MeitY expands the scope of authorities responsible for destruction of records pertaining to directions for interception, monitoring or decryption of information

The Ministry of Electronics and Information Technology (“MeitY”) on February 26, 2024 published the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Amendment Rules, 2024 (“Amendment Rules”).

The Amendment Rules amend the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 (“IT Rules”), which was enacted for the purpose of regulating the interception, monitoring and decryption of information.

The amendment has been made to Rule 23(1) of the IT Rules, pursuant to which a ‘competent authority’ is also now required to destroy any records pertaining to directions for interception, monitoring or decryption of information. The revised Rules 23(1) now reads as - “Every record, including electronic records pertaining to such directions for interception or monitoring or decryption of information and of intercepted or monitored or decrypted information shall be destroyed by thein every six months except in a case where such information is required, or likely to be required for functional requirements.

As per the provisions of the IT Rules, a competent authority includes:

1. The Secretary in the Ministry of Home Affairs, in case of the Central Government; and
2. The Secretary in charge of the Home Department, in case of a State Government or a Union territory, as the case may be.

Interestingly, while the Government hasn’t provided any rationale for this amendment, the amendment seems to have been brought with the intent of ensuring that the ‘competent authorities’ destroy any information (within the specified timeframe) pertaining to instructions issued for the purpose of intercepting, monitoring or decrypting information.