The update would allow WhatsApp to share certain user data with its parent Meta Platforms Inc. (formerly Facebook Inc.), a move that sparked global outrage and stirred regulators in multiple countries.
According to the people cited above, the director general of investigation (DG) attached to CCI has concluded that WhatsApp and its parent, Meta Platforms Inc. (formerly Facebook Inc.) contravened the provisions of competition law that prohibit abuse of dominance.
The DG’s investigation report has been shared with the CCI, one of the persons cited above said on condition of anonymity. Based on the report, the CCI has prepared a draft order that will be finalised soon and issued to the two companies, imposing penalty for the alleged violations, the person added.
As per last year’s amendments to the Competition Act, penalty for violations can go up to 10% of the global sales or income of the entities concerned.
Also read | Chat-based e-commerce key priority for WhatsApp: Meta India head
To be sure, regulatory action has been taken against the policy update in European countries. In December 2021, Germany’s data protection commissioner temporarily banned Facebook from processing German users’ WhatsApp data. Ireland’s Data Protection Commission, too, had imposed a fine on WhatsApp in 2021 for a previous privacy policy update users were asked to accept, before the EU rolled out its General Data Protection Regulation (GDPR) in 2018. GDPR is a EU law protecting the privacy citizens and their data.
However, India is the most important region for the company, considering that WhatsApp has close to 536 million users in the country, the highest in the world, according to Demandsage, a data solution provider. Second-placed Brazil is way behind with only 148 million users. Consequently, the outcome of the Indian watchdog’s investigation has been keenly awaited globally.
Queries emailed to CCI on 10 October remained unanswered at the time of publishing.
An emailed response from WhatsApp’s spokesperson said, “CCI proceedings are sub-judice and we can’t comment on it,” adding that the 2021 privacy policy update did not change the privacy of people’s personal messages.
“WhatsApp gave users the choice of accepting the Privacy Policy Update, and users who chose not to accept the update continue to use WhatsApp to communicate with friends and family without having their accounts deleted or losing functionality,” the spokesperson wrote.
The update that set off alarm bells
The case centres around WhatsApp’s 2021 privacy policy update, which spoke about how businesses could use Facebook-hosted services to store and manage their WhatsApp chats with customers.
CCI has concluded that WhatsApp’s sharing of users’ business transaction information with Meta gave the group entities unfair advantage over competing platforms, said the first person.
Business transaction information of users help social media platforms to profile customers and target advertisements and marketing efforts.
WhatsApp subsequently offered clarifications in 2021 that the policy update did not affect privacy of customer messages with friends or family in any way, and that the changes were only related to optional business features on WhatsApp.
Also read | Mint Explainer: How CCI proposes to implement a new regime for merger approvals?
Advertisements on Facebook and Instagram enable users to message the advertised business through WhatsApp. Meta may use the way one interacts with these advertisements to personalize the advertisements one sees on Facebook or Instagram, the explanation said, adding that customer accounts that did not accept the privacy policy update will not get deleted.
However, according to the regulator, there is still sufficient ground for regulatory action.
The second person quoted above said a significant majority of the then existing WhatsApp users accepted the 2021 privacy policy update in the face of its initial mandatory nature. The subsequent clarifications came after the CCI swung into action. Besides, accepting the privacy policy is mandatory for new users, said the person, who also spoke on condition of not being named.
How regulations are changing
The case assumes significance as customer data, including of online purchases, has become a valuable resource for digital economy firms and an area where competition concerns could arise. As the digital economy grows fast and internet penetration and smart phone usage expands, the regulatory regime is also undergoing a major shift.
While the Digital Personal Data Protection Act or DPDP Act has been legislated and sections are set to be notified separately, a Digital Competition Bill and discussions about a bargaining code for news publishers and news aggregators like internet search engines are underway, seeking to address different aspects of the digital economy.
WhatsApp offered clarifications in 2021 that the policy update did not affect privacy of customer messages with friends or family, and that the changes were only related to optional business features on WhatsApp.
While the DPDP Act looks into consent and privacy-related aspects, the other two are meant to address competition-related aspects in the digital economy.
“The legislative landscape has now changed with the introduction of Digital Personal Data Protection Act of 2023,” said Navneet Sharma, director general of CUTS Institute for Regulation & Competition (CIRC), an independent, not-for-profit research body.
Also read | Regulatory force: Tech titans bow to CCI whip
Sharma explained that the consent mechanism for accessing user data is now statutorily regulated, with data privacy coming under the DPDP Act. The kind of data collected, its purpose, and how it is processed, stored and shared comes under this law, and entities collecting data have to give consumers the option to withdraw consent.
“However, competition law and CCI will come into the picture if data poses an entry barrier or impacts a player’s ability to conduct business,” Sharma said. “The past cases, which are essentially ex-post cases where an alleged competition law violation has taken place, will go through their life cycle of investigation and adjudication by the CCI.”
The rules under the DPDP Act have to be notified and the Data Protection Board of India has to be set up, which is expected, said Sharma.
CCI’s concerns around cross-linking and integration of user data across multiple digital economy platforms can further strengthen the advantages and reinforce the market power of dominant firms and could create entry barriers for other players, CCI had said when it ordered the investigation.
Leave a Reply