New Delhi: The Delhi High Court last week pulled up search engines — like Google and Bing — for evading their statutory obligations to remove ‘non-consensual intimate images’, or objectionable content.
“They cannot be allowed to avoid their statutory obligations by stating that they do not have the necessary technology, which is patently false as has been exhibited during the course of hearing,” a single-judge bench of Justice Subramoniam Prasad said while issuing a slew of directions in the matter.
Justice Prasad was hearing a writ petition seeking blocking of certain websites that displayed intimate images of the petitioner.
It was the petitioner’s case that one Richesh Manav Singhal was circulating her non-consensual intimate images (NCII) on the internet. NCII refers to sexual content distributed without the consent of those depicted in the content — colloquially known as “revenge porn”.
Despite repeated requests to Google, Microsoft, YouTube, Vimeo, and the central government’s Cybercrime Portal, such content was not removed. She then approached the court to direct the removal of such content.
The Delhi High Court has now directed the removal of the said pictures and also held that the protection to search engines under the IT Act “is not absolute in nature”. It then issued a slew of directions to take care of such cases in the future.
The case
As per the petitioner’s claim, Richesh Manav Singhal had introduced himself to her as a British chartered accountant on social media and became close to her.
He had then visited her rented accommodation in Gurugram, Haryana, and allegedly forced himself upon her, clicked explicit pictures and transferred them to his device. She claimed that he had also engaged her minor son in various sexual acts and threatened to release her pictures online and kill her son if she did not pay him money.
She initially complied with his requests, giving him large sums of money and her jewellery. However, when she failed to continue doing so, he released her pictures on the internet. Despite the petitioner’s efforts to approach the grievance cells of various websites, the pictures were not taken down.
The ‘safe harbour’ provision
The search engines’ primary argument was that they had made all possible efforts to ensure that the content did not remain on its index, but they had no control over the content available.
They said they were not “originators” of the content but only intermediaries and enjoyed safe harbour protection under the law.
Section 79 of the Information Technology Act provides a “safe harbour” provision, which states that intermediaries (like Google or Microsoft Bing) will not be liable for third-party data made available by such platforms. However, they must maintain due diligence while discharging their duties, such as the removal of such content in a time-bound manner on request.
The IT rules require the removal of prima-facie (on first look) sexual content to be removed within 24 hours of the receipt of a complaint. They are also required to provide any relevant information within 72 hours of receiving an order in this regard.
The HC noted that according to the IT Rules, if any intermediary fails to observe their duties, the “safe harbour” provided will be vitiated. It said they would be liable for prosecution under the IT Act and the Indian Penal Code (IPC). Such statutory duty cannot be avoided and must be adhered to by search engines.
This comes at a time when the central government is mulling a relook at the ‘safe harbour’ provision for search engines.
‘Intermediaries are directed to cooperate unconditionally’
Justice Prasad noted that directions and recommendations are necessary to ensure that cases of such nature are dealt with in a manner that resolves the problem expeditiously and minimises the trauma to the victim.
He said that on approaching the court, an affidavit by the petitioner identifying the material must be placed in a sealed cover before the court. Grievance officers appointed by intermediaries must also be adequately sensitised and the definition of NCII must be interpreted liberally.
Further, the online Cyber Crime Portal must have a status tracker for complaints — from initiation to resolution. It should be available in regional languages and display contact details of District Cyber Police Stations in Delhi.
He added that Delhi Police must immediately register a complaint on receipt of such information and have an assigned officer to deal with intermediaries such as Google and Microsoft on such a subject.
“The intermediaries are directed to cooperate unconditionally as well as expeditiously respond to Delhi Police, and thereafter follow the time schedules under the IT Rules,” added Justice Prasad.
Fully functioning helpline, reporting mechanism
The court added that a fully functioning round-the-clock helpline must be established to report NCII content. Operators must also have access to a database with registered counsellors, psychologists, and psychiatrists due to the impact that dissemination of NCII content can have on mental health.
“Operators and individuals manning this helpline must be sensitised about the nature of NCII content and must, under no circumstances, indulge in victim-blaming or shaming the victim,” it added.
Intermediaries must also employ “hash-matching technology” to flag such content. It must also be ensured that the reporting mechanism for such offences under the IT Rules is conveyed to the users through a prominent display of the same, Justice Prasad said.
The court also added that the timeframe prescribed under the IT Rules for the removal of such content must be strictly followed.
“…If there is even minor deviation from the said time frame, then the protection from liability accorded to a search engine under Section 79 of the IT Rules cannot be invoked by the search engine,” it said.
‘Privacy of user/victim top priority’
The court said that a petitioner could not be expected to approach the authorities repeatedly regarding the same NCII. A token/digital identifier-based approach must be adopted, allowing the removal of such material even if it resurfaces.
The Court further recommended that the IT Ministry develop a third-party encryption platform for registering the NCII. Once “cryptographic hashes/identifiers” is assigned, such content can be automatically removed.
“Utmost importance should [be] accorded to the fact that the privacy of the user/victim must remain inviolable and the data collected for the purposes of using the hash-matching technology is not stored and misused,” it observed.
“On account of the vulnerability of the data involved, the platform must be subject to greatest of transparency and accountability standard,” it added.
Akshat Jain is a student at the National Law University, Delhi, and an intern with ThePrint.
(Edited by Zinnia Ray Chaudhuri)