3. The reason for resistance to WhatsApp's privacy update is due to concerns over user-data collection as has been made clear in its policy that now broadens the scope of data sharing between WhatsApp and Facebook, or even other third-party services. Though end-to-end encryption still continues, user data on WhatsApp could now be used to further link services with Facebook and other Facebook companies. The company has attempted to clarify that the data being accessed would not be personal in nature, but of those interactions that users have with businesses. 4 But the wide range of data automatically collected, such as IP addresses and phone number area codes, meta data on usage and log, device and connection information, raises privacy concerns.
4. Further, the update does not extend to the European region due to its stringent General Data Protection Regulation. India, not having a similar comprehensive data protection legislation, relies on the Information Technology Act, 2000, and its rules, 5 for regulating the use of sensitive personal data (a subset of personal data), whilst the Personal Data Protection Bill of 2019 still waits in dormancy before the Parliament. The current legal regime is, therefore, inadequate to address the arising data privacy concerns due to, but not limited to, its lack of primary legislation and governmental regulatory authority, narrow scope, and limited penalties.
6. Interestingly, the Competition Commission of India (CCI) passed a suo moto order to initiate an investigation into whether WhatsApp was misusing its dominant position in the industry. The CCI keenly noted in its order that earlier versions of WhatsApp's privacy policies had 'opt-out' provisions unlike in the present update, and observed the new version to be 'take-it-or-leave-it' in nature. It called WhatsApp's data collection to be expansive and disproportionate, and noted that such data concentration, and use, in itself raised anti-competitive concerns. The CCI thus ordered a detailed investigation into WhatsApp's market position and power. Claiming that the CCI was exceeding its jurisdiction by reaching into data privacy matters, and questioning Facebook's impleadment in the same, the order was contested by WhatsApp and Facebook before the Delhi High Court which squashed its challenge. 11
7. Amidst several of these apprehensions from both the government and the public, and their ensuing tussle with WhatsApp, the privacy update has not-so-quietly come into effect in India. With mounting privacy concerns, this does not appear to be a battle that will end soon.
2 Giving more time to our recent update, WhatsApp, https://blog.whatsapp.com/giving-more-time-for-our-recent-update, last accessed on May 19th, 2021.
3 What happens on the effective date?, WhatsApp, https://faq.whatsapp.com/general/security-and-privacy/what-happens-when-our-terms-and-privacy-policy-updates-take-effect/?lang=en, last accessed on May 19th, 2021.
5 Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
6 Karmanya Singh Sareen & Anr. vs. Union of India & Ors, S.L.P. (C) No. 804 of 2017.
7 "You may be trillion dollar company but people value their privacy": Supreme Court seeks response from Centre, WhatsApp, Bar and Bench, https://www.barandbench.com/news/litigation/whatsapp-privacy-policy-challenge-supreme-court-notice-central-government-whatsapp-facebook; last accessed on May 19th, 2021.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.