(1) In addition to the due diligence observed under rule 3, a significant social media 3[intermediary, within three months from the date of notification of the threshold under clause (v) of sub-rule (1) of rule 2, and an online gaming intermediary that enables the users to access any permissible online real money game, shall] observe the following additional due diligence while discharging its duties, namely:—
(a) appoint a Chief Compliance Officer who shall be responsible for ensuring compliance with the Act and rules made thereunder and shall be liable in any proceedings relating to any relevant third-party information, data or communication link made available or hosted by that intermediary where he fails to ensure that such intermediary observes due diligence while discharging its duties under the Act and rules made thereunder:
Provided that no liability under the Act or rules made thereunder may be imposed on such significant social media intermediary 4[or such online gaming intermediary] without being given an opportunity of being heard.
Explanation.—For the purposes of this clause “Chief Compliance Officer” means a key managerial personnel or such other senior employee of a significant social media intermediary 5[or an online gaming intermediary, as the case may be,] who is resident in India;
(b) appoint a nodal contact person for 24x7 coordination with law enforcement agencies and officers to ensure compliance to their orders or requisitions made in accordance with the provisions of law or rules made thereunder.
6[Explanation.—In this clause, “nodal contact person” means the employee of—
(i) a significant social media intermediary, other than its Chief Compliance Officer; or
(ii) an online gaming intermediary, who is resident in India;]
(c) appoint a Resident Grievance Officer, who shall, subject to clause (b), be responsible for the functions referred to in sub-rule (2) of rule 3.
1 Ins. by G.S.R. 275(E), dated 6.4.2023.
2 Ins. by G.S.R. 275(E), dated 6.4.2023.
3 Subs. by G.S.R. 275(E), dated 6.4.2023 for “intermediary shall, within three months from the date of notification of the threshold under clause (v) of sub-rule (1) of rule 2,”.
4 Ins. by G.S.R. 275(E), dated 6.4.2023.
5 Ins. by G.S.R. 275(E), dated 6.4.2023.
6 Subs. by G.S.R. 275(E), dated 6.4.2023 for the existing Explanation. The Explanation, before substitution, stood as under:
“Explanation.—For the purposes of this clause “nodal contact person” means the employee of a significant social media intermediary, other than the Chief Compliance Officer, who is resident in India;”.
Explanation.—For the purposes of this clause, “Resident Grievance Officer” means the employee of a significant social media 1[intermediary or an online gaming intermediary, as the case may be,] who is resident in India;
(d) publish periodic compliance report every month mentioning the details of complaints received and action taken 2[thereon, and, in respect of a significant social media intermediary,] the number of specific communication links or parts of information that the intermediary has removed or disabled access to in pursuance of any proactive monitoring conducted by using automated tools or any other relevant information as may be specified;
(2) A significant social media intermediary providing services primarily in the nature of messaging shall enable the identification of the first originator of the information on its computer resource as may be required by a judicial order passed by a court of competent jurisdiction or an order passed under section 69 by the Competent Authority as per the Information Technology (Procedure and Safeguards for interception, monitoring and decryption of information) Rules, 2009, which shall be supported with a copy of such information in electronic form:
Provided that an order shall only be passed for the purposes of prevention, detection, investigation, prosecution or punishment of an offence related to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or of incitement to an offence relating to the above or in relation with rape, sexually explicit material or child sexual abuse material, punishable with imprisonment for a term of not less than five years:
Provided further that no order shall be passed in cases where other less intrusive means are effective in identifying the originator of the information:
Provided also that in complying with an order for identification of the first originator, no significant social media intermediary shall be required to disclose the contents of any electronic message, any other information related to the first originator, or any information related to its other users:
Provided also that where the first originator of any information on the computer resource of an intermediary is located outside the territory of India, the first originator of that information within the territory of India shall be deemed to be the first originator of the information for the purpose of this clause.
(3) A significant social media intermediary that provides any service with respect to an information or transmits that information on behalf of another person on its computer resource—
(a) for direct financial benefit in a manner that increases its visibility or prominence, or targets the receiver of that information; or
(b) to which it owns a copyright, or has an exclusive license, or in relation with which it has entered into any contract that directly or indirectly restricts the publication 1 Subs. by G.S.R. 275(E), dated 6.4.2023 for “intermediary,”.
2 Subs. by G.S.R. 275(E), dated 6.4.2023 for “thereon, and”.
or transmission of that information through any means other than those provided through the computer resource of such social media intermediary, shall make that information clearly identifiable to its users as being advertised, marketed, sponsored, owned, or exclusively controlled, as the case may be, or shall make it identifiable as such in an appropriate manner.
(4) A significant social media intermediary shall endeavour to deploy technology-based measures, including automated tools or other mechanisms to proactively identify information that depicts any act or simulation in any form depicting rape, child sexual abuse or conduct, whether explicit or implicit, or any information which is exactly identical in content to information that has previously been removed or access to which has been disabled on the computer resource of such intermediary under clause (d) of sub-rule (1) of rule 3, and shall display a notice to any user attempting to access such information stating that such information has been identified by the intermediary under the categories referred to in this sub-rule:
Provided that the measures taken by the intermediary under this sub-rule shall be proportionate having regard to the interests of free speech and expression, privacy of users on the computer resource of such intermediary, including interests protected through the appropriate use of technical measures:
Provided further that such intermediary shall implement mechanisms for appropriate human oversight of measures deployed under this sub-rule, including a periodic review of any automated tools deployed by such intermediary:
Provided also that the review of automated tools under this sub-rule shall evaluate the automated tools having regard to the accuracy and fairness of such tools, the propensity of bias and discrimination in such tools and the impact on privacy and security of such tools.
(5) 1[A significant social media intermediary and an online gaming intermediary who enables the users to access any permissible online real money game] shall have a physical contact address in India published on its website, mobile based application or both, as the case may be, for the purposes of receiving the communication addressed to it.
(6) 2[A significant social media intermediary and an online gaming intermediary who enables the users to access any permissible online real money game] shall implement an appropriate mechanism for the receipt of complaints under sub-rule (2) of rule 3 and grievances in relation to the violation of provisions under this rule, which shall enable the complainant to track the status of such complaint or grievance by providing a unique ticket number for every complaint or grievance received by such intermediary:
Provided that such intermediary shall, to the extent reasonable, provide such complainant with reasons for any action taken or not taken by such intermediary in pursuance of the complaint or grievance received by it.
(7) 3[A significant social media intermediary and an online gaming intermediary who enables the users to access any permissible online real money game] shall enable users who register for their services from India, or use their services in India, to voluntarily verify their accounts by 1 Subs. by G.S.R. 275(E), dated 6.4.2023 for “The significant social media intermediary”.
2 Subs. by G.S.R. 275(E), dated 6.4.2023 for “The significant social media intermediary”.
3 Subs. by G.S.R. 275(E), dated 6.4.2023 for “The significant social media intermediary”.
using any appropriate mechanism, including the active Indian mobile number of such users, and where any user voluntarily verifies their account, such user shall be provided with a demonstrable and visible mark of verification, which shall be visible to all users of the service:
Provided that the information received for the purpose of verification under this subrule shall not be used for any other purpose, unless the user expressly consents to such use.
(8) Where a significant social media intermediary removes or disables access to any information, data or communication link, under clause (b) of sub-rule (1) of rule 3 on its own accord, such intermediary shall,—
(a) ensure that prior to the time at which such intermediary removes or disables access, it has provided the user who has created, uploaded, shared, disseminated, or modified information, data or communication link using its services with a notification explaining the action being taken and the grounds or reasons for such action;
(b) ensure that the user who has created, uploaded, shared, disseminated, or modified information using its services is provided with an adequate and reasonable opportunity to dispute the action being taken by such intermediary and request for the reinstatement of access to such information, data or communication link, which may be decided within a reasonable time;
(c) ensure that the Resident Grievance Officer of such intermediary maintains appropriate oversight over the mechanism for resolution of any disputes raised by the user under clause (b).
(9) The Ministry may call for such additional information from any significant social media intermediary as it may consider necessary for the purposes of this part.
1[(10) An online gaming intermediary who enables access to its users to any permissible online real money game, shall display a demonstrable and visible mark of verification by an online gaming self-regulatory body on such permissible online real money game.
(11) While informing the users of its rules and regulations, privacy policy, terms of service and user agreements under clause (b) of sub-rule (1) of rule 3, an online gaming intermediary who enables the users to access any permissible online real money game, shall include the following information in respect of every such online games, namely:—
(a) the policy related to withdrawal or refund of the deposit made with the expectation of earning winnings, the manner of determination and distribution of such winnings, and the fees and other charges payable by the user;
(b) the know-your-customer procedure followed by it for verifying the identity of the users of such online game;
(c) the measures taken for protection of deposit made by a user for such online game;
and
(d) the framework referred to in rule 4A, relating to such online game.
(12) An online gaming intermediary shall, before accepting any deposit in cash or kind from any user for a permissible online real money game, identify such user and verify his identity:
Provided that the procedure required to be followed by an entity regulated by the Reserve Bank of India for identification and verification of a customer at the commencement 1 Ins. by G.S.R. 275(E), dated 6.4.2023.
of an account-based relationship shall apply, mutatis mutandis, in identification and verification of the users of such online gaming intermediary.
(13) An online gaming intermediary who enables the users to access any permissible online real money game shall not itself finance by way of credit or enable financing to be offered by third party for the purpose of playing such online game.]