CCI Takes On Tech Behemoths: WhatsApp Policy Update And Antitrust Concerns

While WhatsApp has adopted a 'take-it-or-leave-it' approach in India, it allows users in the EU to opt-out from sharing their data with Facebook companies or third parties to ensure compliance with the General Data Protection Regulation (GDPR). However, while data privacy concerns have remained at the forefront of the developments since WhatsApp's January update, there exist antitrust concerns too. In a welcome development, the Competition Commission of India (CCI), after a suo moto cognisance, passed a Section 26(1) order on 24 March 2021, causing the Director General (DG) to initiate an investigation into the matter to ascertain potential contravention of Section 4 of the Competition Act, 2002 ('the Act').

Preliminary Objections Brushed Aside by the CCI

The Commission arrayed both WhatsApp and Facebook as Opposite Parties in the proceedings. Facebook contended that both are different legal entities and that WhatsApp is the appropriate entity to provide information to the Commission. However, considering that Facebook is a direct and immediate beneficiary, the Commission rejected its contention as evasive, egregious and ignorant.

WhatsApp further claimed that the 2021 update falls within the purview of the IT Act framework, which was sub judice before other forums and as such, the CCI should not proceed simultaneously. Herein, WhatsApp relied on CCI v. Bharti Airtel Ltd (2019) 2 SCC 521, wherein the Apex Court held that the CCI should exercise its jurisdiction after the sectoral regulator has concluded its proceedings. However, the question of comity between decisions does not arise since no sectoral regulator is seized of the matter. The authors have dealt with this predicament in detail here.

Furthermore, Section 62 of the Act declares that the Act is in addition to and not derogation of other statutes. While the Courts may consider data, public policy and national security concerns, the same cannot preclude the country's competition watchdog from looking into exploitative and/or exclusionary effects resulting from unreasonable data collection and sharing.

Placing reliance on Harshita Chawla v. WhatsApp Inc. 2020 SCC OnLine CCI 32, WhatsApp submitted that its 2021 update's implementation was postponed to 15 May 2021, and the Commission should refrain from recording a prima facie finding since abuse of dominance is a post-facto analysis. The Commission, unimpressed by the submission, pointed out that the 2021 update is already in effect with users only given a deadline of 15 May 2021. Accordingly, the conduct has already taken place, and Section 4 may be invoked.

Prima Facie Abusive Conduct

In Harshita Chawla, the Commission has already defined WhatsApp's relevant market as the market for Over-The-Top (OTT) messaging apps through smartphones in India', and WhatsApp was held to be dominant in the same under the provisions of the Act.

In the present case, the Commission noted that, unlike the August 2016 update, users had not been given a choice to opt-out and the range of data the 2021 update seeks to capture is unduly expansive and disproportionate. It includes transactions and payments data, data related to battery level, signal strength, app version, mobile operator, ISP, language and time zone, device operation information, service-related information and identifiers, location information of the user even if the user does not use location-related features, amongst other data.

Furthermore, the policy update uses open-ended, vague and unintelligible terms while specifying the scope of data collection, rendering it impossible to ascertain data cost for a user. Such overarching collection of data based on 'involuntary consent' because of WhatsApp's dominant position as the users are 'locked-in' due to strong network effects resultant from a large consumer base was held as imposing unfair terms on the users and prima facie violative of Section 4(2)(a)(i) of the Act.

The CCI correctly noted that creating a 360-degree profile of users through personal data exploitation would place immeasurable market power at WhatsApp and Facebook's disposal. This would allow them to leverage it in adjacent and unrelated markets, such as the display advertising market, leading to a denial of market access for other players and insurmountable entry barriers for new entrants in potential contravention of Sections 4(2)(c) and 4(2)(e) of the Act.

Analysis – Antitrust Concerns at Play

WhatsApp has the audacity to ask for such intrusive information in utter disregard of the users' choice and privacy concerns because of its position as a de-facto unavoidable partner for many Indian businesses and the most widely used instant messaging app among Indian consumers. Since almost all user acquaintances are available on WhatsApp, it increases its value to the user. In a sense, it has locked-in its users since, in the absence of interoperability, one cannot switch to another app without one's contacts doing the same. This is evident from the Commission's observation that even with the surge in Signal and Telegram's downloads, there has been no substantial loss in WhatsApp's consumer base.

The proposed Digital Markets Act (DMA) and Digital Services Act (DSA) in the EU aims to regulate the online intermediaries and marketplaces. The DMA extensively deals with digital gatekeepers, including social networking services, and prohibits them from combining personal data from their core platform services with data from other sources (including other services offered by the gatekeeper). With the 2021 update in play, Facebook will have control over a large consumer base's data and may combine it with data collected from other sources (subsidiaries and third-party apps).

The strong network-effects enjoyed by WhatsApp can be fuelled by potential data-driven advantages that may lead to an increased dependency of businesses and consumers on WhatsApp. In a data-driven digital world, where data is regarded as consideration and is being monetised in the form of targeted advertisements, the competition and data protection watchdogs cannot ignore the possibility of its abuse. The Competition Law Review Committee, in its report, had concluded that the definition of 'price' as set out in Section 2(o) of the Act is broad enough to capture non-monetary considerations like data and therefore is amenable to the jurisdiction of the CCI.

In a joint paper (2016), the French and German Competition authorities expressed that even though 'data protection and competition laws serve different goals', collecting and using personal data by a dominant undertaking can be considered from a competition standpoint. Recently, in the Market Study on the Telecom Sector, the CCI has clarified that even though India is still to legislate a domestic data protection law, the existing antitrust law framework is broad enough to address the exploitative and/or exclusionary conduct arising out of privacy standards of enterprises commanding market power.

In the instant case, the question which needs to be answered by the DG is whether WhatsApp's conduct is 'unfair' and 'unilaterally imposed' to fall foul of section 4(2)(a)(i) of the Act. In 2019, the German competition authority (Bundeskartellamt) held that Facebook's data-sharing practices amounted to an abuse of a dominant position and prohibited it from combining user data collected from its subsidiaries and third-party apps. It was stated that if a dominant company, such as Facebook and WhatsApp, makes using its services conditional upon the user granting the company extensive permission to use their personal data- it would amount to 'exploitative business terms'.

In an almost identical proceeding against WhatsApp and Facebook in Italy, the Italian competition authority imposed a EUR 3 million fine on WhatsApp over data sharing with its parent company. Although the Italian competition authority relied primarily on consumer protection law, WhatsApp's conduct of forcing its users to consent to data-sharing or leave the app could also be pursued as a unilateral imposition of unfair contractual terms under Section 4(2)(a)(i) of the Act.

Further, the new privacy-policy tying is equivalent to a unilateral degradation of privacy, which may amount to an abuse of dominance as it lowers privacy standards to the consumers' detriment. WhatsApp has tied its privacy policy to its services by employing the 'take-it-or-leave-it' approach, which is tantamount to a constructive refusal to supply.

WhatsApp might argue that collection and processing of data are indispensable for its business model as it provides 'free services' and the primary way to generate income is personalised and targeted advertisements for which access to personal data is a pre-requisite. While access to personal data is necessary for WhatsApp's business model, merging or tying data with Facebook-owned companies is intrusive and unreasonable. It will further strengthen the data advantage enjoyed by Facebook by cross-linking the data collected across services.

Concluding Remarks

Facebook can be characterised as a 'data monopoly' after acquiring WhatsApp and Instagram. Facebook and WhatsApp have maintained their dominance, individually and as a group, independently of market forces. Turkey has also opened an antitrust investigation into WhatsApp's 2021 update. In India, the CCI's prima facie order against WhatsApp's 2021 update signals that the excessive collection and usage of data, degradation of privacy standards, data sharing with a group company, and unfair and unilateral terms imposed by a dominant undertaking are amenable to the Commission's jurisdiction.

Japan Fair Trade Commission has formulated guidelines that state that the digital platforms' practice of compelling the users to share their personal information to use their services would be tantamount to 'abuse of a superior bargaining position' under Japan's Anti-monopoly Act. In the Indian context, there is an urgent need to formulate similar guidelines, which mandate the companies to formulate a transparent policy on data collected, used, and shared by them with their subsidiaries and third-party companies.

Although the CCI has caused the DG to investigate, it has failed to take interim measures under Section 33 of the Act, such as an injunction on the operation of the 2021 update until the final decision is taken since serious and irreparable harm may occur because of the said practices, if implemented from 15 May 2021. As observed in the order, the Commission has a duty to prevent practices that may harm competition.