The new TOs and PP entailed that WhatsApp would share transaction data, mobile device information, IP addresses and other data on how users interact with businesses on WhatsApp with the acquirer owner Facebook and its group companies. Such information would also be shared with third-party providers if the user went to those platforms from Whatsapp. These measures set the alarms ringing till multiple clarifications started coming from Whatsapp saying that private chats between individuals and in groups would still remain unaffected and continue to have the end to end encryption intact and only chats with business entities would be subject to such data sharing which will be notified at the start of a chat. Finally, Whatsapp announced that the move would be deferred till May 15, 2021, for a wider understanding of their intent.
Discrimination Against Indians
The Indian Government stepped in with a strong approach and asked Whatsapp to withdraw such changes. The Ministry of Electronics and Information Technology (MEITY) of the Union Government wrote a nine-point comprehensive letter to the CEO of Whatsapp with 14 queries to be replied within a week. It has raised the point that such changes will ‘make invasive and precise inferences about users which may not be reasonably foreseen or expected by users in the ordinary course of accessing these services’. It would also create a situation where people can be profiled with consolidated data from Whatsapp, Facebook and other Facebook-owned companies which are huge in numbers and directly enhance the information security risks and vulnerabilities. MEITY also highlighted that Indian users were being discriminated against compared to their European counterparts without the choice of the opt-out provision.
The government has rightly taken this prudent stand as Whatsapp’s move is a forced consent scenario which is a violation of the principle of ‘purpose limitation’ that is a current global standard to deal with personal data processing. With 40 crores plus user base and the largest in the world among its users in any nation, the government couldn’t have left the platform to its wishes of having the Indian users agree to the changes proposed without the premise of a fair and equitable situation for the lot. After all, despite being a private free entity, the medium had assumed the position of a public sphere by the sheer preference of the users as a medium to exchange text, photos, audio and video. On top of it, Facebook also didn’t have a stellar record for its user’s data protection and has been lax in the past with organisations like Cambridge Analytica accessing and profiling the user data for targeted disinformation campaigns during the 2016 US elections.
The Personal Data Protection Bill (PDPB) which is pending before a joint select Parliamentary Committee now after its introduction in December 2019 was clear that any platform that wishes to use and share user data needs explicit permission from the user and the users’ parents in case the user is a minor. The Bill also ensured that users could choose not to share their data without losing access to the app or the platform
At the same time, Facebook is also under watch in its country of origin, the US, along with other tech giants of antitrust complicacy. The clamour is already there among lawmakers for breaking up Facebook and separating its acquisitions WhatsApp and Instagram. As more antitrust suits are filed against Facebook, it would not be a stretch of the imagination to believe that the latest action by Whatsapp is an attempt by Facebook to create a legal basis for not breaking up the company by creating greater synergies with its subsidiary companies. Many of these tech giants are being seen as consolidating and becoming challenges to nations’ sovereign interests with their huge user base and reckless indifference to growing misuses of the medium. Data collection, sharing, and mining are becoming a wider global challenge that needs global regulatory intervention.
As the nation celebrates the Republic Day, the government’s move is also a call towards protecting the sovereignty of the nation as the users’ interests and privacy have to be protected. The government as it seeks its answers from Whatsapp and its parent Facebook should also ensure the passage of the PDPB soonest so that even if on May 15, 2021, Whatsapp plans to introduce these TOS and PP, the provisions of the Act will deter them from forced acceptance and also the collecting and sharing of personal data. Clearly, the government is seized of the matter and will ensure that such blatant misuse of dominant position is repulsed.
(The writer, a defence and cyber security analyst, is former country head of General Dynamics)