The Ministry has also questioned the timing of the policy change since the country’s Personal Data Protection Bill is on its verge of being finalized. Further the Ministry has also attached a questionnaire to be filled by the WhatsApp CEO, answering inter alia, details of data categories to be collected and whether they conduct Indian users’ profiling. With respect to the difference in the privacy policies between other countries and India, the Ministry has asked for clarifications for the same.
Personal Data to be collected by WhatsApp
- WhatsApp usage
- Profile Picture
- About Information
- Status Update
- Group Details
- IP Address
- Phone Model
- OS Information
- Battery Level
- Signal Strength
- App Version
- Time Zone
- Connection Information
- Payments or Business Feature
Although the messages are not being used or shared as they are end to end encrypted, it is taking other essential private information of the user as aforementioned that gives any person or entity who uses this information, a profile into a person’s online activity.
No Opt-Out Option
WhatsApp has also issued a clarification that its proposed Policy update “does not affect the privacy of your messages with friends or family in any way. The changes are related to optional business features on WhatsApp, and provide further transparency about how we collect and use data”.
Data Protection Laws in India as compared to the European Region
It is to be noted that these policy updates are applicable to every nation except the European Region as they have better data protection laws unlike India whose data protection laws has been languishing for almost 2 years now. As per the provisions of the General Data Protection Regulation passed in 2016 by the European Parliament, WhatsApp legally cannot share data with Facebook in the European Region. Such data protection laws could have prevented this new policy to enter in India.
The Personal Data Protection Bill, 2019 which has been languishing for 2 years, came out of the Srikrishna Committee Report, could have prevented the new WhatsApp policy from being applicable to India as by virtue of Section 5 of the Bill, a person who has consented to use the personal information of any other person, can only use such information for that purpose and for the purposes that have reasonable link to that purpose for which the information was given. The new policy updates basically collects the personal information of its users which are shared by them for the purpose of communicating with friends and family. However, practically, these personal information are being used for other purposes than the purpose for which the information was given, which is the core issue. By the enactment of this Section, this update would have been illegal in India. This is how European Region is safe from this update as they have stringent laws with heavy repercussions and penalties.
Abuse of Dominant Position
Apart from privacy issues, it is also being speculated by experts that the proposed policy update could also invite antitrust issues under the Competition Act, 2002. Last year, CCI (Competition Commission of India) had declared WhatsApp to be in dominant position in OTT messaging apps market in India. It has been reported that although people are switching to other apps the issue remains to be the switching cost due to networking issues as there are over 340 million user in India finding it hard to make the shift to other messaging platforms and Apps. Thus, in view of networking effect, WhatsApp might abuse its dominant position in the market as there will be many who will reluctantly accept the new policy update.
In 2009 when WhatsApp was launched, it committed to not share or sell its user data to any third party. However after Facebook acquired the App in 2014, some years later, it started sharing data with its parent company Facebook, however, back then users where given the option to opt out. Now Facebook predominantly owns the social media platform since majorly used social media apps like Facebook, WhatsApp and Instagram, is owned by it. Now, the policy update is like a one-sided contract, which the users can either take it or leave it.
Protection of Personal Information & Sensitive personal data or information in India
 K.S. Puttaswamy v. Union of India (2017) 10 SCC 1