The Italian Competition Authority has fined Facebook owned Whatsapp EUR 3 million for forcing its to accept in full, the provision to share their personal data with Facebook, “by inducing them to believe that without granting such consent they would not have been able to use the service anymore.” Hat tip: Monica Jasuja on Twitter.
1. Had an excessive emphasis on the need to subscribe within 30 days, failing which users would not be able to use the service.
2. Whatsapp made it difficult for users to figure out whether they could deny consent to share this information with Facebook
3. A pre-selected opt-in
2. As I’d mentioned earlier, how WhatsApp implemented its new terms and conditions was disingenuous: it didn’t communicate the changes in a simpler manner (look at how Facebook currently implements privacy settings), and more importantly, hid the opt-out option a couple of taps away from the initial page. This has been validated by the ICA ruling.
3. What’s problematic is that users are no longer in control of their information (read: We are data). The onus is on users to take responsibility of their data, and not blindly click “I agree”. They need to find ways of preventing access to and collection of their data. Laws have to evolve to provide users that power, and inform users about data being collected from them. Laws will never be able to keep pace with technology, but there’s an urgent need for lawmakers to at least try. So far, they are failing us. The gap between technology deployment and legal oversight is both useful (because it allows for evolution of technology), but can also be problematic.
4. We’re also all at the mercy of privacy terms defined by WhatsApp and Facebook because India doesn’t have a privacy law. There’s an opportunity for a privacy law in India, so that global companies are forced to conform to our privacy laws, instead of forcing Indians to conform to their privacy terms. The Indian government has said in the Supreme Court that there is no fundamental right to privacy, which is shameful. Laws must be geared towards ensuring rights for citizens, and not what currently happens, where laws are meant to give the state overwhelming potentially feudalistic power over citizens
Press Release from the ICA (source)
On 11 May 2017 the ICA closed 2 investigations opened in October 2016 concerning alleged infringements of the Consumer Code by WhatsApp.
– very wide and general exclusions and limitations of responsibility in favor of WhatsApp, also in case of non-performance of contractual obligations by the operator;
– the possibility to unilaterally interrupt the service without reason or advance notice;
– a general right granted to WhatsApp to terminate / rescind the contract in any moment and for any reason and not allowing anymore the user to access / use the services, without granting the same right to the consumer;
– the choice of the law of the State of California as only governing lawin case of disputes, as well as the choice to submit litigations only to the jurisdiction of the U.S. District Court for the Northern District of California or the State Court of California;
– a general right granted to WhatsApp to terminate “orders” without refunds for the services offered, without clarifying the circumstances under which those actions would be carried out;
– the general predominance in case of conflict of the English version of the contract over the Italian one (which is accepted by Italian users), also without allowing the prevalence of the interpretation most favorable to the consumer, independently of the language in which the contractual clause is written.
Rome, 12 May 2017
Disclosure: I’m a co-founder of the Internet Freedom Foundation, which is a petitioner in the Whatsapp Privacy case in India. IFF’s filing is available here, published by Legally India. A note from IFF about this filing is available here.