Indian Govt Files To Restrain WhatsApp From Rolling Out Privacy Policy

India’s Ministry of Electronics and Information Technology (MeitY), on Friday, filed a counter-affidavit in the Delhi High Court, looking to restrain WhatsApp from rolling out its controversial privacy policy update.

The IT ministry’s response was in relation to a petition seeking to direct the central government to force WhatsApp to either roll back its new privacy policy or give users an opt out option. 

In the lawsuit ‘Dr Seema Singh v. Union Of India’, the court had last month sought responses from the central government and had listed March 19, 2021, as the next date of hearing. 

In its counter-affidavit, the government has contended that pending the passing of the Personal Data Protection Bill, 2019, the Information Technology Act, 2000 and the rules made under it, constitute the data protection regime in the country, which WhatsApp would be violating with its new policy.

The government has detailed various counts of violation of the IT Rules, 2011, by WhatsApp and claimed that the new privacy policy fails to specify the types of sensitive personal data (SPD) being collected and has used very generic terms to describe the kinds of data collected. The government has argued that the privacy policy contains no distinction between personal data or sensitive personal data which is being collected. 

The new privacy policy, which was announced by the Facebook-owned company in January, doesn’t change anything for users’ personal chats, which will remain end-to-end encrypted. What will change is how WhatsApp shares data from users’ chats with business accounts, with Facebook’s group companies. 

The policy reads that content shared with business accounts would be visible to “several people in the business”. Notably, WhatsApp has 50 Mn Business accounts, of which 15 Mn are in India. 

The policy says that some “businesses might be working with third-party service providers (which may include Facebook) to help manage their communications with their customers”. The company will, or has been, sharing the following types of user data with Facebook’s group companies: account registration information (phone number), transaction data (WhatsApp now has payments in India), service-related information, information on how you interact with others (including businesses), mobile device information, and IP address.

The Indian government’s counter-affidavit on the matter adds that while WhatsApp’s privacy policy talks about keeping the users informed about the purposes for which their “information” may be collected, it doesn’t define what this “information” may entail. Further, while the policy states that third-party service providers may have access to user data, the names of these service providers and other associated details haven’t been disclosed, neither have their addresses been listed. 

Other violations flagged by the government state that WhatsApp, “fails to provide its users with an option to review or amend the information” and “fails to provide an option to withdraw consent retrospectively”. 

In January, the Internet Freedom Foundation (IFF), a digital liberties organisation, had sought a stay on WhatsApp’s “highly invasive” privacy policy. 

The new privacy policy was set to go live on February 8, 2021, with users given the option of either agreeing to the update or losing access to their account. Sensing the public outrage against the policy in India, the company delayed its implementation by three months till May 15. 

It is worth mentioning that WhatsApp’s data sharing with Facebook is already taking place. While users in the European Union can opt out of data-sharing with Facebook, the rest of the world does not have the same choice.

Last month, it was reported that undeterred by the legal opposition to its privacy policy, WhatsApp was planning to go ahead with the update in India. 

Note: We at Inc42 take our ethics very seriously. More information about it can be found here.