NATIONAL 

1.  India Enacts Key Telecom Rules for Critical Infrastructure and Cybersecurity

In November 2024, Department of Telecommunications, introduced The Telecommunications (Critical Telecommunication Infrastructure) Rules, 2024[1], and The Telecommunications (Telecom Cyber Security) Rules, 2024[2] which apply to telecommunication entities.

The Telecommunications (Critical Telecommunication Infrastructure) Rules, 2024

These Rules establish a comprehensive framework to safeguard India’s critical telecommunication infrastructure. They mandate that telecommunication entities ensure their critical infrastructure complies with specified standards, including Essential Requirements (ERs), Interface Requirements (IRs), and Indian Telecommunication Security Assurance Requirements (ITSARs). Additionally, entities must adhere to the National Security Directive on Telecommunication Sector (NSDTS) and directives on communication security certification issued by the Central Government. The Rules empower the Central Government to authorize personnel to access and inspect hardware, software, and data related to critical telecommunication infrastructure. Telecommunication entities are required to facilitate such inspections and appoint a Chief Telecommunication Security Officer (CTSO) responsible for implementing the Rules. This officer must provide detailed information to the government, including network architecture, authorized personnel access, inventory of related hardware and software, vulnerability assessments, and security audit reports. Furthermore, entities must report security incidents within specified timelines and ensure that any upgrades to critical infrastructure receive prior written certification from the Central Government, confirming compliance with established standards.

The Rules must be adhered to by all entities involved in the ownership, operation, management, or maintenance of critical telecommunication infrastructure. This includes telecommunication service providers, network operators, and entities handling hardware, software, or services associated with critical infrastructure. Critical Infrastructure refers to telecommunication infrastructure deemed essential for the security, defense, public safety, or economic resilience of the country. This includes systems, networks, and assets whose disruption or compromise could have a significant impact on national security, economic stability, or public well-being. The specific designation of such infrastructure is determined by the Central Government.

The Telecommunications (Telecom Cyber Security) Rules, 2024

These Rules are designed to ensure enhanced cybersecurity in India’s telecommunication networks by enforcing stringent compliance measures and introducing a standardized framework for identifying and addressing cyber threats. These Rules mandate that telecom service providers (TSPs) and other relevant entities adhere to comprehensive security protocols, including implementing Government-specified security assurance frameworks, conducting periodic vulnerability assessments, and maintaining incident response mechanisms. The overarching goal is to safeguard critical telecom infrastructure and services from escalating cyber risks, which could compromise national security and public trust.

These Rules are crucial as they directly address the increasing sophistication of cyber threats targeting telecommunication networks, which form the backbone of digital communication and commerce. They emphasize the creation of Security Operations Centres (SOCs), mandatory incident reporting, and a clear chain of accountability. The Rules mandate that only approved and secure hardware and software be deployed, thereby reducing the risk of vulnerabilities introduced through third-party components. The application of these Rules extends to all entities involved in the telecommunication ecosystem, including TSPs, network operators, and equipment providers.

These Rules collectively impose stricter operational and compliance obligations on telecom service providers, network operators, and equipment vendors, requiring them to enhance their security frameworks, regularly assess vulnerabilities, and promptly report security incidents. For entities, this translates to a significant overhaul of existing practices, increased accountability, and a more proactive approach to securing telecommunication networks in alignment with national security objectives.

2. CCI imposes Hefty Penalty on Meta under Anti-Trust Regulations

The Competition Commission of India (“CCI”), in the matter of In re: Updated Terms of Service and Privacy Policy for WhatsApp users [Suo Motu Case No. 01 of 2021][3] has imposed a hefty penalty of INR 213.14 crores on Meta Platforms, Inc. (“Meta”) in relation to the updated ‘Terms of Service’ and ‘Privacy Policy’ of WhatsApp released in 2021 (“Updated Policies”).

In January 2021, WhatsApp introduced its Updated Policies effective from 08 February, 2021. These Updated Policies required users to accept new terms, including mandatory data sharing with other Meta entities, (e.g., with Facebook), to continue using the platform. Unlike WhatsApp’s 2016 policy, which allowed users the choice to opt-out of data sharing with Facebook, the Updated Policies eliminated this option. The CCI observed that the Updates Policies, undermined users’ autonomy and violated The Competition Act, 2002. Meta was also found to have leveraged its dominant position in the OTT messaging apps market to reinforce its influence in online advertising, creating barriers for competitors. Basis this, the CCI directed WhatsApp to restrict data sharing for advertising purposes for 5 years and provide users with clear explanations along with an opt-out option for other types of data sharing. The platform must also allow users to review and modify their preferences through app settings and ensure that future updates comply with these transparency and choice requirements.

Data sharing practices must comply with the law, ensuring transparency, informed consent, and user autonomy as emphasized by the DPDP Act. When data sharing is conducted unlawfully such as imposing mandatory terms without user choice it can trigger repercussions under other legislation, including the Competition Act, 2002. As seen in the CCI’s penalty on Meta, anti-competitive effects like market barriers and abuse of dominance can arise from exploitative data practices, underscoring the necessity for businesses to align data policies with legal standards to avoid liabilities under various legislations. 

3. Delhi HC upheld ‘Right to be Forgotten’ by masking Petitioner’s Details post Acquittal

The Court, in the matter of ABC v. State and Others [Crl. M.C. 495/2019][4], recognized that public availability of case details, despite the petitioner’s acquittal, could cause irreparable harm to his privacy, career, and dignity. It directed the masking of the petitioner’s name and respondent details in all records and search results related to the case, aligning with the ‘right to be forgotten’. Additionally, search engines and social media platform were encouraged to adhere to these privacy principles and remove any relevant public material, reflecting a nuanced balance between individual dignity and the public’s right to information.

4. The High Court of Kerela upholds Right to Access Digital Documents while balancing Privacy of Victim in Criminal Matter
In Aji v. State of Kerela [Crl. Rev. Pet. No. 1218 of 2024][5], the Court addressed a plea by the accused in a case under the Indian Penal Code, 1860 (“IPC”) and Prevention of Children from Sexual Offences Act, 2012 seeking access to CCTV footage to defend himself. The Court identified critical issues regarding fair trial rights, noting the trial court’s denial of access to the footage. While the footage lacked certification under Section 65B of the Indian Evidence Act, 1872 the High Court emphasized that the accused’s right to defend himself included access to all prosecution evidence, barring materials that infringed on the victim’s privacy. It deemed the denial unjustifiable and directed the trial court to allow the accused to view the footage before or during trial. This decision reinforces the balance between procedural fairness and privacy considerations in criminal proceedings.

5. High Court at Karnataka refused to quash FIR in relation to Online Crime
In the case of Mr. Sourish Bose and Smt. Deepanvita Ghosh v. State of Karnataka [Criminal Petition No. 10546 OF 2024], the petitioners sought to quash an FIR registered against them for alleged cheating and fraud involving Amazon Transportation Services Private Limited (“Amazon”). The complaint, filed by Amazon, detailed a scheme where high-value products were ordered and then swapped and returned with low-cost items, resulting in a loss of approximately INR 69,91,940. The petitioners argued that the case should fall under Section 66D of the Information Technology Act, 2000, rather than Section 420 of the IPC, and that the proceedings were without jurisdiction.

The High Court of Karnataka rejected the petition and determined that the allegations, which involved a scheme of returning low-cost items in place of high-value products ordered from Amazon, constituted a clear case of cheating under Section 420 of the IPC. The Court emphasized that the case involved seriously disputed questions of fact that required a full trial and could not be resolved at this stage.  Consequently, the petition was dismissed, and the case was allowed to proceed to trial.

6. Bombay High Court grants Temporary Injunction to Insurance Company on Data Breach

In the case related to data breach of policy-holder’s information, the Bombay High Court, in HDFC Life Insurance Co. Ltd. v. Meta Platforms Inc.& Ors [Interim Application (L) No. 35886 of 2024][6], granted temporary injunction in favour of the applicant, recognizing the significant risk posed by the unauthorized disclosure of sensitive customer data by the defendants including Meta Inc., Telegram and WhatsApp. The applicant demonstrated a prima facie case, highlighting the potential for identity theft, financial fraud, privacy violations, and misuse of confidential information, including impersonation and trademark infringement. Further, the Court ordered WhatsApp and Telegram to take immediate action to remove or block any accounts and content linked to the misuse of HDFC’s customer data. The court also mandated Meta Inc., Telegram and WhatsApp to disclose all available information on Defendant 6 (the unknown person responsible for hacking the Applicant’s data), including personal and contact details, IP addresses, and associated accounts, to aid in the investigation.