AI Weds E-commerce

S. No.

Concerned Advisory

Particulars

1.

Advisory 2(a)

All intermediaries / platforms to ensure that the use of Artificial Intelligence model(s) or algorithm(s)* on or through its computer resource does not permit its users to host, display, upload, modify, publish, transmit, store, update or share any unlawful content as outlined in Rule 3(1)(b) of the IT Rules, 2021 or any provision under the IT Act.

2.

Advisory 2(b)

All intermediaries / platforms to ensure that its computer resource in itself or via the use of Artificial Intelligence model(s) or algorithm(s)* do not permit-

(i) any bias or discrimination, OR

(ii) threaten the integrity of the electoral process

3.

Advisory 2(c)

All intermediaries / platforms to ensure that any use of under testing / unreliable Artificial Intelligence model(s) or algorithm(s)* or further development of such models should be made available to users in India only after appropriately labeling the possible inherent fallibility or unreliability of the output generated.

It has also been advised that the mechanism of 'consent popup' or equivalent mechanisms may be used to explicitly inform the users about the possible inherent fallibility or unreliability of the output generated.

4.

Advisory 2(d)

All intermediaries / platforms to inform the users including by way of its “terms of services” and “user agreements” about the consequence of dealing with unlawful information, including:

· disabling of access to or removal of such information

· suspension or termination of access or usage rights of the user to their user account

with punishment under applicable law.

5.

Advisory 3

Intermediaries through its software or any other computer resource permits or facilitates synthetic creation, generation or modification of a text, audio, visual or audio-visual information, in such a manner that such information may be used potentially as misinformation or deepfake, it has been advised that such information created, generated, or modified through its software or any other computer resource is labeled or embedded with permanent unique metadata or identifier, in a manner that such label, metadata or identifier can be used to-

· identify that such information has been created, generated or modified using computer resource of the intermediary.

· In case any changes are made by a user, the metadata should be so configured to enable identification of such user or computer resource that has effected such change.

NOTE: Advisory 3 uses the term “Intermediaries” and not “Platforms”

6.

Advisory 4

Non compliance of the IT Act and / or IT Rules, 2021 could result in consequences including but not limited to prosecution under the IT Act, 2000 and other criminal laws, for intermediaries, platforms as well as their users.

S. NO.

Relevant Statute

Relevant aspects

1.

Information Technology Act, 2000

(“IT Act”)

1. Section 67 prescribes punishment for publishing or transmitting obscene material in electronic form. As per Section 67, whoever publishes or transmits (or causes to the same) in the electronic form, any material which is lascivious or appeals to the prurient interest or if its effect is such as to tend to deprave and corrupt persons who are likely, having regard to all relevant circumstances, to read, see or hear the matter contained or embodied in it is an offence.

2. The person publishing or transmitting such material shall be punished with imprisonment for a term which may extend up to 3 years along with fine up to Rs. 5 lakhs for first conviction and for any subsequent conviction the offender shall be punished with imprisonment for a term which may extend up to 5 years along with fine up to Rs. 10 lakhs.

3. Section 67A of the IT Act further prescribes punishment for publishing or transmitting of material containing sexually explicit act, etc., in electronic form with imprisonment (in case of first conviction) for a term which may extend to 5 years along with fine up to Rs. 10 lakhs. In the event of any subsequent conviction the punishment would be imprisonment for a term which may extend to 7 years along with fine up to Rs. 10 lakhs.

4. Whereas Section 67B of the IT Act further prescribes punishment for publishing or transmitting of material depicting children (not completed 18 years) in sexually explicit act, etc. including creating text or digital images, collects, seeks, browses, downloads, advertises, promotes, exchanges or distributes material in any electronic form depicting children in obscene or indecent or sexually explicit manner. The punishment on first conviction is imprisonment for a term which may extend to 5 years along with fine up to Rs. 10 lakhs. In the event of subsequent conviction imprisonment for a term which may extend to 7 years along with fine up to Rs. 10 lakhs.

5. It must be noted that the provisions of Section 67, 67A and 67B do not extend to any book, pamphlet, paper, writing, drawing, painting representation or figure in electronic form where the publication is proved to be justified as being for the public good on the ground that such book, pamphlet, paper, writing, drawing, painting representation or figure is in the interest of science, literature, art or learning or other objects of general concern or if the same is kept or used for bona fide heritage or religious purposes.

2.

Bhartiya Nyay Sanhita, 2023

(“BNS Act, 2023”)

6. Under the BNS Act, 2023 in terms of Section 294 (Sale, etc., of obscene books, etc.) obscenity may take place over the content even when displayed in an electronic form.

7. The Supreme Court in Sharat Babu Digumarti v. Govt. (NCT of Delhi)^[1], has held that when the IT Act in various provisions deal with obscenity in electronic form, it also covers the offence under the then Section 292 of the Indian Penal Code (“IPC”).

8. However, it must be noted that the BNS Act, 2023 includes the term “electronic form” in addition to the requirement which were envisaged under the earlier law i.e. IPC (Section 292 IPC).

3.

Indecent Representation of Women (Prohibition) Act, 1986

(“Indecent Representation Act”)

9. The Indecent Representation Act defines “indecent representation of women” as-

“Section 2(c)- “indecent representation of women” means the depiction in any manner of the figure of a woman, her form or body or any part thereof in such a way as to have the effect of being indecent, or derogatory to, denigrating, women, or is likely to deprave, corrupt or injure the public morality or morals.”

10. Section 4 of the Indecent Representation Act mandates that no person shall produce or cause to be produced, sell, let to hire, distribute, circulate or send by post any book, pamphlet, paper, slide, film, writing, drawing, painting, photograph, representation or figure which contains indecent representation of women in any form.

11. The Supreme Court in Aveek Sarkar v. State of W.B.^[2], has observed that when can a picture of nude/semi-nude woman can / cannot be called obscene. The Court observed as follows:

23. …A picture of a nude/semi-nude woman, as such, cannot per se be called obscene unless it has the tendency to arouse the feeling of or revealing an overt sexual desire. The picture should be suggestive of deprave mind and designed to excite sexual passion in persons who are likely to see it, which will depend on the particular posture and the background in which the nude/semi-nude woman is depicted. Only those sex-related materials which have a tendency of “exciting lustful thoughts” can be held to be obscene, but the obscenity has to be judged from the point of view of an average person, by applying contemporary community standards.

12. Contravention of Section 4 would make the person liable to be punished with imprisonment for a term which may extend to 2 years (on first conviction) along with fine up to Rs. 2 thousand. In the event of second or subsequent conviction with imprisonment for at least a period of 6 months but which may extend to 5 years along with fine not less than Rs. 10 thousand which may extend to Rs. 1 lakh.

4.

Protection of Children from Sexual Offences Act, 2012 (“POCSO Act”)

13. Under the POCSO Act, “child pornography” includes any visual depiction of sexually explicit conduct involving a child (i.e. below the age of 18 years) which includes photograph, video, digital or computer generated image indistinguishable from an actual child, and image created, adapted, or modified, but appear to depict a child.

14. POCSO Act further envisages that using a child (i.e. below the age of 18 years) in any form of media including programme or advertisement telecast by television channels or internet or any other electronic form or printed form, whether or not such programme or advertisement is intended for personal use or for distribution, including representation of the sexual organs of a child, the indecent or obscene representation of a child etc.; shall be guilty of the offence of using a child for pornographic purposes.

S. NO.

Relevant Statute

Relevant aspects

1.

IT Act

Section 66E of the IT Act prescribes punishment for violation of privacy as per which whoever intentionally or knowingly captures, publishes (including electronic form) or transmits the image of a private area of any person without his or her consent, under circumstances violating the privacy of that person shall be punished with imprisonment which may extend to 3 years or with fine up to Rs. 2 lakhs or with both.

Explanation (c) to Section 66E defines “private area” as the naked or undergarment clad genitals, public area, buttocks or female breast.

Explanation (e) to Section 66E defines “under circumstances violating privacy” as circumstances in which a person can have a reasonable expectation that—

· he or she could disrobe in privacy, without being concerned that an image of his private area was being captured; or

· any part of his or her private area would not be visible to the public, regardless of whether that person is in a public or private place.

Section 72 of the IT Act further prescribes penalty for breach of confidentiality and privacy. As per Section 72, any person who has secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned discloses such electronic record, book, register, correspondence, information, document or other material to any other person shall be liable to penalty which may extend to Rs. 5 lakhs.

2.

Guidelines for Prevention and Regulation of Dark Patterns, 2023

(“Dark Patterns Guidelines”)

15. The Dark Patterns Guidelines are applicable upon (i) all platforms systematically offering goods or services in India, (ii) advertisers, (iii) sellers^[4]. The said Guidelines prohibits any person including platforms in engaging in any dark pattern practice.^[5]

16. The Dark Patterns Guidelines define dark patterns as^[6]:

“dark patterns” shall mean any practices or deceptive design pattern using user interface or user experience interactions on any platform that is designed to mislead or trick users to do something they originally did not intend or want to do, by subverting or impairing the consumer autonomy, decision making or choice, amounting to misleading advertisement or unfair trade practice or violation of consumer rights;

A platform shall be considered to be engaging in a dark pattern practice if it engages in any practice specified in Annexure 1 to the said Dark Patterns Guidelines.

3.

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 read with IT Act

(“SPDI Rules”)

The SPDI Rules mandates that any Body Corporate which collects receives, possess, stores, deals or handle information of provider of information must provide a privacy policy for handling of or dealing in personal information including sensitive personal data or information.^[7] In terms of Section 43A of the IT Act, Body Corporate means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities.

Body Corporate must ensure that the privacy policy are available for view by such providers of information who has provided such information under lawful contract.^[8] The privacy policy must be published on such Body Corporate's website and must provide for the following^[9]:

(i) clear and easily accessible statements of its practices and policies;

(ii) type of personal or sensitive personal data or information collected including^[10]:

· password;

· financial information such as Bank Account or Credit Card or Debit Card or other payment instrument details;

· physical, physiological and mental health condition;

· sexual orientation;

· medical records and history;

· biometric information;

· any detail relating to the above clauses as provided to body corporate for providing service

· any of the information received under the aforesaid by body corporate for processing, stored or processed under lawful contract or otherwise.

(iii) purpose of collection and usage of such information;

(iv) disclosure of information including sensitive personal data or other information including the information to be shared with third party and / or government^[11];

(v) reasonable security practices^[12]

Any collection of information by a Body Corporate must obtain consent in writing through letter or Fax or e-mail from the provider of the sensitive personal data or information regarding purpose of usage before collection of such information.^[13]