediary to remove content. The absence of natural justice in the rules will make it easy for critics to challenge them legally.
Powers to censor content
The loose language of this rule, critics fear, can be interpreted widely, and the intermediaries may enjoy extraordinary powers to censor content, resulting in unnecessary restrictions on freedom of expression.
No comments:
Post a Comment