India’s anti-trust and fair trade regulator, Competition Commission of India (CCI), on Wednesday, 24 March, ordered an investigation into WhatsApp’s proposed privacy policy changes.
The regulator observed, “The conduct of WhatsApp in sharing of users’ personal data with other Facebook companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie unfair to users.”
CCI’s 21-page order listed the responses by both WhatsApp and its parent company, Facebook, and its reasons for ordering a probe into what it found to be abuse of WhatsApp’s dominant market status through “exploitative and exclusionary conduct”.
It also illustrated the CCI’s dissatisfaction in the manner in which Facebook and WhatsApp responded and the lack thereof. CCI found Facebook’s attitude towards its queries as “egregious and evasive”.
The Quint combed through the order to explain the core issues and why this is a big deal.
All About Competition Commission’s WhatsApp Privacy Policy Probe
1. What is the New Policy?
On 5 January, WhatsApp gave its 2 billion users across the world time till 8 February to accept its updated terms of use and privacy policy or be unable to use the app. However, following a mass outcry, WhatsApp pushed the date to 15 May.
A dive into the current policy and comparison with the 2016 version reveals a growing data collection practice as a result of WhatsApp’s dual role as a messaging platform and a payments platform.
“We process additional information about you, including payment account and transaction information,” the latest update stated in its terms of service as a reflection of its expanding roles.
In addition, the emergence of over 15 million business accounts on WhatsApp in India has affected the new data-sharing practices with these accounts.
While the encrypted nature of personal chats with friends and family remains unchanged, it is the expansive metadata collection as a messaging and business interaction platform as well as a payments platform that has raised concerns.
Expand2. Why CCI Ordered a Probe?
According to the order, CCI prima facie found that WhatsApp had abused its dominant market position to coerce its 350 million users in India to accept its new policy with no scope of opting out.
According to the order, WhatsApp has “contravened the provisions of Section 4 of the Competition Act, 2002, through its exploitative and exclusionary conduct, as detailed in this order, in the garb of policy update”.
Therefore, CCI was of the view that “a thorough and detailed investigation is required to ascertain the full extent, scope and impact of data sharing through involuntary consent of users”.
The Commission directed its investigation arm, the Director General, to conduct and complete the probe and submit the report within 60 days.
Expand3. Why CCI Found WhatsApp’s Policy as 'Exploitative and Exclusionary'?
CCI, in its order, presented detailed explanations of its examination of the 2021 privacy policy update. This included a comparison with the previous versions in 2016.
Among the prima facie findings, three major points were cited:
I. Unfair to users: The purpose of such sharing appears to be beyond users’ reasonable expectations regarding quality, security and other relevant aspects of the service, for which they register on WhatsApp.
II. Coercion: The absence of an option to opt out of the new policy update. The 2016 update gave users a 30-day window to opt-out.
ii. Network effects and prohibitive switching cost from a network like WhatsApp.
III. Exploiting users by lowering data-protection measures.The Commission said that the policy was an abuse of WhatsApp’s dominant position in the market as users were required to accept the unilaterally dictated ‘take-it-or-leave-it’ terms in their entirety, including the data-sharing provisions therein, if they wished to avail of the app’s service.
Expand4. What Does WhatsApp Have to Say?
Responding to the probe ordered by the CCI, WhatsApp said it looked forward to engaging with the regulatory body and remained committed to end-to-end encryption.
“We look forward to engaging with the CCI. WhatsApp remains committed to protecting people’s personal communications with end-to-end encryption and providing transparency about how these new optional business features work,” a WhatsApp spokesperson told The Quint.
In its written responses on 3 February and 25 February to CCI’s queries, WhatsApp had stated that the primary aim of the 2021 update was twofold:
I. to provide users with further transparency about how WhatsApp collects, uses and shares data.
II. to inform users about how optional business messaging features work when certain business messaging features become available to them.According to the order, WhatsApp also added that the 2021 update did not expand WhatsApp’s ability to share data with Facebook and did not impact the privacy of personal messages of WhatsApp users with their friends and family.
“In light of its averments, WhatsApp has submitted that the 2021 update raises no concerns from a competition perspective,” the order stated.
Expand5. Why Did WhatsApp Contend That CCI Shouldn’t Investigate Its Policy Update?
CCI’s order also detailed WhatsApp’s arguments as to why the policy update was beyond the pale of CCI’s purview as well as why they did not merit an investigation on the grounds of abuse of dominance.
WhatsApp, in its response to CCI, stated that the 2021 update had not yet been implemented and had been postponed to 15 May. Therefore, CCI’s allegation of abuse of dominance was premature.
WhatsApp also contended that the Commission had previously, in a separate case, assessed the 2016 Privacy Policy and regarded the allegations raised against data sharing related to the Information Technology Act (IT Act) and data protection/ privacy laws, and held that allegations of breach of the Information Technology Act did not fall within its purview.
WhatsApp also relied on the decision of the Commission in the Harshita Chawla-vs-WhatsApp Inc case to contend that issues related to data localization and data sharing need not be looked into under the Competition law.
The Commission, in its order, went on to dismiss the claims citing provisions of the Competition Act, 2002.
Expand6. Why Is CCI Miffed With Facebook & How It Found Its Response 'Egregious'?
The Commission was not amused by Facebook’s initial lack of response to its queries. Later, when the social media giant did reply, it came across as insincere, as per the observations cited in the order.
On 19 January, CCI sought responses from WhatsApp and Facebook by 3 February. While WhatsApp responded, Facebook neither responded to the queries raised by the Commission nor moved any application seeking extension of time to comply with the requisitions.
After a warning, Facebook eventually did respond, but stated it should not be made a party to the proceedings.
“While Facebook is the parent company of WhatsApp, the two are separate and distinct legal entities. It is WhatsApp (not Facebook) that offers and operates WhatsApp’s instant messaging service that is the subject of the Hon’ble Commission’s order,” the company submitted.
In a strongly worded response to Facebook’s plea, the Commission stated, “It is surprising that Facebook, instead of providing its response thereon, as sought by the Commission, is trying to evade its comments.”
Describing Facebook as a “direct and immediate beneficiary of the new updates”, the order stated “it is egregious that Facebook is feigning ignorance about the potential impact of the updates altogether and avoiding from providing its perspective thereon”.
Rejecting Facebook’s request for its name to be removed from the probe, the order stated that Facebook was very much a party in the case.
(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)
Expand
What is the New Policy?
On 5 January, WhatsApp gave its 2 billion users across the world time till 8 February to accept its updated terms of use and privacy policy or be unable to use the app. However, following a mass outcry, WhatsApp pushed the date to 15 May.
A dive into the current policy and comparison with the 2016 version reveals a growing data collection practice as a result of WhatsApp’s dual role as a messaging platform and a payments platform.
“We process additional information about you, including payment account and transaction information,” the latest update stated in its terms of service as a reflection of its expanding roles.
In addition, the emergence of over 15 million business accounts on WhatsApp in India has affected the new data-sharing practices with these accounts.
While the encrypted nature of personal chats with friends and family remains unchanged, it is the expansive metadata collection as a messaging and business interaction platform as well as a payments platform that has raised concerns.
Why CCI Ordered a Probe?
According to the order, CCI prima facie found that WhatsApp had abused its dominant market position to coerce its 350 million users in India to accept its new policy with no scope of opting out.
According to the order, WhatsApp has “contravened the provisions of Section 4 of the Competition Act, 2002, through its exploitative and exclusionary conduct, as detailed in this order, in the garb of policy update”.
Therefore, CCI was of the view that “a thorough and detailed investigation is required to ascertain the full extent, scope and impact of data sharing through involuntary consent of users”.
The Commission directed its investigation arm, the Director General, to conduct and complete the probe and submit the report within 60 days.
Why CCI Found WhatsApp’s Policy as 'Exploitative and Exclusionary'?
CCI, in its order, presented detailed explanations of its examination of the 2021 privacy policy update. This included a comparison with the previous versions in 2016.
Among the prima facie findings, three major points were cited:
I. Unfair to users: The purpose of such sharing appears to be beyond users’ reasonable expectations regarding quality, security and other relevant aspects of the service, for which they register on WhatsApp.
II. Coercion: The absence of an option to opt out of the new policy update. The 2016 update gave users a 30-day window to opt-out.
ii. Network effects and prohibitive switching cost from a network like WhatsApp.
III. Exploiting users by lowering data-protection measures.
The Commission said that the policy was an abuse of WhatsApp’s dominant position in the market as users were required to accept the unilaterally dictated ‘take-it-or-leave-it’ terms in their entirety, including the data-sharing provisions therein, if they wished to avail of the app’s service.
What Does WhatsApp Have to Say?
Responding to the probe ordered by the CCI, WhatsApp said it looked forward to engaging with the regulatory body and remained committed to end-to-end encryption.
“We look forward to engaging with the CCI. WhatsApp remains committed to protecting people’s personal communications with end-to-end encryption and providing transparency about how these new optional business features work,” a WhatsApp spokesperson told The Quint.
In its written responses on 3 February and 25 February to CCI’s queries, WhatsApp had stated that the primary aim of the 2021 update was twofold:
I. to provide users with further transparency about how WhatsApp collects, uses and shares data.
II. to inform users about how optional business messaging features work when certain business messaging features become available to them.
According to the order, WhatsApp also added that the 2021 update did not expand WhatsApp’s ability to share data with Facebook and did not impact the privacy of personal messages of WhatsApp users with their friends and family.
“In light of its averments, WhatsApp has submitted that the 2021 update raises no concerns from a competition perspective,” the order stated.
Why Did WhatsApp Contend That CCI Shouldn’t Investigate Its Policy Update?
CCI’s order also detailed WhatsApp’s arguments as to why the policy update was beyond the pale of CCI’s purview as well as why they did not merit an investigation on the grounds of abuse of dominance.
WhatsApp, in its response to CCI, stated that the 2021 update had not yet been implemented and had been postponed to 15 May. Therefore, CCI’s allegation of abuse of dominance was premature.
WhatsApp also contended that the Commission had previously, in a separate case, assessed the 2016 Privacy Policy and regarded the allegations raised against data sharing related to the Information Technology Act (IT Act) and data protection/ privacy laws, and held that allegations of breach of the Information Technology Act did not fall within its purview.
WhatsApp also relied on the decision of the Commission in the Harshita Chawla-vs-WhatsApp Inc case to contend that issues related to data localization and data sharing need not be looked into under the Competition law.
The Commission, in its order, went on to dismiss the claims citing provisions of the Competition Act, 2002.
Why Is CCI Miffed With Facebook & How It Found Its Response 'Egregious'?
The Commission was not amused by Facebook’s initial lack of response to its queries. Later, when the social media giant did reply, it came across as insincere, as per the observations cited in the order.
On 19 January, CCI sought responses from WhatsApp and Facebook by 3 February. While WhatsApp responded, Facebook neither responded to the queries raised by the Commission nor moved any application seeking extension of time to comply with the requisitions.
After a warning, Facebook eventually did respond, but stated it should not be made a party to the proceedings.
“While Facebook is the parent company of WhatsApp, the two are separate and distinct legal entities. It is WhatsApp (not Facebook) that offers and operates WhatsApp’s instant messaging service that is the subject of the Hon’ble Commission’s order,” the company submitted.
In a strongly worded response to Facebook’s plea, the Commission stated, “It is surprising that Facebook, instead of providing its response thereon, as sought by the Commission, is trying to evade its comments.”
Describing Facebook as a “direct and immediate beneficiary of the new updates”, the order stated “it is egregious that Facebook is feigning ignorance about the potential impact of the updates altogether and avoiding from providing its perspective thereon”.
Rejecting Facebook’s request for its name to be removed from the probe, the order stated that Facebook was very much a party in the case.
(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)