WhatsApp must delete pre-2016 user data and cannot share existing data with Facebook pending privacy rights decision

Delhi HC directed WhatsApp to protect user privacy by ordering that users deleting accounts before 25.09.2016 must have their data completely removed from servers without sharing with Facebook. For continuing users, existing data up to 25.09.2016 cannot be shared with Facebook or its group companies. The court noted privacy rights remain undecided by SC in K.S. Puttaswamy case and directed authorities to consider bringing internet messaging applications under statutory regulatory framework. Petition disposed.

---

---

Issues Involved:
1. Sharing of user data by WhatsApp with Facebook.
2. Protection and safety of privacy of WhatsApp users.
3. Regulation of internet messaging services under statutory framework.
4. Consent mechanism for WhatsApp's new privacy policy.
5. Fundamental right to privacy under Article 21 of the Constitution of India.

Detailed Analysis:

1. Sharing of User Data by WhatsApp with Facebook:
The petitioners, users of WhatsApp, filed a Public Interest Litigation (PIL) to prohibit WhatsApp from sharing user data with Facebook and its group companies. They argued that WhatsApp's proposed change in privacy policy, which allows sharing user account information with Facebook, infringes on the fundamental rights of users. The court noted that WhatsApp's initial privacy policy guaranteed complete protection of user data, but this changed after Facebook acquired WhatsApp in 2014. The court acknowledged that users voluntarily opted for WhatsApp's services, agreeing to its terms of service, which included potential changes in privacy policy.

2. Protection and Safety of Privacy of WhatsApp Users:
The petitioners contended that the change in privacy policy without adequately informing users was unfair and violated their right to privacy under Article 21 of the Constitution. They claimed that the manner of obtaining user consent was deceptive, as many users could not comprehend the implications of the new terms. The court, however, emphasized that users have the option to delete their accounts if they do not agree with the new policy, which would ensure their data is deleted from WhatsApp's servers.

3. Regulation of Internet Messaging Services Under Statutory Framework:
The court noted that the Union of India and the Telecom Regulatory Authority of India (TRAI) were also respondents in the case. The court highlighted that while TRAI regulates Internet Service Providers, internet messaging applications like WhatsApp are not yet under statutory regulatory framework. The court referred to ongoing consultations by TRAI on regulatory frameworks for Over-The-Top (OTT) services, indicating that steps towards regulation were in progress.

4. Consent Mechanism for WhatsApp's New Privacy Policy:
The petitioners suggested that WhatsApp should provide a clear "Don't Share" option for users who do not want their data shared with Facebook. They also argued that past user information should not be shared without explicit consent. The court noted WhatsApp's affidavit, which stated that users could opt out of data sharing within 30 days of accepting the new terms. The court directed that users who delete their accounts before the specified date should have their data completely removed from WhatsApp's servers.

5. Fundamental Right to Privacy Under Article 21 of the Constitution of India:
The court acknowledged the petitioners' argument that the new privacy policy infringed on the right to privacy. However, it pointed out that the legal position on the fundamental right to privacy was yet to be authoritatively decided, referring to the pending case of K.S. Puttaswamy v. Union of India. The court concluded that since WhatsApp's terms of service were not based on any statutory provisions, the issue was not amenable to writ jurisdiction under Article 226 of the Constitution.

Conclusion:
The court disposed of the writ petition with the following directions:
1. Users who delete their WhatsApp accounts before 25.09.2016 will have their data completely deleted from WhatsApp's servers and not shared with Facebook.
2. For users who remain on WhatsApp, their existing data up to 25.09.2016 will not be shared with Facebook.
3. The Union of India and TRAI should consider regulating internet messaging applications like WhatsApp under a statutory framework.

The court emphasized the voluntary nature of users' agreement to WhatsApp's terms and the option to delete accounts if they disagreed with the new privacy policy.

---