24 March 2021 1:58 PM GMT
"..the Commission is of the considered opinion that WhatsApp has prima facie contravened the provisions of Section 4 of the Act through its exploitative and exclusionary conduct, in the garb of policy update", said the order passed by the CCI.
"On a careful and thoughtful consideration of the matter, the conduct of WhatsApp in sharing of users' personalised data with other Facebook Companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie unfair to users. The purpose of such sharing appears to be beyond users' reasonable and legitimate expectations regarding quality, security and other relevant aspects of the service for which they register on WhatsApp. One of the stated purposes of data sharing viz. targeted ad offerings on other Facebook products rather indicates the intended use being that of building user profiles through cross-linking of data collected across services. Such data concentration may itself raise competition concerns where it is perceived as a competitive advantage", the 21-page order of the CCI said.
It made a prima facie observation that the policy was an abuse of dominant position resulting in violation of Section 4 of the Competition Act.
"The impugned conduct of data-sharing by WhatsApp with Facebook apparently amounts to degradation of non-price parameters of competition viz.quality which result in objective detriment to consumers, without any acceptable justification. Such conduct prima facie amounts to imposition of unfair terms and conditions upon the users of WhatsApp messaging app, in violation of the provisions of Section 4(2)(a)(i) of the Act".
"..users are required to accept the unilaterally dictated 'take-it-or-leave-it' terms by a dominant messaging platform in their entirety, including the data sharing provisions therein, if they wish to avail their service. Such "consent"cannot signify voluntary agreement to all the specific processing or use of personalised data,as provided in the present policy. Users have not been provided with appropriate granular choice, neither upfront nor in the fine prints,to object to or opt-out of specific data sharing terms,which prima facie appear to be unfair and unreasonable for the WhatsApp users".
The CCI bench comprising Ashok Kumar Gupta(Chairperson), Sangeeta Verma(Member) and Bhagwant Singh Bishnoi(Member) observed that "a thorough and detailed investigation is required to ascertain the full extent, scope and impact of data sharing through involuntary consent of users".
Accordingly, the Commission directed the Director General ('DG') to cause an investigation to be made into the matter under the provisions of Section 26(1) of the Act. The Commission also directed the DG to complete the investigation and submit the investigation report within a period of 60days from the receipt of this order.
The Commission has clarified that the observations are preliminary in nature and will not amount to a final expression of opinion on the merits of the case. "The DG shall conduct the investigation without being swayed in any manner whatsoever by the observations made herein", the order added as a caveat.
WhatsApp LLC and Facebook Inc were arrayed as opposite parties in the case.
Abuse of dominance
Section 4 of the Act proscribes abuse of dominance by an entity commanding dominant position in relevant market.
The CCI noted that WhatsApp is dominant in the relevant market for OTT messaging apps through smartphones in India, as was held in an earlier decision.
The Commission further noted that the previous privacy policies of WhatsApp dated 25.08.2016 as well as 19.12.2019 provided users an option to choose not to have their WhatsApp account information shared with Facebook.
However, under the latest policy, this choice is no longer available to users.
In this regard, the CCI observed :
"This(removal of opt-out choice) implies that data of users, including that of those who are not users of any other service within the Facebook family of companies, will now be shared across Facebook Companies. Simply put, it appears that consent to sharing and integration of user data with other Facebook Companies for a range of purposes including marketing and advertising, has been made a precondition for availing WhatsApp service"
This "take-it-or-leave-it" policy of WhatsApp requires further examination as to whether it violates the provisions of the Competition Act.
The Commission also took note of the "strong lock-in effect" for users as regards their dependence on WhatsApp for messaging services. Switching to another platform for users gets difficult and meaningless until all or most of their social contacts also switch to the same other platform. Users wishing to switch would have to convince their contacts to switch and these contacts would have to persuade their other contacts to switch. Thus, while it may be technically feasible to switch, the pronounced network effects of WhatsApp significantly circumscribe the usefulness of the same.
It noted that despite the increased downloads of alternate platforms like Telegram or Signal, the user base of WhatsApp has not suffered significant loss.
For instance, information on how users "interact with others (including businesses)"is not clearly defined,what would constitute "service-related information", "mobile device information", "payments or business features", etc.are also undefined. At numerous places in the policy, while illustrating the data to be collected, the list is indicative and not exhaustive due to usage of words like 'includes', 'such as', 'For example', etc., which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy.
"Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services. It is also not clear from the policy whether the historical data of users would also be shared with Facebook Companies and whether data would be shared in respect of those WhatsApp users also who are not present on other apps of Facebook i.e.,Facebook, Instagram, etc", the CCI said in the order.
It further said :
"Further, users are not likely to expect their personal data to be shared with third parties ordinarily except for the limited purpose of providing or improving WhatsApp's service. However, it appears from the wordings of the policy that the data sharing scheme is also intended to, inter alia,'customise', 'personalise' and 'market' the offerings of other Facebook Companies. Under competitive market condition, users would have sovereign rights and control over decisions related to sharing of their personalised data. However, this is not the case with WhatsApp users and moreover, there appears to be no justifiable reason as to why users should not have any control or say over suchcross-product processing of their data by way of voluntary consent,and not as a precondition for availing WhatsApp's services".
Version of WhatsApp and Facebook
It further said that the new policy does not expand WhatsApp's ability to share data with Facebook and the said update intends to provide users with further transparency about how WhatsApp collects, uses and shares data. The CCI has asked the DG to examine the veracity of this claim.
Facebook Inc said that it was not a necessary or proper party in the case. Though Facebook admitted that it was the parent company of WhatsApp, it said that both Facebook and WhatsApp are distinct legal entities, and hence it need not be made as a party in the case.
The Commission expressed surprise at this stand taken by Facebook.
"Facebook is a direct and immediate beneficiary of the new updates and in these circumstances, it is egregious that Facebook is feigning ignorance about the potential impact of the updates altogether and avoiding from providing its perspective thereon. In these circumstances, Facebook is proper party in the present matter and its presence is required for effective and complete determination of the issues involved in the present matter. Accordingly, the issue of deletion of its name from array of parties does not arise and the request of Facebook in this regard is rejected", the CCI observed in this regard..
Click here to read/download the order