Meta's proposed Twitter competitor: A look into the possible privacy risk

Meta had cut about 11,000 jobs during the first round of layoffs.

Lawyers and digital rights activists are divided over whether Meta's plans to use data of Instagram users regardless of their participation for the new proposed Twitter-like platform poses a privacy risk.

While lawyers are exercising caution in regards to their opinion on the subject, mostly stating that the cross-platform data transfer will likely be put down in a new privacy policy, digital rights activists are slamming the move saying that the move raises privacy concerns, especially violation of user's consent.

A few days back Moneycontrol reported how Meta, the parent firm of Facebook and Instagram, is hashing out a plan to build a standalone text-based content app that will support ActivityPub, the decentralised social networking protocol powering Twitter rival Mastodon and other federated apps.

The app, code named as P92, will be Instagram-branded and will allow users to register/login to the app through their Instagram credentials. The P92 plans to use Instagram data, regardless of user participation for purposes of analytics, product improvement and ranking on the new platform.

"This potentially raises concerns from privacy and competition perspectives. On privacy, any cross-app data sharing means that Meta, and Meta-owned platforms will continue to gather more information about users," Prateek Waghre, policy director at Internet Freedom Foundation said.

"The proposal to use "Instagram data of all Instagram users regardless of their participation in P92 as freely as possible..." also raises concerns about lack of purpose limitation and violation of user's consent - who may not have envisioned their Instagram usage being used for another app - irrespective of what Meta's policies may say about using such information as 'product feedback'," Waghre added.

Radhika Jhalani, volunteer legal counsel at Software Freedom Law Centre said, "Data sharing in absence of a data protection law is always a risk for users. A significant amount of data sharing happens on basis of informed consent in India, unfortunately informed consent in a country with literacy rates like ours is not fruitful."

The Indian government has begun the process of bringing in India's first data protection law, the Digital Personal Data Protection Bill. Under the law, it brings in provisions that would mandate platforms such as Meta to give an itemicised list of data that they would likely process of users; and at the same time have provisions for 'deemed consent' where consent is deemed to be given in situations where a user voluntarily provides the data and where "it is reasonably expected" that they would provide such personal data.

While responding to a query by Moneycontrol, Supratim Chakraborty, partner at Khaitan & Co said, "It is expected that the privacy policy of Meta would cover all the necessary requirements for cross-platform data transfer irrespective of whether people are using this new platform."

"In the upcoming Digital Personal Data Protection Bill, the bill mandates that the platforms have to give itemicised notice of the data that they are going to process. However, at the same time, one would expect that the provisions of 'deemed consent' as envisaged in the DPDP Bill, are not taken advantage of by platforms," Chakraborty added.

Rajiv Sharma, partner at Singhania & Co LLP, believes that that data which will be migrating to P92 platform is limited to the profile photo and bio of an individual. Sharma pointed out that under the privacy policy of Instagram, the profile photo and bio of an individual is public to everyone -- even if someone does not have a profile.

Sharma pointed out that the Information Technology (Reasonable Security and Procedures and Sensitive Personal Data or  Information) Rules, 2011 (SPDI Rules) allow such data to be shared.

"SPDI Rules clearly state that any information that is freely available or accessible in public domain or furnished under the Right to Information Act, 2005 or any other law for the time being in force shall not be regarded as sensitive personal data or information. Therefore, use of a photo of an individual in an authorized manner is not against the law," Sharma explained.

Lawyers who spoke to Moneycontrol explained that the cross-platform data transfer will be operating under the existing privacy policy of Meta, which governs other Meta-owned platforms.

"Meta will also have their own supplemental privacy policy that would chalk out the details of cross-app data sharing of which the users will be duly notified and shall have an option to agree to the notice/terms at the  time of signing up with P92," Sharma opined.

Anushkaa Arora, Principal & Founder, ABA Law Office, said, "Prima facie it seems that this app will have a developed version of terms and service along with privacy policy which will be in line to existing privacy policy and terms of use of Facebook and Instagram which are well defined in themselves, curtailing any prospective risks associated with regards to privacy breaches."

"Be that as it may, as per my experience in IP/IT for the last decade, I am of the firm view, that possible privacy risks or other risks associated with App development are majorly understood much better once the App is set in motion of use," Arora added.