SC plea to direct WhatsApp to comply with new data law, stop sharing Indian users’ data with other Meta entities

The new application has also asked the SC to direct WhatsApp to appoint a data protection officer as prescribed by the DPDP Act

A plea in the Supreme Court in an ongoing case against WhatsApp’s privacy policy has sought that the apex court should direct the Meta-owned messaging platform to immediately comply with the Digital Personal Data Protection Act (DPDPA) and allow users the option to delete their data stored by the platform before the law came into force.

The application filed in the Karmanya Singh Sareen versus Union of India and others case, which has been going on since 2016, has asked the SC to direct WhatsApp to stop sharing any data with other Meta group entities before taking specific consent from the user.

Moneycontrol has reviewed a copy of the application filed by the petitioner dated October 13. We have reached out to Meta for comments and the story will be updated if they respond.

WhatsApp, which is estimated to have more than 500 million users in India, had faced an uproar on social media after it asked users to consent to a privacy policy update in 2021 in order to be able to continue using the app.

After legal intervention, WhatsApp had said that it would pause the implementation of the privacy policy update until the Indian government comes up with a data protection law — which was enacted in August. However, the government has said that it seeks to have a graded compliance timeline for bringing the law into force within the next six to 12 months.

“It is respectfully submitted that when faced with a similar situation in the European region, where the General Data Protection Regulation i.e. GDPR had been enacted, but had not come into force, WhatsApp had submitted an undertaking to the authorities in Europe that till the GDPR comes into force, they shall not transfer any WhatsApp User data to any other Facebook company on a controller-to-controller basis for any purpose…,” says the application in SC.

Meanwhile, the petitioner has alleged that WhatsApp privacy policy is in contravention of newly enacted Digital Personal Data Protection Act in the way Meta-owned platform collects, processes, stores and shares data with other group entities.

The new application in the ongoing case has also asked the SC to direct WhatsApp to appoint a data protection officer as prescribed by the law.

Under the new data protection law, any entity like a social media platform, or a government body, can only process personal data after the person concerned has given her consent. The reason for processing a person’s data has to be within law.

Accompanied with consent, users will also receive a “notice” from platforms, in English or in any of the major languages of the country. This notice will state the exact personal data of the user that is going to be processed, the purpose, process of grievance redressal, and so on.

On the other hand, public or private entities, in specific cases like in the event of a natural disaster or a national security issue, can also process personal data without consent.