SC wants the govt to protect the privacy of users from service providers like WhatsApp

The Supreme Court today asked the government to ensure that 160 million Indian subscribers are not “entrapped” in any manner by service providers like WhatsApp, which is providing free services to its users. The government also told the apex court that it was in the process of evolving a regulatory regime on data protection which would be binding in nature. “State has a duty to protect the citizenry rights. Since service providers like WhatsApp and Facebook say we are giving it free, the state has to ensure that 160 million citizens who are using the service, are not entrapped in it,” a five-judge Constitution Bench headed by Justice Dipak Misra said. The remarks by the top court came at the fag end of the day-long hearing after WhatsApp, while opposing the maintainability of the plea challenging its 2016 privacy policy, explained the nitty-gritty involved in it. The bench, which is hearing a challenge to the privacy policy of WhatsApp, also questioned whether the instant messaging platform can impose any condition on its users here which violated any part of the Constitution. While questioning the instant messaging platform why the world has “reacted” to its current privacy policy, the bench said nobody wants to share his or her data in “entirety”. “The issue is that you (WhatsApp) have framed a policy inviting customers for the purpose of availing the service. In that sphere, can you impose any condition which violates any part of the Constitution,” the bench asked WhatsApp, which was acquired by Facebook in 2014. “Why has the entire world, and a country like Germany, reacted to it? If it is such a laudable project, why are they reacting,” the bench, also comprising Justices A K Sikri, Amitava Roy, A M Khanwilkar and M M Shantanagoudar, asked and observed, “we undertand the concept of charity”. Senior advocate K K Venugopal, representing Facebook, told the bench that they were not sharing any sensitive or personal data and since India was shifting to digitisation, the service provided by WhatsApp was beneficial as it was end-to-end encrypted. “There are privacy laws in those countries. It is a matter which should be left to the government here,” he said. Meanwhile, the Centre told the apex court, which would now hear the matter on July 21, that they were in the process of making a regulatory regime to deal with the issue. “At the outset, the central government is committed to freedom of choice and right to privacy of citizens. This is non-negotiable and we are committed to this,” Additional Solicitor General (ASG) Tushar Mehta said, adding, “We are already in the process of doing it (regulatory regime).” “We are in the process of making either a statutory rule or executive guidelines, which would be binding in nature, on data protection,” he told the bench. During the day-long hearing, Venugopal said there was no legal framework at present to deal with the issue but most of the prayers sought by the petitioners were covered under the 2011 rules of the Information Technology Act. “These rules have the framework, an issue which has been raised. My submission is that the petition is not maintainable,” he said, adding that it was a matter of policy. He also said they were complying with the provisions of the rules which were in place in India. Senior advocate K V Vishwanathan, appearing for Internet Freedom Foundation (IFF), an intervenor in the case, said that though these rules would apply to WhatsApp and Facebook, but the entire issue, including the aspect of metadata, pending before the apex court, was not covered under it. “We find that the rules prescribe that there has to be a consent if you are sharing sensitive personal data. Suppose the consent is not taken effectively, what is the role of the constitutional court,” the bench said and asked Venugopal,“are you collecting any sensitive personal data at all?”. Responding to the query, the senior counsel said they were not collecting any personal or sensitive data and only phone numbers, device ID, registration details and the last seen status were shared. “These are totally non-sensitive and neutral data and no consent is required for it,” he said while refuting the claims of the petitioner that they produce or use metadata.