Breaking- 'Virtually Gives 360-Degree Profile Into A Person's Online Activity': Whatsapp's New Privacy Policy Challenged In Delhi High Court

The petition has been filed by Advocate Chaitanya Rohilla, stating that the updated Policy gives the Company virtually a 360-degree profile into a person's online activity.

"This level of insight into a person's private and personal activities is done without any government oversight at present or regulatory supervision. Moreover, in the absence of a data protection authority, it leaves the users with a company's own assurances and privacy policies," the plea states.

Thus, he has urged the High Court to issue an injunction order, restraining Whatsapp from enforcing the updated privacy policy, with immediate effect. He has also sought guidelines/ directions to ensure that any change in Privacy Policy by Whatsapp is carried out strictly in accordance with the Fundamental Rights.

Inter alia, he has sought a direction upon the Central Government to exercise of its powers under Section 79 (2) (c) read with Section 87 (2) (zg) of the Information Technology Act and ensure that Whatsapp does not share any data of its users with any third party or Facebook and its companies for any purpose whatsoever.

Whatsapp updated its privacy policy on January 4, 2021 and made it compulsory for its users to accept its terms and conditions, failing which the accounts and services would be terminated after February 8, 2021 for the respective user.

Affects right to Privacy

The Petitioner has, at the outset, stated that updated Privacy Policy directly attacks the fundamental Right of Privacy, guaranteed under Part-III of the Constitution of India, an recognized by the Supreme Court in Justice KS Puttaswamy & Ors. v. Union of India & Ors.

In this regard, it is pointed out that the new policy takes away the choice users had until now to not share their data with other Facebook-owned and third-party apps. The Petitioner submitted,

"if WhatsApp is stating that it is now going to use the users data and share it with the largest social network in the world [Facebook], which is embedded on every second website and collect data from there as well, the integration of this data will essentially mean that the user is perpetually under the surveillance of the Facebook group of companies."

The plea adds,

"the sharing of users' data by WhatsApp to third parties and Facebook is in itself illegal because WhatsApp can only use the information for purposes that are reasonably linked to the purpose for which the information was given. A user who has signed up to WhatsApp because they want to communicate. Users' provide their data to WhatsApp for this, whereas WhatsApp is using this data and sharing it with third-part services and Facebook to run their own businesses. It emphatically implies that the purpose that WhatsApp is using the information for is not reasonably connected to the purpose for which the user is giving that information to WhatsApp."

Further, by mandating its users to accept the Policy within a stipulated timeline, WhatsApp has put a damocles sword upon its users, compelling them to share their data to them and ultimately other companies.

Obligations under International Law

The Petitioner has pointed out that India, being a signatory to the International Covenant on Civil and Political Rights (ICCPR), is obligated to implement essential data protection regime, in both the public and private sectors. In the words of the General Committee of the Covenant:

"Effective measures have to be taken by States to ensure that information concerning a persons' private life does not reach the hands of persons who are not authorized by law to receive, process and use it, and is never used for purposes incompatible with the Covenant. In order to have the most effective protection of his private life, every individual should have the right to ascertain in an intelligible form, whether, and if so, what personal data is stored in automatic data files, and for what purposes."

Similar obligation also arises from a close reading of the Universal Declaration of Human Rights of 1948.

Updated Privacy Policy not applicable in Europe

The Petitioner has pointed out that the updated Privacy Policy introduced by WhatsApp is not applicable in the European Region, owing to the data protection law (GDPR) in place there. However, the company is trying to arbitrarily and in most monopolistic way enforce the policy in India, as they see vulnerability in the absence of any comprehensive law in this subject.

WhatsApp is discharging a Public Function despite being a private entity.

On the point of maintainability, the Petitioner has submitted that WhatsApp is amenable to writ jurisdiction under Article 226 of the Constitution, even though it is a private entity, because as it is discharging a 'Public Function'. [Andi Mukta Sadguru Shree Muktajee Vandas Swami Suvarna Jayanti Mahotsav Smarak Trust v. V.R. Rudani, (1989) 2 SCC 691]

The plea states,

"Whatsapp has become an important mode of communication amongst the citizens of India and is also being used to aide multiple Governmental functions as well. So much so that even the Hon'ble Supreme Court of India, vide Order dated 10.07.2020 in Suo Moto Writ Petition (C) No. 3/2020 in 'Re: Cognizance For Extension of Limitation' had allowed the service of summons via electronic mode including WhatsApp. This substantiates to the fact that WhatsApp is discharging a despite being a private entity."

It adds,

"In the prevalent Covid-19 pandemic times, Confidential proceedings such as that of the mediations is being conducted by WhatsApp."