Personal Data Protection Bill: New WhatsApp Privacy policy case is reminder that India needs to enact the law

Until the Personal Data Protection (PDP) law is introduced, WhatsApp will not make any changes to its new privacy policy.

WhatsApp has refused to withdraw its new privacy policy that was implemented on May 15. The Indian government previously asked WhatsApp to roll back its controversial policy or face action under Indian law. Facebook’s instant messaging app has found a middle ground solution for the time being and said it will not limit the app’s functionality for those who do not accept the new policy.

WhatsApp initially stated that it would delete the accounts of users not accepting the new privacy policy. After facing severe backlash, the company then made changes and said it would limit the functionality of the app. Following various developments, the Indian government asked WhatsApp to withdraw or revise the new privacy policy by March 25 and warned action against the firm stating it has “various options” available to it under Indian law.

The messaging app, which has over 400 million users in India, refused to do so until the Personal Data Protection (PDP) law comes into effect.

The PDP bill was drafted by the Srikrishna Committee in 2018. The bill is influenced by the EU’s General Data Protection Regulation (GDPR) and was drafted in response to the Supreme Court's mandate to the Indian government recognising privacy as a fundamental right.

The GDPR does not permit WhatsApp to share its data with Facebook or any other third party company. Similarly, when converted into a law, PDP would grant extensive data protection rights to Indian citizens while imposing limitations on the collection and processing of personal and sensitive data.

In WhatsApp’s case, the company is defending itself that the Indian government is yet to introduce the PDP Law. Until the law is introduced, WhatsApp will not make any changes to its new privacy policy. It will, however, not limit the functionality of how WhatsApp works in the coming weeks.

“We hope this approach reinforces the choice that all users have whether or not they want to interact with a business. We will maintain this approach until at least the forthcoming PDP law comes into effect,” the statement said.