This article has been written by Raslin Saluja pursuing B.B.A LLB (Hons) from KIIT School of Law, Bhubaneswar. The author critically analyses the new Whatsapp policy and its implications.
Table of Contents
Introduction
WhatsApp, in India with over 400 million users including around 15 million business accounts, is not just a messaging platform but it has become synonymous to sending messages itself. In such a short span of time, WhatsApp has gained popularity because of the rapid increase in the number of smartphone users in India and also because people of all walks of life placed their trust on WhatsApp. The new privacy policy (hereinafter the policy) recently rolled out by WhatsApp is creating furor all across the nation. In this segment we shall be discussing various arguments for and against the policy, reliance shall be placed upon the fact whether this new policy is in contravention of any law of the land, settled case laws or any fundamental right as guaranteed by the constitution of India and also enumerated by the Hon’ble Supreme Court in last 70 years.Whatsapp essentially is a data sharing application; be it in the form of an account information, messages/texts, videos, images, voice messages, files, share location information, contacts and any other information related to use of their service.
Information collected by Whatsapp
I. Information provided by the user
According to Whatsapp’s FAQ these include:
- Account information: user’s mobile number, the contact numbers from the mobile address book (both of ones using the service and ones not) with a confirmation of being authorized to use those and the usual profile name, profile picture and status text.
- Messages: which are not ordinarily stored and are end to end encrypted meaning they can only be read by the users and not by Whatsapp or any other third parties. The message remains on the user’s device but is claimed to be deleted from the Whatsapp servers except when a message is not delivered in which case it remains stored in their servers for 30 days. Only such content is retained for some longer time which is being regularly shared among many people.
- Connections: a list of favorite contacts is created which is based on the user’s communication activity in the app. And upon joining a group, broadcast lists – they get associated with the user’s account information.
- Customer Support: any information that the user may provide in lieu of receiving their help and services.
II. Automatically collected Information
- Usage and Log information : These are mainly the user’s activity behavior, information relating to diagnostic and performance, usage pattern, activities, operation and crash reports.
- Transactional information : information regarding payment receipts, confirmations, app store or third party processing if the user pays for such services.
- Device and connection information: it includes information such as hardware model, operating system information, browser information, IP address, mobile network information including phone number, and device identifiers, location features for diagnostics and troubleshooting purposes meaning searching for the source of problem to solve it.
- Cookies : these are text files with small pieces of data which are used to identify the users in order to provide them better browsing experiences based on data analytics. To provide customized services based on analyzed user choices and language preferences.
- Status information : information relating to online status, last seen status and when the user last updated their status message.
Third-party information
- Information provided by others: when other users provide contact numbers (just as you may provide which helps Whatsapp to operate and analyse the user behavior in utilizing Whatsapp’s service.
- Third-Party Services : when Whatsapp is used combined with other applications, data regarding such use may be stored (for example sharing a news article through Whatsapp share button) theirs), or they may send you a message, send messages to groups to which you belong, or call you.
- Third-Party Providers : Companies with whom Whatsapp works for their services such as app distribution, infrastructure support, supply maps, payment processes, diagnostics and fixing of service issues.
Stoking concerns regarding the privacy policy
Analysis of the privacy policy
Whatsapp is currently witnessing a mass exodus of privacy concerned users after it released an in app notification forcing users to accept its revised privacy policy or stop using its service entirely. In 2014 Whatsapp was acquired by Facebook followed by 2016 when it announced that it will share some of its data with Facebook including phone numbers and last seen activity. In 2017, Facebook was fined by the European Commission for providing misleading information about its technical inability to link its users across platforms and now in 2021 – it rolled out its new privacy policy.
In 2014, Whatsapp issued a statement stating that partnering with Facebook does not alter their values and principle and that they would continue to work independently and autonomously but as of today their policy segment reads that the information they share with Facebook Companies includes user’s account registration, transaction data, service related information, mobile device information, IP address and the like that they obtain upon notice or based on user’s consent. Major changes include Facebook having access to messages that users share with businesses on Whatsapp, Whatsapp will start processing payment accounts and transaction information which include information about payment method, shipping details and transaction amount. Whatsapp will also be collecting granular information about user activity and device and connection information like battery levels and signal strength. And also it will collect the IP address and other information like area code to estimate general location even if the user doesn’t use location features. At this point, users have no other option than to click on ‘I agree’ or to just stop using the service.
And for business, the new privacy policy means that they will now have the option to use “secure hosting services from Facebook to manage their chats with customers on Whatsapp. Upon communication with businesses, Whatsapp can see such exchange and then use that information for marketing, which could include advertising on Facebook. It clearly labels conversations with businesses that use Facebook’s hosting services. Additionally in an optional feature which will inform when being used, the shopping activity for users who interact with Facebook’s Shops commerce feature via WhatsApp can be used to display related ads on Facebook and Instagram. Lastly any interaction with an ad on Facebook with the option to message a business through WhatsApp if then done so, could be used to show more related ads on the social platform.
What are the concerns?
Whatsapp here is trying to collect and analyse metadata which in simple terms means data about data. It will first collect and track users data and then based on such activities will create its own data to simultaneously link a user’s identity across multiple platforms. All of this will help in creating a 360 degree profile about individuals which can then be used to behaviourally manipulate user activities.
1) The updated policy in question is not only arbitrary but is also discriminatory in nature as it is only applicable to Non-European and Non-American countries.
2) Because of the concept of “Informed consent”, much of the existing provisions of privacy policy are diluted.
3) WhatsApp’s parent company Facebook which also happens to own another giant social media platform namely Instagram, is planning to make one giant pool of messaging platforms where users of WhatsApp, Instagram and Facebook can chat without getting into the hassle of making individual connections on these platforms separately. This will have serious implications on the privacy model as there could be possible data leaks. A very recent example is of Bois locker room case on Instagram.
4) WhatsApp has also been alleged to have an active involvement in snoop gate purported by Pegasus where as many as 121 Indian Journalists and other eminent people were amongst hundreds others who were being constantly tracked through this spyware software.
5) WhatsApp shares information with third parties but at the same time it claims that WhatsApp makes sure that the third party is taking due care and caution with the data to that extent to which WhatsApp itself would have taken care. But this argument doesn’t hold strong as WhatsApp cannot force any third party to not have evil motives and be diligent in their practices.
6) The new policy states that in case of change of ownership, WhatsApp will share the data with its new owner.
7) WhatsApp also shares data with companies situated in different countries, and since there isn’t any ubiquitous law for data protection, hence data becomes very vulnerable of any kind of leak/breach in countries with non-stringent data protection laws.
8) WhatsApp collects information which are susceptible to breach and lucrative for companies to formulate divisive marketing strategies. The information collected is as follows: phone number, the IP addresses you’ve used, the brand and type of your phone (or other device), profile picture, the phone numbers of contacts, all WhatsApp groups user is a member of and blocked contacts.
Whatsapp’s clarification
WhatsApp has been repeatedly clarifying in its defence that the update doesn’t affect the privacy of messages with friends and family, and instead relates to messaging businesses through the platform. Through an update and its blog portal it also said to provide further transparency about how they collect and use data. According to FAQ, WhatsApp clarified under the policy that they along with Facebook cannot hear the users call data or see the users’ message exchanges. That they also do not maintain any logs or reports that keep track of who people interact with or the shared location. They further said that it does not share the users’ contacts with Facebook and keeps the group information private too.
They emphasized that the update includes new options that people will have to message a business on WhatsApp. And that has been done in anticipation of creating awareness of the increasing number of users shopping with a business on WhatsApp. They went to say that the update does not expand their ability to share data with Facebook.
They further pushed the date of review and acceptance of terms from February 8 to May 15 in an attempt to provide more clarity and transparency surrounding the misinformation around how privacy and security works on WhatsApp.
The applicable data protection and privacy laws
1) Section 2(1)(w) of Information technology, Act 2000 (hereinafter the act) WhatsApp can be termed as a public authority due to the number of users hence relying on Puttaswamy judgement[1] it can be safely concluded that WhatsApp new user policy is violative of citizen’s right to privacy.
2) The new policy is also violative of Section 72A (Punishment for disclosure of information in breach of lawful contract) of the act.
3) The new policy compromises with Rule 3 enumerated in Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (hereinafter the rules).
4) New WhatsApp policy contravenes sub rule 7 of rule 5 as it has no option for the consumer to get out of providing their sensitive personal data
5) It Contravenes rule 8 as the new policy suggests that same level of security may not be adhered to by its partners with whole the above mentioned data is shared
6) The government of India has responded to this issue by sending a letter to WhatsApp. The letter also reminds WhatsApp of Indian Supreme Court judgment on privacy delivered in 2017 and the proposed data protection law. It notes that in this context, WhatsApp coming out with a policy that allows for more data exchange between Facebook and WhatsApp is untenable because the proposed bill allows collection and usage of data for only specific services, and that data collected from one service cannot be used in another service. The letter then goes on to ask 14 questions from WhatsApp on how user data is utilised and what sort of privacy protections users get.
Implications and suggestions
Impact of the new policy as mentioned earlier requires a crucial policy intervention. Meanwhile, for the most part users can either accept the new terms or delete their Whatsapp accounts and consider switching to more secure platforms especially for sensitive conversations. They can develop awareness about data privacy issues and push enactment of a strong data protection legislation in India. Even for users who have accepted the terms and conditions but wish not to share their information can delete their account within 30 days. However this will not affect the information that other users have related to you. Ordinarily private enterprise behaviour is guided by that of Legislation but in its absence it becomes the duty of the Court to uphold the rights of its citizens. As for the Government of India, they should also adopt stringent measures as enumerated in GDPR and California Consumer Privacy Act (CCPA) to counter such possible menace of data breach.
Conclusion
The new privacy policy prima facie looks discriminatory in nature as it adopts different standards for European and American countries on one hand and other countries on other. As discussed earlier WhatsApp in India is much more than a mere messenger platform, thus a sense of added responsibilities is to be bestowed upon Whatsapp and WhatsApp also need to be more vigilant when it comes to India due to its enormous user base and also because of the fact that a majority of its users in India aren’t that well versed to understand the possible nefarious consequences of a situation of data breach/leak.
References
[1] (2017) 10 SCC 1
LawSikho has created a telegram group for exchanging legal knowledge, referrals and various opportunities. You can click on this link and join:
