India’s Top Court to Rule on WhatsApp-Facebook Data Sharing(1)

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Madhur Singh

A special bench of India’s top court is scheduled to hear final arguments July 17 in a case brought by two Indian students over whether WhatsApp is violating Indian users’ privacy by sharing data with its parent company, Facebook Inc. After the hearing, the case will revert back to the full Supreme Court of India, which will decide whether and to what extent the social messaging application may legally share user data with Facebook. It isn’t clear when the final decision will be issued.

The court will also consider what kind of regulatory regime should govern data privacy for social media businesses. A wide-ranging interpretation of users’ right to privacy may significantly transform India’s regulatory and compliance landscape, privacy professionals say.

A ruling “recognizing the right to privacy will have a tremendous impact on the privacy practices of any and all companies collecting data in India and from Indians,” Asheeta Regidi, a cyberlaw consultant and certified information privacy professional, told Bloomberg BNA.

Companies in India now use general consent to use data for internal purposes or sharing with third parties to justify almost any further use of data, Regidi said. If the court recognizes a broad general right to privacy, that would likely change the balance, providing enhanced protection to users despite broad data consent, she said.

Facebook Acquires WhatsApp

The case began when the students challenged WhatsApp’s privacy policy revision in August 2016 that allowed it to share data with Facebook—the social media giant with a market capitalization of just over $443 billion, Bloomberg data show. Facebook acquired WhatsApp, which previously had a strong user privacy policy, in October 2014 for $21.8 billion.

Smaller companies now use the sale of user data to larger companies as a business model, cybersecurity attorney Prashant Mali told Bloomberg BNA. If the court rules in the students’ favor, “overall compliance costs will go up, risk models will diversify, and insurance and assurance will become mandatory,” he said.

The law firm representing Facebook declined Bloomberg BNA’s request for comments. Facebook didn’t immediately return Bloomberg BNA’s email request for comments.

The students challenged WhatsApp’s revision in a public interest complaint, which is similar to a U.S. class action complaint, arguing that the new policy infringed users’ fundamental rights.

The Delhi High Court ruled that WhatsApp’s privacy policy had informed users that the company reserved the right to share data in the event of a merger or acquisition, and that users couldn’t compel WhatsApp to continue its pre-merger privacy policies. Users who didn’t want to share data with Facebook could have closed their WhatsApp accounts and have their personal data removed, the court said.

The students appealed to the Supreme Court, which referred the matter to the special bench.

Basis for Privacy

India’s Constitution guarantees freedom of life, but whether it guarantees a right to privacy isn’t clear. That question is subject to a separate constitutional challenge in the Supreme Court— K.S. Puttaswamy v. Union of Indiainvolving the collection of demographic and biometric data.

A statutory right to privacy is contained in India’s Information Technology Act (IT Act), but it applies only to certain sensitive personal data —not to other user information that social media sites possess, including content of personal messages and metadata.

The Supreme Court may delay its decision because the government is working on legislation to guarantee citizens’ right to privacy, Mali said. “The court would not want to create chaos, and be accused of judicial overreach by seeming to do the work of the legislature,” he said.

To contact the reporter on this story: Madhur Singh in Chandigarh, India, at correspondents@bna.com

To contact the editor responsible for this story: Donald Aplin at daplin@bna.com

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law: Privacy & Data Security