Excerpt: What Privacy Means by Siddharth Sonkar

On 4 January 2021, when WhatsApp announced an update of its privacy policy, it experienced a storm when millions of Indian users shifted to Telegram and Signal. The misinformation aside, the update, in fact, was primarily related to user interactions with businesses on WhatsApp. Yet, news publications wrongly assumed that WhatsApp had finally ‘crossed a line’, requiring users to share their personal data with Facebook Group companies with no alternative. WhatsApp was quick to clarify that the privacy policy did not significantly impact how individual users typically interact with each other, and this privacy policy update did not mean that Facebook could gain access to the users’ private WhatsApp chats.

However, the more significant update of WhatsApp’s privacy policy was released much earlier on 25 August 2016 when the app enabled the sharing of certain types of user account data (such as phone numbers, transaction information, IP address and so on) with Facebook. When the 2016 update was announced, WhatsApp users were asked to accept the terms by 25 September 2016 (cut-off date) in order to continue using WhatsApp, although pre-existing users (prior to this cut-off date) could opt out of this change. However, for over a billion users who joined WhatsApp after the cut-off date, the choice to opt out was not available.

In fact, in 2016, a petition was filed before the Delhi High Court challenging this update as a violation of the fundamental right to privacy of WhatsApp users in Karmanya Singh Sareen v. Union of India. In its order, the Delhi High Court directed WhatsApp to delete the complete information of users who exercised the option to opt out before the cut-off date. For existing users who did not opt out, the Delhi High Court directed that WhatsApp should not share their pre-existing information with Facebook or any other group company.

The choices you have. If you are an existing user, you can choose not to have your WhatsApp account information shared with Facebook to improve your Facebook ads and products experiences. Existing users who accept our updated Terms and Privacy Policy will have an additional 30 days to make this choice by going to Settings > Account.

What perhaps added to the discomfort was an increased privacy consciousness in India since its recognition as a fundamental right. In the latest update, every WhatsApp user had to mandatorily agree to sharing their data with Facebook.

Noting the change in the privacy policy update in 2021, the Competition Commission of India (CCI) – which regulates anti-competitive practices (such as abuse of dominance) in the market – examined a complaint challenging WhatsApp’s 2021 update as ‘abuse of dominance’. The Commission took a prima facie (based on first impressions) view that this change in the privacy policy seemed to be an act of abuse of its dominant position in the market, and ordered a further probe into WhatsApp’s privacy policy, based on the following observations:

In fact, in Europe, WhatsApp had to modify its privacy policy after the Irish Data Protection Authority imposed a fine of €225 million (Rs19,11,62,25,000) for sharing user data with Facebook.

Of course, the fears that WhatsApp would be sharing chats of users or encrypted information with Facebook were indeed unfounded and baseless. However, the metadata that was still being shared, according to experts, could also be quite revealing about a user. Sharing metadata with Facebook provides it with an enhanced view of the online communication activities and habits of users, running the risk of, for instance, private WhatsApp contacts to become more public Facebook connections. Given the sharing of such information across other Facebook group companies, which are likely to already have swathes of data of existing WhatsApp users available, pre-existing users should at least have had an option to opt out of the change in a privacy policy in 2021. Further, there are increased risks of how metadata and such information can be used to harm individuals, even if it is not personal data per se, as discussed later in the book. In fact, in France, where WhatsApp also sought to share user data with Facebook group companies, the French data protection agency – the Commission Nationale de l’Informatique et des Libertés (CNIL) – ruled that WhatsApp did not have a legal basis for such sharing and must cease the same within one month. In a press statement, the Article 29 Data Protection Working Party, an independent European expert advisory body on data protection, noted that though WhatsApp seeks to share information within the Facebook family of companies for a range of purposes, including marketing and advertising, these were not originally included within the privacy policy and terms of service when existing users signed up to use the service.

After the issuance of the CCI’s order, the Delhi High Court was subsequently approached by WhatsApp for a stay of the order. But the Court refused to stay further CCI investigations into WhatsApp’s privacy policy (which were ongoing at the time of writing this book).

Today, imagining life without WhatsApp is indeed difficult. What makes it more so? Unlike how email clients work, wherein a Gmail user can send an email to an Outlook account, instant messaging platforms largely continue to lack interoperability, an idea significantly recognized by one of India’s most prominent regulatory bodies (such as the CCI, as discussed above) as well. When a messaging platform such as WhatsApp has a large volumes of users, and one’s family, friends and colleagues are all on the same platform, switching platforms would come at the cost of communicating with everyone else – unless one’s entire network also decides to switch platforms along with them. This is called ‘network effects’. The migration of users from WhatsApp to Signal may also have been caused by the same forces which brought users to WhatsApp in the first place – the desire to follow others, while also being uniquely interested in protecting one’s privacy. The absence of a law which mandates interoperability across platforms undermines the ability of users to exercise more privacy-friendly choices, since they are tied down by their networks.

Network effects give big technology platforms the ability to dominate the market, and equips them with enormous amounts of power over a person’s ability to refuse to consent to their terms, particularly if there are changes in the manner in which they are operating, or who they decide to share information with, as they continue to evolve, adapt and expand. But since with great power comes great responsibility, platforms should not be able to abuse their dominance by unilaterally introducing changes to their privacy policies, when users have no option but to consent.

Data Monopolies?

In April 2020, news that Facebook was about to acquire a stake of 9.99 per cent in Jio Platforms became public knowledge. Mukesh Ambani, chairperson of Reliance Industries Limited, highlighted the fact that one of the advantages of this deal would be the ability to integrate WhatsApp with JioMart. While the eventual collaboration seemed unclear, one could envision how JioMart would seek to leverage WhatsApp’s communication network to facilitate bringing potential customers on its platform. While both Facebook and Jio have access to incredible amounts of data through their respective customer databases, the extent to which they would share information with each other remained unclear. Facebook products, like Facebook and Instagram, share significant amounts of information with each other. While data sharing agreements exist with third parties for limited purposes, in the absence of a data protection law significantly limiting the extent of datasharing between entities, or a data protection authority to oversee the privacy implications of this deal, there is nothing beyond the good conscience of Reliance and Facebook preventing them from sharing data with each other.