Major Amendments to the IT Act: From ITAA 14008 to the IT Rules 140141

India’s digital landscape has undergone dramatic transformation over the past two decades, and with it, the laws governing cyberspace have evolved considerably. From the original Information Technology Act of 2000 to the sweeping amendments of 2008 and the controversial rules introduced in 2021, the government has attempted to balance online safety with fundamental freedoms. Yet these changes have sparked intense debates about privacy, free speech, and the extent of state power in the digital realm.

The 2008 amendment: expanding the reach of cyber law 🔗

When the Information Technology Amendment Act came into force in 2009, it represented a significant expansion of India’s cyber law framework. The original 2000 Act primarily focused on e-commerce and digital signatures, but the 2008 amendment recognized the growing complexity of online crimes and introduced several new penal provisions.

New offenses and enhanced penalties 🔗

The amendment introduced multiple provisions addressing emerging cyber threats, including identity theft, child pornography, and cyber terrorism. Section 66A became particularly prominent, criminalizing the sending of offensive messages through computers or communication devices. Meanwhile, Sections 67 and 67A dealt with publishing obscene and sexually explicit content in electronic form.

Perhaps most significantly, the amendment strengthened government surveillance capabilities. Sections 69 and 69A granted authorities enhanced powers to intercept information and block public access to content. These provisions allowed the government to issue directions for interception or blocking in the interest of national security, public order, or preventing certain offenses.

Intermediary liability takes center stage 🔗

Section 79 of the original Act, which addressed intermediary liability, also received attention in the amendment. This provision established that intermediaries like social media platforms and internet service providers would not be held responsible for third-party content on their platforms, provided they exercised due diligence and complied with government orders to remove illegal content.

When free speech meets cyber law: the Section 66A controversy 🔗

Almost immediately after its implementation, Section 66A became a lightning rod for criticism. The provision made it a punishable offense to send messages through a computer or communication device that were deemed grossly offensive, caused annoyance or inconvenience, or contained false information. The penalty was imprisonment of up to three years.

The vague and subjective language of the section led to widespread misuse. Police across India began arresting people for social media posts that were merely critical of politicians or expressed unpopular opinions. One particularly egregious case involved two women in Maharashtra who were arrested for a Facebook post questioning a city shutdown following a political leader’s death.

A landmark Supreme Court judgment 🔗

These arrests sparked public outrage and led to multiple petitions in the Supreme Court challenging the constitutionality of Section 66A. In the landmark 2015 case Shreya Singhal v. Union of India, the Court struck down Section 66A as unconstitutional, holding that it violated the fundamental right to freedom of speech and expression guaranteed under Article 19(1)(a) of the Constitution.

The Court’s reasoning was clear and forceful. It found that terms like “annoyance,” “inconvenience,” and “grossly offensive” were unconstitutionally vague and gave law enforcement arbitrary power to determine what speech was permissible. The provision swept too broadly, capturing protected speech along with genuinely harmful content. Importantly, the Court also held that the restrictions imposed by Section 66A did not fall within the reasonable restrictions permitted under the Constitution.

A zombie law that refuses to die 🔗

Despite being declared unconstitutional in 2015, Section 66A has had a troubling afterlife. Research showed that nearly twice as many cases were filed under Section 66A in the six years after it was struck down than in the period before the judgment. Police, prosecutors, and even courts continued to use the dead law to prosecute citizens, demonstrating a shocking ignorance of or disregard for the Supreme Court’s ruling.

This led to further litigation, with the People’s Union for Civil Liberties returning to the Supreme Court in 2021 seeking enforcement of the original judgment. In 2022, the Court finally ordered that all pending cases under Section 66A be closed and that no new cases be registered under the provision.

Enter the IT Rules 2021: a new regulatory framework 🔗

While the Section 66A controversy was slowly winding down, the government was preparing a new set of regulations that would fundamentally reshape India’s digital ecosystem. The Information Technology Rules of 2021, notified in February of that year, created an extensive framework for regulating social media intermediaries and digital content publishers.

Dual objectives: accountability and grievance redressal 🔗

The government framed the 2021 Rules as serving two primary purposes. First, they aimed to increase accountability of social media platforms by imposing various due diligence obligations. Platforms with more than five million registered users in India were classified as significant social media intermediaries and subjected to additional requirements.

These significant intermediaries had to appoint three key personnel who must be residents of India: a Chief Compliance Officer to ensure adherence to the rules, a Nodal Contact Person for coordination with law enforcement, and a Grievance Redressal Officer to handle user complaints. This last requirement addressed the second major objective of establishing a robust grievance redressal mechanism for users.

The traceability mandate 🔗

Perhaps the most controversial aspect of the 2021 Rules was the requirement for messaging services to enable identification of the first originator of information. This traceability provision applied to significant social media intermediaries that primarily provide messaging services, and could be invoked by court order or by competent government authorities for investigating specific offenses.

The rules specified that such orders could only be issued for preventing, detecting, or investigating serious offenses related to national security, public order, or sexual violence. They also stated that less intrusive means should be considered first. However, critics argued that enabling such traceability would require platforms to fundamentally alter their architecture and retain metadata about all messages permanently.

The backlash: concerns over rights and overreach 🔗

The 2021 Rules immediately faced criticism from multiple quarters. Civil liberties organizations, tech companies, and legal experts raised alarm about various provisions that they believed threatened fundamental rights.

Privacy concerns and the traceability debate 🔗

The traceability requirement became a flashpoint for privacy advocates. To identify the first originator of any message, platforms would need to store information about who sent what to whom for potentially indefinite periods. This goes against the principle of data minimization, a cornerstone of privacy protection that holds that only necessary data should be collected and retained.

End-to-end encrypted messaging services like WhatsApp argued that implementing traceability would require them to break encryption, fundamentally compromising user privacy. The question arose: is lowering the privacy of all users proportionate to the goal of investigating potential criminal content from a few individuals?

Free speech in the crosshairs 🔗

Critics also pointed to several provisions that could chill free expression. The rules required intermediaries to remove content deemed harmful or patently false within strict timelines, but the definitions of prohibited content were seen as overly broad and subjective.

Terms like “harmful to child,” “insulting on the basis of gender,” or information that is “patently false or misleading” but “may reasonably be perceived as a fact” lack clear definitions. This ambiguity could lead to over-compliance by platforms eager to avoid liability, resulting in the removal of legitimate speech. The threat of losing safe harbor protection creates strong incentives for intermediaries to err on the side of takedowns rather than protecting user expression.

Questions of executive overreach 🔗

Legal scholars raised fundamental questions about whether the 2021 Rules exceeded the rule-making powers delegated to the government under the parent Information Technology Act. The Rules defined new categories of intermediaries and imposed obligations on them, including the traceability requirement, which had no basis in the original Act.

The creation of oversight mechanisms for digital news publishers raised additional concerns. Unlike print media, which is overseen by the independent Press Council of India, digital news publishers would be subject to oversight by the Ministry of Information and Broadcasting. This raised fears about government control over online journalism and the potential for selective enforcement against critical voices.

Moreover, the government retained the power to classify any intermediary as significant based on an undefined “material risk of harm” to sovereignty, security, or public order. This discretionary power could theoretically be used to bring smaller platforms under stricter regulations without clear criteria or safeguards.

What do you think? As India continues to grapple with balancing online safety and fundamental freedoms, how can regulations be designed to protect citizens from genuine harms without enabling censorship? And in an age where much of our public discourse happens online, who should have the power to decide what speech is acceptable?

References

1. https://www.techtarget.com/whatis/definition/Information-Technology-Amendment-Act-2008-IT-Act-2008
2. https://www.scobserver.in/journal/section-66a-the-dead-law-that-still-haunts-india/
3. https://globalfreedomofexpression.columbia.edu/cases/shreya-singhal-v-union-of-india/
4. https://globalfreedomofexpression.columbia.edu/updates/2023/01/third-time-lucky-section-66a-and-the-afterlife-of-strategic-litigation/
5. https://prsindia.org/billtrack/the-information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021
6. https://www.eff.org/deeplinks/2021/04/indias-strict-rules-online-intermediaries-undermine-freedom-expression