Online gaming law in India has been a highly contested legal field due to the statutory development being at the nascent stage. Many regulatory and governmental agencies, such as, RBI, SEBI, NSE, etc., have issued various circulars, directions, and notifications for improving and widening the framework of online gaming law in India. In the midst of that, Ministry of Information and Technology has released a Draft Amendment to the Information Technology (Intermediaries Guidelines and Digital Media Ethics Code), Rules, 2021 (the 2021 Rules shall hereinafter be referred to as “the Rules”, and the Draft amendment to the Rules shall hereinafter to referred to as “the Draft Rules”) that defines ‘online game’, and “online gaming intermediary’ (“OGI”), and prescribes specific due diligence and grievance redressal mechanism for the OGIs. Relevant proposed changes to the Rules, with respect to the OGIs, have been discussed below.
I. DEFINITIONS ADDED
Definition of ‘online game’
Game offered on internet
Accessible by a user through a computer source
On a deposit by user in cash or kind
Expectation of earning winnings in cash or kind
Definition of ‘online gaming intermediary’ (“OGI”)
An intermediary that offers one or more online games
II. DUE DILIGENCE
As per the Draft Rules, due diligence shall be observed by intermediaries, including the OGIs [1]. Thus, with the proposed amendments, the OGIs will also have to discharge certain duties in line with the Intermediary Guidelines envisaged in the Rules. Along with that, certain specific duties are also imposed on the OGIs as per the Draft Rules.
1. Information to be published on the website/app
An OGI shall have to prominently publish on its website/app the following [2]:
Rules and regulations formulated by the OGI for the purpose of the online game(s) (“R&R”)
Privacy policy
User agreement
Such information shall have to be provided to the user on the website/app [3]. The R&R, privacy policy, user agreement, and terms of service shall further inform the user about the following [4]:
(i) All the online games offered
(ii) Withdrawal and refund policy
(iii) KYC procedure
(iv) Manner of determination and distribution of winnings
(v) Fee and other charges payable by the user for each online game.
(vi) Risk of financial loss and the associated addiction to such online game
(vii) Measures taken by the OGI to protect the deposits of users
(viii) Framework of self-regulatory body [5]
Further, the OGI shall periodically inform all its users that in case of non-compliance with the R&R, private policy, or the user agreement, it has the right to terminate access or usage rights of the user, or to remove the specific non-compliant information. [6] [7]
An OGI shall also publish the following certificates on its website/app from a reputed certifying body for each online game [8]:
(i) Random number generator certificate [9]
(ii) No bot certificate [10]
2. User account verification
At the time of commencement of a user account-based relationship, the OGI shall identify the user and verify the identity. The same process shall be followed by an OGI which is regulated by RBI for identification and verification of a user. [11]
An OGI shall also enable the users a voluntary verification of their accounts using any appropriate mechanism [12], provided that such information shall not be used for any other purpose unless the user expressly provides his consent for the same. Further, such user shall be provided with a visible mark of verification which shall be visible to all the users of the said service [13].
3. Reasonable efforts to ensure that the user does not indulge in certain activities
An OGI shall ensure that a user does not display, upload, publish, update, or share any information that is in the nature of an online game that:
Further, it shall be imperative for the OGI to make reasonable efforts to ensure that a user does not:
(i) Publish, update, or share information that belongs to any other person, and to which the user does not have any right [16].
(ii) Impersonate any other person [17].
Further, an OGI shall also ensure that there is reasonable due diligence, transparency, and privacy on its platform [18].
4. Removal of unlawful information from the website/app
Upon receipt of any unlawful information, being present on the website/app, by the appropriate government or its agency, the OGI shall remove or disable such information. [19] [20]
However, such information, that has been removed or disabled from the website/app, shall be preserved along with all the associated records for a period of 180 days or for a period as may be required by the lawfully authorized Court or the government agency, for investigation purposes. [21]
Further, where the information is collected by an OGI from the user for the purpose of user registration, the same shall be retained for a period of 180 days upon cancellation or withdrawal of user registration. [22]
Upon receipt of an order by the lawfully authorized Court or the government agency, the information so retained by an OGI shall be provided to such authority within 72 hours of the receipt of such order. [23] [24]
5. Registration of the online game
An OGI shall display a visible mark of registration of all its online games registered by the self-regulatory body on its website/app [25].
In furtherance to the above said, an intermediary shall ascertain information from the OGI and from the concerned self-regulatory body [26] whether such online game has been registered. It shall further display such registration on its website/app [27] [28].
III. GRIEVANCE REDRESSAL MECHANISM [29]
An OGI shall have physical contact address in India for receiving any communication addressed to it by the user or the law agencies or any other person, and the same shall be published on the website/app [30]. Further, the OGI shall also ensure that there is an appropriate mechanism for receiving complaints and grievances, whereby the complainant is able to track the status [31] of the complaint, and the OGI has to provide the status of the complaint in a reasonable manner [32].
Apart from the abovesaid redressal mechanism, an OGI shall also be obligated to appoint certain officers under the Draft Rules:
1. Grievance Officer [33]. An OGI shall appoint an employee [34] as the Grievance Officer [35]. Further, the OGI shall publish the following information on its website / app: (i) the name and contact details of the Grievance Officer, and (ii) the mechanism by which a user (or a victim) may make complaint against the violation of the provisions of the Rules. The Grievance Officer shall acknowledge the complaint within 24 hours and resolve it within 15 days [36]. Also, he shall receive and acknowledge any notice, order or direction issued by lawfully authorized court or government authority.
2. Chief Compliance Officer [37]: A Chief Compliance Officer shall be appointed by an OGI who is either a key managerial person or a senior employee of the OGI [38]. The Chief Compliance Officer shall ensure compliance with the provisions of the Act and the Rules [39], coordinate with law agencies to ensure compliance of their orders, and be the nodal contact person [40]:
An OGI shall appoint a Nodal Contact Person for round the clock coordination with law agencies to ensure full compliance of the orders passed by such agencies [41].
IV. SELF REGULATORY BODY FOR OGIs
A section 8 Company or a registered society of OGIs may apply to the Ministry of Information and Technology for registration as a self-regulatory body. Such body would assist the government in considering whether certain information provided on the website/app of any OGI, being a member of the self-regulatory body, has to be blocked for public access [42]. The membership of such self-regulatory body shall be granted to any OGI based on the OGI’s conformity with the laws for the time being in force in India [43].
Every self-regulatory body shall,
i. Evolve a framework and ensure, by continuous testing and verification, that the online games of the member OGIs are in conformity with such framework [44].
ii. Establish a time bound mechanism for grievance redressal of such complaints of users that have not been resolved by any of its member OGIs [45].
Authored by Sanyam Aggarwal, Advocate at Metalegal Advocates. The views expressed are personal and do not constitute legal opinion.
Endnotes:
[1] Rule 3(1)
[2] Rule 3(1)(a)
[3] Rule 3(1)(b)
[4] Rule 4A(1)(b)
[5] Rule 4B(6)
[6] Rule 3(1)(c)
[7] The same shall be done at least once a year.
[8] Rule 4A(1)(c)
[9] It ensures statistical randomness in the numbers generated by the computer, application, or machine. It further ensures that there is no pattern in the generated numbers and that they are merely random numbers.
[10] It certifies that the online game is peer to peer (P2P) based and hence has been specifically evaluated to confirm that the OGI does not have any systems which allow the usage of bots to control, mimic, assist, aid or override real player action.
[11] Rule 4A(1)(d)
[12] Such as penny drop verification
[13] Rule 4A(1)(e)
[14] Rule 3(1)(b)(ix)
[15] Rule 3(1)(b)(x)
[16] Rule 3(1)(b)(i)
[17] Rule 3(1)(b)(vi)
[18] Rule 3(1)(m)
[19] Rule 3(1)(d)
[20] The same shall be done within 36 hours from the receipt of such information.
[21] Rule 3(1)(g)
[22] Rule 3(1)(h)
[23] Rule 3(1)(j)
[24] However, the law provides that such an order must be in writing, clearly stating the purpose for seeking such information.
[25] Rule 4A(1)(a)
[26] Rule 4B
[27] Rule 3(1)(ma)
[28] The same shall be applicable from 3 months of the commencement of the Draft Rules.
[29] All the requirements related to the redressal mechanism would be applicable upon the expiry of three months from the commencement of the Draft Rules.
[30] Rule 4A(1)(i)
[31] By a unique ticket number.
[32] Rule 4A(1)(j)
[33] Rule 3(2)
[34] Who shall be a resident of India.
[35] Rule 4A(1)(f)
[36] Provided that a complaint for removal or information or communication link shall be resolved within 72 hours of the receipt of such complaint.
[37] Rule 4A(1)(g)
[38] He shall also be a resident of India.
[39] The said officer shall be liable in case the OGI fails to observe due diligence while discharging its duties under the Act and the Rules.
[40] Rule 4A(1)(h)
[41] Such Nodal Contact Person shall be an employee of the OGI, who is not the Chief Compliance Officer, and is a resident of India.
[42] Rule 4B(3) r/w Rule 4B(1) and (2)
[43] Rule 4B(4) r/w Rule 4B(5)
[44] Rule 4B(6)
[45] Rule 4B(8)