QUESTIONS

1          Overview

1.1       Please describe the: (a) telecoms, including internet; and (b) audio-visual media distribution sectors in your jurisdiction, in particular by reference to each sectors: (i) annual revenue; and (ii) 3–5 most significant market participants.
India’s population and a competitive telecom market have led to a multi-fold increase in the number of subscribers in this sector.  Globally, India presently ranks second in terms of telecommunication subscriptions, internet subscribers and application downloads.

According to the Indian Brand Equity Foundation, as at March 31, 2019, India’s total telephone subscriber base stood at approximately 1,200,000,000 and broadband subscriber base increased from 412,600,000 in the year before to 581,510,000 as at March 31, 2019.

The Telecom Regulatory Authority of India (“TRAI”) noted that the gross revenue of the telecom sector stood at approximately USD 3,400,000,000.  As per the fact sheet on Foreign Direct Investment (“FDI”) issued by the Department for Promotion of Industry and Internal Trade (“DIPP”) in June 2019, approximately USD 37,000,000,000 has been invested in the telecommunication sector globally, and USD 8,400,000,000 of this amount was in India.

The media and entertainment industry in India grew at a compound annual growth rate of 13.4% during 2018 and is expected to advance at a similar rate for the next three years.  Digital media and entertainment platforms grew 42% in 2018 and had gross revenues of USD 2,340,000,000.

Major players in the telecom market in India include Bharat Sanchar Nigam Limited, Bharti Airtel, Vodafone Idea Limited and Reliance Jio Infocomm.  The major players in the media sector include Star India, Zee Entertainment Industries, Sony Entertainment and Disney India.  Netflix, Amazon Prime and Hotstar are some of the most prominent web and application-based media / streaming platforms in India.

1.2       List the most important legislation which applies to the: (a) telecoms, including internet; and (b) audio-visual media distribution sectors in your jurisdiction.
(a)                Telecommunications and the internet in India are governed broadly by the following pieces of legislation:

(i)                 Indian Telegraph Act, 1885 (“Telegraph Act”) and the rules framed thereunder;

(ii)               Wireless Telegraphy Act, 1933 (“Wireless Act”) and the rules framed thereunder;

(iii)             Telecom Regulatory Authority of India Act, 1997 (“TRAI Act”), and regulations, orders and directions issued by TRAI; and

(iv)             circulars and directions issued by the Department of Telecommunications (“DoT”).

(b)               The audio-visual distribution/broadcasting sector in India is governed broadly by the following pieces of legislation:

(i)                 Cable Television Networks (Regulation) Act, 1995 (“Cable TV Act”) and the rules framed thereunder;

(ii)               Cinematograph Act, 1952 and the rules framed thereunder; and

(iii)             circulars, directions and guidelines issued by the Ministry of Information and Broadcasting (“MIB”) and TRAI.

(c)                Aside from these specific pieces of legislation, the Information Technology Act, 2000 (“IT Act”) and the Indian Penal Code, 1860 (“IPC”) contain various general provisions that may be extended to this sector.

1.3       List the government ministries, regulators, other agencies and major industry self-regulatory bodies which have a role in the regulation of the: (a) telecoms, including internet; and (b) audio-visual media distribution sectors in your jurisdiction.
(a)                The telecom sector is largely regulated by the following bodies/organisations:

(i)                 DoT;

(ii)               TRAI;

(iii)             Wireless Planning and Coordination Wing of the DoT (“WPC”);

(iv)             Telecom Disputes Settlement and Appellate Tribunal (“TDSAT”); and

(v)               certain self-regulatory industry bodies and associations such as the Cellular Operators Association of India and the Infrastructure Providers Association.

(b)               The major regulatory agencies for the audio-visual media distribution sector in India are as follows:

(i)               TRAI;

(ii)               MIB;

(iii)             WPC;

(iv)             Central Board of Film Certification (“CBFC”); and

(v)               certain self-regulatory industry bodies such as the Advertising Standards Council of India (“ASCI”), News Broadcasters Association (“NBA”) and the Indian Broadcasting Foundation (“IBF”).

1.4       In relation to the: (a) telecoms, including internet; and (b) audio-visual media distribution sectors: (i) have they been liberalised?; and (ii) are they open to foreign investment?
(a)                The Indian economy was liberalised in the 1990s and moved away from a monopolised market regime.  FDI caps in the telecoms sector have been steadily liberalised ever since, and presently foreign investment of up to 100% is permitted in the telecom sector, with a prior regulatory approval required for investments exceeding 49%.

(b)   The FDI caps in the broadcasting sector vary depending on the service being rendered.  For instance, 100% FDI is permitted in broadcasting carriage services under the automatic route, while FDI up to 49% under the approval route is permitted in uplinking of news and current affairs television channels.  By way of a press release dated August 28, 2019, the central government has proposed to permit 26% FDI under the government route for uploading/streaming of news and current affairs through digital media.  The Department for Promotion of Industry and Internal Trade has sought views of the MIB on certain issues that have reportedly been raised by stakeholders over the government’s decision.

2          Telecoms

General

2.1       Is your jurisdiction a member of the World Trade Organisation? Has your jurisdiction made commitments under the GATS regarding telecommunications and has your jurisdiction adopted and implemented the telecoms reference paper?
Yes, India is a member of the World Trade Organisation (“WTO”) and has adopted the ‘WTO Basic Telecommunications Reference Paper on Regulatory Principles’ with reservations made under the General Agreement on Trade in Services (“GATS”).

India has made specific commitments under the schedule of GATS as well as exclusions under the most favoured nation principle.  India has excluded the application of the most favoured nation principle with certain countries based on their bilateral trade relations.  India has also committed to allow service providers of member nations to have a commercial presence in India provided the service providers obtain the relevant approvals from governmental authorities in India, adhere to the FDI regulations prescribed by the central government and obtain a licence from the DoT.

2.2       How is the provision of telecoms (or electronic communications) networks and services regulated?
The Telegraph Act provides for the maintenance and operation of telecommunication networks and services in India.  It provides that the central government has an exclusive right to establish, maintain and operate these services and networks in India.  The central government undertakes this responsibility on its own and through the issuance of licences to private telecom and network service providers and operators.

A licence is also required to be obtained from the DoT to establish a telegraphy apparatus or wireless telegraphy apparatus (defined in detail in question 3.3 below).

The setting up of telecom infrastructure in India requires registration as an Infrastructure Provider Category – I with the DoT.  Any establishment that seeks to provide any services relating to information technology such as call centres, network operation centre services and audio conferencing services are required to register with the DoT and obtain the requisite licences.

2.3       Who are the regulatory and competition law authorities in your jurisdiction? How are their roles differentiated? Are they independent from the government?
TRAI is the statutory regulator for the telecom and broadcasting sector in India.  TRAI is empowered under the TRAI Act to issue guidelines and directions that regulate tariffs, interconnection as well as setting quality of service standards.  TRAI, though a statutory body, functions autonomously.

Competition law in India is governed by the Competition Act, 2002 which establishes the Competition Commission of India (“CCI”). The CCI has the responsibility of eliminating practices which have an adverse effect on competition in India.  It also performs quasi-judicial functions by adjudicating and opining on competition-related issues.  The CCI is a statutory body, which functions autonomously.

The roles of TRAI and the CCI are clearly outlined in their respective statutes.  An overlap may occur while considering competition issues in the telecom sector.  In a recent case where there was a charge of colluding to deny entry into the market of a new player in the telecom industry, an issue was the fact that the CCI took cognisance of the matter, even though TRAI was already adjudicating upon it.  The Supreme Court of India has clarified and has held that TRAI should, at first instance, determine the jurisdictional issues and any question related to competition law would need to be determined by the CCI.

2.4       Are decisions of the national regulatory authority able to be appealed? If so, to which court or body, and on what basis?

The TDSAT has been established to adjudicate upon disputes and appeals made against any decision or order of TRAI.  Appeals to decisions and orders of the CCI lie with the National Company Law Appellate Tribunal (“NCLAT”).  Separately, remedies against legislation or decisions of the government or governmental authorities lie in the form of writ petitions / constitutional challenges, which may be raised by a petitioner before the jurisdictional High Court in each State or the Supreme Court of India.

Licences and Authorisations

2.5       What types of general and individual authorisations are used in your jurisdiction?

India currently has a provision to issue a unified licence (“UL”) to service providers.  The UL regime was introduced to reduce compliance burdens on service providers that are rendering services across multiple licenced areas and to ensure ease of access in obtaining licences to provide telecom services.  This system allows for a service provider to obtain several permissions of the central government under one broad UL.  Authorisation under the UL comprises for any one or more of the following services: (a) access service; (b) internet service (within certain categories); (c) national long distance service; (d) international long-distance service; (e) global mobile personal communication by satellite service; (f) public mobile radio trunking service; (g) very small aperture terminal closed user group service; (h) INSAT MSS-Reporting (“MSS-R”) service; and (i) resale of international private leased circuit service.

If a service provider wishes to operate in all of these sectors, an ‘all services’ authorisation can be obtained.  Facilitation of resale of existing telecom infrastructure at the service level has been helped by the introduction of a virtual network operator model.  This requires a separate licence under the UL regime where the DoT has made relevant guidelines.

Audio-conferencing services require separate licensing by the DoT and are currently not covered under a UL.

2.6       Please summarise the main requirements of your jurisdiction’s general authorisation.

Only an entity incorporated in India can apply for a UL.  This entity must also be compliant with the caps/limits placed under the FDI regulations for the relevant sector.  The applicant is required to pay the relevant fees and maintain a prescribed minimum equity and net worth as prescribed by the central government. The applicant is also required to furnish a bank guarantee, as prescribed from time to time by the relevant authorities.  Additional requirements that may be prescribed under local laws for the relevant sector must also be complied with.

An entity applying for the UL is responsible for the installation, networking, operation, and commissioning of its infrastructure and equipment.  However, virtual network operators may operate without using their own infrastructure.

2.7       In relation to individual authorisations, please identify their subject matter, duration and ability to be transferred or traded. Are there restrictions on the change of control of the licensee?

The UL is granted for a period of 20 years from the effective date of authorisation.  This may be renewed by the DoT, and such term would be co-terminus with the licence.  A virtual network operator is granted a licence of 10 years.

Assignment or transfer of a licence is not permitted without express consent of the DoT.  In the past, lenders have been permitted through tripartite agreements to be assignees of a licence.  There are generally no express restrictions on a change of control of a licence holder.

Public and Private Works

2.8       Are there specific legal or administrative provisions dealing with access and/or securing or enforcing rights to public and private land in order to install telecommunications infrastructure?

The Indian Telegraph Right of Way Rules, 2016 (“Right of Way Rules”) provides that prior permission is required for installation of telecommunications infrastructure on public land.  The Right of Way Rules provide for the manner and procedure in which an application has to be made for seeking this permission.

Establishment of infrastructure on private land requires governmental clearance for infrastructure-related issues such as structural stability, fire safety and any other conditions as may be required under applicable local laws.  Separately, an agreement will also need to be entered into between the owner of the private land and the entity establishing the telecommunications infrastructure, to govern the relationship for use of the private land.

Access and Interconnection

2.9       How is wholesale interconnection and access mandated? How are wholesale interconnection or access disputes resolved?

The UL governs all interconnection- and access-related issues.  It provides for licensees to adhere to regulations and directions issued by TRAI.  The Telecommunication Interconnection Regulations 2018 issued by TRAI regulates the facilitation of interconnection and provides for a dispute resolution mechanism.

2.10     Which operators are required to publish their standard interconnection contracts and/or prices?

Typically, all licensees will be required to publish their standard interconnection contracts.  TRAI has recently released the Telecommunication (Broadcasting and Cable) Services Register of Interconnection Agreements and all such other matters Regulations, 2019.  A ‘reference interconnection offer’ is a document issued by the service provider specifying terms and conditions on which the other service provider may seek interconnection.  A service provider is required to register this document, and any amendments or modifications in the prescribed manner.

2.11     Looking at fixed, mobile and other services, are charges for interconnection (e.g. switched services) and/or network access (e.g. wholesale leased lines) subject to price or cost regulation and, if so, how?

If a telecom service provider wishes to use another network, then they are required to pay interconnection usage charges.  There has been some dispute regarding these charges recently.  The telecom service providers had reportedly anticipated that TRAI would cease prescribing these charges in 2020, but a recent consultation paper issued by TRAI suggests otherwise.  Presently, there are no guidelines that specifically govern wholesale network access.

2.12     Are any operators subject to: (a) accounting separation; (b) functional separation; and/or (c) legal separation?

TRAI has imposed certain accounting separation requirements where telecom sector providers are required to furnish financial data and information.  This is used to analyse financial performance and profitability within the sector and also anti-competitive behaviour.  There are no requirements prescribing functional or legal separation for telecom service providers.

2.13     Describe the regulation applicable to high-speed broadband networks. On what terms are passive infrastructure (ducts and poles), copper networks, cable TV and/or fibre networks required to be made available? Are there any incentives or ‘regulatory holidays’?

TRAI has passed several regulations and notifications governing high-speed broadband and internet networks.  The Regulation on Quality of Service for Broadband Services, 2006, as amended from time to time, is applicable to all internet service providers, basic service providers, unified access service providers and cellular mobile telecom service providers, including public sector service providers such as Mahanagar Telephone Nigam Limited and Bharat Sanchar Nigam Limited, that provide broadband services in India.  The Broadband Regulations prescribe the benchmarks for quality of service parameters including: (a) service provisioning / activation time; (b) fault repair / restoration time; (c) billing performance; (d) response time for customer assistance; (e) bandwidth utilisation; (f) uptime / service availability; (f) latency and packet loss; and (g) customer perception of service.  TRAI has also passed regulations governing dial-up and leased line internet access services, and voice-over internet protocol.

At present, passive infrastructure, such as ducts, equipment chambers, poles and towers can be created and shared by infrastructure providers category-I (“IP-I”) as well as telecom operators.  However, the creation and sharing of active infrastructure (antenna, radio access network and feeder cable) is permitted to licensed telecom operators only.

Price and Consumer Regulation

2.14     Are retail price controls imposed on any operator in relation to fixed, mobile, or other services?

Price control has been imposed on TV broadcasters with regards to tariffs on channels and offering bouquet prices to consumers. In the telecommunication sector, except for tariffs for national roaming, rural telephony and leased lines, tariffs are not imposed by TRAI.  It is critical, however, that any tariffs fixed are non-discriminatory, non-predatory and transparent in nature.

2.15     Is the provision of electronic communications services to consumers subject to any special rules (such as universal service) and if so, in what principal respects?

Agreements executed pursuant to the UL provide for protection of consumer interest and have the following mandatory requirements:

(a)                services must be provided on a non-discriminatory basis;

(b)               continuity of service must be maintained;

(c)                itemised billing must be provided to the consumers;

(d)               appropriate systems to prevent frauds must be in place; and

(e)            reasonable notice must be provided before discontinuing a tariff plan.

Further, TRAI has issued the Telecom Consumers Complaint Redressal Regulations, 2012 which provides a platform for consumers to raise grievances.  TRAI acts as a facilitative body in this dispute resolution mechanism.

Numbering

2.16     How are telephone numbers and network identifying codes allocated and by whom?

The National Numbering Plan (“NNP”), as amended from time to time, governs the management of numbering resources in India.  The DoT allocates numbering resources to licensees in accordance with this plan.

2.17     Are there any special rules which govern the use of telephone numbers?

The NNP has set out a numbering scheme for different types of services.  While standard issued mobile telephony numbers in India are required to be 10 digits long, special access services numbers such as those used by the agencies of the government such as law enforcement, medical aid and fire safety vary from being three digits to four digits long.

2.18     Are there any obligations requiring number portability?

Licensees are mandated to provide the option of mobile number portability to their subscribers under the Telecommunication Mobile Number Portability Regulations, 2009 (“MNP Regulations”).  The MNP Regulations were recently amended and will take effect from November 11, 2019.  TRAI while issuing the amended 2019 MNP Regulations had mentioned that on aspects of associated costs, review of the per port transaction charges shall be taken up separately and these charges shall include the cost of generating unique porting codes by the mobile number portability service providers.

3          Radio Spectrum

3.1       What authority regulates spectrum use?

The WPC is the national radio regulatory authority responsible for frequency spectrum management and licensing.  The WPC comprises of various core committees/wings, including the Licensing and Regulation Wing, New Technology Group and the Standing Advisory Committee on Radio Frequency Allocation (“SACFA”).  The SACFA provides recommendations on major frequency allocation issues, formulation of the frequency allocation plans, advises on various issues related to the International Telecom Union (“ITU”) and attempts to address problems referred to it by various wireless users.

3.2       How is the use of radio spectrum authorised in your jurisdiction? What procedures are used to allocate spectrum between candidates – i.e. spectrum auctions, comparative ‘beauty parades’, etc.?

The National Frequency Allocation Plan (“NFAP”) released by the WPC acts as the regulatory and policy framework for the use and allocation of radio spectrums in India.  The NFAP has been formulated in accordance with the Radio Regulations treaty executed by India and other Member States of the ITU. The primary function of the NFAP is to provide for a mechanism for allocation of radio frequency spectrum to different radio communication services in India.  The NFAP covers a frequency range up to 3,000 GHz.

There are currently 41 radio communication services provided in India and the NFAP has been drafted to ensure that the frequency spectrum is divided into frequency bands and each band is allocated to one (or more) radio communication service.  The spectrum allocation is undertaken on an auction basis and the last auction was conducted in 2016.  The central government is reportedly planning to carry out a fresh auction in late 2019 or early 2020 for allocation of bands for 4G, 5G and certain other frequency bands in India.

3.3  Can the use of spectrum be made licence-exempt? If so, under what conditions?

Yes.  While the Wireless Act provides that a licence is necessary for any wireless telegraphy apparatus, the NFAP provides for over 30 licence-exempt bands..  A wireless telegraphy apparatus has been defined to mean any apparatus, appliance, instrument or material used or capable of use in wireless communication but does not include any such apparatus, appliance, instrument or material commonly used for other electrical purposes, unless it has been specially designed or adapted for wireless communication or forms part of some apparatus, appliance, instrument or material specially so designed or adapted.

The NFAP licence exempt bands have been approved by the central government through various rules and notifications. As an example, the central government has issued the Radio, Television and Video Cassette Recorder Sets (Exemption from Licensing Requirements) Rules, 1997 wherein a licence is not required to establish, maintain, work, possess or deal in radio, television and video cassette recorder sets, and special antenna (including dish antenna), satellite decoder and associated front-end converters, that are used or capable of being used for reception of transient images of fixed and moving objects by means of a television signal in television and video cassette recorder sets directly from satellites operating in the broadcasting satellite service or the fixed satellite service.

3.4       If licence or other authorisation fees are payable for the use of radio frequency spectrum, how are these applied and calculated?

The central government implements a Spectrum Usage Charge (“SUC”) on licensees providing mobile access services in India.  The SUC is computed as a certain percentage of the Adjusted Gross Revenue (“AGR”), which in turn is calculated in accordance with the relevant service authorisation under the relevant service licence.  As an example, the charges on a GSM operator working in a spectrum slab of up to 10.2 MHz is 6% of the AGR, while for CDMA operators working in a spectrum slab of up to 15 MHz it is 8% of the AGR.  TRAI has recently recommended implementing a flat SUC of 3% across all spectrums; however, this is yet to be implemented.

3.5       What happens to spectrum licences if there is a change of control of the licensee?

A change in control situation is typically governed by the terms of the agreement executed pursuant to the UL.  However, generally, there is no material impact on the occurrence of a change of control situation, provided the FDI regulations and conditions continue to be met.  The DoT has also issued specific guidelines governing the transfer and merger of licences or authorisations issued under the UL.

3.6       Are spectrum licences able to be assigned, traded or sub-licensed and, if so, on what conditions?

The Guidelines for Trading of Access Spectrum by Access Service Providers, 2015 (“Spectrum Trading Guidelines”) and the Guidelines for Sharing of Access Spectrum by Access Service Providers, 2015 (“Spectrum Sharing Guidelines”) govern trading and sharing of spectrum between two licensees respectively.  The Spectrum Trading Guidelines provide that the following conditions must be met to permit trading of the access spectrum:

(a)                The two access service providers must be operating under specific licences and in relation to certain demarcated spectrums.  Spectrum trading is presently permitted in certain bands and block sizes.

(b)               An outright transfer of the right to use the spectrum from the seller to the buyer is permitted.  Leasing of the spectrum is not permitted.

(c)              All dues have been cleared prior to concluding any agreement for spectrum trading.

(d)               The sale of the spectrum through trading is permitted only two years after the date of its acquisition through auction or spectrum trading or administratively assigned spectrum converted to tradable spectrum.

(e)                A non-refundable transfer fee of 1% of the transaction amount of the aforesaid trade or 1% of the prescribed market price, whichever is higher, shall be imposed on all spectrum trade transactions, to cover the administrative charges incurred by the central government in servicing the trade.

Frequency swapping / reconfiguration from within the assignments made to the licensees is not treated as trading of spectrum under the regulations.

4          Cyber-security, Interception, Encryption and Data Retention

4.1       Describe the legal framework for cybersecurity.

The cybersecurity regime in India is primarily governed by the IT Act read with the rules and regulations framed thereunder. The IT Act provides for legal recognition and protection for transactions carried out by means of electronic data interchange and electronic commerce, and facilitates electronic filing of documents with governmental agencies in India.

Cyber-crime activities are specifically dealt with under the IT Act and rules and regulations made thereunder such as the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013 (“CERT Rules”) and the Information Technology (Intermediaries Guidelines) Rules, 2011 (“Intermediaries Guidelines”).  The IT Act prescribes penalties ranging from fines to imprisonment for a varied number of actions that would include hacking, denial-of-service attacks, phishing, malware attacks, identity fraud and electronic theft, amongst others.

The IT Act provides that if any person without the permission of the owner or any other person in charge of a computer resource or network, dishonestly or fraudulently, accesses or secures access to a computer resource or downloads, copies or extracts any data from such system, or causes any computer to be affected by a contaminant or computer virus or damages any computer (including a computer system, network, data or database or any program on a computer), such person will be liable for damages, imprisonment and/or fines.  The IT Act also imposes similar punishments on any person that disrupts any computer, causes a denial of access, provides assistance to any person to facilitate access to a computer in contravention of the IT Act, charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, destroys, deletes or alters any information or diminishes its value or utility, or steals, conceals or destroys or alters any computer source code with the intention to cause damage.

In addition, other laws including tort law, property law, contract law, intellectual property law, consumer protection law and privacy law may also be used against cyber-crime activities, depending on the facts and circumstances of the case.

Recently, the Supreme Court of India struck down Section 66-A of the IT Act as unconstitutional, which punished the sending of “offensive messages” with imprisonment for a term of up to three years and with a fine.  The Supreme Court of India held this to be unconstitutional.

In the same case, the Supreme Court of India also read down Section 79 of the IT Act that imposed a duty on intermediaries to either remove or block access to material which is used to commit an unlawful act, upon being informed of such material.  The Supreme Court of India read down this provision to mean that an intermediary would only have to remove or block access to such material upon receiving actual knowledge that a court order had been passed directing it to do so.  This is referred to as the safe harbour doctrine.  Intermediaries have been defined under the IT Act (with respect to an electronic record) to mean any person, who receives, stores, transmits such record or provides any service with respect to that record.  The definition of intermediaries includes, but is not limited to, telecom service providers, network service providers, ISPs, web-hosting service providers, search engines, online payment sites, online auction sites, online market places, and cyber cafés.

In terms of the Intermediaries Guidelines, intermediaries are also prohibited from hosting or publishing any of the restricted information listed above and shall not knowingly: (a) initiate the transmission; (b) select the receiver of such transmission; (c) select or modify the information contained, with respect to any of the restricted information.  Intermediaries are required to act within 36 hours (and where applicable, work with the user or owner of such restricted information) to disable such information from its resources after it receives actual knowledge that a competent court has passed an order or the appropriate governmental authority has issued directions requiring that such information be disabled.

ISPs are also similarly obligated under guidelines issued by the DoT and the central government to take measures to prevent the flow of obscene, objectionable, unauthorised or other content infringing copyrights, intellectual property rights and international and domestic cyber laws in any form over the ISPs’ networks.

The Supreme Court of India has also upheld the ability of the central government to issue blocking orders for websites under the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009, after examining the rules and finding that there were adequate safeguards to ensure that these rules would not be an unreasonable restriction on the freedom of speech and expression.

Criminal action against cyber crimes can be undertaken only by involving law enforcement agencies in India.  Intermediaries, however, are entitled to take certain actions without any form of coordination with any element of government in certain cases.  Intermediaries are prohibited under the Intermediaries Guidelines from knowingly hosting, publishing or initiating a transmission, selecting a receiver of a transmission or selecting or modifying any information contained in a transmission in respect of any prohibited information.  Intermediaries are therefore entitled to disable or block access to such information (upon it coming to its knowledge that such information is being hosted, stored or published on or through its resources) without any element of government coordination.

Further, as indicated above, the IT Act provides for damages to the person who suffers loss due to a cyber crime by way of compensation for certain cyber crimes.  An action to recover such compensation may be initiated by the person who suffers such loss without prior coordination with a government authority.  The CERT Rules permit cybersecurity incidents to be reported by any person to the Indian Computer Emergency Response Team (“CERT-In”).  The CERT-In is a statutory body constituted by the central government by way of a notification dated October 27, 2009 issued under the IT Act.  The CERT-In operates under the Department of Electronics and Information Technology, Ministry of Communication and Information Technology of the central government.

However, specified types of cybersecurity incidents such as target-scanning / probing of critical networks / systems, unauthorised access of an IT system and data, malicious code attacks, identity theft, spoofing, phishing, etc., need to be mandatorily reported to CERT-In by service providers, intermediaries, data centres and body corporates.  CERT-In is empowered under the CERT Rules to call for information and give directions to service providers, intermediaries, data centres, body corporates and any other person which includes the power to direct disabling or blocking of specific information or infrastructure.  In the event of non-compliance with any directions of CERT-In, the body is empowered to file a complaint with a court for further action.

In addition to the penal provisions prescribed under the IT Act (the enforcement of which requires initiation of criminal action), Indian law provides law enforcement authorities with various other criminal mechanisms to pursue cyber criminals.  The IPC is a comprehensive code intended to cover most substantive aspects of criminal law.  Criminal activities punishable under the IPC do extend to the online cyberspace infrastructure.  For instance, Section 506 of the IPC provides that the offence of criminal intimidation will be punishable with imprisonment and/or fine.  Criminal intimidation on a cyberspace infrastructure will be covered under this Section and therefore punishable to the same extent.  According to the National Crime Records Bureau, a majority of the cyber crimes in India are related to cheating or data theft.

4.2       Describe the legal framework (including listing relevant legislation) which governs the ability of the state (police, security services, etc.) to obtain access to private communications.

The Supreme Court of India in its recent decision in Justice K. S. Puttaswamy (Retd.) and Anr. vs Union Of India And Ors. Writ Petition (Civil) No. 494 OF 2012 held that the right to privacy was a fundamental right available to all citizens of India under the Constitution of India.  However, this does not necessarily mean that governmental and regulatory authorities cannot access private communications and data.  While there is no overarching legislation governing the treatment of private communications and sharing of such data with governmental and regulatory authorities, certain specific legislations do provide the government with the right to access to private communications in limited scenarios.

An example of the government’s ability to access private communications is provided for under the contours of the Telegraph Act. The Telegraph Act empowers the government to restrict the transmission of certain messages and allows the government to intercept, detain and disclose if necessary messages, in the interest of public safety, national security or prevention of crime, subject to certain prescribed safeguards.  A licensee who has been granted a UL by the DoT is required to provide necessary facilities to the designated authorities of central government or the relevant State government for interception of the messages passing through its network.

The IT Act also provides for similar powers. The Information Technology (Guidelines for Cyber Café) Rules, 2011 require all cyber cafés operating in India to maintain a log register for a period of one year.  The log register is required to contain certain mandatory details and is required to be shared with the registration agency on a monthly basis showing date usage details of the computer resources.

It is also important to note that any officer in charge of a police station in India is empowered by the Code of Criminal Procedure, 1973 (“CRPC”) to seek the production of any document or information that he believes is necessary for the purposes of any investigation, inquiry, trial or other proceedings.  In essence, Section 91 of the CRPC provides that “whenever any court or any officer in charge of a police station considers that the production of any document or other thing is necessary or desirable for the purposes of any investigation, inquiry, trial or other proceeding under the CRPC by or before such court or officer, such court may issue a summons, or such officer a written order, to the person in whose possession or power such document or thing is believed to be, requiring him to attend and produce it, or to produce it, at the time and place stated in the summons or order”. While not usual practice, regulatory authorities may opt to use this provision of law to seek private data and communications stored with private companies, ISPs or intermediaries.

4.3       Summarise the rules which require market participants to maintain call interception (wire-tap) capabilities. Does this cover: (i) traditional telephone calls; (ii) VoIP calls; (iii) emails; and (iv) any other forms of communications?

The technical conditions applicable to a licensee under the UL requires every licensee to provide for requisite monitoring / interception facilities / equipment for each type of service at its own cost.  This would cover all forms of communications including traditional telephone calls, VoIP calls and e-mails.

The licensee is required to ensure that necessary provision (hardware/software) is available in their equipment for undertaking lawful interception and monitoring (“LIM”) from a centralised location.  Section 5(2) of the Telegraph Act provides as follows: “On the occurrence of any public emergency or in the interest of public safety, the Central Government or a State Government or any officer specially authorized in their behalf by the Central Government or a State Government may, if satisfied that it is necessary or expedient to do so in the interest of the sovereignty and integrity of India, the security of the State, friendly relations with foreign states or public order or for preventing incitement to the commission of an offense for class or messages to or from any person or class of persons or relating to any particular subject, brought for transmission by or transmitted or received by any telegraph, shall not be transmitted or shall be intercepted or detained or shall be disclosed to the Government making the order or an officer thereof mentioned on the order.”

The licensee is also required to ensure suitable redundancy in the complete chain of LIM equipment for trouble-free operations of monitoring of at least 480 simultaneous calls, as per the requirement, with at least 30 simultaneous calls for each of the designated security / law enforcement agencies.  Each MSC of the licensee in the service area is required to have the capacity for provisioning of at least 3,000 numbers for monitoring.  Presently, there are 10 designated security / law enforcement agencies in India.  For the purpose of interception and monitoring of traffic, the copies of all the packets originating from / terminating into the Customer Premises Equipment (“CPE”) shall be made available to the licensor / security agencies in India.

In relation to internet traffic, LIM systems of requisite capacities are to be set up by the licensees for internet traffic including internet telephony traffic through their internet gateways and/or internet nodes at their own cost, as per the requirements of the security agencies / licensor prescribed from time to time.  The cost of maintenance of the monitoring equipment and infrastructure at the monitoring centre located at the premises of the licensee is to be borne by the licensee.  In case the licensee obtains access spectrum for providing internet service / broadband wireless access using the access spectrum, the licensee is required to install the required LIM systems of requisite capacities prior to commencement of the service.

The licensee, while providing downstream internet bandwidth to an internet service provider is also required to ensure that all the downstream traffic of the ISP passing through the licensee’s network can be monitored in the network of the licensee.

4.4       How does the state intercept communications for a particular individual?

The framework for interception of communications has been summarised in our responses to question 4.2 and question 4.3 above.

4.5       Describe the rules governing the use of encryption and the circumstances when encryption keys need to be provided to the state.

While there are a number of sectoral regulations and rules that prescribe a minimum standard of encryption that must be met in relation to specific transactions, there is no legislation presently applicable in India that governs the use of encryption.

The IT Act broadly provides that the central government may, for secure use of the electronic medium and for promotion of e-governance and e-commerce, prescribe the modes or methods for encryption.  The central government had in 2015 prescribed a draft national policy on encryption which was subsequently withdrawn and has not been reintroduced.

The licence agreement executed between the ISPS and the DoT generally only permits encryption of up to 40 bits with an RSA algorithm or equivalent formula, without the prior approval of the DoT.  Higher encryption standards may require the approval of the DoT.  In June 2016, the Supreme Court of India refused to entertain a petition that sought a ban on services and applications such as WhatsApp which were using a higher degree of end-to-end encryption than what was mandated under law.  Presently, the position on using a higher degree of encryption standard in India is unclear as it is unregulated.

4.6       What data are telecoms or internet infrastructure operators obliged to retain and for how long?

The UL requires all licensees to maintain certain operational, commercial and legal documents for a specified period of time.  For instance, the licensee is required to keep a record of all the operation and maintenance command logs for a period of 12 months, which shall include the actual command given, who gave the command, when it was issued and the location from where such command was issued.  For a period of 24 months thereafter, the same information is required to be stored/retained in a non-online mode.

The licensee is also required to keep a record of all the software updates and changes.  The major updates and changes should also be informed to the licensing authority under the UL within 15 days of such change.

In 2009, the government of India permitted foreign carriers in India to conduct certain activities through remote access and imposed a condition that a complete audit trail of remote access activities would be maintained for a period of six months.

The licensee is also required to maintain a record of all commercial records / call detail records with regard to communications exchanged on the network, for a period of at least one year.

5          Distribution of Audio-Visual Media

5.1       How is the distribution of audio-visual media regulated in your jurisdiction?

The mechanism governing distribution of audio-visual media in India is platform-driven.  The Cable TV (Regulation) Act, 1995 governs the distribution of content through satellite television, while guidelines and directions issued by the MIB govern uplinking and downlinking of television channels.  The MIB has also issued guidelines which govern internet-protocol television (“IP-TV”).

The Cinematograph Act, 1952, and the rules framed thereunder, regulates cinema and its content.

5.2       Is content regulation (including advertising, as well as editorial) different for content broadcast via traditional distribution platforms as opposed to content delivered over the internet or other platforms? Please describe the main differences.

Regulation of content is mainly carried out by the MIB and the CBFC.  The ASCI governs advertising.  Other relevant legislations are the IT Act and the Copyright Act, 1957 which regulate distribution of content.  The IPC and certain other criminal legislations in India may become applicable for acts undertaken in relation to non-traditional distribution platforms including through the internet.

5.3       Describe the different types of licences for the distribution of audio-visual media and their key obligations.

As indicated in response to question 5.1, uplinking or downlinking of television channels in India requires the prior consent of the MIB.  In this regard, the MIB has prescribed an eligibility criteria which requires the applicant:  (a)  to be an Indian entity; (b)  to maintain the prescribed net worth; and (c) to be in compliance with the caps on FDI in the relevant sector.  Any such television channel must be registered with the MIB.  An overview of the duties prescribed under uplinking and downlinking guidelines are:

(a)             uplinking is only permitted using C or Ku Band.  Further, uplinking through the Ku Band is only permitted through Indian satellites;

(b)               the regulations laid down by the ASCI and the Cable TV Act must be followed;

(c)                a record of content must be maintained; and

(d)            prohibition from providing satellite TV signal reception to entities other than registered cable operators or DTH operators.

The MIB has also clarified that multi-system operations must ensure that channels prohibited by the MIB are not televised and all channels must be provided access to the platform on a non-discriminatory basis.

5.4       Are licences assignable? If not, what rules apply? Are there restrictions on change of control of the licensee?

Generally, there are no restrictions on a change of control so long as the FDI sectoral caps are complied with and all other statutory/regulatory requirements are met.  A licence is generally not assignable, however, without obtaining the prior consent of the MIB.

6          Internet Infrastructure

6.1       How have the courts interpreted and applied any defences (e.g. ‘mere conduit’ or ‘common carrier’) available to protect telecommunications operators and/or internet service providers from liability for content carried over their networks?

Indian information technology laws contain safe harbour provisions with respect to intermediaries.  An intermediary will not be liable for any third-party information, data or communication link made available / hosted by it, provided that: (a)(i) the function of the intermediary is limited to providing access to a communication system over which the information made available by third parties is being transmitted or temporarily stored or hosted; or (ii) the intermediary does not initiate the transmission, select the receiver of the transmission or select/modify the information contained in the transmission; and (b) has observed due diligence while discharging its duties and is in compliance with local law requirements.

However, if the intermediary does not meet the aforesaid conditions or has conspired, abetted, aided in or induced in the commission of the unlawful act (in relation to the third-party data or communication link) it will not be exempt from liability.  Similarly, if the intermediary fails to expeditiously remove or disable access to any information in relation to which it has received actual knowledge that a competent court or governmental authority has issued a direction for removal, the intermediary will not be exempt from liability.  As stated above, the intermediary is required to disable such information (including through working with the user or owner of such information, wherever possible) within 36 (thirty-six) hours of it obtaining knowledge of such information being stored/hosted or published on its computer system.

6.2       Are telecommunications operators and/or internet service providers under any obligations (i.e. to provide information, inform customers, disconnect customers) to assist content owners whose rights may be infringed by means of file-sharing or other activities?

Under the Intermediaries Guidelines, intermediaries are required to inform its users that in case of non-compliance by the user with the terms of use of the intermediary’s resource, privacy policy or user agreement, the intermediary is entitled to immediately terminate the user’s access or usage rights to the intermediary’s resource and to remove prohibited or non-compliant information.  Intermediaries are then entitled to suspend service or disable access to infrastructure immediately upon becoming aware that there has been non-compliance by the user.  ISPs are also obligated under guidelines issued by the DoT, to take measures to prevent the flow of obscene, objectionable, unauthorised or other content infringing copyrights, intellectual property right and international and domestic cyber laws in any form over the ISPs’ networks.

6.3       Are there any ‘net neutrality’ requirements? Are telecommunications operators and/or internet service providers able to differentially charge and/or block different types of traffic over their networks?

Yes.  TRAI had released the Prohibition of Discriminatory Tariffs for Data Services, Regulations, 2016 which prohibited any service provider from offering or charging discriminatory tariffs for data services on the basis of content.  Subsequently, TRAI provided to the DoT, its recommendations on net neutrality dated November 28, 2017 and a regulatory framework on net neutrality was adopted on July 31, 2018.

The policy framework adopted by the central government defines net neutrality as a concept of non-discrimination of internet traffic by intermediate networks on any criteria.  The core principle behind the policy framework was to restrict any form of discrimination, restriction or interference in the treatment of content, including practices like blocking, degrading, slowing down or granting preferential speeds or treatment to any content.  The various licences issued in India for providing internet services were accordingly amended to restrict a licensee from the following: (a) engaging in any discriminatory treatment of content, including based on the sender or receiver, the protocols being used or the user equipment; and (b) entering into any agreement, contract or arrangement with any person, natural or legal that had the effect of discriminatory treatment of content.

The policy framework did provide for certain exemptions and stated that any specialised services would not be included within the restrictions provided that: these specialised services were not usable or offered as a replacement for internet access services; and the provision of these specialised services was not detrimental to the availability and overall quality of internet access services.  The term specialised services was defined as services other than internet access services that are optimised for specific content, protocols or user equipment, where the optimisation is necessary to meet specific quality of service requirements.

Additionally, the net neutrality implications are not applicable in relation to measures adopted by a licensee that are proportionate, transient and transparent in nature and fall under any of the following categories: (a) reasonable traffic management practices; (b) provision of emergency services or any services provided during times of grave public emergency, as per the process laid down by the licensor or TRAI; (c) implementation of any order of a court or direction issued by the central government, in accordance with law; (d) measures taken in pursuance of preserving the integrity and security of the network and equipment; and (e) measures taken in pursuance of an international treaty, as may be specified by the central government.

6.4       Are telecommunications operators and/or internet service providers under any obligations to block access to certain sites or content? Are consumer VPN services regulated or blocked?

Please see our response to question 6.2 above.  Since VPN services are regulated in India and can be provided by licensees after obtaining certain authorisations under the UL, the obligations relating to the blocking of content (as highlighted in our response to question 6.2 above) could be attracted for VPN services as well.

Author:
Srinath Dasari, Partner