Competition Commission of India (CCI): The coram comprising of Ashok Kumar Gupta (Chairperson) and Sangeeta Verma and Bhagwant Singh Bishnoi (Members) while addressing a very interesting matter with respect to WhatsApp’s updated policy, expressed that:
“…in a data driven ecosystem, the competition law needs to examine whether the excessive data collection and the extent to which such collected data is subsequently put to use or otherwise shared, have anti-competitive implications, which require anti-trust scrutiny.”
As per several media reports, WhatsApp updated its privacy policy and terms of service for WhatsApp users.
It was reported that the new policy made it mandatory for the users to accept the terms and conditions in order to retain their WhatsApp account information and provides as to how it will share personalized user information with Facebook and its subsidiaries.
In the present matter, both Facebook and WhatsApp will together be referred to as ‘Opposite Parties’.
Commission on noting the impact of policy and terms for WhatsApp users decided to take suo motu cognizance of the matter.
WhatsApp submitted that its current Terms and Service and Privacy Policy, as well as the proposed update in the same fall within the purview of the information and technology law framework and these issues, are currently sub judice before various courts and other fora in India.
Further, it was added that the examination of the 2021 Update by Courts and the Government of India is not merely limited to data protection/ privacy laws but extends to assessing more broadly whether the 2021 Update is in conformity with principles of fairness, public policy and national security considerations.
WhatsApp relied on the Supreme Court decision in Competition Commission of India v. Bharti Airtel Limited, (2019) 2 SCC 521, and stated that the said decision emphasized the need to maintain comity between decisions of different authorities on the same issues and held that the Commission should only exercise jurisdiction after the proceedings before the sectoral regulator had concluded and attained finality.
Bench noted that WhatsApp failed to point out any proceedings on the subject matter which a sectoral regulator is seized of.
“…Commission is examining the policy update from the perspective of competition lens in ascertaining as to whether such policy updates have any competition concerns which are in violation of the provisions of Section 4 of the Act.”
Further, the Commission added that, it is obligated to ‘prevent’ practices having adverse effect on competition.
Whether the Ops have violated provisions of Section 4 of the Act?
On what points has the Commission sought clarification?
- The primary aim of the 2021 Update is twofold: (i) to provide users with further transparency about how WhatsApp collects, uses and shares data; and (ii) to inform users about how optional business messaging features work when certain business messaging features become available to them.
- 2016 Update allowed existing users the option to opt-out of sharing their WhatsApp account information with Facebook Companies for ads and product experiences purposes. WhatsApp is continuing to honour the 2016 opt-out for anyone who had chosen it, and the most recent updates do not change that. If anyone who has previously opted out agrees to the 2021 Update, WhatsApp will acknowledge their agreement to the 2021 Update and also continue to honour the 2016 opt-out.
- Privacy of personal messaging is integral to the growth and vision of WhatsApp. This commitment to keeping WhatsApp a safe and protected place where people can connect privately has not changed. WhatsApp cannot see users’ personal conversations with friends and family because they are protected by end-to-end encryption.
- 2021 Update does not expand WhatsApp’s ability to share data with Facebook and does not impact the privacy of personal messages of WhatsApp users with their friends and family.
- The 2021 Update provides more specifics on how WhatsApp works with businesses that use Facebook or third parties to manage their communications with users on WhatsApp. Even for users who choose to interact with a business on WhatsApp, the implications of such data sharing are minimal.
WhatsApp submitted that the 2021 Update raised no concerns from a competition perspective and the said Update aimed to provide greater transparency, hence no investigation shall be initiated.
Commission took note of the recent developments wherein the competing apps, i.e. Signal and Telecom witnessed a surge in downloads after the policy announcement by WhatsApp. However, apparently, it did not result in any significant loss of users for WhatsApp.
Comparison with Previous Policy| No opt-out option?
As per the previous policy, existing users were provided with an option to choose not to have their WhatsApp account information shared with Facebook. However, it was evident from the latest policy statement on the WhatsApp website and the media reports that the said choice as was available under the previous policy is not available now.
“…consent to sharing and integration of user data with other Facebook Companies for a range of purposes including marketing and advertising, has been made a precondition for availing WhatsApp service.”
Moving ahead, Bench noted that the data collected by WhatsApp would be shared with Facebook Companies for various usages envisaged in the policy. The Commission also took note of the submission of WhatsApp that it would continue to honour the ‘opt-out’ option exercised by users during the 2016 Update; however, the 2021 Update do not create any carveout for such users who opted for not sharing their information with Facebook.
On considering the overarching terms and conditions of the new policy, the Commission prima facie opined that the ‘take-it-or-leave-it nature of privacy policy and terms of service of WhatsApp and the information sharing stipulations mentioned therein merit a detailed investigation in view of the market position and market power enjoyed by WhatsApp.
The conduct of WhatsApp/ Facebook under consideration merits detailed scrutiny.
Bench opined that the users are entitled to be informed about the extent, scope and precise purpose of sharing of such data by WhatsApp with other Facebook Companies.
“… opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services. “
Commission also observed that it is also not clear from the policy whether the historical data of users would also be shared with Facebook Companies and whether data would be shared in respect of those WhatsApp users also who are not present on other apps of Facebook i.e., Facebook, Instagram, etc.
There appeared to be no justifiable reason as to why users should not have any control or say over such cross-product processing of their data by way of voluntary consent, and not as a precondition for availing WhatsApp’s services.
No Voluntary Agreement
Users are required to accept the unilaterally dictated ‘take-it-or-leave-it’ terms by a dominant messaging platform in their entirety, including the data sharing provisions therein, if they wish to avail their service. Such “consent” cannot signify voluntary agreement to all the specific processing or use of personalised data, as provided in the present policy.
Unfair
On a careful and thoughtful consideration of the matter, the conduct of WhatsApp in sharing of users’ personalised data with other Facebook Companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie unfair to users.
Data Sharing with Facebook
The impugned conduct of data-sharing by WhatsApp with Facebook apparently amounts to degradation of non-price parameters of competition
The impugned data-sharing provision may have exclusionary effects also in the display advertising market which has the potential to undermine the competitive process and creates further barriers to market entry besides leveraging, in violation of the provisions of Section 4(2)(c) and (e) of the Act.
While stating that a thorough and detailed investigation is required in the matter, and DG to complete the same within a period of 60 days, held that WhatsApp has prima facie contravened the provisions of Section 4 of the Act through its exploitative and exclusionary conduct, as detailed in this order, in the garb of policy update.[Updated Terms of Service and Privacy Policy for WhatsApp Users, In Re., 2021 SCC OnLine CCI 19, decided on 24-03-2021]