Stop Implementation Of WhatsApp's New Privacy Policy : Centre Tells Delhi High Court

Responding to a public interest litigation before the Delhi High Court, the Centre has sought for WhatsApp to be restrained from implementing its new privacy policy and terms of service dated 04.01.2021 from 08.02.2021 or any subsequent date pending adjudication on the case by the court.


The Centre also stated in its reply that in discharge of its obligation imposed by the Supreme Court to frame due guidelines for data protection, it has also framed the Personal Data Protection Bill, 2019 which introduces a "robust regime" on data protection and privacy, which "will limit the ability of entities" such as WhatsApp to issue privacy policies which do not align with appropriate standards of data protection and that pending passage of the Bill, the Information Technology Act, 2000 and the Rules made thereunder form the extant regime on data protection.

The Centre's case is that WhatsApp is a "body corporate" under S.43A of the IT Act, 2000 and under the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data Or Information) Rules, 2011 and must comply with the 2011 Rules, however, it is violative of these Rules on "five counts" mentioned in its reply.

Therefore, it has sought for restraint on implementation of WhatsApp's New privacy policy.

The petition stated that the new WhatsApp privacy policy released on Jan 4, 2021 is violative of the fundamental right to privacy under Article 21, because while its old privacy policy which was issued on Jul 20, 2020 provided the users to opt in or out of data sharing with other Facebook companies, the new policy does not provide the users any option to protect their personal data by opting out of their policy.

The plea argued that according to the new policy WhatsApp could share information with third party service providers and other Facebook companies and that this data sharing arrangement would be used by WhatsApp and its holding companies to analyse and further share with other entities thereby leaving scope for use as well as exploitation - leading to privacy violations.

Therefore, the petitioner talked about three elemental rights recognized by the Justice Shreekrishna Committe Report as well as the Personal Data Protection Bill - the right to access, the right to objection, restriction and portability of data, and the right to be forgotten - and prayed for the court or the Union of India to frame guidelines for effectuating these rights.