Social Media Regulations: India Perspective

Introduction

Social media is a major concern for Cyber Security community simply because of its mammoth proportions and omnipresence. Early social media started with AOL or yahoo chatrooms. Today it is ubiquitous with Facebook, Twitter, Snapchats, Tik tok etc.  Its user base expansion has been exponential with the growth of Internet and the usage of hand-held devices. Today multitude of platforms exists who target all ages and entire spectrum of population unbiased and without much control on content. On one hand social media platforms have transformed how individuals communicate and connect with one another while on other It has blurred the lines of Privacy and between information and misinformation. It is also the biggest market place and influence communities at the same time it is most difficult to regulate. Thus, it is today’s biggest challenge of Law Enforcement Agencies (LEA) and the Governments at large.

Privacy Policy Requirement

Privacy can be difficult concept to define. The term is used without much quantification and qualification frequently in numerous contexts. My attempt to define it would be ‘Prevention of unauthorized usage or access of information that is personally Identifiable (PII) that must be linked to individual or a company (company being an entity). Freedom from being observed, monitored or examined without knowledge or consent can be another (consent being the operative word). There have been many legislative and regulatory compliance issues with regards to Privacy. Many Governments have tried their hands and multitude of laws and regulations exists especially in US and Europe. HIPAA (Health Insurance Portability and Accountability Act), HITECH (Health Information Technology for Economic and Clinical Health) Act, COPPA (Children’s Online Privacy Protection Act) of 1998, USA Patriot ACT (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism) in direct response to September 11,2001, European Union’s General Data Protection Regulation (GDPR) of 2016 ,Canadian PIPEDA (Personal Information Protection and Electronic Documentation Act are some of the laws enacted by advanced economies as they lead the change and felt the impact first. The Indian Government enacted the ITA (Information Technology Act -2000) which governs cybercrime and E- commerce. There has been recent effort to augment and Union cabinet has approved Digital Personal Data Protection (DPDP) Bill 2022(revised bill) to be tabled in the current monsoon season of parliament.

Challenges

Data Privacy and Management

Data is primary component for Information age and is one of the most valuable resources. Securing data is the most challenging role today. Companies are valued because of quantum of data it holds and profiling of demand using computation is major tactical tool available. Similarly, governments collect various data of its population for policy decision making but the same can be used by non-state actors or adversary to harm nations. Earlier the data collection exercise was human intensive and cost prohibitive but social media by its nature has enabled this data collection and profiling a very easy task. Storage of Data and its localization is another challenge for countries the world over.

Social Engineering Attacks

Social engineering is a type of attack that takes advantage of people's motivations and tendencies. People can make mistakes, be duped into doing harm, or purposefully break firm security, making them a weak link in security. Attacks using social engineering take use of aspects of human nature such a fundamental belief in the goodness of other people, a desire to help others, or a tendency to brag. It's critical to take into account the dangers that employees pose to your firm and to put security measures in place to reduce and manage such risks. Social engineering assaults typically take one of two forms: persuading a target to carry out an illegal action or persuading a target to divulge sensitive information. In almost every instance, social engineering involves an attacker persuading the victim to carry out an action or divulge information..

Hate Speech and Cyber Bullying

Individuals have suffered substantial psychological and emotional suffering as a result of hate speech, cyberbullying, and online harassment on social media. By putting stringent restrictions on the material posted on social media platforms and enforcing penalties on violators, social media regulation can assist to prevent the spread of hate speech and online harassment.

Social and Cultural Impact of social media

The impact of social media on society and culture has been significant and wide-ranging. One of the most notable effects has been on communication and social interaction. Social media has made it easier for individuals to connect with each other, regardless of their location or time zone, leading to the emergence of new forms of online communities and social networks.

These online platforms have facilitated the sharing of ideas, collaboration on projects, and support for one another. However, social media has also received criticism for its negative impact on mental health and well-being. Studies have shown that excessive use of social media can lead to anxiety, depression, loneliness, as well as self-esteem, and body image issues. Furthermore, social media has been linked to the spread of misinformation, cyberbullying, and online harassment, which can have detrimental consequences for individuals and communities. Constantly checking social media platforms can lead to overuse and neglect of real-world interactions. This can lead to feelings of loneliness, isolation, and depression. Misinformation, fake news, and propaganda are another potential danger of social media.

Dilemma of LEA

It has created a positive platform for police agencies to send and receive information, recruit resources and future officers, and engage with the public faster and more efficiently.  However, social media has also created an “infodemic” responsible for rapid, widespread information and disinformation. Recent examples of this include information relevant to COVID-19, election propagandas, targeted ad campaigns and police-involved critical incidents.  This spread of information has dramatically enhanced the rapid dissemination of newsworthy stories, quickly changing public sentiments on various issues, including those regarding the police.

Present Legal Frameworks

USA

The US legal framework on cyber space regulating social media derives its powers from 4^th Amendment of Constitution of US. US being the leader in field has multiple federal laws as mentioned above covering various aspects such as PHI (Public Health Information) HIPAA and HITECH, Children privacy (COPPA), LEA acts of CALEA (Communication Assistance for Law enforcement Act of 1994, USA PATRIOT 2001, Identity Theft and Assumption Deterrence Act of 1998 and various laws enacted by States. The umbrella of Laws, regulations and administrative notes regulate social media in US.

Germany

Germany passed the Network Enforcement Act (Netzwerkdurchsetzungsgesetz, NetzDG) (also called the “Facebook Act”). The law did not create any new duties for social media platforms but did impose high fines for noncompliance with existing legal obligations. The Network Enforcement Act is applicable only to social media networks that have 2 million or more registered users in Germany [1]. It obligates the covered social media networks to remove content that is “clearly illegal” within 24 hours after receiving a user complaint. If the illegality of the content is not obvious on its face, the social network has seven days to investigate and delete it. A social media network may be fined up to 50 million euros (about US$59.2 million) for noncompliance. The Network Enforcement Act has been very controversial, and has been criticized as unconstitutional, in particular with regard to free speech, and as not user-friendly, in particular with regard to the complaint mechanism. Since the law entered into force, several political parties have submitted proposals to amend or repeal it.

Indian Legal Framework

In India, the regulatory framework for social media is a collection of laws, rules, and regulations that are enforced by various government agencies such as the Ministry of Electronics and Information Technology (MeitY), the Department of Telecommunications (DoT), and the Ministry of Information and Broadcasting (MIB). With over 600 million internet users, India is the world's second-largest internet market, and social media has become a vital element of the country's digital environment. Yet, as the usage of social media platforms grows, there is growing worry about the dissemination of disinformation, hate speech, and other harmful content online.

Constitution of India 1950:       Like US the constitution of India provides freedom to every citizen that state cannot take away. Through Article 19(1)(a) of constitution provides freedom of speech and expression to every person but this right is not absolute, the government has imposed certain restriction on them under article 19(2) of Indian constitution. There is no specific mention of freedom of media Including social media but it flows through article 19(1)(a).

Indian Penal code 1860:           This act provides remedies and punishment in the cases where there is damage to individual by the action of other individual and any person who violated the laws will be dealt with the provisions mentioned below:

Section 124A: deals with sedition.

Section 153A: deals with promoting enmity

Section 295A: deals with intentionally insulting religion

Section 499: deals with defamation.

Section 505: deals with public mischief

Section 509: Disrespecting women's modesty.

 

Indecent representation of women (prohibition) Act,1998:       The section 3 and 4 of this Act protects and prohibits the act of pornography and also punished those people who circulates these types of obscenity material. section 292 and 293 of Indian penal code also award punishment for indecent representation of women.

 

The Information Technology Act is the principal law that by establishing a legal foundation for electronic governance and governs all areas of electronic communication, including social media. The Act also creates the Cyber Appellate Tribunal and the Cyber Regulations Advisory Committee. The Information Technology Act, 2000 was amended in 2008 to include Section 66A, which made it a criminal offense to send any information that was considered "grossly offensive" or "menacing" through any electronic communication device. In 2015, the Supreme Court of India struck down Section 66A, stating that it was violative of the fundamental right to freedom of speech and expression under Article 19(1)(a) of the Constitution of India. The court held that the provision was vague, overbroad, and had a chilling effect on free speech.

In 2018, the Information Technology Act was amended again to include Section 69A, which empowers the government to block public access to any information that it deems necessary in the interest of national security or public order. The government has enacted regulations governing the operations of social media businesses in the nation, including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Regulations, 2021. These regulations require social media intermediaries to hire Indian-based grievance officers to manage user complaints and remove specific sorts of information within 24 hours of receiving a complaint. The laws also require social media sites to use automated methods to identify and remove illegal information, such as defamatory, vulgar, or invasive privacy. Social media networks must also post monthly compliance reports that include information such as the number of complaints received and the actions taken.

Regulatory Framework of Print and Electronic Media In India

Print Media:

The Press Council of India is a statutory organization created under the Press Council Act of 1978. It is in charge of promoting and maintaining the standards of Indian newspapers and news agencies. The council has the authority to hear complaints against newspapers or journalists that violate journalistic ethics, and it has the authority to act against the offending party, such as imposing penalties or suspending publication. In addition to the Press Council, India has rules that govern the content of print media. The Indian Criminal Code is the most important of them, with prohibitions for defamation, obscenity, and incitement to violence.

Electronic Media:

In India, electronic media is governed by the Cable Television Networks (Regulation) Act of 1995 and the Telecom Regulatory Authority of India Act of 1997. These regulations govern the ownership, operation, and content of television and radio stations. In India, there are additional content rules in effect for electronic media. Restrictions against depicting violence, nudity, and bad language are among them. For infractions of these regulations, the ministry has the authority to levy penalties or cancel permits.

Scandals and Control measures

Facebook and Cambridge Analytica

A massive data privacy scandal involving Facebook and Cambridge Analytica was revealed in 2018, involving the alleged use of Facebook users' data to influence the 2016 US presidential election. Cambridge Analytica, a political consulting firm, is said to have obtained data from millions of Facebook users without their knowledge via a personality quiz app. This information was then used to create psychological profiles of users and to target them with political advertisements aimed at swaying their votes in favor of specific candidates, including Donald Trump. The scandal raised concerns about Facebook's data privacy practices and the potential for social media to be used as a tool for political manipulation.

In India, the government demanded that Facebook and Cambridge Analytica clarify their actions and disclose any information related to the exploitation of Indian users' data. The Indian government was concerned that Indian users' data might have also been used for political purposes or to influence Indian elections. The scandal highlighted the need for stronger regulations to protect users' data and prevent its unauthorized use for political purposes.[2]

Further initiatives have also been made by the Indian government to control social media sites. In 2018, the government demanded that Facebook and Cambridge Analytica clarify the alleged exploitation of Indian users' data. The information was allegedly used to sway the 2016 US presidential election. In India, Facebook has subsequently been involved in a number of additional scandals, including charges of prejudice and the dissemination of hate speech.

Banning of Apps

In 2019, the Indian government urged TikTok to delete improper content, resulting in the removal of millions of videos. In recent years, the government has also blocked other applications, including TikTok, PUBG, and WeChat, claiming national security concerns. These actions have raised questions about the government's intentions and commitment to free expression and online freedoms. Others have accused the government of using national security as a justification to censor information critical of it or its policies.

Possible ways to social media regulation:

Collaborative regulation

One idea is to create a collaborative approach to social media regulation. This might entail social media platforms collaborating with governments, civil society groups, and other stakeholders to create a set of best practices and rules for controlling harmful content on these platforms. Stakeholders may collaborate to produce more effective and nuanced solutions that take into consideration the complexities of social media.

Transparency

Another option is to promote transparency about how social media firms work. This might entail compelling businesses to reveal more information about their algorithms and data gathering techniques, as well as giving users more choice over how their data is utilized. Increased openness would serve to create confidence among users and authorities, as well as highlight areas where further regulation is required.

Algorithmic accountability

Given the role of algorithms in moulding the material that people view on social media, more algorithmic responsibility is required. This may entail adopting new norms and principles for algorithmic transparency, as well as procedures for independent audits and supervision of these algorithms. Social media firms may guarantee that their platforms are more equitable and inclusive by making their algorithms more open and responsible.

Multi-stakeholder governance

More multi-stakeholder governance methods to social media regulation are required. This might entail bringing together governments, civil society organizations, academia, and industry representatives to produce solutions that reflect all stakeholders' interests and concerns. Multi-stakeholder governance can aid in making social media regulation more inclusive and representative of varied viewpoints and demands.

International collaboration

Given the worldwide character of social media, further international cooperation on regulation is required. This might entail the creation of new international norms and guidelines for regulating social media, as well as more collaboration among national governments in exchanging best practices and regulatory methods. Countries can find more effective answers to the issues of regulating social media by working together.

Education and media literacy

Lastly, there is a need for more social media education and media literacy. This might include creating new programs and efforts to assist users in better understanding how social media works, identifying and reporting dangerous information, and protecting their privacy and security online. We can assist people become more educated and responsible online participants by enhancing their media literacy.

Conclusion

People's interactions, communication, and information consumption have been altered by social media. While technology has provided various benefits, such as increased connectedness and information access, it has also introduced new concerns, such as the propagation of disinformation and hate speech. Governments all over the globe are debating how to govern social media in order to handle these difficulties while also ensuring the safety and security of their population. India has put in place a regulatory framework for social media that consists of a patchwork of laws, rules, and regulations enforced by various government agencies.

Individuals can become more engaged and responsible social media users if they are taught how to recognize and report disinformation, hate speech, and other harmful content. This might decrease the load on intermediaries while also ensuring that social media platforms are utilized responsibly and ethically. Finally, social media regulation in India must strike a balance between the need to safeguard public safety and preventing disinformation from spreading.

 

Reference

[1]        Library of Congress Germany: Network Enforcement Act Amended to Better Fight Online Hate Speech https://www.loc.gov/item/global-legal-monitor/2021-07-06/germany-network-enforcement-act-amended-to-better-fight-online-satepeech

[2]        Internet : Wikipedia

India’s Foray in Personal Data Protection Law

        Digital India regulatory framework and laws that is not only are just but at same time fuels growth expectations, protect rights and interest of its citizens at the same time be Business friendly. Any regulation/law is restrictive in nature. India’s digital growth has been exponential which has led to the concern about Personal Data misuse and exploitation has also in tune. Union cabinet has approved Digital Personal Data Protection (DPDP) Bill 2022(revised bill) to be tabled in the upcoming monsoon season of parliament. Though, the consultation process for the bill is over by the Ministry of Electronics and Information Technology (MeitY), the final form will be available after rectification by Parliament. Privacy being fundamental right (as recognized in Aug 2017) is constitutional guarantee. In tune DPDP bill recognizes its need to protect Personal Data, at the same time be not restrictive for Businesses to use personal data lawfully. It lays out obligations and duties on part of Data Fiduciaries (Businesses), Processors (processing data on behalf of fiduciary) and Principals (whose personal data the business wishes to process, including children).

Legality

         The act is applicable on processing Digital personal Data within territorial boundaries of India. It is also applicable for processing of digital data outside territory of India, if done in connection to profiling or to that of any economic activity being done on Indian Territory. Exception being it is not applicable to non automated processing of personal data, offline data, data processed for domestic purposes and records that are over 100 years.

Impact on Business 

        It would be obligatory on fiduciary to give Principals an itemized notice in clear and plain language containing description of personal data sought purpose of obtaining it and obtain consent from principal. The consent needs to be obtained for pre dated data also.

        The Principals Rights to withdraw consent, manage/review consent, rectification, erasure and restricted processing are inherent. This is in tune with EU’s GDPR data subject’s privacy rights would require changes at operational level as well.

        Businesses would have to create Consent Managers (which would enable principals manage their consent) through interoperable platforms which would be registered to the Data Protection Board (DPB) [Section 7(7)]. MeitY has already released a specification for electronic consent ver 1.1 and so has the financial sector with its own Consent Managers for data sharing .The technical solution can vary from sector to sector and business to business.

        Significant fiduciary classified as such will appoint a DPO (Data Protection Officer) based in India and also appoint independent Data auditors for compliance.

        DPDP will lead to revision of Internal Data Policies and review/updating of IT, Data Protection, Data Retention and cyber security policies of companies. It will be reasonable that companies build adequate safeguard through policies, procedures and technologies to handle and process data.

People’s Privacy and Rights 

    User centricity, compliance with extant provisions of laws and granular control lead to right that principal can obtain from fiduciary confirmation/summary/identities of processors processing the data, rights to amendment (rectification), erasure, updation and grievance reprisal mechanism.

Transfer of Data 

        The Data Fiduciary may, where consent of the Data Principal has been obtained, may share, transfer or transmit the personal data to any Data Fiduciary/Processor to process personal data on its behalf under a valid contract. Central Govt may notify countries or territories outside India to which a Data Fiduciary may transfer personal data, in accordance with such terms and conditions as may be specified.The Bill has shedded the rigidity of cross border data transfer which plays a crucial role in easing data flows (helps corporations). The Bill has excluded data localisation requirements which will help in enabling small, medium and large enterprises to store data across geographies resulting in reduction of costs and time spent on localised data storage.

Children’s Age 

        For the purpose of act the age of child has been pegged at 18 years which will lead fiduciaries to obtain consent of parent/guardian of the principal. This age can be debated as it may seem to be on higher side. Post obtaining this parental consent, the Businesses will be required to ensure that such processing does not cause harm to children [Section 10(2)]. Businesses are also prohibited from undertaking tracking and behavioral monitoring of children or targeted advertisements towards them [Section 10(3)].

Conclusion 

        It remains to be seen in what form the bill becomes the law. Whatever be the changes the bill is going to be milestone in way our personal data is handled. Further, it remains to be seen how the DPB and government with its notifications and amendments give final shape to the law. It will lead to cost increase in business at the same time create job opportunities in the field. What GDPR enactment brought to Europe and the business there same can be expected in India.