Is WhatsApp’s policy change illegal?

The update, which would allow WhatsApp to share certain user data with its parent company Meta Platforms Inc., formerly Facebook Inc., sparked global outrage and angered regulators in several countries.

According to the people cited above, the Director General (DG) of Investigation under the CCI concluded that WhatsApp and its parent company Meta Platforms Inc. (formerly Facebook Inc.) violated the competition law prohibiting abuse of dominant position.

One of the people cited above, who did not wish to be named, said the DG’s investigation report has been shared with the CCI. Based on the report, the CCI has prepared a draft order which will soon be finalized and sent to the two companies to impose penalties for the alleged violations, the person added.

Under last year’s amendments to the Competition Act, penalties for non-compliance can reach up to 10% of the relevant entity’s global sales or revenue.

ALSO READ | Meta India head: Chat-based e-commerce is WhatsApp’s top priority

To be sure, European countries have already taken regulatory action in response to policy updates. In December 2021, the German Data Protection Commissioner temporarily banned Facebook from processing the WhatsApp data of German users. The Irish Data Protection Commission also fined WhatsApp in 2021 for requiring users to accept previous privacy policy updates before the European Union introduced the General Data Protection Regulation (GDPR) in 2018. GDPR is an EU law that protects data privacy. Privacy Citizens and Their Data.

However, India is the most important region for the company, considering that WhatsApp ranks first globally with nearly 536 million users in the country, according to data solutions provider Demandsage. Brazil, in second place, lags far behind with only 148 million users. Therefore, the world is eagerly awaiting the outcome of the Indian regulator’s investigation.

A query emailed to the CCI on October 10 remained unanswered as of press time.

“CCI proceedings are ongoing and we cannot comment on this,” a WhatsApp spokesperson said in an email response, adding that the 2021 privacy policy update did not change the privacy of people’s personal messages.

“WhatsApp gives users the option to accept privacy policy updates, and users who choose not to accept updates can continue to use WhatsApp to communicate with friends and family without deleting their accounts or losing functionality,” the spokesperson wrote.

Updates that sound alarm bells

The case revolves around WhatsApp’s 2021 privacy policy update, which involves how businesses use Facebook-hosted services to store and manage WhatsApp chats with customers.

The CCI concluded that WhatsApp shared users’ business transaction information with Meta, giving the group entities an unfair advantage over competing platforms, the first person said.

Information about users’ business transactions helps social media platforms analyze customers and target advertising and marketing efforts.

WhatsApp later clarified in 2021 that the policy update would not affect the privacy of customers’ messages with friends or family in any way, and that the changes were only related to optional business features on WhatsApp.

ALSO READ | Mint Explaner: How does the CCI propose to implement the new merger approval regime?

Advertisements on Facebook and Instagram enable users to send messages to advertising businesses via WhatsApp. Meta may use the way people interact with those ads to personalize the ads people see on Facebook or Instagram, it explained, adding that customer accounts that don’t accept privacy policy updates will not be deleted.

However, regulators said there was still sufficient justification for regulatory action.

The second person mentioned above said that despite the initial mandatory nature of the 2021 privacy policy update, the vast majority of WhatsApp users accepted the update at the time. The CCI took action and came up with subsequent clarifications. Additionally, new users must accept the privacy policy, said the person, who spoke on condition of anonymity.

How regulations are changing

The case is significant because customer data, including online purchases, has become a valuable resource for companies in the digital economy and an area that may raise competition concerns. With the rapid development of the digital economy, the expansion of Internet penetration and smartphone use, regulatory systems are also undergoing major changes.

While the Digital Personal Data Protection Act or DPDP Act has been legislated and various sections will be notified separately, discussions on the Digital Competition Bill and the bargaining code for news aggregators such as news publishers and internet search engines are ongoing to A digital economy that solves different aspects of problems.

WhatsApp clarified in 2021 that the policy update will not affect the privacy of customers’ messages with friends or family, and that the changes are only related to optional business features on WhatsApp.

While the DPDP bill focuses on consent and privacy-related aspects, the other two bills aim to address competition-related aspects of the digital economy.

“With the introduction of the Digital Personal Data Protection Act 2023, the legislative landscape has changed,” said Navneet Sharma, director of the CUTS Institute of Regulation and Competition (CIRC), an independent non-profit research organization.

ALSO READ | Regulatory force: Tech giants succumb to CCI whip

Sharma explained that the consent mechanism for accessing user data is now subject to statutory regulation and data privacy is governed by the DPDP Act. The type of data collected, its purpose and the manner in which it is processed, stored and shared are governed by the law, and entities collecting data must give consumers the option to withdraw consent.

“However, competition law and the CCI are of concern if the data constitutes a barrier to entry or affects the ability of participants to conduct business,” Sharma said. “Past cases have been ex post facto in nature, where alleged breaches of competition law occurred after events , will go through the life cycle of CCI investigation and ruling.”

Sharma said the provisions of the DPDP Act must be notified and the Indian Data Protection Board set up as an expected outcome.

The CCI’s concerns over cross-linking and aggregation of user data across multiple digital economy platforms may further enhance the advantage and market power of dominant players and may create entry barriers for other players, the CCI said while ordering the inquiry.