TECH POLICY LAW

I. A Notification Power, Not a Standalone Obligation

Section 3(7) itself creates no obligation. It is an enabling provision, a grant of power to the Central Government to designate which telecommunication services require biometric identification, with the substantive obligations arriving through the separately notified User Identification Rules and the companion service-designation notification. Practitioners should be precise in client advice that the legally operative event here is the exercise of the power, not the power's existence, and that future government notifications under this same section could extend biometric identification to additional services without any further primary legislation or parliamentary process.

II. Delegated Legislation at Its Broadest

This is delegated legislation functioning exactly as its critics warn it can. Parliament enacted Section 3(7) as part of the Telecommunications Act, 2023, granting the executive open-ended authority to designate covered services by notification. Two and a half years later, the executive has used that authority to bring an entire class of consumer digital communication, wireless access and mobile internet telephony, within a biometric identification regime, through two gazette notifications rather than fresh legislative debate. The democratic accountability that would ordinarily attach to a decision of this consequence, mandatory biometric registration to make a phone call, was exhausted at the moment Parliament passed the enabling section, not at the moment the obligation actually took effect.

III. Wireless Access Was Inevitable; Internet Telephony Was a Choice

Designating wireless access services, ordinary mobile SIM connections, was the least surprising possible exercise of this power, consistent with telecom KYC norms that predate the 2023 Act. The decision to simultaneously designate internet telephony through mobile user terminals as a second covered service was a distinct and more consequential policy choice, extending biometric identification into app-based calling without the benefit of a dedicated public consultation on that specific extension. The two designations arrived in a single companion notification, bundling a predictable extension with a novel one in a way that reduced the political salience of the more significant change.

IV. The Repealed Statute Problem

Some secondary commentary on these rules describes them as operating under both the Telecommunications Act, 2023 and the Indian Telegraph Act, 1885. This is imprecise and worth correcting directly. The 2023 Act repealed the Telegraph Act in its entirety upon commencement. Any authorisation an entity holds that traces its origin to a licence issued under the 1885 Act continues by virtue of the 2023 Act's savings and transitional provisions, not because the Telegraph Act remains independently in force. Advisors drafting client-facing summaries should cite the Telecommunications Act, 2023 as the sole operative statute for this notification and should not present the two Acts as concurrent sources of authority. This is not a pedantic point. A client relying on rights or obligations sourced to the 1885 Act directly, rather than through the 2023 Act's savings clause, risks structuring a legal argument on a foundation that no longer independently exists, an error with real consequences in any dispute over licence continuity or grandfathered authorisation terms.

V. Comparative Note

The Indian model, primary legislation granting broad executive designation power exercised years later through notification, mirrors a pattern common in Indian telecom and technology regulation generally, visible also in the IT Rules' own history of amendment through executive notification rather than fresh statute. This is not unique to India; many jurisdictions grant telecommunications regulators broad designation authority. What distinguishes the Indian instance is the compressed gap between the designation notification and the compliance deadline it triggers, a three month window extendable by three more, which gives regulated entities materially less lead time to build compliance infrastructure than comparable designation exercises in jurisdictions with longer mandatory consultation-to-compliance intervals.

VI. Practitioner Guidance

Clients should treat Section 3(7)'s open-ended designation power as a standing risk factor in any telecommunications-adjacent business model, since further services can be brought within its scope by notification alone. Businesses whose products sit near the boundary of "internet telephony through mobile user terminals," including any VoIP-adjacent or embedded calling feature, should monitor future designation notifications proactively rather than waiting for direct regulatory contact, given the demonstrated willingness to expand coverage without extended public process. Firms should also build internal capability to track Gazette of India notifications directly rather than relying solely on secondary legal commentary, since the gap between an operative notification date and its public discussion, as seen with the electronic evidence examiner notification discussed elsewhere in this cycle, can run to several weeks.