Legal Aspects

Hacking of Smart Phones

Shabbir Chunawalla

Smart phones use operating systems — either iOS of Apple or Android in most of other phones. In their software, the hacking firms try to spot vulnerabilities to sneak into the phone and access the data. Two Israel-based companies, NSO Group making Pegasus and QuaDream, have been using reportedly such vulnerabilities to hack the phones for their clients.

Generally, hackers introduce the malware when the user clicks a malicious link. However, the Israel-based firms use the zero-click technique. Both used similar software exploits called ForcedEntry. It is a computer code designed to leverage a set of specific software vulnerabilities. It provides a hacker unauthorized access to data.

These vulnerabilities could be hidden deep inside the instant messaging platform. Security researchers call ForcedEntry as most technically sophisticated hacking.

Apple fixed the flaws in late 2021, thus rendering both the software ineffective.

Apple has field a suit against NSO Group claiming that the company has violated user’s terms and conditions, and the suit is in its initial stages. NSO has denied any such wrongdoing.

Snooping companies sell the software to governments to protect them against national security threats. However, journalists and human right activists document the abuse of such software.

Data Protection Bill

Shabbir Chunawalla

The joint committee on Personal Data Protection (PDP) Bill, 2019 presented its report on 16 Dec. 2021, recommending changes to draft legislation. It has recommended to change the name of the legislation to Data Protection Bill, as it seeks to include both personal and non-personal data under a single law.

Non-personal data is the data which is with entities like e-commerce companies. They are general profiles, rather than individual personal data.

The Committee was concerned about the capacity of the government departments to protect the large volume of data they collect. It will have to establish SOPs in the ministries and departments etc. to protect the huge amount of data collected. The government will be a significant data fiduciary. It means an entity that controls the storage of data and defines the permitted ways in which it can be processed. Data protection officer must be appointed by every significant data fiduciary.

There will be one data protection authority for personal and non-personal data. Chairperson and members of data protection authority must be appointed within 3 months of the notification of the Act. Sensitive and critical personal data must be brought to country from foreign entities. It is called data localisation.

Social media platforms will be treated as publishers on certain counts. When they are not acting as intermediaries, they are liable for content they host.

These would be restrictions on cross-border data flow.

The Committee has provided a time-frame of 24 months for the implementation of the Data Protection Act.

The Committee has suggested that data fiduciaries dealing exclusively with children’s data must register themselves with data protection authority.

Privacy Breaches

Shabbir Chunawalla

In a democracy, there should be a balance between the power of the state and the autonomy of the individual. Of course, no fundamental right is absolute, there should be justification when a fundamental right is curtailed. In the US there should be a court order to breach any citizen’s privacy. In India too, such a provision can be introduced. Besides, all instances of such authorized breach of privacy must be subjected to a review by a Parliamentory Committee.

If state agencies indulge in surveillance of citizens for prosecuting or for protecting national security, they cannot be given carte blanche to violate citizen rights.

Social media platforms should too be held accountable for the content they host just like other publishers. That will lessen the burden on content moderation.

Cryptos and RBI

Shabbir Chunawalla

Cryptos are matter of concern for the RBI on four possible counts.

Monetary Sovereignty

Cryptos erode monetary sovereignty especially with stablecoins which are pegged to a reserve asset such as a dollar, one to one. Bitcoins were okay, as these were backed by no more than algorithm.

The reserve backing provides gravitas to pull transactions away from the national currency. RBI loses its ability to set the interest rate, calibrate money supply and control inflation.

Facebook’s proposed stablecoin Diem could become a viable competitor to fiat currencies.

Dollar-backed stablecoins are advantageous to the US and therefore the US will be disinclined to regulate them.

Conduits for Capital Outflows

Investors put domestic money in crypto exchanges, and exit out of it abroad in a hard currency. China is reported to have lost as much as $80 billion through cryptos in 2020. Therefore, it banned all crypto transactions.

Financial Instability

Cryptos are highly volatile, e.g. Bitcoin fluctuates between $1000 to $70000 in recent times. It is akin to Tulip mania of the 17th century. Such volatility makes banks vulnerable.

Loss of Seigniorage Revenue

RBI buys assets such as government securities. It pays for those by printing currency. The returns earned by RBI are called seigniorage revenues. Ultimately, it accrues to the government. Cryptos could eat into this revenue.

Facebook and Hate Speech

Shabbir Chunawalla

A whistle blower Frances Haugen, also a former employee, levelled charges against Facebook that it did not do enough to prevent the spread hate speech and misinformation.

In fact, Facebook allocated only 13 percent of its total budget to counter hate speech and misinformation in 2020 outside the US, including India.

Monica, VP, Content Safety Says they have a network of 10 fact checkers working in 11 Indian languages. There are similar number of fact checkers in the US market.

There are reviews of problematic content in 20 Indian languages. In addition, there are hate speech classifiers, which is an automated detection technology in regional languages.

SRBs for Digital Media

Shabbir Chunawalla

There are publishers of online curated content (OTTs) and digital news websites. The Ministry of Information and Broadcasting (MIB) will soon issue a charter spelling out the norms of proposed self-regulating bodies (SRBs) for this sector. These SRBs have been mandated under the new IT rules/laws which govern the digital media.

The digital publishers will be the members of these SRBs. Under the guidelines, 2021, a three-tier content regulation system has been proposed for streaming platforms.

SRBs will refer to the I&B ministry content on such platforms that may ‘incite commission of a cognisable offence relating to public order or circumstances under Sec 69(A) of the IT Act.’

SRBs will also see to adherence to the code of ethics by their member publisher, address grievances, and appeals and ensure compliance from their members.

After notification, OTT players have formed two SRBs – one under the aegis of Internet and Mobile Association of India (IAMAI) and another under the Indian Broadcasting Foundation (IBF). It has decided to change its name to Indian Broadcasting and Digital Foundation (IBDF).

Senior ministry officials are discussing with different industry bodies to make the implementation simpler.

The Ministry will issue orders to the publisher based on the recommendations of IDC or inter-departmental committee. This committee has members drawn from ministries of women and child development, home affairs, law and justice, electronics and IT, external affairs and defence. IDC meets once in 2-3 months. IDC henceforth will have domain experts too.

The IDC will have the power to issue warnings. It can also publishers to delete, modify, content, and even block matters that are covered under the IT Act.

In emergency case, the Centre can also issue interim order of blocking suo moto. It places such order with 48 hours before the IDC.

All orders to block must be placed before a review committee.

If smaller digital portal cannot afford a grievance officer, an existing senior officer can perform such functions.

A time frame of one year is proposed for implementation.

ASCI’s Guidelines for Social Media Influencer Marketing

Shabbir Chunawalla

In May 2021, ASCI has issued final guidelines for influencer marketing, three months after sharing its draft guidelines. Influencers must label branded posts, or else both parties are accountable. The disclosure label should be clear, identifiable and prominent. The guidelines also define influencers and what establishes a connect between the influencer and advertiser. It identifies the words permissible to call it a sponsored post.

It advises the influencers to satisfy themselves that the advertiser is in a position to substantiate the claims made in the advertisement.

ASCI will detect the violations by using AI-based tools.

Influencers feel that mostly the advertisers are responsible for being reluctant to put disclosure labels.

ASCI is a self-regulatory body. The guidelines are not legally binding. It can guide and mediate, but it cannot compel.

Social Media and IT Guidelines

Shabbir Chunawalla

As we know, in India, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 were notified on February 25, 2021. Vide these rules, the Government had granted three months to comply with new IT rules. Therefore, a significant social media intermediary has to appoint a chief compliance officer, a nodal contact person to coordinate with law enforcement agencies and a resident grievance officer. The social media intermediary has to identify the first originator of problematic content. A significant intermediary means one with over 5 million registered users. On May 25, 2021, these guidelines came into force. Social media can lose their intermediary status (pursuant to Rule 7 of the IT Rules, 2021) if they do not comply with the guidelines. This could make them responsible for third party content hosted on their platforms. The protection had been granted to them under section 79(1) of the IT Act, 2000. It enables intermediaries to protect themselves from liability for any third-party information, data or communication link made available or hosted by the intermediaries.

significant social media intermediaries have made representations to the government prior to May 25, 2021 deadline. They have asked for an extension. The Government is expected to work with the stakeholders to formulate S0Ps or standard operating procedures. There is a possibility of the imposition of criminal liability on the employees of the intermediary. This is at odds with the modern corporate liability jurisprudence that leans replacing the criminal liability with monetary penalties in the interest of ease of doing business and better enforcement.

This development is not to be seen in isolation. It is a global trend. In the initial days of Internet, platforms were given immunity from liability by the US for content posted by users. This law, Section 230 of the Communication Decency Act, provided a global template. The playing field was deliberately kept uneven between mainstream media and social media. This social media could become a dominant player which hurt credible journalism and news dissemination. Today social media operates with rights but without responsibilities. Even in the US, the relevance of Sec-230 is being questioned.

WhatsApp has challenged the new intermediary guidelines in Delhi High Court stating that the ‘new requirement under Rule 4(2) is ‘unconstitutional, illegal, and ultra vires the IT Act.’

It contends that this forces it ‘ to break end-to-end encryption on its messaging service, as well as the privacy principles underlying it, and infringes upon the fundamental rights to privacy and free speech of the users’.

The Government says new rules will be used in exceptional cases, e.g. prevention, investigation or punishment of very serious offences. It will not affect the normal functioning of WhatsApp. The rule to trace the first originator of information is mandatory for each and every significant social media intermediary.

Wider public consultation is called for before implementation. The Rules gave only three months. The EU’s General Data Protection Regulation allowed for two years.

Apart from social media platforms, the newb rules affect Slack, Zoom, LinkedIn, YouTube and mainstream news sites, which carry reader comments.

Under these rules any content flagged by the government must be taken off within 36 hours of notice. Though this would curb the fake news, there is likelihood of its being misused. Of course, all fundamental rights are subject to reasonable restrictions, but the issue is who decides what is reasonable. In the new rules, the final arbiters are the government officials. Maybe, an independent institutional mechanism is called for to bridge the trust deficit.

Social media firms now run the risk of facing increased litigation from users and social activists on content perceived as offensive. On non-compliance with the guidelines, the management becomes vulnerable as they lose the immunity to the third party content.

Google has filed a case in HC saying it is not a social intermediary and is an aggregator.

To follow the government guidelines the Big Tech companies are appointing nodal officers. However, this has tax implications. These companies pay tax on cost plus basis, on about 8-10 % of total revenue. There is an equalisation levy — 6 per cent on advertising revenue and 2 per cent on digital transactions. This could change since appointment of nodal officers changes their legal statues to permanent establishment (PE) in India subject to Indian tax laws. They are seeking a way around this. In defence, they can contend that the compliance is mandated and does not create PE status.

Except Twitter, others have complied with the guidelines and have appointed the requisite officers. Facebook has even submitted a report of the takedowns after receiving the complaints and investigating them.

Pharmacopoeias

Shabbir Chunawalla

About 20 countries have Pharmacopoeias out of the 200 countries. They operate with varying degrees of autonomy with their regulatory agencies. Many are part of the government, and work in close association with their regulatory agency, e.g. Japan, China, Brazil, Mexico and the Russian Federation. The European Pharmacopoeia in Europe is elaborated by the European Pharmacopoeia Commission, which draws its membership from the countries participating in the Council of Europe (and not the European Union). The British Pharmacopoeia may be able to remain in the Council of Europe. The US Pharmacopoeial Convention operates as a private non-profit body in the US (separate from the FDA). The USP was created in 1820 whereas the FDA was created in the early 20th Century. Pharmacopoeias began working together in harmony in the early 1990s.

Drug Regulation in India

Shabbir Chunawalla

India’s regulation of drugs and cosmetics is a parallel set up at the central and state level — we have the Central Drugs Standards Control Organisation (CDSCO) and State Drugs Control Departments (SDCDs). Such a dual system has its demerits. There is overlapping and there is no uniformity in interpretation and implementation of the Act. Ideally, there should be a single monitoring system.

The CDSCO acts as the Central Licensing Approving Authority for grant or renewal of licenses of blood banks, drug testing labs, vaccines, medical devices, sera, large volume parenterals and new drugs. The inspection is joint inspection. The report is given to the State Licensing Authority. It grants or renews the license. It is forwarded upwards to DCGI for ratification.

There is joint inspection for granting certificates to exporters. The testing samples drawn by central officers are sent to central testing labs and by the state officers to the state testing labs.

Capacity is assessed by joint inspection. CDSCO functions as a co-ordinating authority with states. Prior to granting of licenses in Form 28, 28 A. 28B, 28D or 28DA, there is joint inspection. In a proposed amendment to the Act, it is suggested that license in respect of 17 categories of drugs will be taken up by CDSCO. In respect of other categories of drugs, the powers vest with the state authorities.

There are two wings in the regulatory authorities — enforcement wing and laboratory wing. In enforcement wings, the functionaries are Drugs Controller General (India), Joint Drugs Controller (India), Deputy Drugs Controller (India), Assistant Drugs Controller (India) and Drug Inspector (India). In the lab wing, there is Principal Scientific Officer equivalent to Joint Drugs Controller, Chief Scientific Officer equivalent to Dy. Drugs Controller, Scientific Officer or Government Analyst equivalent to Assistant Drugs Controller and Junior Scientific Officers equivalent to Drug Inspector.

The organisation has five broad functions — enforcement and new drugs, import-export, pharmacovigilance and blood bank, lab and intelligence, HR and admn. medical services each headed by Joint Drugs Controllers. These report to DCGI who in turn reports to the Government. All of these are assisted by deputies and assistants at the middle level. At the bottom of the pyramid, we have drug inspectors and junior scientific officers.

Ideally, the central and state authorities should merge into one drug regulatory system. It will enable effective implementation of the Drugs and Cosmetics Act, 1940.