WhatsApp’s 2021 Privacy Policy – Update from India

By G. R. Bhatia & Aaditya Ranbir Sahgal1

Competition regulators around the world have taken note of WhatsApp’s proposed 2021 Privacy Policy and Terms of Service from the perspective of antitrust law. In India, the Competition Commission of India (“CCI”) vide its order dated 24.03.2021 took suo motu cognizance of WhatsApp’s 2021 privacy policy and terms of its service and found it to be prima facie a case of abuse of dominance  in violation of  Section 4 of the Competition Act, 2002 (“Act”).

The CCI’s decision reasoned that WhatsApp, a dominant entity in the “market for Over-The-Top (OTT) messaging apps through smartphones in India” providing a non-substitutable service, was not giving its users an option to opt out of the user data sharing arrangement between WhatsApp and Facebook. It was highlighted that such an “opt-out” choice had been provided in its previous iterations and based thereon the CCI had found no prima facie contravention of the Act.

In its order on March 24, the CCI made important observations in the context of privacy vis-à-vis competitiveness, finding that non-price factors such as privacy is an important parameter of competition. The CCI observed that consumer sentiment has shifted towards valuing privacy even if at higher product costs. Further, the CCI observed that WhatsApp had become entrenched and network effects had undeniably set in for WhatsApp thus making the entry of new market players to be more difficult. Accordingly, the CCI prima facie concluded that WhatsApp is a dominant and entrenched entity which is forcing users to comply with terms dictated by it in an anti-competitive/abusive manner.

It is relevant to note that the CCI has decided to put its weight behind such a concept of privacy being an important non-price factor of competition. Although not cited in the order itself, CCI’s January, 2021 market study on the tele-communications sector in India noted that “in the era of data aggregation, competition analysis must also focus on the extent to which a consumer can ‘freely consent’ to (an) action by a dominant player.”² The Report stated that abuse of dominance can take the form of lowering privacy protection and, therefore, falls within the ambit of antitrust as a form of non-price competition since the lowering of privacy standards implies a lack of consumer welfare. Consent has also been encapsulated as an important prerequisite for processing personal data in Sections 11 and 14 of the Personal Data Protection Bill, 2019 which is presently before the Joint Parliamentary Committee.

WhatsApp challenged CCI’s order of March 24 before the Delhi High Court (“DHC”) and its primary argument was that the CCI had exceeded its jurisdiction by taking cognizance of a case when the subject matter was already pending adjudication before the DHC and the Supreme Court (“SC”). Rejecting such an argument, the DHC observed that though some of the issues may substantively be the same before the two fora, there cannot be an inviolable rule that merely because an issue is pending before a superior court, the CCI would get divested of the jurisdiction that it would otherwise possess under the Act. Accordingly, WhatsApp’s challenge to the CCI’s order was rejected.

Facebook argued before the CCI as well as before the High Court that it ought not to be made party to these proceedings since they are separate legal entities. The CCI rejected the same, observing that such a submission was “egregious” since Facebook would be a beneficiary of the data sharing arrangement. Accordingly, it was held to be a necessary party since the data was to be shared with it. The DHC also rejected such contentions of Facebook, finding merit in the CCI’s rationale. The DHC judgment dated 22.04.2021 dismissing the challenge to the CCI’s order rendered by a single judge bench, is currently under appeal before a division bench in WhatsApp LLC v. CCI & Anr., LPA 163 of 2021 and LPA 164 of 2021.

The 2021 privacy policy and terms of service have also been challenged before the DHC as violative of the fundamental right to privacy as well as provisions of the Information Technology Act, 2000, in Dr. Harsha Gupta v. Union of India & Ors., W.P. (C) 2947 of 2021. In the aforementioned proceedings, in its defence, WhatsApp has submitted that a wide variety of applications such as Zoom, Truecaller, Zomato, Ola, Koo, BigBasket, and Aarogya Setu have similar privacy policies and, in some cases, the actual data collection exceeds the data collected by WhatsApp.³ It has also contended that users are not constrained or forced to use WhatsApp and can cease to do so if they are aggrieved by the impugned update.

Further, WhatsApp’s 2016 update had been impugned before the Supreme Court and during its pendency, the 2021 privacy policy change has also been challenged in the same proceedings by way of an application filed in Karmanya Singh Sareen & Anr. v. Union of India & Ors., SLP (C) 804/2017.⁴ The said application claimed that WhatsApp was offering lower privacy protections in Indian as compared to Europe. Notice was issued by the Supreme Court in the said case and parties have been asked to submit their replies. The Government of India also called upon WhatsApp to withdraw the proposed update in Jan., 2021.⁵

It is pertinent to note that WhatsApp’s troubles are not localized in India. In addition to India, WhatsApp has faced scrutiny from regulators globally as well. Interim orders and directions requiring WhatsApp to refrain from rolling out the update have also been issued in Argentina⁶, South Africa,⁷ and Turkey.⁸ Although concerns have been expressed that users in the European Union (“EU”) would be offered a higher degree of protection on account of the General Data Protection Regulations (“GDPR”), regulators within the EU have expressed doubts that the update complies with the GDPR.⁹

WhatsApp on its part has published a new FAQ page on its website clarifying that the policy update does not affect the privacy and security of your messages with friends or family in any way.  It explains:

• We can’t see your personal messages or hear your calls;
• We don’t keep logs of who is messaging or calling;
• We can’t see your shared location;
• We don’t share your contacts;
• Groups remain private;
• You can set your message to disappear; and
• You can download your message.

It further says that million of people around the world communicate securely with businesses of all sizes on WhatsApp.  In order to make messaging easier and better with businesses using hosting services, discovery and UPI enabled payment services, it seeks to put in place changed privacy policy.

Recently, the Government of India reportedly sent a notice to WhatsApp stating that its new privacy policy (which permits sharing business communication of users with its owner/parent Facebook (even though personal chats remain encrypted) is a violation of several provisions of Indian laws/rules and further said that in fulfilment of its sovereign responsibility to protect the rights/interest of its citizens, the Government will consider various options available to it under the laws in India.  WhatsApp has reportedly responded that it won’t withdraw the privacy update, however, it will not limit the functionality of a user till the country gets a data protection law.¹⁰

Click here for a PDF version of the article

1 G. R. Bhatia, Partner & Head of Competition Law, L & L Partners Law Offices, New Delhi. Aaditya Ranbir Sahgal, Associate, L & L Partners Law Offices.

2 Competition Commission of India, Market Study on the Telecom Sector in India – Key Findings and Observations, pg. 33. (January 22, 2021). Available at https://www.cci.gov.in/sites/default/files/whats_newdocument/Market-Study-on-the-Telecom-Sector-In-India.pdf.

3 CNBC TV18, WhatsApp defends new privacy policy, claims other companies collect more data (May 14, 2021). Available at https://www.cnbctv18.com/technology/whatsapp-defends-new-privacy-policy-claims-other-companies-collect-more-data-9302051.htm.

4 Supreme Court Observer, WhatsApp-Facebook Privacy. Available at https://www.scobserver.in/court-case/whatsapp-facebook-privacy-case.

5 Reuters, India asks Facebook’s WhatsApp to withdraw privacy policy update (January 19, 2021). Available at https://www.reuters.com/article/india-facebook-whatsapp-idUSKBN29O11G.

6 Bloomberg Law, Argentina Suspends WhatsApp Update for Antitrust Probe into Facebook (May 18, 2021). Available at https://news.bloomberglaw.com/tech-and-telecom-law/argentina-suspends-whatsapp-update-for-antitrust-probe-into-facebook.

7 Gadgets 360, WhatsApp-Facebook Data-Sharing Policy Update Opposed by South Africa (March 5, 2021). Available at https://gadgets.ndtv.com/apps/news/whatsapp-facebook-data-sharing-policy-update-new-terms-rules-privacy-south-africa-oppose-2384066.

8 Rekabet Kurumu, The Competition Board launched an investigation of Facebook and WhatsApp of its own accord and stopped the obligation to share WhatsApp data (January 11, 2021). Available at https://www.rekabet.gov.tr/tr/Guncel/rekabet-kurulu-facebook-ve-whatsapp-hakk-14728ae4f653eb11812700505694b4c6.

9 GSM Arena, German regulator orders Facebook to cease collecting data from WhatsApp users (May 12, 2021). Available at https://www.gsmarena.com/german_regulator_orders_facebook_to_cease_collecting_german_whatsapp_users_data_-news-49062.php.

10 Media report available at https://timesofindia.indiatimes.com/india/whatsapp-defiant-wont-withdraw-privacy-update/articleshow/82926203.cms.