India's Supreme Court threatens Meta over WhatsApp data sharing

Abstract

What happens in India matters a great deal to Meta because India is Meta’s largest market for its WhatsApp service, with up to 853.8 million monthly active users.  Meta/WhatsApp is facing two ongoing Supreme Court cases challenging its data sharing practices under two different aspects of Indian law. In 2027, when India’s data privacy law comes into force, it may face a third type of challenge.

The Supreme Court is currently examining WhatsApp’s 2021 privacy policy which requires users to accept data sharing as a condition for continued use of the WhatsApp platform. The content of WhatsApp messages continues to be protected by WhatsApp’s ‘end-to-end’ encryption, but what is essentially metadata about messages and their senders can now be shared. The policy allows WhatsApp to share users' data with Facebook and all its group companies for the purposes of commercial advertising and marketing. The Competition Commission of India (CCI) considered that the consent obtained was not genuine consent, and the privacy policy changes were anti-competitive as a result. It imposed a joint penalty of USD 23.5 million (approx.) on WhatsApp and Meta and also imposed a 5-year ban on WhatsApp transferring data. The National Competition Law Appellate Tribunal (NCLAT) then upheld the penalty imposed but not the 5-year ban. Meta/WhatsApp appealed.

The Supreme Court bench, led by Chief Justice Surya Kant said Meta’s appeal would be dismissed if the companies failed to immediately file an undertaking stating that they would not share user data. He described the privacy policy as ‘a decent way of committing theft of private information'. Meta gave the undertaking and the case continues.

An even broader challenge to WhatsApp’s data-sharing practices is the long-running case of Karmanya Singh Sareen v Union of India. In issue is the company’s 2016 policy update which permitted sharing of user data with Facebook and its group companies which had acquired WhatsApp in 2014.

The petitioners objected to WhatsApp’s change of policy requiring users to agree to data sharing or discontinue use of the service, arguing that users should be able to opt out of data sharing with Facebook, and with WhatsApp’s supposed obtaining of consent from users unable to understand its policy terms, arguing that they amounted to deception.

In Puttaswamy v Union of India (2017) an unusual nine judge ‘constitution bench’ of India’s Supreme Court unanimously decided that India’s Constitution recognises an inalienable and inherent right of privacy as a fundamental constitutional right. In 2016 the Delhi High Court rejected the petition, but the petitioners filed a Special Leave Petition at the Supreme Court, relying on Puttaswamy. If and when a Constitution Bench is appointed to hear Karmanya Singh Sareen, then India’s constitutional right of privacy will be tested against WhatsApp’s data sharing practices as a question of privacy, not of competition law.

India’s Supreme Court is positioning itself to once again become the focal point of privacy law developments in India.

Keywords: India, Meta, competition, privacy, data protection