Who would have imagined India, without a data privacy law, could make the Facebook-owned messaging service, WhatsApp, change its stance and adopt a more favourable approach to its privacy policy update? This is a stance far removed from its initial warning of 4 January that users had to consent to its new global privacy policy or risk having their accounts deleted.
WhatsApp’s “take it or leave it” policy change – although seemingly in line with Indian regulations, or rather the lack of them – was what caught the attention of the Indian antitrust authority. Disguised as a policy update, WhatsApp breached antitrust law through “exploitative and exclusionary conduct”, the Competition Commission of India (CCI) alleged.
With WhatsApp’s entrenched market position, consumers would find it difficult to transition to another platform. The CCI has a strong case against WhatsApp changing its privacy policy and its proposal to harvest consumer data in the manner it is positioning, says Bagmisikha Puhan, an associate partner at TMT Law Practice in New Delhi.
It is not just the question of sharing data through WhatsApp Business with connected parties. The platform captures an entire ecosystem as users can shop and make the payment through WhatsApp Pay, and also discuss the merits of the product, all on a single platform, Puhan points out. “All of this, tied up, could create barriers to entry and disincentivise others,” she says.
CCI’s investigation into WhatsApp’s privacy policy, alleging abuse of dominance, is problematic. It has set off alarms on whether the antitrust investigation will result in additional compliance requirements for companies’ data privacy policies under the Competition Act.
Deeksha Manchanda, a partner with Chandhiok & Mahajan in New Delhi, fears the investigation and the final order could create a parallel governance structure for regulating privacy and personal data. “Privacy is a constitutionally guaranteed right that has to be protected by way of a distinct statute,” says Manchanda, adding that the right to privacy cannot be subjected to the market position of the parties.
The Competition Act does not lay down any rules on data privacy, nor are the standards a company has to follow statutorily prescribed, so the CCI’s decision to tackle privacy will only create uncertainty and ambiguity, says Manchanda.
Following a global backlash and faced with legal battles in India from users, the government, and the competition watchdog, WhatsApp changed its tune in early May. It announced that the new updated privacy policy is not “mandatory”, and that it would not force users to accept the update, at least not until India’s Personal Data Protection Bill is enacted.
The draft bill of 2019 is expected to be tabled in the parliament in the coming monsoon session, in July. Since the very premise that attracted the CCI’s attention has changed, because WhatsApp has “effectively” given users the option not to accept the policy change “for now”, it could be said that the CCI’s order against WhatsApp no longer holds merit.
This gives WhatsApp good grounds to have the antitrust investigation set aside. “The right to privacy of an individual is not an absolute right,” says Akshat Kulshrestha, a competition lawyer working with S&R Associates in New Delhi. “But it is subject to restrictions and limitations made by the state to protect the public interest. It will now be left to the courts to balance the interests of an individual in maintaining the right to privacy with the interest of the state in maintaining law and order.”
Rahul Narayan, an advocate on record at the Supreme Court in New Delhi, says the essential basis of the legal challenges is “the perception that Indian users are being short-changed in comparison to users in Europe”. India does not have a data protection law akin to the General Data Protection Regulation (GDPR).
Once an effective data protection law is in force, there would be “a solid legal basis for treating the data in the same way, whether in Europe or India,” says Narayan. With the absence of a law, WhatsApp is bound by court judgments on the right to privacy, delivered in a constitutional context against the state, he adds.
WhatsApp’s spokesperson says that the recent policy update does not change the privacy of people’s messages and its purpose is to provide additional information about how people can interact with businesses if they choose to do so.
“One takeaway is that technology continuously raises genuine issues of great significance as regards privacy, and that popular discourse on the issue must get out of simple binaries and contend with nuances and complexities,” says Narayan.
