1. In January of 2021, WhatsApp, the Facebook-owned messaging giant, announced key changes to its privacy policy.1 Users were given no option but to mandatorily agree to its latest privacy update if they wished to continue using the application. It was initially intimated that come the deadline date, those who failed to click 'I agree,' would no longer have access to the platform. Following severe backlash, the company then pushed the deadline from February 8th to May 15th of 2021. 2

2. With the deadline date now having passed, WhatsApp has explained what users would experience if they do not accept its privacy policy. 3 It has made clear that user accounts will not be deleted, but that they will receive persistent reminders to accept the new update. If acceptance is continued to be withheld, users will then begin to encounter limited functionality on the application. From initially not being able to access their chat list, users would then not receive incoming calls or notifications, with WhatsApp no longer sending messages and calls to the user's phone. However, this would not occur for all users at the same time. WhatsApp aims to essentially dry out the user by withholding incoming information until acceptance of the policy update. It has also clarified that users will be able to export existing data from the application.

3. The reason for resistance to WhatsApp's privacy update is due to concerns over user-data collection as has been made clear in its policy that now broadens the scope of data sharing between WhatsApp and Facebook, or even other third-party services. Though end-to-end encryption still continues, user data on WhatsApp could now be used to further link services with Facebook and other Facebook companies. The company has attempted to clarify that the data being accessed would not be personal in nature, but of those interactions that users have with businesses. 4 But the wide range of data automatically collected, such as IP addresses and phone number area codes, meta data on usage and log, device and connection information, raises privacy concerns.

4. Further, the update does not extend to the European region due to its stringent General Data Protection Regulation. India, not having a similar comprehensive data protection legislation, relies on the Information Technology Act, 2000, and its rules, 5 for regulating the use of sensitive personal data (a subset of personal data), whilst the Personal Data Protection Bill of 2019 still waits in dormancy before the Parliament. The current legal regime is, therefore, inadequate to address the arising data privacy concerns due to, but not limited to, its lack of primary legislation and governmental regulatory authority, narrow scope, and limited penalties.

5. Litigation over privacy and data protection issues is not new to WhatsApp as its privacy policy from 2016 too was subject to contention, with a Special Leave Petition still pending before the Supreme Court of India. 6 The new privacy update has now been challenged before the Apex Court7 and the Delhi High Court, with contentions raised on differential treatment between Indian and European WhatsApp users, and on how the policy infringes upon the fundamental right to privacy. In response to a petition before the Delhi High Court, 8 WhatsApp stated that it would no longer defer its privacy policy rollout, and that users were not being forced to use the application, 9 while knowing full-well that it continues to be the most widely used messaging application in India. According to news reports, the Central Government called the update as violative of Indian information technology laws, and that the Ministry of Electronics and Information Technology has directed WhatsApp to quickly withdraw the update as it harms the rights and interests of Indian users by undermining informational privacy as well as data security. 10

6. Interestingly, the Competition Commission of India (CCI) passed a suo moto order to initiate an investigation into whether WhatsApp was misusing its dominant position in the industry. The CCI keenly noted in its order that earlier versions of WhatsApp's privacy policies had 'opt-out' provisions unlike in the present update, and observed the new version to be 'take-it-or-leave-it' in nature. It called WhatsApp's data collection to be expansive and disproportionate, and noted that such data concentration, and use, in itself raised anti-competitive concerns. The CCI thus ordered a detailed investigation into WhatsApp's market position and power. Claiming that the CCI was exceeding its jurisdiction by reaching into data privacy matters, and questioning Facebook's impleadment in the same, the order was contested by WhatsApp and Facebook before the Delhi High Court which squashed its challenge. 11

7. Amidst several of these apprehensions from both the government and the public, and their ensuing tussle with WhatsApp, the privacy update has not-so-quietly come into effect in India. With mounting privacy concerns, this does not appear to be a battle that will end soon.

Footnotes

1 WhatsApp Privacy Policy, WhatsApp, https://www.whatsapp.com/legal/updates/privacy-policy/?lang=en; last accessed on May 19th, 2021.

2 Giving more time to our recent update, WhatsApp, https://blog.whatsapp.com/giving-more-time-for-our-recent-update, last accessed on May 19th, 2021.

3 What happens on the effective date?, WhatsApp, https://faq.whatsapp.com/general/security-and-privacy/what-happens-when-our-terms-and-privacy-policy-updates-take-effect/?lang=en, last accessed on May 19th, 2021.

4 Answering your questions about WhatsApp's Privacy Policy, https://faq.whatsapp.com/general/security-and-privacy/answering-your-questions-about-whatsapps-privacy-policy; last accessed on May 19th, 2021.

5 Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

6 Karmanya Singh Sareen & Anr. vs. Union of India & Ors, S.L.P. (C) No. 804 of 2017.

7 "You may be trillion dollar company but people value their privacy": Supreme Court seeks response from Centre, WhatsApp, Bar and Bench, https://www.barandbench.com/news/litigation/whatsapp-privacy-policy-challenge-supreme-court-notice-central-government-whatsapp-facebook; last accessed on May 19th, 2021.

8 Virtually Gives 360 Degree Profile Into A Person's Online Activity: WhatsApp's New Privacy Policy Challenged in Delhi High Court, LiveLaw, https://www.livelaw.in/top-stories/whatsapp-privacy-policy-delhi-high-court-fundamental-right-to-privacy-168410; New PIL Challenging WhatsApp Updated Privacy Policy: Delhi High Court seeks Centre's Response, LiveLaw, https://www.livelaw.in/news-updates/new-pil-challenging-whatsapp-updated-privacy-policy-delhi-high-court-seeks-centres-response-173638, last accessed on May 19th, 2021.

9 Not Forcing Anyone to Use App, Users Free to Leave; Aarogya Setu, IRCTC Have Similar Privacy Policy: WhatsApp tells Delhi High Court, LiveLaw, https://www.livelaw.in/top-stories/not-forcing-anyone-to-use-app-users-free-to-leave-aarogya-setu-irctc-have-similar-privacy-policy-whatsapp-tells-delhi-high-court-174152, last accessed on May 19th, 2021.

10 India Gives WhatsApp 7 Days to Roll Back New Privacy Policy: Report, Business Standard, https://www.business-standard.com/article/technology/india-gives-whatsapp-7-days-to-roll-back-new-privacy-policy-report-121051900558_1.html; India Directs WhatsApp for Withdrawal of its Revised Privacy Policy, Business Standard, https://www.business-standard.com/article/technology/india-directs-whatsapp-for-withdrawal-of-its-revised-privacy-policy-121051900594_1.html, last accessed on May 19th, 2021.

11 WhatsApp LLC and Ors. vs. Competition Commission of India and Ors., W.P.(C) 4378/2021 and CM 13336/2021; Delhi High Court dismissed WhatsApp, Facebook's Challenge to CCI Order for Probe on New Privacy Policy, LiveLaw, https://www.livelaw.in/top-stories/delhi-high-court-dismisses-whatsapp-facebooks-challenge-to-cci-order-for-probe-on-new-privacy-policy-172922, last accessed on May 19th, 2021.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.