We Have No User Data Except Name & Phone Number; We Don't Process Personal Sensitive Data : WhatsApp Tells Supreme Court

On Wednesday, WhatsApp infomed the Supreme Court that by policy it does not process sensitive personal data of its users.A Constitution Bench bench comprising Justices KM Joseph, Ajay Rastogi, Aniruddha Bose, Hrishikesh Roy and CT Ravikumar was hearing the petitions which were filed challenging the 2016 privacy policy of WhatsApp. The case was referred to the Constitution Bench in 2017.On the last date of hearing, the Bench was apprised that a Data Protection Bill is to be introduced in the Parliament in the second half of the Budget Session, 2023. In view of the same, the Centre and WhatsApp, two of the respondents in the matter, implored the Bench to consider deferring the hearing. After briefly hearing the Sr. Counsels, the Bench had indicated that it would hear the parties on the issue whether it should continue with the hearing. On Wednesday, the Attorney General for India, Mr. R. Venkataramani, also flagged the same concerns that the Solicitor General of India, Mr. Tushar Mehta, had expressed on the previous occasion. He was afraid that the Court’s deliberations on the draft Bill, might orient the debate in the Parliament. Informing the Bench that the Bill subject to getting approval from the Cabinet is intended to be presented in the second half of the Budget Session, i.e., between 13th March, 2023 and 6th April, 2023, he sought the Court’s indulgence to postpone the hearing till then. Senior Advocate, Mr. Kapil Sibal, representing WhatsApp, supported the submissions made by the Solicitor General and Attorney General in this regard. He submitted - “It is not just ordinary legislation. It has an impact on investment, freedom of speech, privacy...It will impact even other intermediaries…If it is between now and July, what is the harm? It took 6 years for the European Union to pass the Bill.”Echoing the submission made by Mr. Sibal, Senior Advocate, Mr. Arvind Datar, appearing on behalf of Meta(parent company of WhatsApp, emphasised that there are ample regulations and guidelines to ensure safeguards in sharing of data. To elucidate on the policy followed by WhatsApp, Mr. Sibal submitted that there are two regimes. One of the policies is followed in the European Union while the other is followed in the rest of the world, including India. He asserted that there are 600 million users of the Application in India, and none of them seems to have complained that their data has been disclosed by WhatsApp to any third party. Mr. Sibal argued that the Information Technology Act and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 regulates the concerned field. It was pointed out by Mr. Sibal that WhatsApp is protected by end to end encryption and even WhatsApp does have any information with respect to the users’ messages. He submitted that the concept of sharing data with Facebook comes into existence when a person is on both the Applications and is carrying on activities on Facebook. He indicated that the only user information that is available to WhatsApp other than the user's name is the phone number. “What is the information we have? Your name, phone number, that’s all. That is the information we have. Basically it is the phone number. But nothing to do with content, nothing to do with the personal data….WhatsApp does not process personal sensitive data. That is our policy.”Mr. Sibal informed the Bench that there are several Government of India Applications where no explicit consent is obtained; continued use is deemed as consent. “In many other platforms, including Govt. of India platforms there is not even a provision which says that 'I agree’. Continued use is deemed consent by the Govt. Apps… IRCTC, Aarogya Setu, BHIM.”After going through the Rules, Justice Joseph was of the opinion that the protection therein was primarily with respect to sensitive personal data. According to him, it appeared that personal data could be transferred without consent. “We are telling you that Rule 7 is capable of being used for transfer of information without consent…The question is not whether you do it with or without consent. It is whether the law permits it to be transferred without consent.”With respect to its ability to manipulate political views, the Judge expressed concern that since political opinion is not considered as sensitive personal data, it might not have the same safeguards as the sensitive personal data and if passed on to a third entity it can be used for commercial purposes as well as political purposes. He added - “My views of a particular politician... If the views are gathered by you and passed on to someone…You may say that you may not want to put that man as a candidate. I remember, initially, WhatsApp was charging for the service. Thereafter, they changed the policy. Obviously, there is a business consideration.”Mr. Sibal responded, “If he does not want any of the information to be used, he can only be on WhatsApp...

We Have No User Data Except Name & Phone Number; We Don't Process Personal Sensitive Data : WhatsApp Tells Supreme Court

Sohini Chowdhury

Tags