Delhi High Court issues notice on challenge to CERT-In directions to store information of VPN service users

The Delhi High Court on Wednesday issued notice in a petition challenging directions issued by the Indian Computer Emergency Response Team (CERT-In) to virtual private network (VPN) service providers to store names, email IDs, contact numbers and IP addresses of customers for a period five years. (SNTHostings v. Union of India).Justice Yashwant Varma directed CERT-In to submit its reply to the petition filed by VPN provider, SNTHostings. The Court ordered,"Issue notice. The present petition challenges the directions given in the circular dated April 28, 2022 by CERT-In. The petitioner submits that Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 are vague leave the petitioner in a quandary.".After seeking a response from the Central government, the Court posted the matter for hearing on December 9..SNTHostings contended that the CERT-In directions were a violation of the privacy of citizens. It also contended that its fundamental right to practice any profession or trade, guaranteed under Article 19(1)(g) of the Constitution, was under threat as such directions effectively prohibit the company from providing VPN services altogether. "In fact, many global players have suspended operations in India owing to the kind of restrictions imposed by the Impugned Directions," the petition stated..The VPN provider thus sought an order to set aside directions (iv) and (v) of Direction No. 20(3)/2022 issued by CERT-In under Section 70-B of the Information Technology Act, 2000. As per these directions, a range of entities, including the petitioner and other VPN providers were required to:(a) mandatorily enable logs of all information and communications technology (“ICT”) systems and maintain them securely for a rolling period of 180 days within the Indian jurisdiction. (Direction IV)(b) register and maintain extremely detailed and invasive personal information of users – such as validated names, address, contact numbers, and email address of subscribers, period of hire, Internet Protocols allotted to members, the purpose of hire and ownership pattern of subscribers – for 5 years or longer, as mandated by law, even after any cancellation or withdrawal of registration of a user. (Direction V). In case of any incident, the information collected by the VPN provider and other target entities must be shared with the Central government. The directions further state,"Failure to furnish information or non-compliance with the Impugned Direction is punishable with imprisonment of up to one year, or fine, or both under sub-section (7) of Section 70B of the IT Act, 2000.".Appearing for SNTHostings, Advocate Samar Bansal submitted during the hearing,"The present petition poses a challenge to the particular (CERT-In) Directions. We contend that they are ultra vires. This is an illegal legislation on an essential legislative function.I genuinely don't know how to comply. It is so vague and overbroad. In their own FAQs, they say that they will follow a graded system but that doesn't follow from the Rules."Bringing out the discrepancy in the Rules framed under the IT Act and the FAQs issued by CERT-In, it was further submitted that the while the former says servers must be in India, the FAQs say the opposite and allows for servers being outside..The plea asserts that the directions are ultra-vires Section 70B(6) of IT Act, as they require the VPN provider to collect information it otherwise would not have collected."Under threat of punitive action, the Impugned Directions require the Petitioner to collect logs which record the activities of the customers as well as personal information of its customers. In violation of the principle of storage limitation, the Petitioner is then mandated to store logs for an arbitrary period of 180 days and store identifiable information of customers for the duration they avail services and a further 5 years or longer even after customers have stopped availing its services," the plea contended.Another fact pointed out was that these directions authorise the Central government to direct the VPN provider to hand over the information it collects. However, they do not impose any limitation on how long the government can store such data, which is again in violation of the principle of storage limitation.."Mandating the petitioner to pervasively monitor user activity and store this data for arbitrarily and unreasonably long periods under the guise of security measures is nothing short of treating the entire class of people who use VPN services as suspects for crimes that have not even been identified yet," the plea reads.Hence, the petitioner prayed that directions IV and V be struck down as being ultra-vires Section 70B(6) of the IT Act, 2000..Digital rights organisation Internet Freedom Foundation (IFF) provided legal assistance to the petitioner, SNTHostings.