WhatsApp Trying to Force Users to Accept New Policy Before Data Protection Law Comes: Centre to High Court

The Centre has told the Delhi High Court that social messaging platform WhatsApp was trying to "force" its users to consent to the new privacy policy before the Personal Data Protection Bill becomes the law by bombarding them with notifications daily to obtain their consent.

Terming WhatsApp's bombarding of notifications on its customers as an "anti-user practice" for obtaining "trick consent", the central government has urged the court to direct the messaging platform to desist from pushing notifications onto its existing users with regard to the new privacy policy.

The Centre's claim has been made in an additional affidavit filed in response to several pleas challenging the new privacy policy of WhatsApp.

A WhatsApp spokesperson responded to the affidavit, “We reiterate that we have already responded to the Government of India and assured them that the privacy of users remains our highest priority. As a reminder, the recent update does not change the privacy of people's personal messages. Its purpose is to provide additional information about how people can interact with businesses if they choose to do so.”

“We will not limit the functionality of how WhatsApp works in the coming weeks. Instead, we will continue to remind users from time to time about the update as well as when people choose to use relevant optional features, like communicating with a business that is receiving support from Facebook. We hope this approach reinforces the choice that all users have whether or not they want to interact with a business. We will maintain this approach until at least the forthcoming PDP law comes into effect,” the spokesperson added.

One of the pleas, which was the first one to be filed, was moved by Chaitanya Rohilla, a lawyer, in January this year.

Rohilla, represented by advocate Manohar Lal, has contended that the updated privacy policy violates users' right to privacy under the Constitution and they can either accept it or exit the app, but they cannot opt not to share their data with other Facebook-owned or third party apps.

The plea has claimed that the new privacy policy of WhatsApp allows full access into a user's online activity without there being any supervision by the government.

In its additional affidavit, which supports the petitioners claims, the Centre has said the privacy policy violates the rules as it fails to specify types of sensitive personal data being collected and also fails to notify users about details of the sensitive personal information which is collected.

Besides, the policy also does not provide an option to users to review or amend the information, does not provide an option to withdraw consent retrospectively and also fails to guarantee further nondisclosure by third parties, the affidavit has said.

It has also stated that WhatsApp was "indulging in anti-users practices by obtaining ''trick consent'' from the users for its updated privacy policy".

"It is submitted that millions of WhatsApp existing users, those who have not accepted the updated 2021 privacy policy are being bombarded with notifications on an everyday basis," it has said.

The government has said that WhatsApp "has unleashed its digital prowess to the unsuspecting existing users and would like to force them to accept the updated 2021 privacy policy by flashing such notifications at a regular intervals".

"The game plan is very clear, i.e., to transfer the entire existing user base committed to the updated 2021 privacy policy before the Personal Data Protection (PDP) Bill becomes the law," the government has said in its affidavit.

The government has sought directions to WhatsApp to place on record the number of times such notifications have been sent out till date on daily basis and what was the conversion rate - that is how many have accepted the updated 2021 privacy policy vis-a-vis the number of notifications.

The central government has further said that WhatsApp "is currently having access to personal, sensitive, and business data of hundreds of millions of Indian users and has also acquired role of an ''essential digital service'' during COVID-19 pandemic", and thus, it was imperative that it privacy policy and terms of service "should be examined on the touchstone of privacy principles as laid down in K S Puttaswamy" judgement of the Supreme Court.