India asks WhatsApp to withdraw privacy policy changes

The Indian government has asked WhatsApp to withdraw the recent changes in the privacy policy of the messaging app, saying unilateral changes are unfair and unacceptable.

In a strongly worded letter to WhatsApp CEO Will Cathcart, the ministry of electronics and information technology said India is home to the largest user base of WhatsApp globally and is one the biggest markets for its services.

The proposed changes to the WhatsApp Terms of Service and Privacy Policy, without giving users an option to opt-out, "raise grave concerns regarding the implications for the choice and autonomy of Indian citizens," it wrote.

The ministry asked WhatsApp to withdraw the proposed changes and reconsider its approach to information privacy, freedom of choice and data security.

WhatsApp had on January 16 delayed the introduction of the new privacy policy after user backlash over sharing of user data and information with the parent company, Facebook Inc.

Stating that Indians should be properly respected, the ministry said, "any unilateral changes to the WhatsApp Terms of Service and Privacy would not be fair and acceptable."

With over 400 million users in India, the changes will have a disproportionate impact on the country's citizens, it said.

It asked WhatsApp to provide details of the services provided by it in India, categories of data collected and permissions and consents sought.

Also, WhatsApp has been asked to explain if it conducts profiling of Indian users on the basis of their usage, as well as explain difference between the privacy policy in India and other countries.

WhatsApp has also been asked to provide policy on data and information security, privacy and encryption.

It has also been asked to detail data sharing with other apps and if it captures information about other apps running on the mobile phones of the user.

Besides, complete technical architecture and server hosting data of Indian users have been asked to be furnished along with details of access to a third party.

The changes "enable WhatsApp, and other Facebook companies, to make invasive and precise inferences about users which may not be reasonably foreseen or expected by users in the ordinary course of assessing these services, the ministry said.

The updated terms would enable WhatsApp to collect "highly invasive and granular metadata" such as time, frequency and duration of interactions, group names, payments and transaction data, online status, location indicators as well as any messages shared by users with business accounts.

"The collection and onward sharing with Facebook companies, of sensitive personal data of individuals portends an ecosystem where any meaningful distinction between companies and WhatsApp will cease to exist," it said.

"This approach has the potential to infringe on core values of data privacy, user choice and autonomy of Indian users," it said.

WhatsApp had earlier this month begun asking its 2 billion users worldwide to accept an update of its privacy policy if they want to keep using the popular messaging app.

The new terms caused an outcry among technology experts, privacy advocates and users and triggered a wave of defections to rival services such as Signal.

In the updated policy, it got a right to share data it collected from WhatsApp users with the broader Facebook network, which includes Instagram, regardless of owning any accounts or profiles there.

Some businesses, as per the new policy, were to use Facebook-owned servers to store messages.

This triggered an outcry regardless of WhatsApp's assertion that all private messages between friends and family members remain end-to-end encrypted.

Stating that the changes proposed create systemic vulnerability, the ministry said the government expects WhatsApp "to take all information security safeguards as per law".

It went on to state that the Personal Data Protection Bill is being discussed by a joint committee of the Parliament and making "a momentous change for its Indian users at this time puts the cart before the horse."

Also, Indian users are being subjected to differential treatment when compared to their European counterparts where the changes do not apply.

"By not providing Indian users with the ability to opt-out of this data sharing with other Facebook companies, WhatsApp is treating users with an 'all-or-nothing' approach," the ministry said