According to LiveLaw’s report, in 2021, WhatsApp had written to the IT Ministry stating:
“WhatsApp will not limit the functionality of how WhatsApp works in the coming weeks as previously planned. We will continue to display our update from time to time to people who have not yet accepted. In addition we will display the update whenever a user chooses relevant option features….We hope this approach reinforces the choice that people have in how they use WhatsApp. We will maintain this approach till the forthcoming Data Protection Bill comes into existence.”
A five-judge bench of the Supreme Court, comprising Justices KM Joseph, Ajay Rastogi, Aniruddha Bose, Hrishikesh Roy and CT Ravikumar asked WhatsApp to publicise the 2021 undertaking in at least five national newspapers on two occasions through full-page advertisements. This the court said would help users who have not yet accepted the privacy update.
After deliberations over whether the matter should be heard in context of the data protection bill, the bench decided to list it for hearing on April 11, 2023 once the Budget session concludes. The court was informed that the bill will be introduced in the Parliament in the second half of the budget session.
STAY ON TOP OF TECH POLICY: Our daily newsletter with top stories from MediaNama and around the world, delivered to your inbox before 9 AM. Click here to sign up today!
What’s the case about?
The matter was first heard by the Delhi High Court and in 2016, the court declined to grant the reliefs sought by the petitioners; the order was then challenged in the Supreme Court and referred to the Constitution bench in 2017. In the latest update, the case was heard on January 31 and February 1, 2023.
Why it matters?
Key arguments over collection of personal data
In the last two days of the hearing, the parties argued over the type of user-data WhatsApp had access to and the implications of such data collection for Indian users in the absence of a data protection law.
‘We do not collect personal data’: Representing WhatsApp, senior advocate Kapil Sibal maintained that WhatsApp messages are end-to-end encrypted and even the company does not have access to such information. He also stated that question of data-sharing comes into the picture only if the user is using both applications, Facebook and WhatsApp and that the company has access only to a user’s name and phone number, as per LiveLaw’s report. He adds that the company does not process sensitive personal information. He argued that with respect to sensitive personal data, WhatsApp works in compliance of the Information Technology Act and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.
Reading Rule 7 of the IT Rules
After Sibal’s statement over IT Rules compliance, Justice Joseph viewed that as per Rule no 7 of the IT Rules, “it appeared that personal data could be transferred without consent”.
“We are telling you that Rule 7 is capable of being used for transfer of information without consent…The question is not whether you do it with or without consent. It is whether the law permits it to be transferred without consent,” he states. In this regard, the Justice highlights that if political views are not considered to be sensitive personal information, such information can be potentially used for political as well as commercial purposes. This was seen in the case of Cambridge Analytica.
‘Give us an opt-out option’: Senior advocate Shyam Divan, appearing for the petitioner, argued that if WhatsApp is already complying with an existing legal regime, then there’s no need to wait for the data protection legislation. He emphaises on the ‘data breach’ aspect of the case and cites author Sushona Zuboff’s explanation of “surveillance capitalism”, stating that it is about how data has “enormous commercial value”.
“We will show the manner in which meta-data has an enormous commercial value, which is being exploited by WhatsApp sharing it with Meta,” he says, according to Livelaw’s live blog.
He argued that Facebook must obtain informed consent of users and allow them to “opt-out” of policy changes that require data sharing. Noting that WhatsApp has not yet restricted those users who haven’t accepted the changes, from using the application, Divan asked the court to direct WhatsApp to give an “undertaking that it would not share data with Facebook companies” until the data protection bill is out. To this, Sibal pointed out the May 2021 letter to the IT Ministry and the court directed WhatsApp to publicise it exclusively to better inform the users.
Senior Advocate M.K Vishwanath appearing for the Internet Freedom Foundation reiterated that WhatsApp’s 2021 policy update enables sharing of extensive metadata without providing an option for users to choose otherwise. “Let them give us the opt out policy. They want this unregulated situation to continue,” Vishwanath asserted.
This post is released under a CC-BY-SA 4.0 license. Please feel free to republish on your site, with attribution and a link. Adaptation and rewriting, though allowed, should be true to the original.