The proliferation of artificial intelligence-generated synthetic media has created unprecedented challenges for digital governance worldwide. In India, the Ministry of Electronics and Information Technology notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (IT Amendment Rules 2026) on February 10, 2026, which came into force on February 20, 2026 [1]. These amendments introduce stringent timelines for content takedown, particularly a two-hour window for removing non-consensual intimate images and deepfake pornography, raising critical questions about constitutional validity and practical feasibility. This article examines whether the IT Amendment Rules 2026 strike a proportionate balance between protecting fundamental rights and ensuring operational viability for digital intermediaries.

The Regulatory Framework: Understanding the IT Amendment Rules 2026

The Information Technology Act, 2000 serves as the foundational legislation governing cyberspace in India, with the IT Rules 2021 providing detailed guidelines for intermediary liability. The IT Amendment Rules 2026 specifically target synthetically generated information, defined under the newly inserted Rule 2(1)(wa) as “audio, visual or audio-visual information which is artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that such information appears to be real” [1].

Under the amended framework, intermediaries must now remove content within drastically compressed timelines. Rule 3(1)(d) mandates removal of unlawful content within three hours of receiving a government or court order, reduced from the previous thirty-six hour window [2]. More significantly, Rule 3(2)(b) requires intermediaries to act within two hours for cases involving exposure of private areas, nudity, sexual acts, or artificially morphed images that were previously subject to a twenty-four hour deadline [3].

The amendments also impose mandatory labelling requirements under Rule 4(1A), requiring significant social media intermediaries to ensure users declare whether uploaded content is synthetically generated, and to embed permanent metadata or unique digital identifiers in such content [2]. These provisions are designed to address the exponential rise in deepfake-related crimes, with Indians losing approximately twenty-two thousand eight hundred forty-five crore rupees to cybercriminals in 2024, marking a two hundred six percent increase from the previous year [1].

Constitutional Foundations: Article 19 and the Freedom of Speech Framework

The constitutional validity of content takedown regulations must be examined through the lens of Article 19(1)(a) of the Constitution of India, which guarantees all citizens the right to freedom of speech and expression. This right extends to digital platforms and online speech, as established in numerous Supreme Court pronouncements. However, Article 19(2) permits the state to impose reasonable restrictions on this freedom in the interests of sovereignty and integrity of India, security of the state, friendly relations with foreign states, public order, decency or morality, contempt of court, defamation, or incitement to an offense.

The landmark judgment in Shreya Singhal v. Union of India [4] fundamentally reshaped intermediary liability law in India. The Supreme Court struck down Section 66A of the Information Technology Act, 2000 for being unconstitutionally vague and having a chilling effect on free speech. More importantly for the present discussion, the Court read down Section 79 of the IT Act and Rule 3(4) of the Intermediaries Guidelines to mean that intermediaries obtain actual knowledge requiring content takedown only through a court order or notification from a government authority, not through private complaints.

Justice Nariman observed in Shreya Singhal that “adjudicating on whether or not there is contravention of a particular provision of law, is the quintessential sovereign function to be discharged by the State or its organs. This function cannot be delegated to private parties such as intermediaries” [4]. This principle remains foundational to understanding the scope and limits of intermediary obligations under Indian law.

The tension between free expression and content moderation has been further explored in recent jurisprudence. The Constitution bench in recent observations emphasized that restrictions on speech must be precisely tailored, proportionate, and narrowly drawn to pass constitutional scrutiny. Any framework limiting expression must not be ambiguous or overbroad, and must serve a legitimate state interest through the least restrictive means available.

Proportionality Analysis: Balancing Rights and Regulatory Objectives

The proportionality test, derived from constitutional jurisprudence, requires that any restriction on fundamental rights must satisfy four criteria: it must have a legitimate aim, be suitable to achieve that aim, be necessary in that no less restrictive alternative exists, and maintain a fair balance between the restriction and the rights affected.

The legitimate aim of the two-hour takedown window is clear and compelling. Non-consensual intimate imagery and deepfake pornography cause severe psychological trauma, reputational damage, and constitute violations of dignity and privacy. These harms are often irreversible, with content spreading rapidly across platforms and causing lasting damage to victims. The Supreme Court of India, including the Chief Justice himself who became a victim of a deepfake video, has repeatedly flagged the inadequacy of existing laws in addressing this digital menace [5].

However, the necessity prong of the proportionality test raises significant concerns. A two-hour response window for global platforms handling millions of content pieces daily presents formidable operational challenges. Automated detection systems, while increasingly sophisticated, struggle with accuracy rates and generate both false positives and false negatives. Human moderation at scale within such compressed timelines requires substantial infrastructure investment, multilingual expertise, and contextual understanding that may not be immediately available.

Furthermore, the rules do not provide clear standards for what constitutes “reasonable and appropriate technical measures” for detecting prohibited synthetic content, nor do they establish performance benchmarks or acceptable error-rate thresholds [3]. This ambiguity creates uncertainty for intermediaries attempting compliance while simultaneously risking over-censorship to avoid liability.

The Deepfake Crisis: Judicial Recognition and Response

Indian courts have increasingly recognized the unique threats posed by deepfake technology. In Arun Jaitley v. Network Solutions Private Limited, the Delhi High Court protected personality rights in the digital domain, establishing that personal names of prominent individuals merit protection against cybersquatting and unauthorized use [6]. While this case predated the deepfake era, its reasoning about protecting digital identity and preventing misuse of persona has been extended to contemporary challenges.

More recently, courts have addressed deepfake-specific harms. The Delhi High Court, in addressing cases involving prominent personalities, has issued orders requiring platforms to deploy automated technology for detecting and deleting infringing content. These judicial directions acknowledge that manual takedown procedures are inadequate for addressing the scope and velocity of digital harm, necessitating technological solutions to counter technological threats [7].

The Supreme Court’s jurisprudence on dignity and privacy rights under Article 21 provides additional constitutional grounding for robust anti-deepfake measures. The right to life and personal liberty has been interpreted expansively to include the right to dignity, privacy, and reputation. Non-consensual intimate imagery, whether real or synthetic, violates these fundamental rights in ways that justify state intervention.

Comparative Perspectives: Global Approaches to Deepfake Regulation

India’s two-hour takedown mandate can be contextualized against international regulatory approaches. The United States enacted the Take It Down Act in May 2025, requiring platforms to remove non-consensual intimate imagery and deepfakes within forty-eight hours of notification [8]. This legislation provides more time for compliance while establishing federal standards for notice-and-takedown procedures.

The European Union’s approach under the AI Act and the Digital Services Act establishes risk-based frameworks that impose heightened obligations on very large online platforms while providing more nuanced timelines and procedural safeguards. These frameworks recognize that different types of content and different platform capacities warrant differentiated regulatory responses.

The critical distinction in India’s approach is the extremely compressed timeline coupled with potential loss of safe harbor immunity under Section 79 of the IT Act for non-compliance. This creates high-stakes pressure on intermediaries that may incentivize over-removal of content to avoid liability, potentially infringing on legitimate speech and expression.

Operational Feasibility: The Implementation Challenge

The operational challenges of implementing a two-hour takedown window cannot be understated. Platforms must first receive notification, verify the complainant’s identity and claim, locate the specific content across potentially multiple instances and formats, assess whether it genuinely violates the rules rather than constituting legitimate parody or satire, and then execute technical removal while maintaining records for potential legal challenges.

For global platforms operating across time zones, the requirement means maintaining round-the-clock moderation teams with expertise in Indian law and cultural context. For smaller intermediaries and emerging platforms, these requirements may create insurmountable barriers to entry, potentially consolidating the digital marketplace in favor of large incumbents with resources to build extensive compliance infrastructure.

The IT Amendment Rules 2026 provide limited clarity on contentious edge cases. Exclusions for “routine editing” and “good faith creation” remain subject to interpretation, particularly for satire, parody, or artistic expression [3]. The mechanism for verifying user declarations about synthetic content is also undefined, leaving intermediaries to develop their own standards without regulatory guidance.

Furthermore, the rules do not address the reality that deepfakes are constantly evolving technologically. Detection methods that work today may be obsolete tomorrow as generation techniques become more sophisticated. This creates an arms race dynamic where compliance frameworks must continuously adapt, yet the regulatory timelines remain fixed.

The Safe Harbor Dilemma: Balancing Protection and Accountability

Section 79 of the Information Technology Act provides intermediaries with safe harbor immunity from liability for third-party content, provided they comply with due diligence requirements. The Shreya Singhal judgment clarified that this immunity is preserved when intermediaries respond appropriately to government or court orders for content takedown [4].

The IT Amendment Rules 2026 explicitly state that intermediaries will not lose safe harbor protection when removing or disabling access to synthetically generated content in accordance with the rules [2]. However, the practical effect of the compressed timelines is to shift substantial risk to intermediaries. Failure to remove content within two hours could result in loss of immunity, exposing platforms to liability for damages suffered by victims.

This creates a strong incentive structure favoring over-removal. When faced with uncertainty about whether specific content violates the rules, platforms will likely err on the side of taking down questionable material rather than risking significant legal exposure. This dynamic undermines the careful balance struck in Shreya Singhal, where the Court sought to prevent intermediaries from becoming private judges of content legality.

The constitutional concern is that this effectively delegates quasi-judicial functions to private platforms, requiring them to make rapid determinations about content legality without the procedural safeguards that accompany governmental or judicial decision-making. This runs contrary to the Shreya Singhal principle that adjudicating legal violations is a quintessentially sovereign function.

Recommendations: Toward a More Balanced Framework

A more constitutionally sound and operationally viable framework would incorporate several modifications. First, the rules should establish clear, graduated timelines based on content type and harm severity. Genuinely harmful non-consensual intimate imagery might warrant expedited removal, while other synthetic content could operate under longer timeframes allowing for careful review.

Second, procedural safeguards must be strengthened. Users whose content is removed should receive notification and have meaningful opportunity for appeal. The rules should establish independent review mechanisms, similar to content review boards that some platforms have voluntarily adopted, ensuring that takedown decisions are subject to oversight beyond the initial platform determination.

Third, the regulatory framework should provide clearer technical standards and guidance. Rather than leaving intermediaries to develop their own detection methodologies, the government could establish certification programs for detection tools, create safe harbors for good faith use of approved technologies, and provide regular guidance on emerging deepfake techniques and appropriate responses.

Fourth, the rules should explicitly protect legitimate uses of synthetic media. Clear carve-outs for news reporting, academic research, artistic expression, and political commentary would prevent over-censorship while still addressing genuinely harmful content. These exceptions should be defined with sufficient precision to provide meaningful guidance while remaining flexible enough to accommodate technological evolution.

Finally, enforcement should be proportionate and consider platform size and resources. Differential standards for large social media intermediaries versus smaller platforms would recognize that compliance capacity varies substantially across the digital ecosystem. This tiered approach is common in other jurisdictions and helps prevent regulatory capture by large incumbents.

Conclusion

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 represent India’s most comprehensive effort to address the deepfake crisis. The two-hour takedown window for non-consensual intimate imagery reflects legitimate concerns about severe harms that victims suffer from such content. However, the constitutional validity and operational feasibility of this extremely compressed timeline remain questionable.

The framework must be evaluated against the standards established in Shreya Singhal v. Union of India and the broader constitutional jurisprudence on freedom of speech and expression. While protecting victims of deepfake abuse is a compelling state interest, the means chosen must be narrowly tailored, provide adequate procedural safeguards, and avoid creating incentive structures that lead to over-censorship of legitimate speech.

The tension between rapid response to digital harm and protection of free expression is not unique to India, but India’s approach is among the most aggressive globally. As implementation proceeds, close monitoring of compliance rates, false positive removals, and impact on legitimate speech will be essential. The rules include provisions for periodic review, and such reviews should incorporate empirical data on implementation challenges and constitutional concerns.

Ultimately, effective deepfake regulation requires a multi-stakeholder approach combining legal frameworks, technological solutions, media literacy, and international cooperation. The two-hour takedown window, while well-intentioned, may prove to be operationally impossible without substantial modifications that better balance the legitimate interests of all stakeholders while maintaining fidelity to constitutional principles of free expression and due process.

References

[1] Ministry of Electronics and Information Technology. (2026). Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026. https://www.outlookbusiness.com/news/meity-notifies-it-rules-to-curb-deepfakes-and-ai-generated-content

[2] Outlook Business. (2026). AI Labelling, Quicker Takedowns: Decoding India’s New Social Media Rules. https://www.outlookbusiness.com/explainers/ai-labelling-quicker-takedowns-decoding-indias-new-social-media-rules

[3] Obhan & Associates. (2026). India’s New Deepfake Regulation: MeitY Notifies Amendments to Information Technology Rules 2021. https://www.obhanandassociates.com/blog/indias-new-deepfake-regulation-meity-notifies-amendments-to-information-technology-rules-2021/

[4] Shreya Singhal v. Union of India, (2015) 5 SCC 1, AIR 2015 SC 1523. https://indiankanoon.org/doc/110813550/

[5] The Sentinel Assam. (2026). Can new IT rules stop the deepfake epidemic? https://www.sentinelassam.com/more-news/editorial/can-new-it-rules-stop-the-deepfake-epidemic

[6] Arun Jaitley v. Network Solutions Private Limited, CS(OS) 1745/2009, Delhi High Court (2011). https://indiankanoon.org/doc/754672/

[7] Khurana & Khurana. (2025). Deepfake Regulation India 2025: MeitY’s Comprehensive IT Rules Amendment. https://www.khuranaandkhurana.com/deepfake-regulation-india-2025-meity-s-comprehensive-it-rules-amendment

[8] Skadden, Arps, Slate, Meagher & Flom LLP. (2025). ‘Take It Down Act’ Requires Online Platforms To Remove Unauthorized Intimate Images and Deepfakes When Notified. https://www.skadden.com/insights/publications/2025/06/take-it-down-act

[9] The Federal. (2026). India mandates 3-hour takedown for AI content: FAQ of what you need to know. https://thefederal.com/category/explainers-2/ai-content-faq-on-new-it-rules-for-ai-generated-content-deepfake-229394

The post MeitY’s 2-Hour Deepfake Takedown Window Under IT Amendment Rules 2026: Constitutionally Proportionate or Operationally Impossible? appeared first on Bhatt & Joshi Associates.

Introduction

Taking into consideration a country’s ability to maintain control of its technological assets, data and digital infrastructure, digital sovereignty can be defined as the status of individual countries having the ability to govern themselves in the digital domain. The rapid development of technology coupled with the growing availability of the internet has made issues of digital sovereignty increasingly important. This construct has in addition come to cover the questions of how states control themselves in the digital environment, such as by regulating data flow, protecting cyberspace and controlling essential technologies. The issue of how to exercise these sovereign powers is also coming to be considered through processes of international relations and law. Digital sovereignty helps more than just the protection of national interests it also enables the protection of privacy and the answer to corporate moral and social responsibility as well as morality in the advancement of technology. This article details everything that affects the legal regulation of digital sovereignty encompassing laws, case laws and the most important judicial decisions which determine the direction of regulation.

The Concept of Digital Sovereignty

Digital sovereignty represents the nation’s ability to regulate and control its digital assets including data storage, processing and infrastructure within its territorial boundaries. This is in part recognising the broader concept of state sovereignty in the digital domain. The growing use of technology for governance, economic operations and societal interactions shows the need for a robust legal framework to ensure digital sovereignty. At its heart, digital sovereignty is the need to ensure that digital infrastructures such as servers, software and communication networks remain within the control of the state and are not subject to interference from foreign entities. Furthermore, it is desired for citizens’ data to be protected from exploitation by multinational corporations or foreign governments. In recent years geopolitical tensions and trade disagreements have increased the importance of digital sovereignty as nation states understand the strategic significance of what they can control over their digital environment. States are constantly seeking to ensure that citizen’s data is not abused by foreign entities in which they do not have pre-agreed upon consent by an external jurisdiction. This objective requires a balance to be reached between the protection of national interests and adherence to current and past international trade and data-sharing agreements. The increasing influence of multinational technology companies has complicated matters, as they operate across many jurisdictions which makes regulation a very difficult proposition to solve.

Legal Frameworks Governing Digital Sovereignty

International Legal Frameworks

Digital sovereignty is regulated by international treaties, agreements, and guidelines which vary in scope. The Budapest Convention on Cybercrime, for example, seeks to deal with internet-related crimes and promote international collaboration. At the same time, it has been criticized for allowing state data access through the border without sufficient consent which is considered a violation of state sovereignty. This situation underscores the challenge of crafting agreements that states find universally acceptable as far as sovereign rights are concerned, while achieving global engagement is a requirement. 

The Tallinn Manual on the International Law Applicable to Cyber Warfare is yet another document of profound importance in this regard. It is not a statute, but it suggests how international law should guide cyber activities and warfare. It delineates the delineation of state obligations bordering on responsibility and authority in cyberspace with the expectation that each state will establish adequate laws to govern its domain. 

Other frameworks such as the UN Guiding Principles on Business and Human Rights focus on the obligation of businesses to uphold human rights as they conduct their digital operations. On the other hand, the General Agreement on Trade in Services (GATS) offered by the World Trade Organization (WTO) establishes principles for conducting trade over the Internet but tends to conflict with the exercise of national digital sovereignty, such as requirements for data localization.

National Legal Frameworks

Asserting digital sovereignty has become a global trend with countries adopting specific laws and regulations for its enforcement. Here are some notable examples:

Within the European Union, there is a transnational legal framework known as the General Data Protection Regulation (GDPR). It enforces strict data protection policies not only within EU member states but also for foreign entities dealing with EU citizens’ data. GDPR showcases how digital sovereignty can be exercised when organizations are required to observe data protection protocols regardless of their geographical jurisdictions. Its extraterritorial scope obligates foreign countries processing data of EU nationals to comply with the regulation, therefore ensuring the EU’s might beyond borders.

In the United States, the federal government has not yet implemented comprehensive data protection laws. Indeed, there are sector-verified laws such as the Health Insurance Portability and Accountability Act (HIPAA) and the California Consumer Privacy Act (CCPA) that provide some level of protection. The CLOUD Act (Clarifying Lawful Overseas Use of Data) also exemplifies the application of U.S. law to data stored in other countries, which often causes conflicts of jurisdiction. This demonstrates the U.S.’s focus on law and order alongside national security.

Through the localization of data and other cross-border relations, China’s Cybersecurity Law and Data Security Law pay special attention to various policies. These laws give the state unprecedented authority over digital affairs by ensuring that critical data stored in China remains within the country’s borders. Additionally, the Personal Information Protection Law (PIPL) pairs personal data with a distinct form of protection and also has data protection clauses like the GDPR but with significantly more state control. 

With the Digital Personal Data Protection Act of 2023, India also joins the list of countries attempting to claim digital sovereignty. This legislation intends to control data processing operations and be responsible for data from any information system which belongs to an Indian citizen. The Act’s provisions for data localization and the creation of a Data Protection Board reflect India’s attempt at managing privacy and security rights.

Regulation of Digital Sovereignty

Just like any other political domain, legislation, administration, and to some extent enforcement come together to form the structure of digital sovereignty. Most governments create a special regulatory body or department responsible for the supervision of internet activity and ensuring adherence to national legislation. For example, both the EU’s Data Protection Authorities (DPAs) and the American Federal Trade Commission (FTC) have separate jurisdictions, but both share the responsibility for consumer privacy and data protection issues in their respective areas.  

Moreover, international treaties, as well as diplomatic and trade agreements are just as important in defining the scope and boundaries of digital sovereignty. Member nations form qualitative protocols which balance economic exchange and the ethical treatment of citizens’ data. The EU and US are currently debating the EU-US Data Privacy Framework, which aims to facilitate the transfer of data across the Atlantic while complying with the rulings of the Schrems II case. Such agreements often receive heavy criticism for lacking sufficient measures against unauthorized foreign spying.

In the same light, interpretation of the law has a major impact on digital sovereignty. Increasingly, courts in various countries have to deal with cases of restriction associated with geolocation, data movement, invasion of privacy, and conflict of laws among nations, which all have borders, but no clear boundaries. Through these judicial actions, states are provided with the limits and logic, which the law imposes on digital sovereignty concerning the rights and powers of each state, the corporations, and the individuals.

Key Case Laws and Judicial Precedents

One of the most important cases regarding digital sovereignty is Google LLC v. CNIL, which was ruled in 2019. The Court of Justice of the European Union (CJEU) made a ruling on the spatial jurisdiction of “the right to be forgotten” within the scope of the GDPR. The court found that search engine operators are required to remove information from their EU domains, but not from the rest of the world. This ruling exemplifies the scope of boundaries of digital sovereignty as well as the battle between local and international legislation. 

Microsoft Corp. v. United States (2018) is a classic U.S. case that deals with if the U.S. authorities had the power to force Microsoft to provide emails stored in Irish servers. With the introduction of the CLOUD Act, this case went moot, but it certainly brought into focus national jurisdiction against cross-national borders data storage. This case also helped put into focus the power domestic laws could employ beyond their borders and international cooperation to resolve these issues.

The Schrems I and II cases (2015, 2020) are especially important when it comes to data transfers between the EU and the U.S. These landmark rulings called into question the legitimacy of the Safe Harbor and Privacy Shield agreements, respectively. The CJEU struck down both accords due to a lack of protective measures for EU citizens’ data within the United States, further emphasizing the need for strong safeguards when claiming digital sovereignty. Such decisions have forced the EU and the U.S. to come up with new agreements which try to address the concerns of privacy and, at the same time, enable data exchange across the Atlantic.

In India, the most notable decision is Justice K.S. Puttaswamy v. Union of India (2017) where the court attributed the right to privacy to the fundamental rights guaranteed under the Constitution. That case initiated the development of data protection policies and called attention to the duty of the state to protect citizens’ digital rights. In addition, the ruling sought to achieve a balance between one’s privacy and the interests of the state concerning security and governance.

Challenges to Digital Sovereignty

Pursuing digital sovereignty is not a walk in the park; there are inter-jurisdictional issues, technological dependencies, and the strife between securing information and invading privacy. For instance, the Microsoft United States case illustrates how the international boundaries of the internet can lead to controversies. Nations are required to resolve those disputes while safeguarding their sovereign interests and encouraging diplomacy.

Technological dependence makes claiming sovereignty over digital spaces more complex. Countries that are dependent on external technologies can’t have sovereignty, since they are chained to foreign service providers for the vital infrastructure and services. A dependency could be lessened if there was a drive towards innovation and the development of infrastructure. However, these strategies necessitate great resources and motivation from the government.

Governments have a hard time striking a balance between protecting the security of the nation and the privacy of the individual. Overreach into people’s cyberspace in the name of fighting crime or terrorists can lead to anger and rejection. The need for legislation to give back-door access to secured communication will, for example, be opposed by privacy champions and IT firms.

Policies such as data localization often interfere with international business, trade, and cooperation. Data localization is helpful because it gives greater control, but it can also increase restrictions on businesses and their access to foreign markets. Finding local limits that do not harm global cooperation is, therefore, a key challenge for global policymaking.

Future of Digital Sovereignty

With advances in technology, artificial intelligence, quantum computing and blockchain technologies will pose new issues for digital sovereignty. The legal policies of countries need to adapt to these changes within the scope of international standards.

The development of AI poses distinct problems and possibilities for the concept of digital sovereignty. Countries must engage in healthy competition to manage the ethical issues concerning AI’s development and usage. Equally, as advancements are made in quantum computing, new security measures will need to be implemented to protect digital assets as current encryption standards are disrupted. 

Equally, a multilateral approach to setting standards is required to deal with the increasingly digital nature of the world. The creation of a Global Digital Compact is an example of an initiative that strives to ensure a collaborative approach and flexible governance. It captures how national responsibilities must merge with international considerations in the modern world.

Conclusion

Digital sovereignty is an evolving concept which reflects the intersection of law, technology and policy. The effective implementation of digital sovereignty requires robust legal frameworks, vigilant regulation and effective adjudication. While challenges continue to exist there is a requirement for continued debate as the protection of national trade and the rights of individual citizens remain still very important in today’s interconnected world. Through the use of a combination of national legislation international cooperation and technological innovation nations may navigate the complexities of the digital age and uphold their autonomy. As technology continues to advance, digital sovereignty will remain a potent basis of governance in the 21st century.

The post Legal Framework for Digital Sovereignty appeared first on Bhatt & Joshi Associates.

Introduction

With globalization and the digital world being so intertwined, data has become an essential resource that propels innovation, commerce, and even governance. The movement of data across borders supports several facets of global life such as trade, communication, and even joint research and development projects. However, these increases in reliance on cross-border data exchange foster a lot of concern concerning data privacy, national security and individual rights. This article discusses the multi-faceted intersection of these conflicting interests and the regulations, laws, case laws, and rules that govern cross-border data privacy.

The Importance of Cross-Border Data Privacy

Data privacy is the safeguarding of personal information from unauthorized collection, use, or disclosure. While cross-border data flows facilitate the transfer of data between countries, it also raises privacy concerns due to different legal and regulatory frameworks in place. For a person, control over utilization of their data is core to their right to privacy which is a fundamental aspect of human autonomy. On the other hand, unrestricted data flow has the potential to undermine national security, economic order, and law enforcement and public safety functions of the state.

A comprehensive means of addressing such highly divergent concerns is necessary to satisfy the valid interests of governments, but especially protecting the individual. The intricacies arise from cultural, legal, and political nuances that shape data privacy laws in different countries. These factors have a profound influence on global business today more than ever.

Key Regulatory Frameworks Governing Cross-Border Data Privacy

A patchwork of international, regional, and national laws governs the regulation of cross-border data privacy. These frameworks aim to provide guidelines for the transfer and processing of data while addressing concerns related to sovereignty, privacy, and security.

The European Union: GDPR and Beyond

The European Union (EU) has established a worldwide leading example in matters of Data Handling, Protection, And Control through the General Data Protection Regulation (GDPR). Put into effect in 2018, the GDPR sets forth extremely high standards regarding the collection, processing, storage, and transfer of personally identifiable information. The regulation obligates the entities transferring the data outside the European Union to guarantee that the host country meets “adequate” protection standards as defined by the European Commission. Alternatively, entities can make use of standard contractual clauses (SCCs) or binding corporate rules (BCRs). 

The consequences of the GDPR privacy restrictions are notable for every country’s data policy. It guarantees that all organizations outside the EU that deal with data from EU residents must adhere to its requirements. Such rules show how the EU prefers to assert the rights of individuals rather than the business and state concerns. 

Apart from GDPR, the EU has also adopted other responsive policies to meet other particular problems posed by the transfers of data across borders. One example is “Schrems II” brought by the Court of Justice of the European Union (CJEU, 2020) which cancelled the EU-US Privacy Shield because it focused too much on the protection of data against heavy-handed governmental spying. This highly publicized ruling has given rise to the EU-US Data Privacy Framework among others.

The United States: A Sectoral Approach

Unlike the EU’s holistic strategy, the U.S. employs a piecemeal approach to data privacy regulation. The Health Insurance Portability and Accountability Act (HIPAA) and Children’s Online Privacy Protection Act (COPPA) deal with particular categories of data while other privacy laws are not as comprehensive. Nonetheless, California is leading the way with the California Consumer Privacy Act (CCPA) and its successor, the California Privacy Rights Act (CPRA), which are more extensive at the state level.

The lack of a single federal law on data protection creates problems for U.S. entities involved in international data transfers. The now-defunct EU-U.S. Privacy Shield attempted to create such mechanisms but was criticized for weak promises of protection. The “Schrems II” ruling showed the weaknesses of these systems and prompted US legislators to reconsider their stance on privacy and surveillance policy.

Asia-Pacific Region: A Diverse Landscape

Countries within the Asia-Pacific region are at various levels of implementing regulations. While Japan, South Korea, and Singapore have robust data protection laws, other nations have yet to solidify their frameworks. Japan’s Act on the Protection of Personal Information (APPI) is one of the few statutory instruments that provides for a smooth data flow between Japan and the EU by enabling the country to use the GDPR’s provisions. South Korea’s PIPA is, like APPI, considered to have high standards of privacy protection as it grants data subjects rights while catering to state objectives.

Unlike other nations, India is currently crafting its comprehensive data protection regulation. The proposed Digital Personal Data Protection Act (DPDPA) addresses data flow by mandating explicit consent for data transfers and restricting sharing with countries deemed to not have sufficient protections. This shows India’s effort to position itself as a global tech player while still trying to protect its citizens’ rights.

International Organizations and Guidelines

In addition to national and regional frameworks, international organizations such as the Organization for Economic Cooperation and Development (OECD) and the Asia-Pacific Economic Cooperation (APEC) have developed guidelines to promote cross-border data privacy. The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data and the APEC Cross-Border Privacy Rules (CBPR) system seek to harmonize standards and facilitate interoperability. However, their voluntary nature and lack of enforcement mechanisms remain significant limitations.

National Security vs. Individual Rights

The tension between national security and individual rights is a recurring theme in cross-border data privacy debates. Governments often justify data access and surveillance measures as necessary to combat terrorism, cybercrime, and other threats. However, such measures can encroach on individual rights, raising concerns about mass surveillance, data misuse, and lack of accountability.

Surveillance Laws and Practices

The U.S. FISA and FISA Amendment 702 give intelligence agencies sweeping powers to tap into data from US entities, even when the data is related to non-U.S. citizens. Many privacy advocates have raised concerns about these blurs in the law. These concerns were further illuminated when Edward Snowden leaked information related to the NSA’s surveillance programs.

Critics claim that laws like China’s Cyber Security Law do more harm than good as they complement state surveillance policies at the cost of privacy and set a dangerous trend for international data exchange.

Judicial Scrutiny and Balancing Acts

Judicial bodies serve as the primary venue for adjudicating the tension existing between securing the nation’s borders and protecting the rights and freedoms of the people. As an example, the case Carpenter v. United States (2018) determined that obtaining historical cell site information without a warrant constituted a violation of the Fourth Amendment. This case was a milestone for privacy protection in the contemporary world.

In the same vein, the European Union’s decision on Schrems II brought attention to the necessity of having stronger legal protection against state monitoring. It scrutinized and disbanded the EU-U.S. Privacy Shield because it failed to safeguard the personal data of citizens of the EU about American spying policies. A continuation of these movements is also visible in The European Court of Human Rights (ECHR) which has issued judgments enhancing the protection of privacy rights about state security.

The Role of International Agreements in Data Privacy

International accords are critical for aligning data privacy policies and enabling international data movement. The APEC CBPR system and the OECD Guidelines create frameworks to close regulatory gaps and enhance cross-border cooperation. The Global Privacy Assembly, a world gathering of privacy regulators, has also helped promote the harnessing of global efforts toward data privacy.

Notwithstanding, broad international agreements are often critiqued for being voluntary and difficult to enforce. Improving those frameworks and making compliance mandatory could improve trust and collaboration on a global scale. Bilateral agreements like the EU-U.S. Data Privacy Framework exemplifies how collaboration can support solving common problems.

Challenges and the Way Forward for Cross-Border Data Privacy

In the age of rapidly evolving technology and politics, border data privacy faces constant difficulties. Innovations such as artificial intelligence, blockchain, and IoT (the Internet of Things) collect and create huge sets of data that demand accountability, consent, and sovereignty. Furthermore, the enforcement of data localization laws, that stipulate data storage and processing within a country’s borders, presents additional relativities for international corporations. While these laws seek to emphasize security and data protection, they further stifle innovation and economic development by segments of the digital economy. 

Finding a reasonable middle ground is necessary to confront these gaps. Policymakers need to incorporate the interests of a larger array of actors that include governments, businesses, civil societies, and individual citizens. Building global standards for data usage and security backed with reliable enforcement allows movement towards a more inclusive, structured, and protected data environment.

Conclusion 

The right to cross-border data privacy touches on multiple intricacies like an individual’s privacy, the national security needs of the state, and the global economy’s requirement for minimal barriers to data movement. Achieving this balance is possible through careful regulation, judicial, and international cooperation.

With rapid advancements in technology, the laws and regulations designed for cross-border data privacy protection have to adapt. When countries lead with transparency and human rights-centered regulations, finding the balance needed becomes easier. Most importantly, uniting to protect privacy while working on acceptable security measures is essential for trust in the ecosystem.

The post Cross-Border Data Privacy: Balancing National Security and Individual Rights appeared first on Bhatt & Joshi Associates.

Introduction

The internet has revolutionized communication, providing an unprecedented platform for sharing ideas, opinions, and information. While it has enabled individuals to exercise their freedom of expression, it has also brought challenges related to the regulation of online content. This balancing act between safeguarding free speech and addressing harmful content presents a complex legal and ethical dilemma. Governments, international organizations, and courts have attempted to regulate online content through legislation, judicial decisions, and administrative frameworks. This article examines the legal mechanisms, significant case laws, and the ongoing debate surrounding the regulation of online content and freedom of expression.

The Significance of Freedom of Expression

Freedom of expression is a cornerstone of democratic societies, enshrined in international legal instruments such as Article 19 of the Universal Declaration of Human Rights (UDHR) and the International Covenant on Civil and Political Rights (ICCPR). It allows individuals to voice opinions without fear of censorship or retaliation and fosters societal progress through open discourse. However, this right is not absolute. Limitations may be imposed to address issues such as hate speech, defamation, misinformation, and national security concerns, provided they comply with legal principles of necessity and proportionality.

In the context of online platforms, freedom of expression has taken on new dimensions. Social media, blogs, and digital forums offer spaces for the exchange of ideas, allowing marginalized voices to be heard. Yet, the very openness that makes the internet a powerful tool for free expression also renders it vulnerable to misuse. Governments and private entities face the challenge of ensuring that restrictions on speech are not arbitrary or overly restrictive, while addressing the harms caused by malicious or illegal content.

Challenges in Regulating Online Content

The advent of the internet has amplified the scale and reach of harmful content. Hate speech, fake news, cyberbullying, and child exploitation material are among the issues demanding regulatory intervention. Unlike traditional media, online platforms operate globally, complicating jurisdictional enforcement. Moreover, the anonymity afforded by the internet makes it difficult to identify and hold offenders accountable.

Regulating online content must balance the protection of free speech with the need to curtail harmful activities. Overregulation risks stifling legitimate expression, while underregulation could allow the proliferation of harmful content. The rise of artificial intelligence and automated moderation systems has added another layer of complexity, raising questions about transparency and accountability in content regulation. Automated tools may inadvertently censor legitimate speech or fail to detect nuanced forms of harmful content, underscoring the need for human oversight.

In addition to technological challenges, cultural and political factors influence the regulation of online content. What constitutes harmful or unacceptable content often varies across jurisdictions, reflecting differing societal values and norms. This diversity complicates efforts to develop universal standards and underscores the importance of context-sensitive approaches to regulation.

Legislative Frameworks for Regulating Online Content

National Laws

Countries have adopted diverse legal approaches to regulate online content, reflecting differing cultural, political, and legal traditions. For instance, the United States prioritizes free speech under the First Amendment but permits limited exceptions such as incitement to violence and obscenity. The Communications Decency Act (CDA) Section 230 provides immunity to online platforms for user-generated content, fostering innovation but also shielding platforms from liability for harmful content.

In contrast, European countries adopt stricter regulations. The European Union’s General Data Protection Regulation (GDPR) addresses privacy and data protection, indirectly impacting content regulation. Additionally, the Digital Services Act (DSA) imposes obligations on online platforms to remove illegal content and ensure transparency in content moderation. Germany’s Network Enforcement Act (NetzDG) mandates the swift removal of hate speech and other illegal content, imposing significant fines for non-compliance.

India’s Information Technology Act, 2000, provides another example of a national framework. Its intermediary guidelines and digital media ethics codes, introduced in 2021, require platforms to address grievances and remove unlawful content within tight timelines. However, these regulations have been criticized for their potential to curb free speech, particularly when applied to politically sensitive content.

International Standards

International standards provide a framework for balancing online content regulation and freedom of expression. The ICCPR’s Article 19 permits restrictions on freedom of expression if they are provided by law, pursue legitimate aims, and are necessary and proportionate. Regional human rights instruments, such as the European Convention on Human Rights (ECHR), also influence national legal frameworks. The European Court of Human Rights (ECtHR) has issued landmark rulings balancing free speech and content regulation, emphasizing the need for clear, precise, and narrowly tailored laws.

Efforts to harmonize international approaches to online content regulation are exemplified by the work of the United Nations and other global organizations. The UN Guiding Principles on Business and Human Rights, for example, urge corporations, including digital platforms, to respect human rights and operate transparently. Multistakeholder initiatives like the Global Network Initiative also advocate for ethical practices in regulating online content.

Case Laws Shaping Online Content Regulation

United States 

In Reno v. American Civil Liberties Union (1997), the U.S. Supreme Court struck down provisions of the CDA that sought to regulate indecent content on the internet, emphasizing that such broad restrictions violated the First Amendment. This case underscored the challenges of crafting content regulation laws that respect free speech.

Another significant case is Packingham v. North Carolina (2017), where the Court invalidated a law prohibiting sex offenders from accessing social media. The decision highlighted the internet as a critical venue for exercising free speech, necessitating careful consideration of restrictions.

European Union

The ECtHR’s ruling in Delfi AS v. Estonia (2015) held an online news platform liable for defamatory user comments. The Court recognized the need to hold intermediaries accountable for harmful content under certain circumstances, setting a precedent for balancing platform responsibility and freedom of expression.

In CJEU’s Google Spain v. AEPD and Mario Costeja González (2014), the Court established the “right to be forgotten,” allowing individuals to request the removal of search engine links to personal data. While empowering individuals to control their online presence, the ruling raised concerns about its impact on freedom of information.

Other Jurisdictions

In India, the Supreme Court’s decision in Shreya Singhal v. Union of India (2015) struck down Section 66A of the Information Technology Act, deeming it unconstitutional due to its vague and overbroad restrictions on online speech. This landmark judgment underscored the importance of clear and precise legal standards in content regulation.

China exemplifies an authoritarian approach, employing extensive content controls under its Cybersecurity Law and other regulations. While these measures aim to maintain social stability, they have been widely criticized for suppressing dissent and restricting access to information. The Great Firewall of China serves as a prominent example of government-imposed internet censorship.

The Role of Online Platforms in Content Regulation

Online platforms such as Facebook, Twitter, and YouTube play a central role in content regulation. These companies use community guidelines, automated moderation tools, and human moderators to remove harmful content. However, their policies and practices often lack transparency, leading to accusations of bias and arbitrary enforcement.

The actions of platforms are increasingly scrutinized in court. For instance, in Netchoice LLC v. Paxton (2023), a U.S. federal court reviewed Texas’s law prohibiting platforms from censoring content based on viewpoint. The case highlighted the tension between protecting free speech and allowing platforms to curate content responsibly.

Platforms also face challenges in enforcing content policies across diverse jurisdictions. Cultural differences and varying legal requirements complicate the implementation of consistent moderation practices. Transparency reports and independent oversight mechanisms are emerging as potential solutions to enhance accountability.

Judicial Insights and Trends in Online Content Regulation

Courts worldwide continue to grapple with the interplay between technology, free speech, and regulation. Key trends include an increasing emphasis on balancing competing rights, such as freedom of expression and the right to privacy. Courts are also focusing on the proportionality and necessity of restrictions on online speech, ensuring that limitations serve legitimate aims without unduly infringing on fundamental rights.

Another emerging trend is the recognition of platform accountability. Courts are exploring the extent to which platforms should be held liable for user-generated content, with a growing emphasis on transparency and due process in content moderation decisions. This shift reflects a broader societal expectation that platforms act responsibly in managing the vast amounts of content they host.

The Path Forward: Harmonizing Regulation and Freedom of Expression

The regulation of online content is a dynamic and evolving field. Governments, courts, and platforms must collaborate to address emerging challenges. Key priorities include developing clear and transparent legal standards that strike a balance between safeguarding free speech and addressing harmful content. Laws should be narrowly tailored to target specific harms, avoiding overly broad or vague restrictions.

Enhancing platform transparency is another critical priority. Platforms should disclose their moderation policies and decision-making processes, ensuring accountability and building public trust. Independent oversight mechanisms, such as external audits or advisory boards, can provide additional safeguards against arbitrary enforcement.

International cooperation is essential to address the global nature of online content regulation. Cross-border collaboration can help harmonize standards, share best practices, and combat transnational challenges such as misinformation and cybercrime. Regional agreements and multilateral initiatives can play a vital role in fostering coordinated responses.

Safeguarding marginalized voices is a crucial consideration in content regulation. Efforts to combat harmful content should avoid disproportionately silencing vulnerable groups, ensuring that diverse perspectives are represented online. Inclusive policymaking processes can help identify and address the unique needs of different communities.

Conclusion Online Content and Freedom of Expression

Regulating online content while safeguarding freedom of expression is a delicate balancing act that requires nuanced legal and policy responses. By adhering to principles of necessity, proportionality, and transparency, societies can create an internet that respects free speech while protecting against harm. Through robust legislation, thoughtful judicial interpretations, and responsible platform governance, the balance between regulation and freedom can be maintained, fostering an inclusive and safe digital environment.

The post Assessing the Legal Framework for Regulating Online Content and Freedom of Expression appeared first on Bhatt & Joshi Associates.

Introduction

In a pivotal moment for digital rights and freedom of speech in India, the Supreme Court has temporarily halted the implementation of the Fact-Check Unit (FCU), established under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2023. This decision underscores the ongoing debate surrounding government regulation of online content and its implications for fundamental rights.

The Genesis of the Controversy

The Notification of the Fact-Check Unit

On April 6, 2023, the Ministry of Electronics and Information Technology notified the establishment of a Fact-Check Unit tasked with identifying and flagging “false, fake or misleading” information concerning the Union Government on social media platforms. The initiative was part of the broader Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, aiming to curb the spread of misinformation online.

The Mechanics of Fact-Checking

Under the amended IT Rules, social media intermediaries were obligated to take down posts flagged by the FCU. Additionally, internet service providers were required to block URLs to such content. Failure to comply could result in these platforms losing their ‘safe harbour’ protections, which shield them from legal accountability for user-generated content.

Legal and Public Backlash Against the Fact-Check Unit Suspension

Immediate Legal Challenges

The establishment of the FCU was met with immediate legal challenges. Comedian Kunal Kamra, the Editors Guild of India, and the Association of Indian Magazines, among others, filed petitions against the amendment, arguing it posed serious risks to free speech and was arbitrary in its targeting of content related to the Union Government alone.

Supreme Court’s Intervention

The Supreme Court’s decision to stay the operation of the FCU until a final decision by the Bombay High Court highlights the constitutional questions raised by the IT Rules amendment. The Court emphasized the need for a thorough analysis of the amendment’s impact on the fundamental right to freedom of speech and expression.

Diverse Perspectives on Fact-Checking and Free Speech

The Government’s Stance

The government defended the FCU, arguing that flagging false news does not lead to automatic content takedown. Instead, it suggested that intermediaries are notified and given the option to remove the content or provide a disclaimer. This approach purportedly aims to protect the public from misinformation while preserving free speech.

Critics’ Concerns

Critics, including digital rights groups and opposition parties, argue that the FCU and the IT Rules amendment could lead to online censorship and abuse of power. The vagueness of terms like “fake,” “false,” or “misleading,” and the government’s unilateral power to decide on these matters, were seen as threats to democratic discourse and press freedom.

Judicial Review and Constitutional Scrutiny

The Bombay High Court’s role in reviewing the constitutional validity of the IT Rules amendment is crucial. Previous cases, such as the landmark Shreya Singhal vs. Union of India, have set strict procedures for blocking content and emphasized that restrictions on free speech must be reasonable and proportionate.

Conclusion: Regulatory Challenges Amid Fact-Check Unit Suspension

The ongoing legal battle over the Fact-Check Unit and the IT Rules amendment reflects a broader struggle to balance government efforts to combat misinformation with the need to protect free speech and democratic engagement online. As the judiciary continues to scrutinize these measures, the outcome will likely have far-reaching implications for digital rights and governance in India.

The Supreme Court’s stay order not only halts the immediate implementation of the FCU but also sets the stage for a deeper examination of how nations navigate the complex terrain of information regulation in the digital age. The final decision, expected to emanate from the Bombay High Court, will be a landmark judgment on the limits of government authority over digital content and the protection of fundamental rights in the digital era.

The post Fact-Check Unit Suspension: A Legal and Public Discourse on India’s Information Regulation appeared first on Bhatt & Joshi Associates.

The intersection of digital privacy and national security has emerged as one of the defining legal battlegrounds in contemporary India. In May 2021, WhatsApp LLC filed a petition before the Delhi High Court challenging Rule 4(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) IT Rules, 2021[1]. This WhatsApp challenge to IT Rules 2021 on traceability represents a fundamental dispute between the government’s regulatory ambitions and the right to privacy of millions of Indian users who rely on encrypted messaging services. The case raises critical questions about the extent to which the state can demand technological capabilities that may undermine the very foundations of secure digital communications. WhatsApp’s petition argues that the traceability requirement violates constitutional protections enshrined under Articles 14, 19(1)(a), 19(1)(g), and 21 of the Indian Constitution, while also exceeding the statutory authority granted under the Information Technology Act, 2000[2].

The Legal Framework: Information Technology Act and Intermediary Rules

The Information Technology Act, 2000 serves as the primary legislative framework governing digital intermediaries in India. The Act, through its various provisions, aims to balance the interests of innovation and user protection with legitimate state concerns regarding security and public order. Within this framework, Section 79 of the IT Act holds particular significance as it provides what is commonly known as safe harbour protection to intermediaries. Under Section 79(1), an intermediary shall not be liable for any third party information, data, or communication link made available or hosted by it, subject to certain conditions[3].

The safe harbour protection under Section 79(2) applies only when the intermediary’s function is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored. The intermediary must not initiate the transmission, select the receiver, or modify the information contained in the transmission. Furthermore, the intermediary must observe due diligence while discharging its duties and comply with guidelines prescribed by the Central Government[4].

However, this protection is not absolute. Section 79(3) specifies that the exemption shall not apply if the intermediary has conspired, abetted, aided or induced the commission of an unlawful act, or upon receiving actual knowledge or notification from the appropriate government or its agency regarding unlawful content, fails to expeditiously remove or disable access to that material. The Central Government exercises its rule-making authority under Section 87(2) of the IT Act, which empowers it to make rules for carrying out the provisions of the Act.

On February 25, 2021, the Ministry of Electronics and Information Technology notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, superseding the earlier 2011 rules. These rules significantly expanded the regulatory framework governing digital intermediaries, introducing new classifications and obligations. The rules distinguish between ordinary intermediaries and Significant Social Media Intermediaries, defined as platforms with registered users in India above a notified threshold of five million users. For SSMIs providing messaging services primarily, Rule 4(2) imposes an additional due diligence requirement to enable the identification of the first originator of information on its computer resource as may be required by a judicial order or an order passed under Section 69 of the IT Act[5].

Understanding Rule 4(2): The Traceability Mandate

Rule 4(2) of the IT Rules 2021 represents the centerpiece of this legal controversy. The provision specifically requires significant social media intermediaries that provide services primarily in the nature of messaging to enable the identification of the first originator of information on its platform. This obligation arises when either a court of competent jurisdiction or an authority empowered under Section 69 of the IT Act issues an order requiring such identification. The provision includes a crucial territorial limitation, stating that where the first originator of any information is located outside India, the first originator of that information within India shall be deemed to be the first originator.

The term “originator” is defined in the IT Act as a person who sends, generates, stores or transmits any electronic message. However, this definition creates ambiguity because an originator may not necessarily be the author or creator of the content. Someone who forwards a message, shares a screenshot, or copy-pastes content from another platform could potentially be identified as the originator, even though they did not create the underlying content. This technical limitation raises significant questions about the effectiveness and fairness of the traceability mechanism.

The requirement applies only to SSMIs providing messaging services, which would include platforms like WhatsApp, Signal, and Telegram that have more than five million users in India. WhatsApp, with over 530 million users in India, clearly falls within this category and is therefore subject to the traceability mandate. The rules do not specify the exact technological mechanism by which traceability should be implemented, leaving it to the platforms to determine how to comply with the requirement without breaking end-to-end encryption.

WhatsApp’s Constitutional Challenge to IT Rules 2021 on Traceability

WhatsApp’s petition before the Delhi High Court presents a multifaceted constitutional challenge to Rule 4(2). Analysis of WhatsApp’s challenge to Rule 4(2) IT Rules 2021 on traceability, encryption, privacy and national security highlights the broader implications for digital rights in India. The company filed its writ petition on May 26, 2021, one day after the deadline for compliance with the new rules. Senior Advocate Mukul Rohatgi represented WhatsApp before a division bench comprising Chief Justice DN Patel and Justice Jyoti Singh. The Delhi High Court issued notice to the Centre on August 27, 2021, directing the government to file a response to WhatsApp’s contentions[6].

The petition argues that Rule 4(2) violates the fundamental right to privacy as recognized in the landmark Supreme Court judgment of Justice K.S. Puttaswamy (Retd.) v. Union of India. In this unanimous nine-judge bench decision delivered on August 24, 2017, the Supreme Court held that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution[7]. The judgment established a three-part test for any invasion of privacy: legality, necessity, and proportionality. WhatsApp contends that Rule 4(2) fails all three prongs of this test.

On the legality prong, WhatsApp argues that there is no law enacted by Parliament that expressly requires an intermediary to enable identification of the first originator of information on end-to-end encrypted platforms. The company submits that Rule 4(2) is ultra vires to Section 79 of the IT Act because the parent statute does not authorize the imposition of such a requirement through subordinate legislation. The petition emphasizes that while Section 79 grants rule-making power regarding due diligence requirements for intermediaries, it does not extend to mandating fundamental changes to the technological architecture of encrypted messaging services.

Regarding necessity, WhatsApp argues that Rule 4(2) allows for the issuance of orders to identify the first originator without judicial oversight or prior judicial scrutiny, which means there is no guarantee against arbitrary state action. The petition points out that orders can be issued not only by courts but also by executive authorities under Section 69 of the IT Act, without requiring the government to demonstrate that less intrusive means are unavailable or ineffective. This absence of procedural safeguards violates the necessity requirement established in the Puttaswamy judgment.

On proportionality, WhatsApp submits that the traceability requirement would force the platform to break end-to-end encryption for all its users, not just for specific individuals suspected of wrongdoing. The petition explains that to trace even one message, the service would have to trace every message, as there is no way to predict in advance which user will be the subject of an order seeking first originator information. This wholesale surveillance architecture is grossly disproportionate to any legitimate state interest and creates privacy risks for hundreds of millions of innocent users.

The petition also challenges Rule 4(2) under Article 14 of the Constitution, which guarantees equality before the law. Relying on the Supreme Court’s decision in Shayara Bano v. Union of India, WhatsApp argues that laws are manifestly arbitrary in violation of Article 14 when they are obviously unreasonable, capricious, irrational, without adequate determining principle, or excessive and disproportionate. The company contends that Rule 4(2) is manifestly arbitrary because it imposes burdens far exceeding any purported benefits and because Parliament did not intend to grant authority to make such legislation through subordinate rule-making.

Furthermore, WhatsApp asserts that Rule 4(2) violates the fundamental right to freedom of speech and expression guaranteed under Article 19(1)(a) of the Constitution. The petition explains that once citizens become aware that messaging platforms have built the ability to identify first originators, they will not feel safe to speak freely for fear that their lawful private communications will be traced and used against them. This chilling effect on free speech is antithetical to the very purpose of end-to-end encryption, which is designed to protect the confidentiality and security of private communications.

The Government’s Defense of Traceability

The Union of India, through the Ministry of Electronics and Information Technology, has filed detailed responses defending the constitutionality and necessity of Rule 4(2). The government’s position rests on several key arguments that attempt to balance individual privacy rights with collective security interests.

The Centre argues that Section 87 of the Information Technology Act granted it the power to formulate Rule 4(2), which mandates significant social media intermediaries to enable identification of the first originator in legitimate state interest. The government emphasizes that this requirement is essential for curbing the menace of fake news and offences concerning national security, public order, and crimes against women and children. The Ministry has stated that the right to privacy is not absolute and must be balanced against the Article 21 rights of vulnerable citizens within cyberspace who are or could be victims of cyber-crime.

In its affidavit before the Delhi High Court, the government has clarified that it respects the right to privacy and has no intention to violate it when WhatsApp is required to disclose the origin of a particular message. The Centre maintains that such requirements arise only in cases involving very serious offences related to sovereignty and integrity of India, security of the state, friendly relations with foreign states, public order, or incitement to cognizable offences. The government contends that the traceability provision is reasonable and expects platforms to use mechanisms that guard encryption while protecting user privacy.

The government has also placed the burden on intermediaries to develop technological solutions that comply with Indian law. The Centre’s submission states that even if existing technology does not allow identification of the first originator without breaking encryption, it is the legal obligation of platforms like WhatsApp to find solutions that can enable such identification. The Ministry argues that platforms cannot claim immunity from legal obligations simply because compliance may require modifications to their current technological architecture.

Additionally, the government has pointed to WhatsApp’s own data collection practices, arguing that the platform already collects users’ personal information and shares it with Facebook and other third parties for commercial purposes. This, according to the Centre, undermines WhatsApp’s claims about protecting user privacy. The government maintains that if WhatsApp can collect and process user data for business purposes, it should be able to develop mechanisms for identifying first originators when required by law enforcement for investigating serious crimes.

The Privacy Jurisprudence: Puttaswamy and Its Application

The Puttaswamy judgment forms the doctrinal foundation for privacy protection in India and serves as the primary precedent in WhatsApp’s challenge to Rule 4(2) IT Rules 2021 (traceability clause). In Justice K.S. Puttaswamy (Retd.) v. Union of India, decided on August 24, 2017, a nine-judge constitution bench of the Supreme Court unanimously held that the right to privacy is a fundamental right intrinsic to life and personal liberty under Article 21 and is a part of the freedoms guaranteed by Part III of the Constitution. The bench comprised Chief Justice J.S. Khehar and Justices J. Chelameswar, S.A. Bobde, R.K. Agrawal, R.F. Nariman, A.M. Sapre, D.Y. Chandrachud, S.K. Kaul, and S. Abdul Nazeer.

Justice Chandrachud, writing for himself and three other judges, articulated that privacy is a concomitant of an individual’s right to exercise control over their own personality. The judgment recognized that privacy safeguards individual autonomy and recognizes the ability of individuals to control vital aspects of their lives. Privacy protects personal intimacies including marriage, procreation, family, and sexual orientation, which are at the core of privacy and dignity. The Court emphasized that privacy attaches to the person and is not lost merely because an individual is in a public place.

The Puttaswamy judgment established that privacy is not an absolute right and can be restricted by the state, but any such restriction must satisfy a three-part test. First, there must be legality, which requires that any invasion of privacy must be through a validly enacted law. Second, there must be necessity, meaning that the restriction must serve a legitimate state aim and there must be guarantees against arbitrary state action. Third, the restriction must be proportionate, requiring that the state achieve its legitimate aims through the least restrictive alternative available.

The judgment also recognized informational privacy as a distinct facet of the right to privacy. Justice Chandrachud observed that dangers to privacy in the age of information can originate not only from the state but also from non-state actors. The Court commended to the Union Government the need to examine and put in place a robust regime for data protection, cautioning that such a regime requires careful and sensitive balance between individual interests and legitimate concerns of the state.

The Puttaswamy decision explicitly overruled earlier Supreme Court judgments in M.P. Sharma v. Satish Chandra and the majority opinion in Kharak Singh v. State of Uttar Pradesh to the extent that they held privacy was not a fundamental right under the Constitution. The Court held that life and personal liberty are inalienable to human existence and constitute rights under natural law. No civilized state can contemplate an encroachment upon life and personal liberty except through the authority of law that meets constitutional requirements.

In applying this jurisprudence to Rule 4(2), WhatsApp argues that the traceability provision fails the Puttaswamy test on all three grounds. The petition contends that there is no valid parliamentary law authorizing such invasive surveillance, that procedural safeguards against arbitrary state action are absent, and that the requirement to break encryption for all users is grossly disproportionate to any legitimate governmental objective.

Technical Implications: End-to-End Encryption and Traceability

The technical dimensions of this legal dispute are crucial to understanding why WhatsApp and other encrypted messaging platforms oppose the traceability requirement so vehemently. End-to-end encryption is a security measure that prevents third parties, including the messaging platform itself, from accessing the content of communications between users. When a message is sent using end-to-end encryption, it is encrypted on the sender’s device, transmitted in encrypted form, and only decrypted on the recipient’s device. The encryption keys are stored only on user devices, not on the platform’s servers.

WhatsApp implemented end-to-end encryption using the Signal Protocol in 2016, meaning that the company itself cannot read the messages exchanged between users. This technical architecture is fundamental to the platform’s privacy promise to its users. The company has consistently maintained that requiring traceability would necessitate fundamental changes to this architecture that would undermine the security and privacy protections offered by end-to-end encryption.

Technology experts and civil society organizations have supported WhatsApp’s technical claims. A parliamentary standing committee report concluded that technology experts were unanimous in their opinion that it is technically impossible to introduce traceability on encrypted platforms without breaking the encryption technology itself. The report noted that implementing originator traceability may weaken end-to-end encryption and create vulnerabilities that could be exploited by malicious actors.

To comply with Rule 4(2) while maintaining end-to-end encryption, messaging platforms would need to implement what is known as message tracing or message tracking. This would require storing metadata about who sent which message to whom and when, creating a database that maps the flow of messages across the platform. However, this approach has several significant problems.

First, storing such metadata at scale would be technically challenging and expensive, particularly for a platform like WhatsApp that processes billions of messages daily. Second, this metadata database would itself become a massive privacy risk, as it would reveal communication patterns, social networks, and associations among users. Third, the metadata could be used to infer the content of communications even without breaking encryption, as patterns of communication can be highly revealing.

Moreover, traceability based on the first forwarder rather than the original creator of content has limited effectiveness. Users commonly copy content from websites or other platforms and paste it into chats, take screenshots of messages, or retype content they have seen elsewhere. In such cases, the person identified as the first originator on WhatsApp would not actually be the creator or author of the content, rendering the traceability mechanism ineffective for its stated purpose of identifying the source of misinformation or harmful content.

Comparative Perspectives: Global Approaches to Encrypted Communications

India is not alone in grappling with the tension between encrypted communications and law enforcement access. Governments worldwide have sought various approaches to address this challenge, often referred to as the encryption debate or the going dark problem.

In the United States, law enforcement agencies have long advocated for backdoors or exceptional access mechanisms that would allow them to decrypt communications when authorized by court order. However, technology companies and privacy advocates have consistently argued that such mechanisms would weaken security for all users and could be exploited by adversaries. The debate has resulted in a stalemate, with no federal legislation requiring backdoors in encrypted systems.

The European Union has taken a different approach through its General Data Protection Regulation and the ePrivacy Directive, which provide strong protections for communications privacy. However, some EU member states have proposed or enacted national legislation requiring platforms to retain certain metadata or provide access to encrypted communications under specific circumstances. These national measures have faced legal challenges under EU law for potentially conflicting with fundamental rights protections.

Australia passed the Telecommunications and Other Legislation Amendment (Assistance and Access) Act in 2018, which requires technology companies to provide technical assistance to law enforcement agencies, including potentially weakening encryption. This legislation sparked significant controversy and concern from technology companies and civil society organizations about its impact on security and privacy.

The United Kingdom has considered similar measures through the Investigatory Powers Act 2016, which grants broad surveillance powers to government agencies. However, courts have struck down portions of this legislation for violating privacy rights under the European Convention on Human Rights. In December 2020, the Court of Justice of the European Union ruled that UK surveillance practices violated EU law, specifically regarding bulk data retention requirements.

Brazil’s Marco Civil da Internet provides strong protections for internet users’ privacy and freedom of expression, while also establishing procedures for law enforcement access to user data with judicial authorization. The Brazilian approach attempts to balance privacy and security through clear procedural safeguards and judicial oversight, which contrasts with India’s Rule 4(2) that allows executive authorities to issue traceability orders without prior judicial review.

These international examples demonstrate that while many countries struggle with similar tensions between privacy and security, most democratic nations that have attempted to mandate weakening of encryption or require traceability have faced significant legal, technical, and political challenges. The lack of a clear international consensus on this issue underscores the complexity of the problem that India is attempting to solve through Rule 4(2).

The Status of Proceedings and Future Implications

The legal challenge to Rule 4(2) remains pending before the Delhi High Court. After issuing notice to the Centre in August 2021, the court has heard arguments from both sides but has not yet rendered a final judgment on the merits of WhatsApp’s petition. In April 2024, during one of the hearings, WhatsApp’s counsel made the striking statement that the platform would exit India if forced to break encryption, underscoring the fundamental nature of the dispute.

The Supreme Court of India, in March 2024, transferred various petitions challenging different aspects of the IT Rules 2021 from multiple High Courts to the Delhi High Court for consolidated hearing. This transfer indicates the national importance of the issues at stake and suggests that a definitive resolution may eventually require Supreme Court intervention.

Meanwhile, the government has shown no indication of withdrawing or modifying Rule 4(2). The Ministry of Electronics and Information Technology has consistently defended the provision as necessary for public safety and national security. In subsequent amendments to the IT Rules in 2022, the government actually expanded intermediary obligations in other areas, suggesting a continued commitment to stringent regulation of digital platforms.

The outcome of this case will have profound implications for digital rights in India and could set precedents affecting hundreds of millions of users of encrypted messaging services. If the court upholds Rule 4(2), WhatsApp and other encrypted messaging platforms will face a difficult choice: either comply with the traceability requirement by fundamentally redesigning their encryption systems, which would undermine their global security architecture, or refuse to comply and potentially face loss of safe harbour protection or even be forced to exit the Indian market.

Conversely, if the court strikes down Rule 4(2) as unconstitutional, it would establish important limits on the government’s ability to mandate surveillance capabilities through subordinate legislation. Such a ruling would affirm the primacy of the Puttaswamy privacy framework and clarify that fundamental alterations to encrypted communications systems cannot be imposed without clear parliamentary authorization and robust procedural safeguards.

The case also raises broader questions about the regulation of digital platforms in India and the appropriate balance between innovation, privacy, and security. As India develops its digital economy and seeks to establish itself as a technology hub, the legal framework governing digital platforms will significantly influence whether India is perceived as a rights-respecting jurisdiction that protects user privacy or as one where surveillance concerns may deter users and businesses.

Conclusion

WhatsApp’s constitutional challenge to the traceability provision in the IT Rules 2021 represents a watershed moment in Indian digital rights jurisprudence. At its core, this case requires courts to determine whether the government can mandate that private companies build surveillance capabilities into encrypted communications systems, and if so, under what conditions and with what safeguards. The resolution of this case will shape the future of privacy, free speech, and secure communications for hundreds of millions of Indians who rely on messaging platforms for personal, professional, and political expression.

The legal and technical complexities involved demonstrate that there are no simple answers to the challenges posed by encrypted communications in the digital age. Both the government’s security concerns and users’ privacy interests are legitimate and important. However, the Puttaswamy framework provides clear guidance that any invasion of privacy must be necessary, proportionate, and backed by adequate procedural safeguards. As the Delhi High Court weighs these competing interests, its eventual decision will determine whether India’s approach to digital regulation respects the constitutional commitment to privacy while addressing legitimate security needs.

References

[1] The Print. (2021, May 26). WhatsApp challenges new IT rules in Delhi HC, terms it ‘unconstitutional’. https://theprint.in/india/whatsapp-challenges-new-it-rules-in-delhi-hc-terms-it-unconstitutional/666023/ 

[2] LiveLaw. (2021, June 10). Traceability Rule Will Break End-To-End Encryption; Can Put Privacy Of Journalists, Activists, Politicians At Risk: WhatsApp Tells Delhi High Court. https://www.livelaw.in/news-updates/whatsapp-delhi-high-court-traceability-end-to-end-encryption-privacy-risk-174743 

[3] Indian Kanoon. Section 79 in The Information Technology Act, 2000. https://indiankanoon.org/doc/844026/ 

[4] The LawGist. (2024, March 8). Exemption from Liability of Intermediary (Section 79 of Information Technology Act 2000). https://thelawgist.org/exemption-from-liability-of-intermediarysection-79-of-information-technology-act-2000/ 

[5] PRS India. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. https://prsindia.org/billtrack/the-information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021 

[6] LiveLaw. (2021, August 27). Delhi High Court Issues Notice To Centre On WhatsApp’s Plea Challenging Traceability Clause Under IT Rules 2021. https://www.livelaw.in/top-stories/delhi-high-court-notice-centre-whatsapps-plea-challenging-traceability-clause-under-it-rules-2021-180387 

[7] Supreme Court Observer. Fundamental Right to Privacy – Justice K.S. Puttaswamy v Union of India. https://www.scobserver.in/cases/puttaswamy-v-union-of-india-fundamental-right-to-privacy-case-background/ 

[8] MediaNama. (2021, May 27). Summary: WhatsApp alleges IT Rules are unconstitutional in lawsuit. https://www.medianama.com/2021/05/223-whatsapp-lawsuit-it-rules-indian-government/ 

[9] Software Freedom Law Center. (2023, May 17). Legal challenges to the traceability provision – What is happening in India? https://sflc.in/legal-challenges-traceability-provision-what-happening-india/ 

Published and Authorized by Vishal Davda

The post WhatsApp Challenges IT Rules 2021 on Traceability Clause: A Constitutional and Privacy Dispute in India’s Digital Regulation appeared first on Bhatt & Joshi Associates.