'WhatsApp is storing our data on servers which are physically located in another country.'
'We might be having good relations with a particular country at this very moment, where WhatsApp's data servers are located, and in which our data is stored, but tomorrow we might be having bad relations with them, then what is going to happen to that data.'
When WhatsApp, earlier this month, asked its users to accept its updated privacy policy and set a stiff deadline for doing so and warned its users that they would not be able to avail this service if they don't accept its updated privacy policy by February 8 (now postponed till May 15), it raised the ire of those fighting for the protection of personal data and defenders of right to privacy.
Advocate Chaitanya Rohilla, who felt that WhatsApp's latest privacy policy update violates Indian citizens' fundamental rights, filed a writ petition in the Delhi high court to take on WhatsApp and prevent it from getting a carte blanche over users' data this privacy update would give the popular social media app.
Advocate Rohilla spoke with Prasanna D Zore/Rediff.com about why he feels it violates our right to privacy. He believes the government should intervene and ensure that the personal and private data of Indian citizens is adequately protected and secure.
Why did you file a writ petition in the Delhi high court against WhatsApp's updated privacy policy?
Being a user (of WhatsApp) I got a notification from WhatsApp that I'm supposed to accept some terms and conditions.
They told me that they have updated their privacy policy and that it was obligatory upon my part to accept it.
If I didn't accept it, then they would be cancelling my subscription, my service and also terminate my account.
That particular thing made me uncomfortable and so I read the policy in detail. Upon reading the policy in detail I found that this policy is absolutely in violation of my right to privacy.
They were sharing more data about users than I thought they were actually doing.
How does WhatsApp's updated privacy policy violate its users' right to privacy?
Every citizen of this country has a right to say to anyone that this (sharing of personal private data without permission) is none of your business. Yes, I would want to keep things (one's private data) to myself.
In a nutshell, this is what right to privacy is all about. But what WhatsApp is doing is it is basically sending everything (all the data collected from users), whatever I'm sharing with other people.
If I'm talking to any business entity (say an online insurance app) on WhatsApp, then other business entities in the same industry would be able to see all those messages and that data would be visible to them.
It is all clearly mentioned in the policy. That means whatever I am sharing with my friends or family about anything it would be stored on their data servers and it would be shared with Facebook's partners.
Hasn't WhatsApp clarified that the sharing of such data will be only for business entities and that it will not share personal chat data?
This is not just about (sharing) business (related data). What WhatsApp is trying to do is convert Facebook, Instagram and WhatsApp into an integrated social media platform so that they will be able to target their audience based on their behavioural traits.
They will be collecting data and then they will be studying the behaviour of users about certain things, upon visiting certain Web sites (a business entity) and then they would be sending us targeted advertising in a particular way.
But WhatsApp has issued a clarification (external link) that this updated policy will not affect data in your personal chats...
WhatsAppp keeps saying that they won't be sharing your personal chat with Facebook, but it is not just about personal chats. It is also about whatever I'm sharing.
Let's say I'm visiting a Web site and I like the content of this Web site. Let's say I'm doing some online shopping, and like the content of it, or I like the product that they are offering and I share it with a friend on WhatsApp.
So WhatsApp will know whatever I have shared and eventually then send that data to Facebook. And then Facebook will target me and start showing me similar products related to my online search.
In this context, it is also a big-time threat to our national security.
How is it a threat to national security?
WhatsApp is storing our data on servers which are physically located in some other countries. Their updated policy specifically mentions that all such data will be stored and processed in the United States of America.
Such data and its use will be subject to the privacy laws of that particular country. There is no need to say this, but the privacy laws of that country may be different from what we have in India.
We might be having good relations with a particular country at this very moment, where WhatsApp's data servers are located, and in which our data is stored, but tomorrow we might be having bad relations with them, then what is going to happen to that data.
In such a scenario, who will be guaranteeing the safety and security and privacy of our data?
But how is it a threat to our national security?
Let's say, for example, the USA government asked Facebook or WhatsApp to share plain data or behavioural data that they (Facebook and WhatsApp) have studied or they have collected from Indians over a period of time, and we have no idea to what extent and what all they have collected and how they have spliced and studied it, and how the US government will use this data.
Now, there is a very interesting thing that exposes WhatsApp.
Given the strict European GDPR (General Data Protection Regulation) laws, WhatsApp has different set of privacy updates in Europe and for countries like India, where we still don't have comprehensive privacy laws that protects our data.
WhatsApp knows that people in India are vulnerable because there is no specific (privacy) law that protects and secures and guarantees the privacy of our data (and so they have different privacy updates for Indians).
This choosy behaviour cannot be allowed. This is what I found problematic and the Indian government must not allow it.
What is your plea before the Delhi high court?
In my prayer before the Delhi high court, I have requested the ministry of and electronics and information technology (MEITY) through the Union of India to frame guidelines that will restrict and prohibit WhatsApp from sharing this data with its parent company (Facebook) or any third party that does business with Facebook.
If you are storing my data that I provide to you then you cannot share it with Facebook to help them in their business by sharing this data with third parties.
I am giving you my data for a particular intended purpose that helps me avail your services. You cannot share such data with third parties and benefit from it by violating my right to privacy.
Till the Union of India frames such guidelines, I have also prayed that the compulsion that WhatsApp is making it mandatory for its users in India to accept their updated privacy policy be stayed. They should not pressurise Indians with their 'accept it or leave it' policy on sharing of users' data.
How does this updated privacy policy violate an individual's right to privacy?
In 2017, the Supreme Court had declared that the Part III of our Constitution (contained in Articles 12 to 15 dealing with fundamental rights) recognises our right to privacy.
It also said that it is every individual's right to share whatever they want to share and they may not be subject to any compulsion.
The Data Protection Bill, 2019, is still pending in Parliament, which needs to be enacted; Section 5 of this Data Protection Bill also talks about data shared for intended purposes cannot be used for other purposes.
You are not supposed to share it for other miscellaneous purposes for which it was never given to you.
This is also Parliament's intent to protect the data of Indians. I am sure that the government will also question WhatsApp about its privacy policy.
WhatsApp's updated privacy policy most vehemently violates Indian citizens' right to privacy and my plea (before the Delhi high court) is an effort to protect privacy and data of every Indian.
What harm can accepting WhatsApp's updated privacy policy bring to its users in India?
Let's say, today you accept it. Then from today onwards whatever things you will share with your friends and family on WhatsApp, it will be shared with Facebook and other Web sites.
Hasn't WhatsApp denied these charges and clarified that its updated privacy policy will not affect privacy of users' messages in India with their friends and family?
Let me give you specific reference to that privacy policy, where they have said that your data will be stored and shared with third parties and Facebook side body and Facebook. And this is not just about business.
Also (as per the updated privacy policy of WhatsApp), even if I decide that I don't want to share my location with WhatsApp, and even if I turn it off, then after accepting this updated privacy policy, my location would still be shared with WhatsApp. This will happen even if I turn off the access to my location on my phone.
This is more like a 360-degree surveillance that WhatsApp and Facebook will be engaging in and I don't want that.
If I'm choosing not to share my location with any particular application, that means I'm not comfortable with it (sharing my location). So, arbitrarily they are going to share my location or have access to wherever I am.
This is not at all acceptable. This is my right to privacy (which this privacy update violates).
Also, the behavioural data (in possession of and studied by Facebook and WhatsApp) affects the election process.
In 2016, this is what happened in the USA. Facebook was penalised for sharing this behavioural data with a particular candidate who was contesting the 2016 presidential election.
Is WhatsApp lying to its users because according to you they will be sharing data from personal chats as well with Facebook and third parties, and which is strongly refuted by WhatsApp?
See, there is no clarity about it. This is my grievance with WhatsApp; we don't know till what extent or what all data they would be sharing because their privacy policy is very ambiguous.
But you said earlier that if I'm sharing something I liked on an online shopping portal with my friend then this data too will be shared by WhatsApp with Facebook and third parties?
This is one of the examples; this is how they work with third-party services. It says if you interact with a third-party service or another Facebook company product linked through their services then my IP address and my location will also be shared.
