We Have No User Data Except Name & Phone Number; We Don't Process Personal Sensitive Data : WhatsApp Tells Supreme Court

A Constitution Bench bench comprising Justices KM Joseph, Ajay Rastogi, Aniruddha Bose, Hrishikesh Roy and CT Ravikumar was hearing the petitions which were filed challenging the 2016 privacy policy of WhatsApp. The case was referred to the Constitution Bench in 2017.

On the last date of hearing, the Bench was apprised that a Data Protection Bill is to be introduced in the Parliament in the second half of the Budget Session, 2023. In view of the same, the Centre and WhatsApp, two of the respondents in the matter, implored the Bench to consider deferring the hearing. After briefly hearing the Sr. Counsels, the Bench had indicated that it would hear the parties on the issue whether it should continue with the hearing.

On Wednesday, the Attorney General for India, Mr. R. Venkataramani, also flagged the same concerns that the Solicitor General of India, Mr. Tushar Mehta, had expressed on the previous occasion. He was afraid that the Court’s deliberations on the draft Bill, might orient the debate in the Parliament. Informing the Bench that the Bill subject to getting approval from the Cabinet is intended to be presented in the second half of the Budget Session, i.e., between 13th March, 2023 and 6th April, 2023, he sought the Court’s indulgence to postpone the hearing till then.

Senior Advocate, Mr. Kapil Sibal, representing WhatsApp, supported the submissions made by the Solicitor General and Attorney General in this regard. He submitted -

“It is not just ordinary legislation. It has an impact on investment, freedom of speech, privacy...It will impact even other intermediaries…If it is between now and July, what is the harm? It took 6 years for the European Union to pass the Bill.”

Echoing the submission made by Mr. Sibal, Senior Advocate, Mr. Arvind Datar, appearing on behalf of Meta(parent company of WhatsApp, emphasised that there are ample regulations and guidelines to ensure safeguards in sharing of data.

To elucidate on the policy followed by WhatsApp, Mr. Sibal submitted that there are two regimes. One of the policies is followed in the European Union while the other is followed in the rest of the world, including India. He asserted that there are 600 million users of the Application in India, and none of them seems to have complained that their data has been disclosed by WhatsApp to any third party. Mr. Sibal argued that the Information Technology Act and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 regulates the concerned field.

It was pointed out by Mr. Sibal that WhatsApp is protected by end to end encryption and even WhatsApp does have any information with respect to the users’ messages. He submitted that the concept of sharing data with Facebook comes into existence when a person is on both the Applications and is carrying on activities on Facebook. He indicated that the only user information that is available to WhatsApp other than the user's name is the phone number.

“What is the information we have? Your name, phone number, that’s all. That is the information we have. Basically it is the phone number. But nothing to do with content, nothing to do with the personal data….WhatsApp does not process personal sensitive data. That is our policy.”

Mr. Sibal informed the Bench that there are several Government of India Applications where no explicit consent is obtained; continued use is deemed as consent.

“In many other platforms, including Govt. of India platforms there is not even a provision which says that 'I agree’. Continued use is deemed consent by the Govt. Apps… IRCTC, Aarogya Setu, BHIM.”

After going through the Rules, Justice Joseph was of the opinion that the protection therein was primarily with respect to sensitive personal data. According to him, it appeared that personal data could be transferred without consent.

“We are telling you that Rule 7 is capable of being used for transfer of information without consent…The question is not whether you do it with or without consent. It is whether the law permits it to be transferred without consent.”

With respect to its ability to manipulate political views, the Judge expressed concern that since political opinion is not considered as sensitive personal data, it might not have the same safeguards as the sensitive personal data and if passed on to a third entity it can be used for commercial purposes as well as political purposes. He added -

“My views of a particular politician... If the views are gathered by you and passed on to someone…You may say that you may not want to put that man as a candidate. I remember, initially, WhatsApp was charging for the service. Thereafter, they changed the policy. Obviously, there is a business consideration.”

Mr. Sibal responded, “If he does not want any of the information to be used, he can only be on WhatsApp and not on Facebook. He wants to take advantage and then says, don't give us the advertisement.”

Senior Advocate, Mr. Mukul Rohatgi pointed out that when a user downloads WhatsApp they have to agree to the policy. Ideally, without agreeing to the same, they cannot use the Application. He emphasised that the policy was available on the Application and is not in fine print.

Senior Advocate, Mr. Shyam Divan, appearing for the petitioner, argued that if it is the respondents’ case that there are extant regulations and they are in compliance with the same, then the Court might not await the introduction of the draft Bill. Thereafter he went on to explain what author Shoshana Zuboff describes as surveillance capitalism; the concept that data has enormous commercial value. He submitted -

“We will show the manner in which meta-data has an enormous commercial value, which is being exploited by WhatsApp sharing it with Meta…”

He argued that when WhatApp introduced the Application, they had projected that they were not going to part with the data of their users. The user base increased and so did the valuation of the company. WhatsApp’s assurance continued to exist even after Facebook took over. However, in 2016, there was a drastic change in privacy policy. He pointed out that as per the international standard, Facebook should obtain informed consent and provide an opt out option for those who do not wish to comply with its privacy policy. He further submitted -

“On Facebook you get a feed of news articles based on your Metadata that their algorithm is calculating, so it is not only advertisements.There is a huge disparity between what they do with the data and how they commercially utilise it…My Constitutional substratum is broadly with respect to right to privacy…Our submission is that as far as fundamental right to privacy is concerned, it is recognised qua the State. It has been observed by the Court that in privacy there is some horizontal element as well, which involves non-state actors also.”

Mr Divan clarified that WhatsApp’s original business policy was if the users do not adhere to the new policy they would have to discontinue using the Application. However, there has been a change. WhatsApp has not restricted the use for those who have not accepted their privacy policy. However, on a daily basis, they send notifications to these users to agree to their privacy policy. He asked the Court to direct WhatApp to give an undertaking that it would not share user’s data with Facebook companies till the Data Protection Bill comes into existence.

Mr. Sibal made it clear that it might not be possible to give such an undertaking as the same policy is applicable for almost 140 countries and an exception cannot be curved out for India, when the Indian law itself has not incorporated the principles of the GDPR (General Data Protection Regulation) prevalent in the European Union.

Mr. Datar submitted that there is a finding that the efficiency of WhatsApp has been reduced due to the principles incorporated in the GDPR. He informed the Bench that for the same reason, the same policy is not adopted in developed countries, like the United States of America, the United Kingdom, Singapore, Australia. He assured the Bench, “WhatsApp does not share any message. It does not violate any principles in Puttaswamy.”

Senior Advocate, Mr. K.V. Vishwanathan, appearing on behalf of Internet Freedom Foundation (intervenors), submitted that the 2021 privacy policy of WhatsApp permits it to collect large metadata without providing for an opt-out policy.

“Let them give us the opt out policy. They want this unregulated situation to continue.”

Mr. Sibal indicated that by a letter dated 22.05.2021, WhatsApp has already given an undertaking that the functionality of WhatsApp will not be affected for users who have not accepted its privacy policy and the position would continue till the Data Protection Bill comes into existence.

In the light of the same, the Bench directed WhatsApp to give wide publicity to the undertaking so that the users are aware of their stand.

As the respondents indicated some difficulties in going ahead with the hearing, the Bench though initially hesitant, finally thought it fit not to hear the matter now. It listed the matter for directions on 11th April, 2023 (post the Budget session).

[Case Title: Karmanya Singh Sareen and another versus Union of India And Ors. SLP(C) 804/2017]