WhatsApp case shows need for data privacy law

WhatsApp case shows need for data privacy law

The Supreme Court may have come down heavily on WhatsApp over the proposed change in its privacy policy, but uncertainty brews as to whether the top court can force the US messaging service to reverse its decision while a data privacy law does not exist in India.

WhatsApp’s New Year announcement requiring users outside the EU either to agree to an updated privacy policy and terms of service by 8 February, or stop using the messaging app altogether, witnessed a backlash from users and regulators across the globe. Since then, the US messaging app has deferred the rollout of its revised policy to 15 May this year.

At least three lawsuits have been filed against WhatsApp and its parent, Facebook, in Delhi High Court, with the latest one in the Supreme Court. The Indian government has also demanded that the messaging app reverse its privacy policy, stating it is discriminatory and will result in security risks.

The government’s push is seen more for “political gain”, says MM Sharma, the head of competition law at Vaish Associates in New Delhi.

The government’s counsel, solicitor general Tushar Mehta, argued before the Supreme Court that, regardless of the non-existence of a privacy law in India, privacy is a fundamental right protected under the Indian constitution. The three-member bench of Supreme Court judges called out that while the US tech giant may have huge coffers, people valued their privacy more than money. The court also asked WhatsApp to give an assurance on oath that users’ personal data is not being shared with any third parties.

The government may be able to convince the Supreme Court by showing their intention through the provisions of the Personal Data Protection Bill, but this is not an easy task. Not when WhatsApp and Facebook have a reasonable defence in the fact that India does not have a data privacy law yet, unlike the EU’s General Data Protection Regulation (GDPR), says Sharma.

Without regulations being in place, it is uncertain whether the top court will pass any order considering that the initial case (Karmanya Singh Sareen v Union of India) has been going on for years, Deeksha Manchanda, a Delhi-based partner at Chandhiok & Mahajan points out.

Shyam Divan, the senior advocate representing the petitioners before the Supreme Court, tells India Business Law Journal that since the Supreme Court will recess for the summer break on 13 May 2021, there is likely to be an effective interim ruling on the issues by then.

Outlining options before the Supreme Court, Divan says WhatsApp could be either required to continue its present privacy policy with respect to India until the data protection law is enacted, or allow Indians to receive the same level of privacy protection available to Europeans until the domestic law comes into being. He does not rule out a third possibility that the court will allow WhatsApp to alter its privacy policy with respect to India.

In an interim application filed by Karmanya Singh Sareen, in a pending petition from 2017, the Supreme Court was asked to direct WhatsApp to apply the same privacy policy standards to users in India as those in the EU. The petition said that WhatsApp sharing user data infringed fundamental rights under article 19 (freedom of speech and expression) and article 21 (right to life) of the Indian constitution.

“The right to privacy exists in the constitution, but legislation is required to be laid down by the government to define the contours of the right,” says Manchanda.

If the final Personal Data Protection Bill is in line with Europe’s data protection law, then WhatsApp will need to revise its policy for India, adds Manchanda. Until there are regulations on how data should be shared or controlled, or what rights data fiduciaries should be given are required, there is not much that the Supreme Court can do for now.

The Business Law Digest is written by Freny Patel.

Law.asia subscripton ad red 2022