WhatsApp row: How messaging app's new privacy policy impacts legal rights of Indian citizens

Popular messaging application Whatsapp recently announced a new privacy policy. It is mandatory for users to accept the new terms in order to continue using the app. While Whatsapp justifies the changes based on a need to integrate better with other products of its parental company, Facebook Inc, the new privacy policy has faced a severe backlash from varied stakeholders ranging from privacy advocates, competitive businesses, etc. It led to a massive exodus from the messaging applications to rival messaging applications like Signal, Telegram, etc. In this article, I analyse the impact of the new WhatsApp privacy policy on the legal rights of Indian users, competitive businesses and explore possible policy interventions. Updated Privacy Policy The most significant change in the new policy is the declaration that Whatsapp would share information across the Facebook Network of Companies, ie, Facebook, Instagram, etc. While it was optional previously, post 8 February, it would become mandatory. After facing a backlash from users, Whatsapp has put the policy on hold till 15 May. While personal Whatsapp messages are end-to-end encrypted (which means no third party, nor Whatsapp can get access to the messages), Whatsapp would now collect and transmit large scale information about how you interact on the platform across the Facebook Network. Further, interactions with businesses on WhatsApp, including messages, will be accessible across the Facebook network. To explain simply, WhatsApp will conduct significant data mining exercises in two prongs: i) primary text messages sent to business accounts ii) metadata, ie, data about data. The latter part is the more controversial part while seemingly innocent. This can reveal highly sensitive information about an individual’s identity and character. We will try to unpack what metadata means in this context and its effect on user rights. What is metadata? Metadata, for the purpose of our discussion, can be explained as almost everything about a message except for the ‘content’ of that message. Whatsapp collects varied information like contacts, location details, financial details, unique identifiers of phones. This metadata collected can then be linked to one’s individual identity and be used to build a complete profile of them. For example, location details can reveal one’s ethnicity, or, financial details including transactional information can reveal whether one is a spendthrift. This identity-based profile created via this metadata would help Facebook Inc to target users with advertisements for businesses associated with its network. These targeted advertisements may be segmented according to the user’s identity, interests, hobbies, etc. For example, WhatsApp may collect financial information from users on WhatsApp pay and the same may be shared with Facebook to help target the user with advertisements from credit agencies, banks, etc.

On a more dangerous scale, details about and user’s spending habits or location can help Facebook build an identity/personality profile helping them target advertisements from businesses like political consultancies or political parties.

Legal Concerns The new policy does not take into account the consent of users when it makes it mandatory to accept the new policy. While there is always an option to not use the application, the application in itself is immensely popular, and not several people might realise a direct abrogation of their rights. An opt-in contract rule would require a specific, clear, and affirmative acceptance of the terms and conditions by a user, rather than implicit or unspecified consent. The opt-in policy present on paper, once made mandatory for continuing the use of the popular application (without an opt-out clause), violates the consent rule of private parties. In 2017, a nine-judge bench of the Supreme Court had declared the right to privacy a fundamental right of all citizens. The apex court ruled that a right to privacy includes a right to control usage of one’s data ie, decisional autonomy over data of every citizen. While citizens have such a right to privacy only against the state under the Indian Constitution, the state has a positive obligation to protect the rights of its citizens especially when private legislation is absent. While India does not currently have a data protection law, a bill proposed earlier by the Srikrishna Committee stipulates under Section 5 that the usage of data/information must be reasonably linked to the purpose for which it was given. Under this proposed section, for example, data collected like financial information on WhatsApp cannot be used by Facebook, a different entity to target users with advertisements for associated businesses. Under this proposed bill, the onus is on the businesses to ensure that the user’s consent with regards to the collection of data is fairly taken, and the collected data is used in a reasonable manner linked to its original purpose. The norms proposed by the Srikrishna Committee are similar to the law applicable in the European Union on this limited point.

The new policy of sharing Whatsapp data with Facebook will not be applicable to the European Union. This is because of the General Data Protection Regulation which prohibits businesses from collecting data that is not essential and reasonably necessary for their services. Therefore, WhatsApp can only collect data that is essential to run its services, ie, of running a messaging application. Data cannot be shared with Facebook since it is not essential to the functioning of a messaging application.

The new policy may also significantly affect competitive businesses that are not an associated business to Facebook Inc, ie, they do not market their services on Facebook. In 2017, the European Commission had imposed a fine of €110 million on Facebook, for providing incorrect and misleading information related to the merger between Facebook and Whatsapp. This privacy policy may be seen as a stepping stone for a much larger planned integration of the three ‘giants’ in the Facebook Network of Companies — Facebook, Instagram, and Whatsapp. Facebook started off as a social media platform that protected the privacy of users but slowly started backsliding on such commitments, offering users worse off privacy protections as it became a dominant player in the market. In today’s day and age, owing to the hegemony, market dominance, and the reach of Facebook and Instagram — businesses find it suitable to market on these platforms due to their incomparable reach. With the data collected from WhatsApp, Facebook Inc may establish a monopoly in digital marketing leading to justified concerns from anti-trust activists. It is imperative for crucial policy interventions with respect to data protection in India. Ordinarily, governmental legislations deriving values from the Constitution should guide private behaviour. In the absence of the same, it is the duty of the courts to protect the fundamental rights of citizens.