ARTICLE
20 March 2025

Data Privacy And Cyber Security Newsletter | February 2025

DL
Dentons Link Legal

Contributor

Dentons Link Legal logo
Established in 1999, Dentons Link Legal is a full service corporate and commercial law firm with over 40 partners and 150 lawyers across multiple practice areas. With offices across all major Indian cities and access to more than 200 offices in more than 80 countries of Dentons’ combination firms across the world, Dentons Link Legal is equipped to assist you in achieving your business objectives with the help of a team of experienced, well trained and qualified lawyers. The Firm’s clientele includes some of India’s leading corporate groups, public sector undertakings, public sector and private banks, private individuals, and multinational corporations across the world.
February 12, 2025: In an effort to further enhance consumer protection against Unsolicited Commercial Communication ("UCC")...
India Technology

I. UPDATES:

Industry Updates: India

1. Telecom Regulatory Authority of India ("TRAI") enhances consumer protection:

February 12, 2025: In an effort to further enhance consumer protection against Unsolicited Commercial Communication ("UCC"), TRAI has amended the Telecom Commercial Communications Customer Preference Regulations, 2018 ("TCCCPR, 2018"). This amendment was undertaken to curb the evolving ways by which telecom services are being misused as well as promote a transparent consumer ecosystem. Key features of the amendments are:

  1. Consumers can now file complaints against spam UCC, within 7 days without having to prior register their preferences for blocking or receiving commercial communications. Action against such complaint by the access provider has to be promptly undertaken within 5 days. 
  2. Telecom operators are now mandatorily required to provide customers an opt-out option for promotional messages for the ease of identification, shall carry necessary suffix. Further, customer consent obtained for completing a transaction will remain valid for only 7 days to prevent indefinite marketing under the pretext of prior consent.
  3. Access providers, upon first violation by the sender will bar such sender for 15 days, and thereafter on subsequent violations, will disconnect all telecom resources, including PRI/SIP trunks, across all access providers, and blacklist the sender for one year. 
  4. To strengthen the telecom ecosystem, various compliances by access providers have also been set out along with resulting penalties for instance misreporting of UCC counts shall result in penalties ranging from INR 2 lakh for the first violation, INR 5 lakh for the second, to INR 10 lakh for each instance of subsequent violations. 
  5. Some of the other key compliances are (a) telecom operators must deploy honeypots to track spam calls and messages, (b) analyze trends and take preemptive action against spammers. Senders and telemarketers must undergo physical verification, biometric authentication and unique mobile number linking during registration, ensuring greater transparency. To enhance accountability, TRAI mandates strict principal entity- telemarketer traceability, leading to a more robust and secure regulatory framework.

Link Here

2. Ministry of Electronics and Information Technology ("MeitY") responds to queries on web scraping of personal data:

February 7, 2025: Responding to queries on web scraping for training AI models, the Minister of State for Electronics and Information Technology, Mr. Jitin Prasada, recently stated in the Rajya Sabha that web scraping with respect to any publicly available user data by intermediaries including social media platforms, for training AI models is punishable under Section 43 of Information Technology Act, 2000 ("IT Act"). Section 43 of IT Act provides penalty for unauthorized access to computer system and provides compensation for damages to affected parties. 

Additionally, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 obligates intermediaries, to implement data protection measures and prevent unauthorized data access. Furthermore, the Digital Personal Data Protection Act, 2023 ("DPDP Act") mandates organisations processing personal data, to implement robust compliance measures, including obtaining consent for specified purposes before processing of digital personal data and respect for individual rights. 

Link Here 

3. Recommendations on the frequency spectrum in 37-37.5 GHz, 37.5-40 GHz, and 42.5-43.5 GHz bands identified for International Mobile Telecommunications ("IMT"):

February 4, 2025: TRAI has released their recommendations for the auction of spectrum in the frequency bands 37- 37.5 GHz, 37.5- 40 GHz, and 42.5- 43.5 GHz identified for IMT. The notification can be accessed Here.

4. Union Budget 2025 set to boost AI, data privacy and security initiatives:

February 1, 2025: MeitY has received a total budgetary allocation of INR 26,026.25 crore, to strengthen the IndiaAI Mission and expand production linked incentive schemes for semiconductors, electronic and IT hardware. 

Following are the key allocations made for the development of AI, cybersecurity and data privacy:

  1. With AI taking center stage in public discourse and its inevitable growth in the foreseeable future, IndiaAI Mission has been allocated INR 2000 crore, a whopping 1056% increase from the revised estimates in the 2024-25 budget. IndiaAI Mission is a national level program to democratize and catalyze the AI innovation ecosystem in the country and ensure the global competitiveness of AI startups and researchers of India. The mission aims to establish a robust AI ecosystem through strategic programs and partnerships across the public and private sectors. 
  2. The Data Protection Board of India, key regulatory authority under the DPDP Act responsible for enforcing data protection regulations, has been allocated a total of INR 5 crores.
  3. The Indian Computer Emergency Response Team ("CERT-In"), the national nodal agency for responding to computer security incidents, has been allocated INR 255 crore.

Link Here

5. Indian AI Model likely to be launched in 6 months:

January 30, 2025: Union Minister for Electronics & Information Technology, Railways, Information & Broadcasting, Mr. Ashwini Vaishnaw announced that India is likely to launch its own safe and secure indigenous AI model within 6 months at an affordable cost. 

Features of Indian AI model

  • Indian AI model will be initially launched with 10,000 Graphics Processing Units ("GPUs") with plans to expand to 18,693 GPUs. GPU is a specialized processor which can process many pieces of data simultaneously, making them useful for machine learning, video editing etc.
  • India's AI Model computation will cost < INR 100 per hour after 40% Government subsidy. Presently global models' computation costs 2.5 to 3 dollars per hour usage.

To ensure safety and ethical deployment of the Indian AI model, the Union Minister also announced the establishment of the Indian AI Safety Institute. The Institute will be set up on a hub and spoke model with various research and academic institutions, private sector partners joining the hub and taking up projects under the Safe and Trusted Pillar of India AI Mission. These initiatives by the Government aim to establish indigenous AI models that align with global standards while addressing unique challenges and opportunities within the Indian context.

Link Here 

6. MeitY releases the Estimation and Measurement of India's Digital Economy report:

January 22, 2025: India's digital economy has been expanding rapidly yet there are no credible and up-to-date estimates on the contribution of the digital economy to national income and employment. Recognizing this, MeitY has released the Estimation and Measurement of India's Digital Economy Report ("Report"). 

In accordance with the Report, India's digital economy is estimated at 11.74% of the national income in 2022-23. In absolute numbers, the digital economy in 2022-23 was equivalent to INR 31.64 lakh crore (~USD 402 billion) in GDP. Based on the projections in the Report, India's digital economy is expected to grow almost twice as fast as the overall economy, contributing to nearly one-fifth of national income by 2030. 

With the estimates produced in this Report, India is the first among developing countries to adopt the Organization for Economic Cooperation and Development framework to produce the most up-to-date estimate for the size of its digital economy. 

Link Here

7. Election Commission of India ("ECI") issues an advisory for labelling synthetic/ AI generated content used by political parties for election campaigning:

January 16, 2025: Recognizing the growing impact of AI-generated synthetic content in shaping public opinion, the ECI has issued an advisory mandating all political parties and their leaders, candidates and star campaigners to prominently label AI-generated or significantly altered images, videos, audio and other materials used in election campaigns, with a notation such as "AI-Generated" / "Digitally Enhanced"/" Synthetic Content". Additionally, disclaimers must be included in advertisements and promotional materials featuring synthetic content, whether disseminated online or through other media. 

The above measures are aimed to ensure transparent campaigning, responsible use of AI and informed voter participation.

Link Here 

8. MeitY publishes report on AI Governance Guidelines Development:

January 06, 2025: Back in 2023, an Advisory Group was formed under the Office of the Principal Scientific Advisor to provide guidance on AI governance. Under the guidance of this Advisory Group, a sub-committee on 'AI Governance and Guidelines Development' ("Sub-Committee") was set up to provide workable recommendations for AI governance in India which published its recommendations in the form of 'AI Governance Guidelines Report' ("Report"). 

Following are key recommendations of the Report: 

  1. The Report proposes a comprehensive AI governance framework, including an Inter-Ministerial Committee and a Technical Secretariat within MeitY to monitor AI usage, develop standard protocols and identify regulatory gaps. The Technical Secretariat will provide technical solutions, conduct horizon-scanning, map stakeholders and maintain an AI incident database to enhance oversight and accountability.
  2. An AI incident database shall be established which shall be repository of AI-related incidents, including ethical violations, security breaches and system failures.
  3. The Report acknowledges existing laws against AI-driven deepfakes and malicious content but highlights the need for specific regulations on copyright and bias/discrimination through use of AI.
  4. The Report advises that activity-based regulation may be adopted, to be followed by a combination approach in the future. Further, it emphasizes the need for a "whole-of-government" approach and advises against fragmented regulations.

Link Here

II. Judgements:

Global

1. United States District Court held that the use of copyrighted materials for training AI Model does not amount to fair use:

February 11, 2025: In Thomson Reuters Enterprise Centre GmbH and West Publishing Corp Vs. ROSS Intelligence Inc. (No. 1:20-cv-613-SB) the District Court of Delaware ("Court") revising its 2023 summary judgement held that ROSS Intelligence, an AI-based legal research start-up, infringed upon Westlaw's copyright by using its headnotes and editorial content to train ROSS's AI-powered legal research tool, without a proper license. Thomson Reuters and West Publishing Corporation own and operate Westlaw, which not only includes primary legal materials (such as case law and statutes) but also editorial elements i.e., headnotes that summarize the legal principles and key number system, a proprietary system used to organize legal topics. Ross Intelligence after being denied to license Westlaw's materials partnered with a third-party vendor, LegalEase, to acquire "Bulk Memos" containing legal questions and answers derived from Westlaw's headnotes. The Court noted that 2,243 headnotes from Westlaw have been directly copied and/or were substantially similar. The Court also held that both the headnotes and key number system met the low threshold of originality to qualify for copyright protection. 

ROSS took the defense of fair use doctrine, which the Court analyzed on the basis of the four-factor test, that is, (1) the purpose and character of the use; (2) the nature of the copyrighted work; (3) the amount and substantiality of the portion used; and (4) market harm. Considering the four factors, the Court rejected ROSS's fair use defense and granted partial summary judgment for Thomson Reuters on direct copyright infringement. 

Link Here 

High Court

2. Delhi High Court has jurisdiction to hear the ANI Vs. OpenAI copyright infringement case: 

February 21, 2025: In ANI Media Pvt. Ltd. v. OpenAI Inc & Anr. (CS(COMM) 1028/2024), Indian news agency Asian News International ("ANI") has filed a suit in Delhi High Court against OpenAI, an artificial intelligence research organization, under the provisions of the Copyright Act, 1957.

In the suit, Open AI questioned the jurisdiction of the Indian courts as its servers are located outside India. Given the complexities arising from technological advancements and copyright concerns, the Court appointed two Amicus Curiae to assist in the proceedings. 

Amicus Curiae Dr. Arul George Scaria has now submitted that the Delhi High Court has jurisdiction in the case primarily because ANI is based in Delhi and although the servers of OpenAI are based abroad, ChatGPT is used and accessed in India. 

Link Here 

3. Madras High Court upheld the dismissal of patent claim for a product designed to integrate human and AI capabilities:

January 29, 2025: In Caleb Suresh Motupalli ("Appellant") Vs. Controller of Patents (C.M.A. (PT) No. 2 of 2024), the Appellant sought a review of the Controller of Patents' order rejecting a patent application for a product integrating human intelligence with AI to enhance human capabilities. 

Facts

A patent application was filed by the Appellant for a product titled 'Necktie Persona-Extender/Environment-Integrator and Method for Super-Augmenting a Persona to Manifest a Pan-Environment Super-Cyborg,' claiming priority over a U.S. patent application. The First Examination Report raised objections related to lack of innovation, unclear definitions, and broad, abstract claims, making it ineligible for patent protection. The use of biblical references, vague terms and undefined features further weakened its legal standing. Ultimately, the Controller of Patents rejected the application.

Order

The Madras High Court upheld the rejection, ruling that the claims were too vague, lacked technical specificity, and failed to establish a concrete method to achieve the intended augmentation. It concluded that the invention lacked technical effect and did not meet the patentability criteria under the Patents Act, 1970.

Link Here

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More