Background of Whatsapp’s new Privacy Policy
Earlier this year, the social media platform WhatsApp announced that it would be making changes to its privacy policy. This led to a massive controversy, with several experts speaking out against the move[1], a call for a shift to platforms like Signal, which business scion Elon Musk joined in on[2], and reports that the Indian government was going to launch an investigation[3]. The uproar has forced WhatsApp to push the implementation by three months[4] and consecutively, it launched[5] a campaign to protest against the outrage. At the heart of the trouble lies the fact that India is WhatsApp’s largest market, and losing its hold over 400 million users may damage it’s profitability.
Even three months after the outrage, the issue has not been settled. The Competition Commission of India (“CCI”) ordered an investigation into WhatsApp’s new privacy policy and its terms and conditions. This was recently challenged by WhatsApp and Facebook in the Delhi High Court, the judgement of which is currently pending.
This article will be examining the CCI’s decision, its reasoning, and any other antecedent questions that remain unanswered. However, before all this, we need to briefly discuss what the changes actually are, as there has been considerable confusion regarding them.
Updated Terms And Conditions
The changes led to a wave of panic and speculation, which obviously resulted in the spread of misinformation. WhatsApp also came out with its own set of clarifications, but whether it is comprehensive or not is up to question. What is not up for dispute is the fact that WhatsApp made this new policy mandatory. The user had to accept these new changes or they would lose access to their chats and would not be able to use WhatsApp any longer.
The new privacy policy in which it detailed its data sharing practices with Facebook extensively, the update was mainly to elucidate on its current relationship of data sharing with Facebook and to promote the ability of businesses on WhatsApp. For example, WhatsApp clarified that it allows interaction with third-party services or Facebook contents and clearly stated that it was sharing data with Facebook and third parties pursuant to its services.[6] Further, whenever someone uses an in-built video player on a video from a third-party platform, third parties will receive information, like the user’s IP address. It also elaborates on data sharing among Facebook’s allied companies and states unequivocally that it stores data in the United States of America.
The primary change came in terms of its treatment of businesses.[7] WhatsApp stated that it would allow businesses to use hosting services from Facebook, through which it could access customer chats. Pursuant to this, the application will share customer data[8] like phone numbers and transaction information with these businesses. This will allow businesses to target advertisements and use transaction data to make business decisions.[9]
However, certain allegations raised about the changes were false. For example, communication between two consumers, i.e. someone and their friend or family is still end-to-end encrypted and WhatsApp still cannot intercept texts or snoop on calls. Further, the new privacy policy does not “expand” WhatsApp’s communications with Facebook, but only outlines what it has been doing for years. Phone numbers, location information, and content has been shared with third parties for years,[10] though the veracity of this claim is considered at a later stage.
In summary, alot of misinformation has been present around these changes. Much of this has been false. At the same time, WhatsApp is not a good faith actor and has been actively harvesting and processing user data. Here, it was merely being transparent with its practices and revamping some business-related services, in order to fulfil its goal to become a major e-commerce player.
CCI’s Order And Delhi High Court Case
On the 24th March, 2021, the Competition Commission of India or CCI ordered a suo motu antitrust investigation into the changes to WhatsApp’s terms and conditions and privacy policy.[11] The order begins by stating concerns the CCI has regarding the compulsory acceptance of the changes to the privacy policy. It recalled a previous order of its own in 2017, in Vinod Gupta and WhatsApp[12], noted that there was an ‘opt out’ option. The CCI unequivocally stated that it was concerned about the mandatory imposition of the new policy on users, and that this was the rationale behind the investigation.
WhatsApp tried to challenge the CCI’s jurisdiction based on various grounds, such as the presence of another regulator, that the matter was sub judice in another forum, that the subject matter was outside the ambit of competition law. We do not need to go into the reasoning of this, but the CCI rejected all of these preliminary objections and determined that the investigation could proceed.
The first determination that the CCI had to make was whether WhatsApp had a dominant position in the relevant market. It identified the “market for OTT [over the top] messaging apps through smartphones in India to be the relevant market, extensively quoting from its previous decision in the Harshita Chawla case[13]. The CCI ultimately determined that WhatsApp had a dominant position in the market, because of global usage data and “information available in the public domain”. The CCI thus upheld what it had decided in Harshita Chawla, and said even though that decision is from August, 2020, the rise of apps like Signal has not significantly dented WhatsApp’s position since it is entrenched due to “network effects”. Network effects are scale effects, i.e. increase in a number of users leads to an increase in the value of the application for other users, which leads to a corresponding increase in users, which again leads to an increase in the value. This is compounded and the result is that the dominant company is effectively entrenched.
The CCI then moved to the heart of the issue: The compulsory nature of the new privacy policy. The 2016 update to WhatsApp provided users the ability to opt out from sharing information with Facebook and other third-party apps. However, while WhatsApp says it will continue to honour the opt-out of the 2016 update, there is no exception carved out in the 2021 update and it seems to apply to all. Therefore, WhatsApp is incorrect when they argue that the information is “descriptive” as thus amounts to a tangible change in data sharing practices for many users.
The CCI also complains the new policy is “unduly expansive and disproportionate”. Transaction and payment data, battery level, signal strength, app version, mobile operator, language, Internet Service Provider, time zone, device information, service-related information, identifiers, location information would now be shared with Facebook.
Lastly, the CCI notes that many of the information categories are “unintelligible” and imprecise. The information covered under users interacting “with others (including businesses)”, “service-related information”, “mobile device information”, “payments or business features” are all undefined. Further, much of the policy uses qualifiers like “including”, “for example”, which means that the data types being collected are not exhaustive and the limit of data collection is unclear.
Thus, because of the mandatory nature of the new policy, the expansive nature of data collection and imprecise definition of what data will be collected, the CCI made out a prima facie case that needed further investigation.
Pertinently, the CCI provided a rationale for why privacy policy can come under the contours of competition law. WhatsApp seems to be targeting the sharing of data in order to use information from WhatsApp to build user profiles for better development of Facebook’s products. This data concentration is actually a competitive advantage and can lead to entrenchment of dominance, and since it is carried out in a manner that prima facie seems untenable, the CCI has jurisdiction to investigate.
Facebook and WhatsApp challenged[14] this decision in the Delhi High Court, arguing that the Competition Commission was abusing its suo motu jurisdiction and did not have authority to try the case, since the Supreme Court was already hearing a similar matter. The CCI responded that it was not investigating the privacy concerns, but was investigating the competition aspects of the case. It further argued that prima facie the new policy would be used to create user profiles in a manner equivalent to “stalking”, and all for the purpose of targeted advertising. The hearings have concluded and the Delhi High Court has reserved its judgement.
Analysis
The order raises several interesting questions. First, the order seems to state in unequivocal terms that it is investigating proposed changes before they are enforced. However, this runs against the general consensus surrounding abuse of dominance claims, which traditionally are brought after abuse of dominant position has occurred.[15] This represents a sea of change in the way the CCI investigates abuse of market dominance cases, and it is interesting to see how this will be dealt with going forward.
Second, the CCI has now waddled into the sector of data privacy. While it is obviously a positive development as data is increasingly being used to create a competitive advantage, there remain some problems of enforcement. The CCI, for any remedy, will have to rely on the data privacy laws in the nation to determine infringement and come out with a remedy.[16] However, the Personal Data Protection Bill has not yet been passed and it is unclear if and when it will come into force. As a result, the question of remedies and determination of how law has been violated will be of definitive importance later on.
Third, the CCI order clarifies much of the muddled public debate. WhatsApp’s public release seems to whitewash the privacy policy updates as non-controversial ones. The CCI astutely pokes holes in this characterization by pointing out how this new update does not only ‘describe’ the current policy, but is a tangible transformation. Further, the CCI also points out the fact that many of these ‘categories’ are undefined and consumers do not have an idea of what sort of data is being funnelled under them. This weakens WhatsApp’s argument that the data of users is only sent during interactions with businesses. This is a valuable contribution in itself to the public debate around the changes in the policy.
Ultimately, though, this is a broadly positive move. WhatsApp is undoubtedly the dominant OTT messaging platform in the country and its imposition of a privacy policy onto consumers without providing them a chance to opt out reflects the dominance that WhatsApp has in the market. It is now siphoning off user data for the profitability of Facebook. The CCI’s order is groundbreaking not only because it provides a forum to challenge the new policy, but because it breaks with precedent to investigate possible monopolistic acts before they materialise, highlighting the historic failure of post facto measures to effectively punish companies that commit antitrust violations. While there are some hiccups and unanswered questions in the process, the CCI’s reasoning is persuasive and lays out a solid case for a more detailed investigation.
Conclusion
WhatsApp’s new privacy policy has led to a furore and significant controversy in the public domain. However, despite all the noise, the damage to WhatsApp’s popularity and user base has been minimal. The CCI’s order to further investigate the changes to the privacy policy are a welcome development. This is not only because it is willing to enter a new field of law, but is willing to break with precedent for the broader benefit of consumers. The CCI’s order also comes as welcome relief to consumers, since WhatsApp was imposing these changes on consumers, and these consumers do not have any effective forum for recourse. The order is a very positive change.
However, one of the most unexpected yet welcome contributions of the CCI order is the clarity it introduces to the exact scope of changes being introduced. WhatsApp and social media have been involved in a protracted misunderstanding regarding the new changes, and the CCI order’s greatest contribution in the present is ensuring that the exact problems with these updates can be highlighted.
The saga is far from over. The Delhi High Court has not made a final decision, and the Director General’s detailed investigation may absolve WhatsApp at the end of the investigation. Though there are a few questions that remain unanswered, the move is largely a positive one, and it will be interesting to see how it plays out.
References
[1] Romita Majumdar, ‘Why India’s Industry And Privacy Experts Are Worried About WhatsApp’s New Privacy Policy?’ Inc42 Plus, 7 January, 2021, available at: https://inc42.com/features/why-industry-and-privacy-experts-are-worried-about-whatsapps-new-privacy-policy/ ( last visited April 14, 2021).
[2] DNA Web Team, ‘WhatsApp’s new privacy policy invites criticism as users contemplate shifting to other messaging apps’ DNA India, 12 January, 2021, available at: https://www.dnaindia.com/technology/report-whatsapps-new-privacy-policy-users-criticise-other-messaging-apps-signal-2867575 (last visited April 13, 2021).
[3] FE Online, ‘Trouble mounts for WhatsApp as India starts ‘evaluating’ controversial new privacy policy update’ The Financial Express, 14 January, 2021,available at: https://www.financialexpress.com/industry/technology/trouble-mounts-for-whatsapp-as-india-starts-evaluating-controversial-new-privacy-policy-update/2171023/ ( last visited April 13, 2021).
[4] PTI, ‘WhatsApp delays new privacy policy by three months amid severe criticism’ National Herald, 16 January, 2021, available at : https://www.nationalheraldindia.com/media/whatsapp-delays-new-privacy-policy-by-three-months-amid-severe-criticism> (last visited April 14, 2021).
[5] Anumeha Chaturvedi, ‘New privacy policy will not impact how people communicate privately with friends or family: WhatsApp’, 09 January, 2021, available at: https://economictimes.indiatimes.com/tech/technology/new-privacy-policy-will-not-impact-how-people-communicate-privately-with-friends-or-family-whatsapp/articleshow/80181783.cms?from=mdr (last visited April 13, 2021).
[6] Tech Desk, ‘WhatsApp updates terms of service and privacy policy: Why you need to accept it’ Indian Express, 16 January 2021, available at: https://indianexpress.com/article/technology/social/whatsapp-new-2021-terms-of-service-and-privacy-policy-new-changes-accept-or-delete-7134815/ (last visited April 14, 2021).
[7] ‘Answering your questions about WhatsApp’s Privacy Policy’ WhatsApp FAQ, available at: https://faq.whatsapp.com/general/security-and-privacy/answering-your-questions-about-whatsapps-privacy-policy/?lang=en (last visited April 13, 2021).
[8] Jagmeet Singh, ‘WhatsApp: Everything You Need to Know About the Controversial Privacy Policy Update’ Gadget360, 22 February, 2021, available at : https://gadgets.ndtv.com/apps/news/whatsapp-privacy-policy-update-changes-what-happens-if-you-dont-agree-details-facebook-data-2376020 ( last visited April 12, 2021).
[9] Supra note 1.
[10] Gopal Sathe, ‘WhatsApp Delays New Privacy Policy, But It’s Still Sharing Data With Facebook’ Gadget360, 18 January, 2021, available at : https://gadgets.ndtv.com/apps/opinion/whatsapp-new-privacy-policy-sharing-data-with-facebook-2353796 (last visited April 13, 2021).
[11] In Re: Updated Terms of Service and Privacy Policy for WhatsApp Users, Suo Moto Case No. 01 of 2021, Competition Commission of India.
[12] Vinod Kumar Gupta vs. WhatsApp Inc., Case No. 99 of 2016, Competition Commission of India.
[13] Harshita Chawla v. WhatsApp Inc, CCI Case No. 15 of 2020, Competition Commision of India.
[14] PTI, ‘Ordered probe of WhatsApp policy on competition aspect: CCI to Delhi High Court’ Economic Times, 13 April, 2021, available at : https://economictimes.indiatimes.com/news/india/ordered-probe-of-whatsapp-policy-on-competition-aspect-cci-to-delhi-high-court/articleshow/82048168.cms (last visited April 15, 2021).
[15] Board of Control for Cricket in India v. CCI, COMPAT, Appeal No. 17 of 2013; Supra note 13.
[16] The Personal Data Protection Bill, 2019, Bill No. 373 of 2019.
BY DEBAYAN BHATTACHARYA | NATIONAL LAW UNIVERSITY, DELHI