A New ‘Dawn Raid’ To Keep You Awake – India’s Safe Harbor Law

Since India’s new intermediary laws were notified on February 25, 2021, they have existed in a curious vacuum. Everybody concerned went on with life as usual. The Government did not issue any FAQs, etc., to show how to comply with these. Courts, asked to opine on constitutionality, have not done so as yet. Most surprisingly, digital business majors and social media companies did not let slip if they agreed or disagreed with the rules, or how they proposed to deal with them.

Perhaps social media companies, in particular, thought that a ‘wait and watch’ approach would work and that there was a chance the enforcement of the new 2021 rules would be as lax as that of the earlier 2011 ones (or that an Indian court would ‘bell the cat’ for them, and strike down or read down these rules, a la Shreya Singhal).

This approach did not work out. The Ministry of Electronics and Information Technology (MEITY) and the Ministry of Information and Broadcasting (MIB) issuing a letter asking SSMIs and digital publications to (on the same day as the rules came into effect!) furnish details of local officers and their addresses signify the direction that enforcement intends to take.

Some ‘Skin in the Game’, by Law

The 2011 safe harbor rules were ineffective in part because they did not allow the Indian Government to ‘catch hold’ of Significant Social Media Intermediaries (SSMIs). Most SSMIs did not have employees or offices in India. Given their outsize influence, and despite some "voluntary" compliance by SSMIs, this regulatory imbalance could not have endured for much longer.

With the 2021 rules, the government has breached the biggest protection for foreign SSMIs, i.e., that data is held outside of India and they did not have offices or employees here. Requests will now be made to, and action taken against, local officers and offices now mandated by law. These rules achieve what the government wanted to achieve in a uniquely Indian way – police officers turning up at offices with warrants.

There is no way for foreign SSMIs to avoid having ‘skin in the game’ now. Everyone who has dealt with LE in India will have war stories of ‘dawn raids. These raids can be for income tax, trademark enforcement, weights and measures, et al. A new ‘dawn raid manual’ is now required for “intermediary liability raids”.

How did we get here, and what the future holds

This situation has arisen because SSMIs have been unable (or unwilling) to ‘bell the cat’ by challenging the provisions likely to hurt most, those involving local officers and offices. Now, a raft of enforcement action against local officers may result, and the potential damage that can be caused may be substantial. An SSMI’s CCO will look to their options carefully, given that personal liability is at stake. The question also remains whether such officers will be empowered to action the LE request. If they are simply ‘post boxes’, they remain ‘fall guys’ in this whole picture, asked by LE to comply, but without the power to do so unless HQ deigns an approval.

Undoubtedly, there will be valid LE requests which ought to now, theoretically, be responded to quicker; all LE requests should not be treated with suspicion. Most of them are valid and it is a fact that the Internet will and should be regulated to an extent, as even the most die-hard fans of “free” Internet will acknowledge now. But most will agree that a “dawn raid” is not the way to try and regulate the world wide web.

Equally, this short-circuited route to get compliance will raise questions on the sophistication of Indian law enforcement, whether due process is being followed, and if this enables “invalid” requests to slip through. Whether the requests for information or action are legal or not is almost academic, if the Government has a method to force compliance quickly before courts can intervene. By agreeing to appoint local officers and provide local contacts, SSMIs have opened the door to potentially unfettered LE demands, without giving themselves the time or opportunity to resist such demands (or to even check whether they are valid or not). SSMI’s legal counsels will now face a stark choice, requiring them to decide whether to deny LE requests based on a constitutional or jurisdictional challenge (which may take months to resolve (if at all)) or to comply, given the risk of immediate enforcement against employees in India.

There has been talking of a balance needed to be struck between regulation and intermediary protection. The 2021 rules don’t strike that balance, and this was expected. It was also expected (maybe in error) that SSMIs would mount a serious legal challenge to some onerous provisions. Their failure to do this means that this balance has not been achieved and the field is set against SSMIs.

(Vikram Jeet Singh is a partner at BTG Legal. It is a market-leading firm advising technology and internet giants on various regulatory issues. Views are personal.)