Tech policy in 2023: From DPDP Act to net neutrality concerns, deepfakes, new telecom law and more

The Indian government took several key decisions when it comes to protection of personal data, regulation of fake news, deep fakes and so on.

2023 has been a significant year for India when it comes to tech policy, with the country getting its first law dedicated to the protection of the personal data of citizens.

This law is intended to bring a paradigm shift in the way platforms handle citizen’s user data and so on.

However, apart from the Digital Personal Data Protection Act, there were other important developments in 2023 that one should know about.

In January, the government self-regulatory mechanism for online gaming, which mandated the creation of a self regulatory organisation (SRO) that would be responsible for certifying what is permitted as an online game in the country.

In April, the Ministry of Electronics and Information Technology (MeitY) notified the same rules, stating that multiple SROs will be allowed to determine whether a real-money game will be permitted to operate in India or not.

The rules are yet to be implemented as the ministry has not notified any SROs for the sector till now.

However, in December four leading gaming industry bodies signed a voluntary code of ethics for online gaming in a bid to build a “safe, trusted and accountable” sector with a focus on user protection.

In January 2023, MeitY released draft amendments to the Information Technology Rules 2023, stating that news identified as fake or false by the Press Information Bureau’s fact check unit needed to be removed from social media platforms.

This proposal was opposed by lawyers and digital rights groups, who raised concerns over possible infringement on freedom of speech and expression.

In April, the amendments were tweaked to state that a government-appointed organisation (rather than specifying PIB) will be tasked to identify any false or misleading content relating to the government.

The implementation of this rule has been stayed since stand-up comedian Kunal Kamra, Editors Guild of India and the Association of Indian Magazines filed petitions against this proposed rule in the Bombay High Court. On September 29, the court finished hearing arguments, and posted the matter for January 5, 2024, for pronouncement of the judgement.

Simultaneously, Moneycontrol also reported that the government was exploring a self-regulatory mechanism to fact-check non-government-related content.

In April, a controversy erupted after the industry body Internet and Mobile Association (IAMAI), whose members include both Indian companies and large foreign companies, argued against the need for a separate digital competition framework aimed at regulating "anti-competitive practices" by Big Tech companies, in a draft submission.

Indian entrepreneurs slammed IAMAI, saying that a digital competition law was indeed necessary and insinuating that the industry body's stance on the matter was a reflection of the composition of its leadership. The outgoing executive council of IAMAI was composed of representatives of Big Tech companies.

The controversy reached its climax when the results of the elections to IAMAI's governing council were announced in May.

The new 24-member governing council of IAMAI, which was voted in in May does not have any Big Tech members. Dream 11’s Harsh Jain is the new chairperson.

In August this year, the Digital Personal Data Protection Act was passed in both houses of Parliament to become a law.

The law has been sought by various sections of society ever since the Supreme Court deemed the Right to Privacy as fundamental – with reasonable restrictions – in 2016.

A version of the bill was introduced in 2018 and tabled in 2019, after which it was referred to a joint parliamentary committee. The panel studied the bill for two years and presented its report in December 2021. However, in 2022, the government withdrew the bill, citing compliance-related reasons.

After a few months, the government came out with the Digital Personal Data Protection Bill. The Cabinet approved the bill in July, clearing its way to be tabled in the ongoing monsoon session. This bill was passed in August amid protests from the Opposition.

On August 3, the Ministry of Commerce announced restrictions on the import of laptops, personal computers and tablets including ultra-small form factor computers, and servers.

The Directorate General of Foreign Trade (DGFT), the concerned body under the ministry which looks after import and export regulations, said in a notification that the import of such items will be permitted against a licence.

The immediate repercussion of this development was that Apple, Samsung, HP, and other major laptop and PC makers froze their imports to India. The government then stayed the implementation of the Union commerce ministry's curbs till October 31.

In October, the government relaxed these rules and told the industry that it would extend the unrestricted import of laptops, tablets, and computers till September 30, 2024.

For now, importers will have to feed in their organisation and import data for the past three years in an import management system.

In place of restrictions on imports, the government has developed a new import authorisation platform, where importers will have to feed in their import and other related details when it comes to laptops, tablets and so on.

In September, seven years after the Telecom Regulatory Authority of India (TRAI) ruled in favour of net neutrality, another debate reared its head over this principle which encompasses the idea that ISPs and telecom companies should treat all online traffic equally and refrain from any form of discrimination towards specific apps, websites and so on.

The recent controversy was triggered over a TRAI consultation on “Regulatory Mechanism for Over the Top Communication services and Selective Banning of OTT services”.

In the consultation, telecom companies proposed that internet companies pay them a network fee based on the traffic they generate, turnover threshold, number of users and so on.

Critics of these suggestions maintain that this would lead to higher operation costs for internet companies, which may subsequently, “drive smaller players out of the market, limit user choice and preference, or lead to a spike in usage or subscription fees”, digital rights group Internet Freedom Foundation said.

As a response, digital rights groups have revived a signature campaign that played a major role in the net neutrality debate that took place in 2015, and that ultimately led to TRAI ruling in favour of net neutrality in 2016.

In December, the government tabled and passed in Lok Sabha the Telecommunications Bill 2023, a piece of legislation that will supersede the existing regulatory framework for the telecommunication sector, based on the Indian Telegraph Act, 1885, the Wireless Telegraphy Act (1933), and the Telegraph Wires (Unlawful Possession) Act (1950).

In the previous version of the bill, the ambit of the regulation also included OTT services such as WhatsApp or Signal. However, in the bill that was tabled in the Parliament on October 18, OTT has not been included.

However, concerns have been raised by industry and civil society regarding the broad definitions in the new telecom bill. They claim that the broad definitions of keywords such as telecommunication services, message and so on, could be so broad that the bill’s scope could encompass internet-based services too.

Moneycontrol exclusively reported how global tech giant Meta was concerned that OTT applications, for instance, messaging apps such as WhatsApp or Signal, can come under the regulatory ambit of the bill.

In November, actor Rashmika Mandanna’s deepfake video went viral. The video, originally of British influencer Zara Patel, was digitally altered to make her face look like Mandanna’s. There was a huge uproar about the video, with netizens calling for the government to regulate AI.

Following that MeitY sent an advisory to social media platforms warning them that not removing deepfake content from their platforms can attract penalties, such as losing safe harbour provisions, and so on.

Later, Minister for Electronics and Information Technology Ashwini Vaishnaw and Minister of State Rajeev Chandrasekhar held one and two meetings, respectively, with the industry on the issue.

After the Vaishnaw meeting, the government decided that it would begin work on regulations dedicated to tackling deepfakes.

In an interview, Chandrasekhar reminded the industry that regulation of deep fakes falls under the IT Rules and that the companies will have to remove such content from the platforms. On December 26, MeitY issued another advisory to the industry urging them to comply with IT Rules.

Earlier in December, the government held a meeting with the industry conveying to them that the government intends to release the draft rules for the DPDP Act in the coming days and notify it in January.

If the DPDP Act in its current form provides a framework for the legislation, the rule-making process will shape its contours.

According to an unreleased version of the rules seen by Moneycontrol, the government plans to mandate social media, e-commerce and gaming companies to delete the personal data of inactive users after three years.

The rules may also exempt educational institutions, healthcare institutions and other government bodies from the restrictions that are mandated under the DPDP Act when it comes to children’s data processing.