The Supreme Court has directed WhatsApp to publicise its stance allowing Indian WhatsApp users to continue using the service without accepting the company’s 2021 privacy policy until the Data Protection Bill is introduced in the Parliament, LiveLaw reported.
According to LiveLaw’s report, in 2021, WhatsApp had written to the IT Ministry stating:
“WhatsApp will not limit the functionality of how WhatsApp works in the coming weeks as previously planned. We will continue to display our update from time to time to people who have not yet accepted. In addition we will display the update whenever a user chooses relevant option features….We hope this approach reinforces the choice that people have in how they use WhatsApp. We will maintain this approach till the forthcoming Data Protection Bill comes into existence.”
A five-judge bench of the Supreme Court, comprising Justices KM Joseph, Ajay Rastogi, Aniruddha Bose, Hrishikesh Roy and CT Ravikumar asked WhatsApp to publicise the 2021 undertaking in at least five national newspapers on two occasions through full-page advertisements. This the court said would help users who have not yet accepted the privacy update.
After deliberations over whether the matter should be heard in context of the data protection bill, the bench decided to list it for hearing on April 11, 2023 once the Budget session concludes. The court was informed that the bill will be introduced in the Parliament in the second half of the budget session.
STAY ON TOP OF TECH POLICY: Our daily newsletter with top stories from MediaNama and around the world, delivered to your inbox before 9 AM. Click here to sign up today!
What’s the case about?
The Supreme Court was hearing the 2016 case Karmanya Singh Sareen And Anr vs Union Of India, in which a batch of petitioners challenged the changes to WhatsApp’s privacy policy allowing sharing of users’ data with parent company Facebook (now Meta). WhatsApp had not given users a choice to opt-out of the data sharing agreement. The policy was challenged on the grounds of failing to protect users’ data privacy and infringing upon their fundamental right under Article 21 of the Indian Constitution.
The matter was first heard by the Delhi High Court and in 2016, the court declined to grant the reliefs sought by the petitioners; the order was then challenged in the Supreme Court and referred to the Constitution bench in 2017. In the latest update, the case was heard on January 31 and February 1, 2023.
WhatsApp’s 2021 privacy update confirming Facebook’s access to business messages on WhatsApp and other metadata giving greater insights on user information to the company, is also being heard in the current court proceedings. It had put the privacy policy on hold until the data protection law came into force. The petitioners, government of India, WhatsApp and Facebook and the Internet Freedom Foundation are parties to the case.
Why it matters?
WhatsApp’s new privacy policy allowing access to users’ data for Facebook and Instagram raises serious privacy concerns at a time when Indians do not have a data protection law. Internet rights’ experts have pointed out that the policy can expose granular data and meta-data of WhatsApp users to Facebook, specifically for business users. Exploitation of user data for targeted advertising and marketing purposes by Meta is well know. The privacy policy has also been taken up for investigation by the Competition Commission of India. The Supreme Court’s arguments in the WhatsApp case in India are critical to understand the aspects that the court is focusing on while dealing with matters related to Big Tech data collection and sharing issues.
Key arguments over collection of personal data
In the last two days of the hearing, the parties argued over the type of user-data WhatsApp had access to and the implications of such data collection for Indian users in the absence of a data protection law.
‘We do not collect personal data’: Representing WhatsApp, senior advocate Kapil Sibal maintained that WhatsApp messages are end-to-end encrypted and even the company does not have access to such information. He also stated that question of data-sharing comes into the picture only if the user is using both applications, Facebook and WhatsApp and that the company has access only to a user’s name and phone number, as per LiveLaw’s report. He adds that the company does not process sensitive personal information. He argued that with respect to sensitive personal data, WhatsApp works in compliance of the Information Technology Act and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.
Reading Rule 7 of the IT Rules
After Sibal’s statement over IT Rules compliance, Justice Joseph viewed that as per Rule no 7 of the IT Rules, “it appeared that personal data could be transferred without consent”.
“We are telling you that Rule 7 is capable of being used for transfer of information without consent…The question is not whether you do it with or without consent. It is whether the law permits it to be transferred without consent,” he states. In this regard, the Justice highlights that if political views are not considered to be sensitive personal information, such information can be potentially used for political as well as commercial purposes. This was seen in the case of Cambridge Analytica.
‘Give us an opt-out option’: Senior advocate Shyam Divan, appearing for the petitioner, argued that if WhatsApp is already complying with an existing legal regime, then there’s no need to wait for the data protection legislation. He emphaises on the ‘data breach’ aspect of the case and cites author Sushona Zuboff’s explanation of “surveillance capitalism”, stating that it is about how data has “enormous commercial value”.
“We will show the manner in which meta-data has an enormous commercial value, which is being exploited by WhatsApp sharing it with Meta,” he says, according to Livelaw’s live blog.
He argued that Facebook must obtain informed consent of users and allow them to “opt-out” of policy changes that require data sharing. Noting that WhatsApp has not yet restricted those users who haven’t accepted the changes, from using the application, Divan asked the court to direct WhatsApp to give an “undertaking that it would not share data with Facebook companies” until the data protection bill is out. To this, Sibal pointed out the May 2021 letter to the IT Ministry and the court directed WhatsApp to publicise it exclusively to better inform the users.
Senior Advocate M.K Vishwanath appearing for the Internet Freedom Foundation reiterated that WhatsApp’s 2021 policy update enables sharing of extensive metadata without providing an option for users to choose otherwise. “Let them give us the opt out policy. They want this unregulated situation to continue,” Vishwanath asserted.
This post is released under a CC-BY-SA 4.0 license. Please feel free to republish on your site, with attribution and a link. Adaptation and rewriting, though allowed, should be true to the original.
Also Read:
- Delhi HC Dismisses WhatsApp And Meta’s Plea Against CCI Probe Into Privacy Policy
- European Commission Tells WhatsApp To Clarify Its Privacy Policy Change By End Of February 2022
- WhatsApp Puts New Privacy Policy On Hold Until Data Protection Bill Comes Into Force: Report
- Following Backlash, WhatsApp To Show In-App Banner Explaining Privacy Policy
- WhatsApp To Severely Restrict Features For Users Who Don’t Accept New Privacy Policy
