‘Consultation on data rules will be fruitless so close to elections’

Ministry of Electronics and IT plans to introduce Digital Personal Data Protection rules with a transition period of 6 months to 1 year, ahead of Lok Sabha elections.

The Digital Personal Data Protection (DPDP) rules will have a transition period of six months to one year, minister of state for electronics and information technology (MeitY) Rajeev Chandrasekhar has said, adding that while they are ready to be released for consultation, it may not be a fruitful exercise right now ahead of the upcoming Lok Sabha elections.

Rajeev Chandrasekhar (PT)

“Today to put the rules out before elections, it has no meaning because in two weeks time, there is going to be nobody in government who is not going to be busy with elections,” Chandrasekhar told HT in an interview. Given that ”they will come into effect only six months or one year down the road,” releasing them before the general elections, expected to be held in the summer, is “not a critical path issue”, he added.

The IT Ministry, since at least November 2023, has also been working on amending the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to deal with the issue of deepfakes. Given the imminent general elections, and Chandrasekhar’s statement on January 17 that the deepfakes related amendments would be notified in the following 7-10 days, are amendments to IT Rules expected before elections? “No,” he said. “I have clarified repeatedly, the advisory (issued by MeitY to social media platforms in 2023) clarifies that deepfakes are nothing but AI (artificial intelligence)-powered misinformation. You (platforms) need to deal with it. You (platforms) need to address it,” he said.

HT had also learnt that the MeitY is looking to include language related to algorithmic bias in amendments to the IT Rules. “That is a conversation we have had in the DIA (Digital India Act) context,” he said. However, the government could decide to make these amendments to the IT Rules in the third term if the new legislation takes a long time to come, he said.

This new law — the Digital India Act — was first mentioned in April 2022 by Chandrasekhar during an interview and since then, has been mentioned multiple times, but no white paper or draft has been released for consultation. Two public consultations on principles the draft Digital India Bill were held in 2023 but no document emerged subsequently. In report tabled in the Lok Sabha on February 8, the parliamentary standing committee on communications and information technology hauled MeitY up over the delays in enacting the Digital India Bill.

In the same report, the parliamentary committee also criticised the MeitY for the delay in drafting the rules under the Digital Personal Data Protection Act, 2023 — which despite being notified has not been enacted yet. Chandrasekhar had told the industry in a closed-door meeting in December 2023 that they would be released for consultation by the end of 2023 and be notified in the first week of January, HT reported on December 21.

But Chandrasekhar told HT, “We are never going to go with an artificial timeline for any legislation that needs to be future proof.

“We have taken extraordinary amounts of times to do every bit of consultation on whether it’s IT Rules, Cybersecurity Directions, not because we have nothing else to do. We think that these are seminal, very important pieces of regulatory milestones that we are putting on the ground. They will have to evolve. ... We have got the legislation [DIA] ready. We could have taken it to Parliament. But it is not our style to take the legislation and just ramrod it through Parliament. We want to take this [to the Parliament] after consultation with a lot of inputs, as we did for the pre-consultation,” he said.

Among others, the amendments to the IT Rules to govern the online gaming industry have also been in a state of limbo despite being enacted because the government has said the proposals for self-regulatory bodies presented by the industry are too industry-centric.

The IT Rules, themselves, still face a slew of petitions across Indian courts under multiple provisions, including against the government-run fact check unit, over the traceability provision, and over the section of the rules that governs streaming platforms and digital news publishers.

When asked if this is marking a period of regulatory uncertainty in the technology industry, Chandrasekhar disagreed. “If anything, today, the confidence of the industry in predictability, openness and transparency of how we interact with them is at a high. They have said this to me themselves even when I have to say tough things about deep fakes and misinformation. We do this openly through dialogue,” he said.

Then there is the tussle between different ministries over jurisdiction in cyber space. This, the minister said, is “inevitable” due to the “accelerated digitisation of all segments of our economy”, including in agriculture, medicine, science and technology, and education. “The fact is that while we as MeitY are the custodians of a safe and trusted Internet, every other ministry in every other domain has a digital footprint. And that footprint is only expanding, especially as more and more Indians join the internet,” he said.

“The nature of platforms is becoming much more complex and diverse. There is nothing to prevent a gaming platform from being an educational platform from being a messaging platform. Regulation in the old sense of regulating through functionality or regulating through domain will not work anymore,” he said. Competition issues, for instance, will be jointly regulated by the MeitY and Competition Commission of India.

To regulate AI, the government wants platforms and models to be legally responsible for the content they put out,, especially if it is harmful, he said. He cited a recent case where a Big Tech company was conducting public trials of their large language model. “You cannot use the Indian consumer as a guinea pig. You can probably do it in some other countries. On the Indian internet, you have to make sure your platform does not engage in unlawful activities, does not cause harm, and certainly should meet in letter and spirit the responsibility of safety and trust,” he said.