The Union Government on January 31 told the Supreme Court that it will introduce the Digital Personal Data Protection Bill, 2022, in the second half of the Parliament’s budget session of 2023. The court was hearing a batch of Special Leave Petitions in Karmanya Singh Sareen and another versus Union of India and others. It challenged the 2016 privacy policy of WhatsApp. The policies authorise WhatsApp to share data with Facebook and all its group companies for commercial advertising and marketing purposes. The 5-judge Bench was presided over by Justices KM Joseph, Ajay Rastogi, Aniruddha Bose, Hrishikesh Roy and CT Ravikumar.
The petition was filed by two students who claimed that the agreement between social media apps is a breach of their right to privacy and their freedom of speech. The petition challenges WhatsApp’s data sharing with Facebook. WhatsApp, which Facebook acquired in 2014, had until 2016, kept the data of WhatsApp users separate from that of Facebook users. However, in 2016, WhatsApp and Facebook modified their privacy policy to facilitate sharing meta-data (details like the phone number of users) between the two apps. This, apparently, lets Facebook to carry out limited profiling of WhatsApp users and then can assist the company in displaying targeted advertisements when these users are using Facebook and Instagram.
Solicitor General of India Tushar Mehta, representing the Union, submitted before the Bench that he has filed an affidavit with respect to the said Bill. As per him, the Bill might touch upon most of the issues discussed in the petitions. He added that the Privacy Policies of the United States, as well as Europe, were taken into consideration. He requested the Bench not to permit anybody to argue on the contents of the Bill in the court until the same is presented in the Parliament.
Senior Advocate Kapil Sibal appeared on behalf of Meta-WhatsApp, Senior Advocate KV Vishwanathan on behalf of Internet Freedom Foundation, and Senior Advocate Shyam Divan on behalf of the petitioners.
Kapil Sibal requested the Bench to hear the matter in July 2023. He submitted that if the verdict is given before the Bill comes into force, it may hinder the Bill from having a complete effect. He added that the existing policy of WhatsApp does not misuse users’ information and only shares content with third parties after taking consent and solely does so for the user’s benefit.
Shyam Divan urged the Bench to hear the matter immediately. He cited three reasons for doing so –Primarily, there is no fixed schedule for Parliament to pass the Bill. Secondly, WhatsApp was sharing user information to Facebook and other third parties for profitable purposes without obtaining user consent, and such an act violates the fundamental Right to Privacy. Lastly, WhatsApp had dissimilar privacy standards for users residing in Europe and India. This violates the right to privacy provided by Transnational Human Rights Law.
KV Vishwanathan submitted before the Bench that there was no regulation concerning data protection, even though there exists a positive obligation to regulate it.
The Bench passed an order asking the responding party to publish this information afresh in five national newspapers on February 15 and March 1, 2023, and continue to permit users to opt-out of the Privacy Policy.
These guidelines will continue to be in action until the next hearing on April 11, 2023.
The Personal Data Protection Bill was introduced in the Lok Sabha on December 11, 2019, and referred to a Joint Committee of Parliament (JCP), which presented its report on December 16, 2021. However, the government withdrew the Bill during the Monsoon session in 2022, citing the need for a new Bill that “fits into the comprehensive legal framework” consistent with the JCP’s 81 amendments and 12 recommendations.
The previous year in October, Union minister Ashwini Vaishnaw had stated that the Centre was hoping to bring a comprehensive personal data protection Bill in the Budget session of Parliament in 2023. He mentioned that a consensus is emerging that safeguarding the privacy of internet users should be the utmost priority of governments around the globe.
