WhatsApp and Privacy: Whither data protection laws?

Source: Reuters

Note to readers: Hello world is a program developers run to check if a newly installed programming language is working alright. Startups and tech companies are continuously launching new software to run the real world. This column will attempt to be the "Hello World" for the real world.

The privacy debate is raging again in India. A few days ago, instant messaging company WhatsApp asked users to consent to its updated privacy policy. It contained details of how the company processes user data; how businesses can use Facebook hosted services to store and manage WhatsApp chats with business accounts; and how it partners with Facebook to offer integrations across Facebook products.

Users had to consent to the updated privacy policy by February 8. But the update drew heavy criticism from users. The Indian government jumped into the fray. The ministry of information and technology asked WhatsApp to withdraw changes to the policy in a letter and said that it is concerned for the “choice and autonomy of Indian citizens,” and the take it or leave it approach is not ideal.

IT minister Ravi Shankar Prasad added that businesses are free to do business in the country as long as it complies with the laws of the land. WhatsApp said that it will extend the deadline to accept the updated privacy policy to May 15 and it also ran ad campaigns saying that it does not read your personal communications.

Where is the bill?

What is incredulous in this episode is that the ‘laws of the land’ — the personal data protection bill — is still in the works. And it has been in the works for many years even as several large-scale services with implications on users’ privacy were rolled out. But before we get to that, let’s back up a little.

There are two types of companies on the internet. Those that rely on advertising for revenue, such as Google and Facebook, and those that don’t. The ad-dependent companies, if one was to take a strict view like acclaimed scholar Shoshana Zuboff, are part of a new economic order called surveillance capitalism. She defines surveillance capitalism as a practice that ‘claims human experience as free raw material for hidden commercial practices of extraction, prediction, and sales.’

Companies that make money from advertisements online rely on knowing more and more about the users—the raw material — and matching it against advertisements. This, of course, is not appreciated by proponents of privacy. In the European Union, a major policy effort came to fruition when the General Data Protection Regulation (GDPR) was implemented in May 2018.

Online advertising has been deeply affected by the GDPR, which places several restrictions on companies tracking users for advertising. The law not only applies to companies in the EU but also to companies outside the EU that serve customers in the region online.

It has already been used to penalise Internet companies that rely on advertising as a source of revenue. In January 2019, France fined Google €50 million, the biggest GDPR fine to date, alleging that Google was not transparent enough about collecting data; and that it was in violation of several articles such as lawfulness of processing data and principles relating to the processing of data.

Long wait in India

Now India has been working on its own version of personal data protection laws. The personal data protection bill, 2019 was tabled in the Lok Sabha in December 2019. It was then referred to a joint parliamentary committee of 20 members.

The committee, which sought an extension to submit its report during the winter session of the parliament, usually held in the months of November - December. But alas, the winter session of the parliament itself was canceled due to the pandemic. The parliament will hold its next session later this month. But that’s going to be focused on the budget. In the absence of the law, how then, does the government plan to ensure the data privacy of its citizens?