The union government is considering a proposal to make internet and social media firms “accountable” for the “algorithms” they deploy to tailor content based on the specific browsing history and profile of users, officials in the know told ET. India will be among the first few nations to mandate legal oversight of these proprietary codes if the proposal is included in the forthcoming Digital India Act (DIA).

The draft laws are expected to also contain provisions governing the use of emerging technologies such as advanced quantum computing, artificial intelligence and the metaverse among others, sources said.

“The idea is to prevent misuse of Indian citizens’ data. Even if the data is stored in India, it can be misused by highly advanced algorithms. That must be prevented,” said a senior government official.

The DIA will also include provisions
regulating the way in which large internet firms process data. This is to ensure they do not identify an individual user from an anonymised dataset. “Depending on the size, the type of intermediary and the space they operate in, there will be rules and regulations to ensure no user harm is done,” said officials aware of the matter.

Also read | Significant work done, draft Digital India Act framework by early 2023, says MoS IT


The draft rules, which are in the final stage of preparation, will be sent to the law ministry for review before it is made available for public consultation. The new rules will replace the 22-year old Information Technology Act, 2000, which has governed the country’s technology sector, till date.

Social media intermediaries such as Meta, Google and Twitter, which deal in large amounts of personal data on a day-to-day basis may also be asked to disclose the methods by which they process the data collected by them in specific cases. Such requests, however, will have to be backed by law enforcement agencies through court orders, according to the officials cited above.

Typically, algorithms define how social media users consume content. For instance, internet firms such as Twitter and Facebook display “news feeds” to users that are tailored to their location and interests. The proprietary codes can also analyse wide swathes of data to create specific profiles based on browsing or shopping history along with other factors such as gender, age, friends and family.

Earlier this year, the minister of state for electronics and information technology Rajeev Chandrasekhar had urged member states of Global Partnership on Artificial Intelligence (GPAI)
to work towards a framework to prevent misuse of artificial intelligence leading to user harm.

Earlier this year, in one of the first cases of its kind, short-video sharing platform TikTok told an Australian government committee that it would allow government officials to review its algorithm and test its source code. This was after the Australian government raised concerns over profiling of its citizens by the ByteDance-owned firm.

Upcoming Legislation


India’s DIA is modelled on the drafts of the country’s Telecom Bill and the Digital Personal Data Protection Bill that were released earlier this year. The DIA will be simple and concise in format, leaving space for executive rulemaking in the future given the changing technology landscape, sources said.

“We are not going to overload the DIA with too many legal regulations. Instead, it will be an umbrella framework with space for executive rules which can be updated as required with time,” they added.

In a departure from earlier practices, the Ministry of Electronics and Information Technology, which is drafting the DIA is likely to seek independent legal opinion on some of the contentious issues before sending the draft bill to the union law ministry for its opinion ahead of releasing to the public for wider discussion, sources said

The final draft of the DIA may be released for public consultations soon after the winter session of the Parliament is over, they added.

In the last one year, India has seen a rush of policies aimed at regulating the digital ecosystem. While the draft telecom Bill was released earlier this year, the government also
notified changes to the IT Intermediary Rules under the IT Act, 2000. Earlier this month, it also published a draft of the revised Data Bill after setting aside the Personal Data Protection Bill that was five years in the making.

On November 18 this year, the
IT ministry released a draft of the DPDP Bill for public consultation. In the latest draft, the government has proposed that if any organisation, data fiduciary or processor, handling the personal data of users fails to “take reasonable security safeguards to prevent personal data breach”, a penalty of up to Rs 200 crore will be levied.

The draft of the new data bill has
allowed the storage and transfer of data in “trusted” jurisdictions, which would be defined by the government from time to time. The revised bill also envisages the imposition of stiff financial penalties if organisations fail to contain data breaches or intimate users and the government about such incidents.

Stay on top of technology and startup news that matters. Subscribe to our daily newsletter for the latest and must-read tech news, delivered straight to your inbox.