‘O Brave New Market’: SEBI’s Demand For Increased Digital Surveillance

SEBI has now requested the indian government for enhanced powers to (i) access call records from social media platforms for investigations into securities law violations and (ii) remove posts from such social media platforms in order to curb the growing menace of market manipulation.

Aldous Huxley’s ‘Brave New World’, the classic dystopian novel, provided a glimpse of government censorship and control through technology and its impact on citizens. It exemplified the tension between individual autonomy and state control and urged caution against the unchecked application of technology in shaping individual beliefs, behavior and societal norms.

In recent times, market manipulation and scams, have become a global phenomenon. Market regulators worldwide are grappling to maintain market integrity in the digital era, where social media and internet is being misused for such market manipulation.

Closer home, the Securities and Exchange Board of India (“SEBI”), finds itself navigating uncharted waters— seeking enhanced powers from the Indian Government to (i) access WhatsApp messages, telegram, call records for ‘investigation into market violations’;(ii) remove unauthorized financial advice from social media platforms.¹ The regulator’s efforts to maintain market integrity through mass digital surveillance raises important concerns about free speech and privacy rights.

This article examines how SEBI’s evolving ‘oversight approach’ to digital surveillance intersects with fundamental rights. It explores the constitutional questions at stake and potential pathways for the regulator to achieve its objectives within the legal framework.

Power Play: SEBI’s Growing Appetite for Digital Surveillance

In 2013, the Securities Laws Amendment Second Ordinance 2013, granted the Indian market regulator, SEBI, the authority to request information and records, including call detail records (CDRs) from telecom service providers, for the first time.² This Ordinance was subsequently codified by the Securities (Amendment) Act 2014. CDRs provide details about the duration, time, location, frequency of calls but not the content of communications. Courts have caveated that such coercive measure of calling for CDRs, should not be used for fishing expeditions, indiscriminately seeking information without a pending inquiry or investigation. It must be exercised only by an officer authorised by SEBI, with written reasons recorded. These measures ensure that the privacy of individuals is protected and can only be invaded in accordance with the law, as emphasised in the Indian Council of Investors v Union of India case.³

While, the market regulator has in numerous instances, obtained and relied upon WhatsApp messages and other private communications as evidence in enforcement actions (Front Running by Ketan Parekh, Rohit Salgaocar;⁴ orders in the matter of Circulation of Unpublished Price Sensitive Information through WhatsApp messages with respect to HDFC Bank Ltd;⁵ in the matter of CARE Ratings Ltd.),⁶ such private communications have been obtained from the devices of individuals under investigation in exercise of SEBI’s powers under Section 11C (4) of SEBI Act.⁷ These seizure powers require an order from the Magistrate or Judge of the Designated Court, where SEBI must demonstrate the necessity of the seizure. To date, SEBI has no direct access to private communications of individuals on social media platforms such as WhatsApp and Telegram or the power to intercept mobile/telephone calls, despite its repeated requests to the Indian Government.⁸

In the past, social media platforms have denied SEBI’s request for such information, on the basis that SEBI is not designated as an authorized agency.⁹ In India, authorized agencies are permitted to intercept, monitor, decrypt information on computer resource upon the issuance of an order by the competent authority. Furthermore, such orders of the Competent Authority are not subject to judicial scrutiny per Section 69 of the IT Act, 2000, read with Rule 5 of the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information), 2009 (“IT Interception Rules”). These requests for interception or monitoring/decryption are allowed only in the interest of sovereignty or integrity of India, the defence of India, the security of State, friendly relations or public order, or for preventing incitement to the commission of any serious cognizable offence.

SEBI is not designated as an authorized agency to exercise such powers. These powers, however, vest with certain security and intelligence agencies such as the Intelligence Bureau, Central Board of Direct Taxes, Directorate of Revenue Intelligence, Cabinet Secretariat (RAW), Income Tax Department and Enforcement Directorate.¹⁰ Notably, the surveillance powers granted to these agencies are currently being contested and are pending consideration before the Supreme Court in M.L. Sharma & Ors v Union of India case.¹¹

SEBI has now requested the Indian Government for enhanced powers to (i) access call records from social media platforms for investigations into securities law violations and (ii) remove posts from such social media platforms in order to curb the growing menace of market manipulation.¹² Astonishingly, even in the absence of specific powers, SEBI has proceeded to remove around 70,000 “misleading social media posts” by “unregistered” investment advisors in “collaboration” with social media intermediaries like Meta, Google.¹³

Panoptic Surveillance in the name of Market Integrity and Privacy Rights Concerns: Navigating Constitutional Boundaries

Maintaining market integrity is crucial for national security. Courts have repeatedly affirmed that orderly functioning of the securities market is a matter of public interest, impacting not just those who transact in the market but the broader market economy. Inflows and outflows of capital from the stock market can have immediate and often serious effects on financial stability.¹⁴ The stock market serves as an economic barometer of the national economy and plays a vital role in the nation’s economic development.¹⁵ Accordingly, SEBI, as an expert regulatory body, is vested with wide powers to ensure the protection of the interest of investors and the orderly development of the securities market.

However, the extensive power, sought by SEBI to directly remove/takedown social media posts without a Court order and without notifying the account owner, may be seen as a violation of Article 14 (principles of natural justice) and Article 19 (online free speech) of the Indian Constitution.¹⁶ The Indian Supreme Court, in the case of Shreya Singhal v the Union, ruled that takedown or blocking actions could only be justified in the interests of the security or defence of India, public order, etc.¹⁷ These are the same grounds on which reasonable restrictions on free speech are allowed, as stipulated under Article 19(2) of the Indian Constitution.

In India, takedown/ blocking notices are issued only by the Designated Officer of the Central Government, after a request is made by a government-notified organization (authorized agencies) in accordance with the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public Rules, 2009 (“Blocking Rules”).> These requests can be made on limited grounds such as in the interest of sovereignty or integrity of India; security of state, maintaining friendly relations with foreign states, or public order.

The Blocking Rules mandate that a blocking notice must be issued by the Designated Authority to either the account owner ‘or’ the intermediary hosting the information. However, there is no mandatory requirement to notify the account owner prior to the issuance of the blocking order. Typically, the blocking notice is sent only to the intermediaries (social media platforms / internet service providers), not the account owner. Consequently, the account owner has no mechanism for relief due to the lack of notice, pre-decisional hearing, and access to the reasoned blocking order because of the confidentiality required by the Blocking Rules. The Blocking Rules also mandate confidentiality regarding blocking requests and actions taken for blocking information (Rule 16 of the Blocking Rules). Therefore, it can be argued that the Blocking Rules violate principles of natural justice and lack transparency, an effective grievance redressal mechanism, and judicial scrutiny of blocking orders. Notably, the constitutional validity of the Blocking Rules is currently under challenge and is pending consideration before the Supreme Court in the case of Software Freedom Law Center, India & Anr. v Union of India & Anr.¹⁹ The Supreme Court, while admitting the writ, has noted that the government must ensure there will be no takedown of social media posts without the account owner’s response.²⁰

SEBI’s latest request for access to call records and groups and channels, from social media platforms for investigations raises concerns about violation of fundamental right to privacy. In 2018, SEBI had requested the Indian Government for permission to intercept calls and electronic communication of those suspected of serious economic offences like insider trading but this request was previously denied by the Government.

Under the extant laws, the Government and its authorised agencies are permitted to lawfully intercept calls and messages from telecom service providers (TSPs) as per the Telecommunications Act, 2023, in conjunction with the Procedures and Safeguards for Lawful Interception of Messages, 2024 (“Telecom Interception Rules”).²¹ These Rules stipulate that an interception order can only be issued by a competent authority or government authorised agency. Such orders are limited to specific ground, including the interest of the sovereignty and integrity of India, defence and security of the State, friendly relations with foreign States, public order, or for preventing incitement to the commission of any offence.

IT Interception Rules also permit Government and authorised agencies to intercept communications on over-the-top (“OTT”) platforms like Whatsapp and Telegram on similar grounds. However, platforms like WhatsApp claim that their end-to-end encryption protocol²² ensures that messages are not retained by Whatsapp during ordinary course of service provision.²³ They assert that neither WhatsApp nor any third party can access the content exchanged between the users and that users, as messages are stored on users’ own device. Therefore, Whatsapp claims it cannot produce the contents of users’ messages in response to government interception request.

Nevertheless, authorised agencies can request access to metadata, such as basic subscriber information (name, service start date, IP address, device type, email address), as well as details about the duration, time and location of calls, and information on who contacted whom. These details are not encrypted and can be legally obtained through due process.

Critics argue that the interception mechanism under both the Telecommunications Act and the IT Act lack transparency and an effective grievance redressal mechanism that includes judicial scrutiny of the orders issued.

Furthermore, the surveillance powers of the Indian Government have been widened by the recently enacted Digital Personal Data Protection, 2023 (“DPDP Act”). The DPDP Act grants sweeping powers to the Government and its notified instrumentalities, exempting them from certain provisions of the Act. The DPDP Act permits non-consensual data processing by the Government if it is in the interest of the sovereignty and integrity of India, state security, friendly relations with foreign states, maintenance of public order, or preventing incitement to any cognizable offence. It is arguable that such broad processing powers conferred on the Government may violate an individual’s fundamental right to privacy and fail the proportionality test.

The Global Regulatory Compass: Learning from Cross-Border Approaches to Digital Surveillance

Interestingly, global market regulators such as the Securities and Exchange Commission (“SEC”)²⁴ in the United States of America, the Financial Conduct Authority²⁵ in the United Kingdom and the Securities, and the Financial Regulator (“SFC”) in Hong Kong,²⁶ and the Australian Securities and Investments Commission (“ASIC”) do not have the authority to directly intercept private communications or block access to social media posts. However, in certain cases, interception agencies have shared lawfully intercepted information with the market regulators if the information pertains to matters within their investigative jurisdiction.²⁷

In the United States, interception of private communications is permissible only for the purposes of investigating or enforcing specified criminal offences and does not include securities violations.²⁸ While the SEC, upon a formal order of investigation, is empowered to issue an administrative subpoena requiring the recipient to produce documents, communication records, including the contents of electronic communication, or provide testimony,²⁹ it does not have the power to directly intercept private communications.

In Hong Kong, the SFC has set up its own social media page to counter misleading posts.³⁰ SEBI can consider using AI tools to identify and analyse misleading social media content and, similar to SFC, SEBI can use its existing social media handle to counter such misleading posts. To conclude, it can be said that the powers SEBI is seeking is drastic in nature when compared to other global regulators like SEC and SFC. These powers also have implications on the fundamental rights to privacy and free speech. Therefore, if and when SEBI is vested with these powers, they will have to be exercised with adequate safeguards and after following procedure established by law and principles of natural justice. There is no doubt that a well-functioning financial market is vital to the stability of the national economy. What remains to be seen is whether the Indian government is willing to provide the drastic powers SEBI has been requesting them for at least a decade.

Disclaimer – The views expressed in this article are the personal views of the authors and are purely informative in nature.