Right to Privacy verdict: Is it enforceable against a private technology company such as WhatsApp?

The Supreme Court’s verdict on the right to privacy last week is expected to bring about tremendous changes in the privacy practices adopted in the country. The impact of the verdict on the privacy practices of the State is obvious.

The right to privacy verdict will also have a definite indirect impact on all companies collecting data. One is through the enactment of a data protection law , which the Supreme Court has directed the government to do, at the earliest. The second is through its application in the WhatsApp Facebook case , where any directions or requirement of enactment of a law directed by the Supreme Court will impact private companies.

A direct impact, on the other hand, is not so clear cut. The main question that arises is whether a private company can be taken to Court for the violation of the fundamental right to privacy.

Issue in the WhatsApp Facebook case

WhatsApp’s privacy practices had initially been upheld by the Delhi High Court on the grounds that there was no fundamental right to privacy (then) nor any applicable statutory provisions. This first hurdle has been crossed with the recognition of the right to privacy.

Now, the next hurdle is whether a fundamental right can be enforced against a private company like WhatsApp.

Can FRs be enforced against non-state actors? When considering the application of the fundamental right to privacy on non-State actors, the main objection that comes to mind is that fundamental rights are, typically, enforceable only against the State. This concept has been established through various judgments of the Supreme Court. Consider also some fundamental rights like the right to equality, which reads ‘The State shall not deny equality before law….’, indicating a restriction to the state.

Article 12 of the Constitution defines a State to include the government, the parliament, the state legislatures and local or ‘other’ authorities. Earlier, the judicial interpretation of the term ‘other authorities’, was restricted to authorities related to the government and legislature, such as a governmental body. Now, it is being expanded to include other aspects, such as a corporation established by statute, a private body over which the government can exercise control, bodies granted certain powers, etc. For instance, this may include bodies like ONGC, LIC and so on.

Is WhatsApp performing a public function? One such expansion on the definition of ‘state’ is that a writ may be enforced against a private body that is performing a public function. WhatsApp, arguably, is performing such a function, when it provides a communication service to over 200 million people in India.

The arguments in the WhatsApp Facebook case , include that WhatsApp is not only a service intended as a replacement of conventional text messages and SMSs, but is also riding on a public medium, i.e., the infrastructure provided by telecom service providers (TSPs). To further establish the public nature of WhatsApp’s service, an analogy has been drawn between the heavily regulated TSP services in comparison with OTT services like WhatsApp.

TSP services, as is known, have very strict regulatory requirements, including privacy obligations. The downside of this line of argument is, however, that it indirectly advocates the regulation of OTT services on par with TSPs. Without going into all the drawbacks, from the privacy perspective, stringent regulation of OTT services could mean lesser privacy for the people in the long run.

This is because there is every possibility of the government prescribing low encryption standards to enable decryption and surveillance at its will. This will bring an end to the end-to-end encryption offered by WhatsApp. This has been seen earlier in India in the case of Blackberry, where the government lowered Blackberry’s privacy and security standards and mandated interception.

Does the Constitution bar enforcement against non-State actors? Looking at an alternative solution, Part III of the Constitution of India does not expressly restrict the protection of fundamental rights against violation by the State only. Nor does Article 32, which deals with the right to approach the Supreme Court for violation of a fundamental right, nor does Article 226, which deals with the same right with respect to High Courts.

In fact, Article 21, the right to life and liberty, reads as follows: ‘No person shall be deprived of his life or personal liberty except according to procedure established by law’. There is thus nothing in this article either to restrict its application to State actors only. Applying the newly recognised right to privacy to this, it can be said that no person can be deprived of his fundamental right to privacy, except according to procedure established by law. The freedoms under Article 19 are also established without reference to the State.

Thus, from a bare reading of these provisions, it can be argued that the Constitution in no way bars the enforcement of the fundamental rights against non-State actors.

Vishakha v Rajasthan enforced fundamental rights against private persons also In fact, one of the cases being alternatively urged before the Supreme Court in the WhatsApp Facebook case is the landmark Vishakha v State of Rajasthan. Here, the Supreme Court issued detailed guidelines for the protection of the fundamental rights of working women under Articles 14, 19 and 21. These guidelines were issued for mandatory adoption by all workplaces, which include both State and non-State actors. This case indicates that the Supreme Court has not restricted the issuance of writs and enforcement of fundamental rights against the State only. There thus exists the possibility of enforceability of fundamental rights against private bodies as well.

This case indicates that the Supreme Court has not restricted the issuance of writs and enforcement of fundamental rights against the State only. There thus exists the possibility of enforceability of fundamental rights against private bodies as well.

Adopting this method can allow the issue of detailed guidelines for the protection of privacy immediately, without having to wait for the government to come out with a data protection law, or without the risks of TRAI issuing stringent regulations for OTT services.

SC’s approach will demonstrate right to privacy against private companies A direct impact of right to privacy verdict on private companies, through allowing its enforcement against them, is therefore limited, but very much possible. The Supreme Court may take one of many approaches when dealing with the WhatsApp Facebook case, including issuing detailed privacy guidelines, directing the government to issue data protection laws, holding that the writ petition is not maintainable since WhatsApp is a private company, and so on.

The final verdict of the Supreme Court, in this case, will demonstrate the enforceability of a right to privacy in the case of a private company, or, at the least, in the case of a private communication service like WhatsApp.

The author is a lawyer with a specialisation in cyber laws and has co-authored books on the subject.