A summary of the new Intermediary Guidelines (as amended in 2023)
A. TITLE
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2023
B. NEW CONCEPTS AND DEFINITIONS INTRODUCED
1. Online game defined to mean a game offered on the Internet, and accessible by a user through a computer resource or an intermediary.
- Internet has been defined as a combination of computer facilities, electromagnetic transmission media, and related equipment, comprising the interconnected worldwide network of computer networks that transmits information based on a protocol for controlling such transmission.
2. Online gaming intermediary (OGI) is an intermediary that enables users to access or more online game.
3. Online gaming self-regulatory body (OGSRB) is a body that is specially named in a Gazette notification, and which has been entrusted with the job of verifying that an online real money game is a permissible one.
There is no limit to the number of OGSRB that the Govt. may designate. [Rule 4A (1)]
Who can be an Online Gaming Self-Regulatory Body (OGSRB)?
(i) Must be a registered company under s. 8 of the Companies Act, 2013 (i.e., a company formed to promote art, commerce, science, social welfare, charity etc.)
(ii) It must have membership representing the gaming industry, and which offer and promote online games responsibly.
(iii) It must have financial and other means to perform its duties.
(iv) Its board members must be reputable individuals, must not have any conflicts with performing the functions of the OGSRB.
(v) Directors must possess special knowledge or experience of the online gaming industry, ICT, public policy, law enforcement, public administration or public finance;
educationists; experts in psychology, mental health; experienced persons in protecting child rights (vi) Its MOA and AOA must contain provisions relating to performance of functions and grievance redressal without conflict of interest and on an arm's length basis. They must also spell out the objective of disclosure by its members of verification of online games and holding them accountable. Further, any amendment done in the MOA or AOA on these subjects of online gaming should be with the previous approval of the MeitY
[Rule 4A (2)] 4. Online real money game (ORMG) A game where a user makes a deposit
(in cash or kind) and expects to earn back on that deposit. This can be anything from prizes, cash, or kind, (also called "winnings") which is handed out based on the user's performance in the game.
5. Permissible online game That which is either not an online real money game (ORMG) or which is a recognized permissible online real money game (PORMG)
C. SUBSTANTIVE PROVISIONS
6. Extension of existing obligations of intermediaries to Online Gaming Intermediaries (OGI) ` (i) User agreements, privacy policies, user agreements etc. of intermediaries must now require users to not host, display, publish etc. information that:
(a) relates to an online game that causes user harm (defined as any effect detrimental to a user or child).
(b) in respect of any business of the Central Government, is identified as fake, or false or misleading by the fact-check unit of the Government, and that which is notified in the Gazette.
(c) is an online game but has not been verified as a permissible online game.
(d) Is an advertisement (or surrogate advertisement) of an online game that isn't a permissible online game, or of an intermediary offering such a game.
(ii) If an OGI, which enables users to play permissible online real money games (PORMG) changes its user agreements or other policies, then it will inform users of this change within 24 hours.
(iii) Obligation to perform some of the additional due diligence under section 4 (over and above the due diligence that all intermediaries must perform) now also rests on an online gaming intermediary (OGI), in addition to a significant social media intermediary.
7. Appeals to the Grievance Appellate Commission
(i) Now, appeals can be filed to the Grievance Appellate Committee on the additional ground that a complaint to the intermediary was not decided by its grievance officer within the time fixed by the Rules [Rule 3A]
8. Special regime created specifically to regulate online gaming intermediaries [Rule 4, 4A]
(i) Additional due diligence obligations specific to an OGI are:
(a) Where it enables or facilitates access to a permissible online real money game (PORMG), then it must display a verification mark. This mark signifies that the game has been verified by the OGSRB [Rule 4 (10), Rule 4A (7)]
(b) If an online intermediary, which enables or facilitates a PORMG, then it must contain the following information in its privacy policy, user agreements etc:
o Refund policy on deposits made by users. o Policy on determination and distribution of winnings. o Fees and other charges payable by users. o KYC procedure for verifying user identity. o Measure to protect deposits made by users.
(c) Before any deposit is accepted by an OGI, the identity of the user must be verified. KYC procedure followed under the aegis of the RBI shall apply.
(d) An online intermediary which enables or facilitates PORMG shall not finance through credit or enable third party financing for the purpose of playing the game.
(ii) A&A Note Obligations under Rule 4(3), Rule 4(4) have not been extended to an OGI. Particularly, Rule 4(4), which obligates significant social media intermediaries to deploy automated tools to proactively identify and disable any content which is unlawful, depicts rape, child sexual abuse or conduct, or any content which has been previously held as being unlawful.
The 2021 IT Rules made a significant advancement by introducing this concept, as now, legislation compels social media intermediaries with a large subscriber base, of using technology to detect and disable unlawful content.
Take-down and disablement of unlawful content, even if it is harmful to children, is not an obligation cast on OGIs.
What can be the reasons for this? And what happens when an OGI doesn't comply with its obligations, or fails to ensure that users comply with its policies, will be the topic of another post.
9. Verification of online real money games and the obligations of SelfRegulatory Bodies [Rule 4A]
(i) As stated above, Online Gaming Self-Regulatory Bodies (OGSRB) will verify whether an online real money game qualifies for status of permissible online real money game (PORMG) under the IT Rules, 2021 (Rule 4A (1))
(ii) Criteria for qualifying as a Permissible Online Real Money Game (PORMG)
(a) The game does not involve wagering on an outcome. (b) The game and the intermediary comply with Rule 3 and Rule 4 of
the IT Rules, 2021; the law on the age at which an individual is eligible to enter a contract; and other framework made by the OGSRB.
(Rule 4A (3)) (iii) A phase-wise verification
(a) The OGSRB may initially base its decision on the information provided by the applicant. An initial declaration that the game is a PORMG can be made for a maximum of three months.
(b) Within this 3-month period, the OGSRB should endeavour to complete its verification process, and communicate either the acceptance or the rejection (with reasons) of the game as an PORMG.
(iv) Suspension of verification - OGSRB can revoke or suspend the verified status of the game. Due hearing must be given to the game to make defend its case, and reasons for refusing its claims must be in writing [Rule 4A (6)]
o Any entity aggrieved by the decision of an OGSRB can file a complaint with a Grievance Officer, whose details shall be published on the website of the OGSRB. Complaints must be acknowledged within 24 hours [Rule 4A (11)]
(v) Verification details of all PORMGs to be always published on the mobile app website etc. of the OGSRB. The list must be updated regularly, and must spell out details such as verification date, reasons
for verification, reasons for suspension or cancellation of PORMG status. [Rule 4A (4])
o The Government / MeitY can consider these details before deciding whether to block a PORMG under s. 69A of the IT Act, 2000 [Rule 4A (10)]
(vi) OGSRB must publish its framework, through which it verifies online real money games (ORMG). The published framework, must include:
o What measures are used to ensure that the ORMG does not harm the sovereignty, security, integrity of India, friendly relations with foreign states, public order.
o What safeguards are in place to prevent user harm (self-harm, psychological harm etc)
o What measures are in place to safeguard children, ensuring parental control, access control of children?
o What measures are in place to classify online games as suitable for a certain age group and based on nature and type of content?
o What measures are in place to safeguard against gaming addition, financial loss, fraud? The rules suggest that the following safeguards must be there at the very least:
Repeated warning messages, whose recurrence will increase as the game exceeds a certain duration and allowing a user to exit a game after reaching either a time or money-based limit set.
10.MeiTY's ultimate regulatory authority
(i) MeitY can suo-motu require an OGSRB to respond why its decision to verify a game as a PORMG is correct. If MeitY unsatisfied, then it can ask the OGSRB to take corrective steps [Rule 4A (12)]
(ii) MeitY can also suspend or revoke the OGSRB status, after giving a company a fair hearing. Reasons for the decision must be communicated in writing. However, MeitY can pass interim orders to protect interest of any users of online games verified by the OGSRB [Rule 4A (13)]
11.Grace Period before these Rules activate
(i) The obligations, in the amended Rule 3 and Rule 4 of the IT Rules 2021, will not apply till at least three OGSRBs have been designated by MeitY. Once designated, a further grace period of 3 months will apply before the obligations kick in.
12.What about games that are not real money games?
(i) Any intermediary which gives access to a game which is not an Online Real Money Game (ORMG) can also be made to follow the same obligations under Rule 3 and Rule 4, should the Central Government consider it necessary for reasons of security, sovereignty, integrity, maintaining public order and friendly relations with other states.
(ii) This will be especially notified in the Official Gazette. While doing so, the time period during which it must comply with these obligations.
(iii) A&A Note - Obligations of Rule 4A have been specifically excluded. Rule 4A seems to be dedicated only to regulating Online Real Money Games (ORMG)
