The Italian Competition Authority has fined Facebook owned Whatsapp EUR 3 million for forcing its to accept in full, the provision to share their personal data with Facebook, “by inducing them to believe that without granting such consent they would not have been able to use the service anymore.” Hat tip: Monica Jasuja on Twitter.

The press release from the authority specified that the in-app procedure for obtaining the acceptance of the new Terms of Use:
1. Had an excessive emphasis on the need to subscribe within 30 days, failing which users would not be able to use the service.
2. Whatsapp made it difficult for users to figure out whether they could deny consent to share this information with Facebook
3. A pre-selected opt-in
4. The difficulty of opting out once the Terms of Use were accepted in full.

The ruling also deemed illicit unfair terms of use in the contract, including those related to limitation of Whatsapp’s liability, the possibility to unilaterally interrupt the service without reason or advance notice, or disallow a user to access/use the service, a limitation of jurisdiction to California for settling disputes, among other issues (noted in the press release below). We’ve written to Facebook for inputs on how it intends to change the Whatsapp terms of use.

You may read Whatsapp’s terms of use here.

Quick comments

1. It’s worth noting that today the Whatsapp Privacy case is being heard today in the Supreme Court of India. This judgment may be used for reference in the court at some point in time. In that case, the petitioners’ had argued that WhatsApp and Facebook had failed to respect users’ privacy rights and highlighted the ambiguity in some of the clauses in Whatsapp’s Terms of Use.

2. As I’d mentioned earlier, how WhatsApp implemented its new terms and conditions was disingenuous: it didn’t communicate the changes in a simpler manner (look at how Facebook currently implements privacy settings), and more importantly, hid the opt-out option a couple of taps away from the initial page. This has been validated by the ICA ruling.

3. What’s problematic is that users are no longer in control of their information (read: We are data). The onus is on users to take responsibility of their data, and not blindly click “I agree”. They need to find ways of preventing access to and collection of their data. Laws have to evolve to provide users that power, and inform users about data being collected from them. Laws will never be able to keep pace with technology, but there’s an urgent need for lawmakers to at least try. So far, they are failing us. The gap between technology deployment and legal oversight is both useful (because it allows for evolution of technology), but can also be problematic.

4. We’re also all at the mercy of privacy terms defined by WhatsApp and Facebook because India doesn’t have a privacy law. There’s an opportunity for a privacy law in India, so that global companies are forced to conform to our privacy laws, instead of forcing Indians to conform to their privacy terms. The Indian government has said in the Supreme Court that there is no fundamental right to privacy, which is shameful. Laws must be geared towards ensuring rights for citizens, and not what currently happens, where laws are meant to give the state overwhelming potentially feudalistic power over citizens

Press Release from the ICA (source)

On 11 May 2017 the ICA closed 2 investigations opened in October 2016 concerning alleged infringements of the Consumer Code by WhatsApp.

In the first investigation, the ICA has ascertained that WhatsApp Inc. de facto forced the users of its service WhatsApp Messanger to accept in full the new Terms of Use, and specifically the provision to share their personal data with Facebook, by inducing them to believe that without granting such consent they would not have been able to use the service anymore. The consumers that already used WhatsApp Messanger on the date the Terms of Use were modified (25 August 2016) had instead the possibility to only accept part of the changes, since they could decide not to give their consent to share the information of their WhatsApp account with Facebook and still be able to use the app.

The practice has been implemented through: a) an in-app procedure for obtaining the acceptance of the new Terms of Use characterized by an excessive emphasis placed on the need to subscribe to the new conditions within the following 30 days or lose the opportunity to use the service; b) an inadequate information on the possibility of denying consent to share with Facebook the personal data on WhatsApp account; c) the pre-selection of the option to share the data (opt-in); d) finally, the difficulty of effectively activating the opt-out option once the Terms of Use were accepted in full. The second investigation, concerning the alleged unfair nature of some contractual clauses included in WhatsApp Messenger’s “Terms of Use”, assessed as illicit the contract terms concerning:

– very wide and general exclusions and limitations of responsibility in favor of WhatsApp, also in case of non-performance of contractual obligations by the operator;

– the possibility to unilaterally interrupt the service without reason or advance notice;

– a general right granted to WhatsApp to terminate / rescind the contract in any moment and for any reason and not allowing anymore the user to access / use the services, without granting the same right to the consumer;

– the general right granted to WhatsApp to introduce changes, also of economic nature, to the Terms of Use without indicating in the contract the reasons according to which the company introduces those changes and without establishing appropriate mechanisms for informing the consumer about them, together with the “tacit approval” provision allowing the company to obtain the consent to the change simply through consumer inertia;

– the choice of the law of the State of California as only governing lawin case of disputes, as well as the choice to submit litigations only to the jurisdiction of the U.S. District Court for the Northern District of California or the State Court of California;

– a general right granted to WhatsApp to terminate “orders” without refunds for the services offered, without clarifying the circumstances under which those actions would be carried out;

– the general predominance in case of conflict of the English version of the contract over the Italian one (which is accepted by Italian users), also without allowing the prevalence of the interpretation most favorable to the consumer, independently of the language in which the contractual clause is written.

Rome, 12 May 2017

*

Disclosure: I’m a co-founder of the Internet Freedom Foundation, which is a petitioner in the Whatsapp Privacy case in India. IFF’s filing is available here, published by Legally India. A note from IFF about this filing is available here.