Imagine one fine morning you open your social media you find your private chats being circulated among different groups or any personal image being hacked by someone and published over the internet. What would be your reaction?

In the 21^st century we can hardly find any person away from social media platforms. One such social media which has received worldwide appreciation is WhatsApp and it is used by different people and organisations to undertake contracts, agreements and business deals with easy. In India, with the introduction Information Technology Act 2000 WhatsApp was recognised as a great messaging platform provided that it follows the guidelines updated by the Act.

With so much data being shared worldwide through this platform, WhatsApp after being taken over by Meta in 2014 made people focus on the data protection and privacy because there were worldwide concern who ended up sharing sensitive personal data with Facebook resulting in compromising the user policy.

In 2016 WhatsApp updated its Privacy policy with the purpose of sharing user data with Facebook (parent company) to target the advertisement. The users were given an ‘opt-out’ option for a period of 30 days to let the user choose whether to allow Facebook to get access to their data for the targeted advertisement or restrict them. But disadvantageously, if the user didn’t opt for the given option, after 30 days it shall be an implied consent by the user to the app for data sharing. It was further seen that people who joined WhatsApp after August 2016 where not even given a choice. This action by Facebook breached the Right to privacy of the users, because their consent to share data was not even considered by the company. The judgement of this case allowed sharing data with Facebook till 25^th September, so being aggrieved the petitioner applied at the Supreme Court challenging the privacy policy.

Shockingly, the judgment allowed sharing of data collected post 25 September with the parent company Facebook under the new Privacy Policy. Aggrieved by the judgment, the petitioners Sareen and Shreya Sethi knocked on the gates of justice at the Supreme Court, challenging the 2016 Privacy Policy of WhatsApp in their Special Leave Petition (SLP). The Internet Freedom Foundation (“IFF”), represented by Senior Advocate K.V Vishwanath, is also one of the intervenors in this case.

Later in 2017 Supreme court while giving the judgement in the landmark case of K.S. Puttaswamy v. Union of India recognised the Right to Privacy under Art 21 and made it a fundamental right to promote the Data Protection Framework in India. On December 2019 the Personal Data Protection Bill 2019 was presented at Rajya Sabha, and since then this Bill has faced numerous questions from the stakeholders to privacy professionals, and finally on 3^rd August 2022 the PDP Bill was unexpectedly withdrawn and the Parliament was informed to amend few provisions before it gets again presented.

On March 2021 , the Competition Commission of India discovered the violation of Section 4 of the Competition Act and demanded an investigation on the basis of abuse of dominant position done by the messaging app through the data sharing terms in the Privacy Policy. In its opinion WhatsApp abused its dominance by forcing users to compulsorily agree to share their personal data with Facebook companies if they wanted to continue using the app. The mere inquiry made by the CCI was a positive approach to undertake the privacy policy by WhatsApp until the Data Protection bill comes into force. 

When Meta approached the court against the suo moto action of the CCI, the court said that the 2021 privacy policy was leaving WhatsApp users in a “take it or leave it” scenario without any ‘opt-out’ option, thereby creating a “mirage” of choice and forcing its users into an agreement. The court clearly refused to interfere into the working of the CCI and dismissed their appeal .

Interestingly, WhatsApp has also received straight warning from the different data protection agency form several EU countries because of the new data privacy policy adopted by them in 2021 and for this WhatsApp Ireland was fined with €225 million by the Irish Data Protection Commission for breach of the GDPR since they breached several provisions of the GDRP since 2018.

Thus, in the current scenario after establishing right to privacy as one of the major fundamental right of the citizens, every person has the right to be asked before sharing their personal data through application. India is waiting for the privacy bill to be passed until then the data protection in India is a serious matter to be looked into. Its high time that India brings in the Privacy Bill to protect the users data being transferred to other organisation without their consent.