THE POLICY LAB-35
DECEMBER 26, 2023

By J B Mohapatra

SELF-REGULATORY Body(SRB) has not been specifically defined in the Information Technology (Intermediary Guidelines and Media Ethics Code) Rules, 2021, though its constitution, duties, responsibilities and functions are part of the Rules. In fact before the constitution of SRB finds a place in the Rules (under Rule 4A), the most important of SRB's functions finds a mention in (Rule 4(10)):

"4(10) An online gaming intermediary who enables access to its users to any permissible online real money game, shall display a demonstrable and visible mark of verification by an online gaming self-regulatory body on such permissible online real money game"

The fact that functions of the SRB are much wider than what Rule 4(10) has indicated becomes clearer in Rule 4A, whose operative parts read as follows:

"(3) The online gaming self-regulatory body, upon an application made to it by its member in respect of an online real money game, may declare such online real money game as permissible online real money game, if, after making such inquiry as it deems fit, it is satisfied that-

(a)the online real money game does not involve wagering on any outcome; and

(b) the online gaming intermediary and such online game is in compliance with the provisions of rules 3 and 4, the provisions of any law relating to the age at which an individual is competent to enter into a contract, and the framework made by the online gaming self-regulatory body under sub-rule (8):"

Making the SRB accountable for compliance issues at the level of the online gaming intermediary and the online game under the provisions of Rule 3 and Rule 4 thus renders the SRB liable for certain supervisory functions. Apart from the supervisory functions, the Rules provide for direct administrative-cum-regulatory actions from SRB. Compiling the two functions, a summary of those under both categories is as follows:

SRB's Supervisory Functions:

a) under Rule 3:

- to publish rules, regulations, privacy policy and user agreement in intermediary's website and mobile based app - Rule 3(1)(a)

- to make reasonable efforts to ensure that information the intermediary hosts, displays, uploads, transmits, stores and shares does not belong to another person -Rule 3(1)(b)(i);

- that it does not encourage money laundering or gambling, cause user harm -Rule 3(1)(b)(ii);

- it does not infringe any patent, trademark, copyright or other proprietary rights -Rule 3(1)(b)(iv);

-is not harmful to child-Rule 3(1)(b)(iii);

-does not intentionally communicate misinformation which is patently false and untrue or misleading -Rule 3(1)(b)(v);

-does not threaten unity, integrity, defence, security or sovereignty of India, friendly relations with foreign states, or public order, or causes incitement to commission of any cognisable offence or prevents investigation of any offence -Rule 3 (1)(b)(vii);

-does not contain software virus or any code, file or program designed to interrupt, destroy or limit the functionality of any computer resource-Rule 3(1)(b)(viii);

-is not in the nature of an online game that is not verified as permissible online game-Rule 3(1)(b)(ix);

-is not in the nature of advertisement or surrogate advertisement or promotion of an online game that is not a permissible online game or of any online gaming intermediary offering such an online game -Rule 3(1)(b)(x);

-does not violate any law for the time being in force -Rule 3(1)(b)(xi);

-informs the users of actions and consequences arising on non-compliance with rules and regulations -Rule 3(1)(c)

- takes action on notification received under section 79(3)(b) of IT Act -Rule 3 (1)(d))

-informs changes to its rules, regulations, privacy policy or user agreement within 24 hours of such change -Rule 3(1)(f)

-preserves the information which have been removed or access which has been disabled for a further period as stipulated -Rule 3(1)(g)

-intermediary retains information from a user for registration on the computer resource -Rule 3(1)(h)

- ensures reasonable security practice and procedures -Rule 3(1)(i)

- assists government agency in investigation of cyber security events (Rule 3(1)(j))

- prevents modification of technical configuration of computer resource for circumventing any law -Rule 3(1)(k)

- shares information with I-CERT on cyber security events - Rule 3(1)(l))

- ensures reasonable measures to provide accessibility of services to users- Rule 3(1)(m)

- respects citizen rights under articles 14,19 and 21 of the Constitution-Rule 3(1)(n)

- appoints the grievance officer- Rule 3(2)

(b) under Rule 4:

- to appoint the chief compliance officer and nodal contact person, and a resident grievance officer -Rule 4(1)(a)/(b)/(c)

- to publish monthly compliance report - Rule 4(1)(d)

- to ensure a physical contact address of the intermediary in India - Rule 4(5)

- to ensure appropriate grievance or complaint redressal system -Rule 4(6)

- to ensure a system of voluntary verification of user account at the time of registration - Rule 4(7)

- intermediary to ensure that the online real money game that a user is accessing has demonstrable and visible mark of verification by SRB -Rule 4(10))

- information to the user of rules and regulations, privacy policy, terms of service, user agreements, policy related to withdrawal and refund of deposit, manner of determination and distribution of winnings, fees and charges payable by the user, KYC procedure for identity verification, measures taken for protection of deposit, and framework in Rule 4A - Rule 4(11)

- to ensure verification of identity of user before accepting deposit - Rule 4(12)

- to ensure that the intermediary is not financing the user for the purpose of playing online game -Rule 4(13)

SRB's direct functions under Rule 4A:

- to declare such games as permissible online real money games after making inquiries and ascertaining that it does not involve wagering on any outcome; the game is in compliance with the provisions of Rule 3 and 4, admission of an user to any game under appropriate age-rated conditions, and is compliant to the framework established by the SRB under sub Rule (8) of Rule 4A - 4A (3)

- to publish and maintain updated list of permissible online real money games including applicant's details, validity of verification, details of suspension or revocation - 4A (4)

- to publish and maintain updated list of current and past members - 4A (5)

- to exercise power to suspend or revoke the verification-4A (6))

- online gaming intermediary to display a demonstrable and visible mark of verification stating that online real money game stands verified by the SRB -4A(7)

- to publish on its web site or mobile based application a framework for verifying an online real money game, which should include: (a) game not against the interests of sovereignty and integrity of India, security of the state, friendly relations with other states and public order (b) safeguards against user harm, psychological harm (c) measures to safe guard children including parental or access control, age-rating classification of games (d) measures to safeguard users against gaming addiction, financial loss and fraud, setting up systems for generating alerts, self-exclusion etc - 4A (8)

- to publish framework for redressal of grievances and contact details of grievance officer -4A(11)

Though there is nothing against codifying the concept, composition, and operation of SRB in one single document- that is (Intermediary Guidelines and Media Ethics Code), Rules 2021- it has been likely that many crucial parts of SRB's functions have not been fully captured for the sake of achieving brevity in the document. Without getting into exhaustive details of what areas of SRB that the present Rule is silent about, principally the below-mentioned could be regarded as gap areas:

(a) Manner of considering an application seeking registration as SRB, provisional registration, mandating a validity period for registration, refusal of registration, revocation or suspension of registration, and reconsideration after refusal

(b) Internal control standards for SRB: standards for approval and rejection of membership; governing norms for supervision of members; powers of inspection, auditing and surveillance; exercise of powers for disciplinary actions against members; power to constitute committees; power to levy membership and annual fees from members; powers and duties of office bearers of SRB

(c) Establishing a SOP for the purposes of Rule 4A(3) and 4A(8)

Other fiscal legislations have provided for establishing self -regulatory organisations through regulations notified under their respective parent legislation. SEBI Act, 1992 for example under section 30 read with section 11(2)(d) of that Act empowered the government to notify SEBI (Self- Regulatory Organisation) Regulations, 2004 which not only proceeded to define a SRO, but facilitated in laying down operational and governance norms.

The precedent set out in setting up SRO under the SEBI Act through legislative enablement, and a Rule based Notification thereafter could be an example to follow through in the case of online gaming as well, since the (Intermediary Guidelines and Media Ethics Code) Rules appears to be insufficient to address the relevant issues highlighted hereinbefore.

While the framework under Rule 4A(8) which the SRB is mandated under the Rules to establish principally ensures setting up of parental or access control, age-rating mechanism, time-based and monetary-threshold alerts, time-outs for discouraging gaming addiction, disclosure of rules for disbursal of user funds, or caution on financial risks and frauds, the most salient of its mandated functions as provided in Rule 4A(3) is devising that intelligent differentia that distinguishes permissible online gaming from gambling. Once an online game is verified by the SRB, the intermediary is at liberty to offer that online game to its users. If the online game is not verified or is rejected by the SRB, that online game besides being denied access on the intermediary's platform should at most times partake the character of 'wagering' or 'gambling', jurisdiction over which now vests with the respective States under the force of entry 34 list II of the Seventh Schedule of the Constitution. It is therefore incumbent upon the SRB to ensure appropriate character of the online game based on standardised, rational and scientific criteria and then conclude whether or not the online game on offer is a game that confirms to the requirements of Rule 4A(3).

Consistent engagement with games developers, games auditors and testers should enable the SRBs to keep themselves abreast of any new or emergent issues arising on evaluation of online games, and whether the online games seeking SRB's approval or changes to the games format of those games already approved confirm to the requirements of the Rules. A rule-based decision sans bias or subjectivity can come about through a standard uniform protocol.

To sum up, a Notification independent of the (Intermediary Guidelines and Media Ethics Code) Rules delineating the definition, compositions, duties, and functions, governance norms both internal and external of SRB should be a requirement to bring a greater degree of clarity and transparency, apart from providing for a clearer process and comprehensive guidelines on all aspects of SRB's functioning including on:

a) framework for games evaluation, testing and verification protocols, harm assessment protocols, and protocols for combating addiction, financial fraud and loss

b) code of conduct for its members and code of conduct for SRB's engagement with externalities: government, other SRBs and regulatory bodies

c) framework of agreement between SRB and online gaming intermediaries.