2016 (9) TMI 1674 - HC - Indian Laws

WhatsApp must delete pre-2016 user data and cannot share existing data with Facebook pending privacy rights decision

Delhi HC directed WhatsApp to protect user privacy by ordering that users deleting accounts before 25.09.2016 must have their data completely removed from ... Seeking prohibition on respondents No. 2 to 4 from sharing, in any manner whatsoever, details and data of every kind of the subscribers / users of WhatsApp with any entity including Facebook or its family of companies - Protection and safety of privacy of WhatsApp users - HELD THAT:- Having regard to the complete security and protection of privacy provided by the Respondent No. 2 initially while launching 'WhatsApp' and keeping in view that the issue relating to the existence of an individual's right of privacy as a distinct basis of a cause of action is yet to be decided by a larger Bench of the Supreme Court in K.S. Puttaswamy [2015 (8) TMI 526 - SUPREME COURT] it is considered appropriate to issue the following directions to protect the interest of the users of 'WhatsApp': i) If the users opt for completely deleting 'WhatsApp' account before 25.09.2016, the information/data/details of such users should be deleted completely from 'WhatsApp' servers and the same shall not be shared with the 'Facebook' or any one of its group companies. ii) So far as the users who opt to remain in 'WhatsApp' are concerned, the existing information/data/details of such users upto 25.09.2016 shall not be shared with 'Facebook' or any one of its group companies. iii) The respondent Nos. 1 and 5 shall consider the issues regarding the functioning of the Internet Messaging Applications like 'WhatsApp' and take an appropriate decision at the earliest as to whether it is feasible to bring the same under the statutory regulatory framework. Petition disposed off. Issues Involved:1. Sharing of user data by WhatsApp with Facebook.2. Protection and safety of privacy of WhatsApp users.3. Regulation of internet messaging services under statutory framework.4. Consent mechanism for WhatsApp's new privacy policy.5. Fundamental right to privacy under Article 21 of the Constitution of India.Detailed Analysis:1. Sharing of User Data by WhatsApp with Facebook:The petitioners, users of WhatsApp, filed a Public Interest Litigation (PIL) to prohibit WhatsApp from sharing user data with Facebook and its group companies. They argued that WhatsApp's proposed change in privacy policy, which allows sharing user account information with Facebook, infringes on the fundamental rights of users. The court noted that WhatsApp's initial privacy policy guaranteed complete protection of user data, but this changed after Facebook acquired WhatsApp in 2014. The court acknowledged that users voluntarily opted for WhatsApp's services, agreeing to its terms of service, which included potential changes in privacy policy.2. Protection and Safety of Privacy of WhatsApp Users:The petitioners contended that the change in privacy policy without adequately informing users was unfair and violated their right to privacy under Article 21 of the Constitution. They claimed that the manner of obtaining user consent was deceptive, as many users could not comprehend the implications of the new terms. The court, however, emphasized that users have the option to delete their accounts if they do not agree with the new policy, which would ensure their data is deleted from WhatsApp's servers.3. Regulation of Internet Messaging Services Under Statutory Framework:The court noted that the Union of India and the Telecom Regulatory Authority of India (TRAI) were also respondents in the case. The court highlighted that while TRAI regulates Internet Service Providers, internet messaging applications like WhatsApp are not yet under statutory regulatory framework. The court referred to ongoing consultations by TRAI on regulatory frameworks for Over-The-Top (OTT) services, indicating that steps towards regulation were in progress.4. Consent Mechanism for WhatsApp's New Privacy Policy:The petitioners suggested that WhatsApp should provide a clear 'Don't Share' option for users who do not want their data shared with Facebook. They also argued that past user information should not be shared without explicit consent. The court noted WhatsApp's affidavit, which stated that users could opt out of data sharing within 30 days of accepting the new terms. The court directed that users who delete their accounts before the specified date should have their data completely removed from WhatsApp's servers.5. Fundamental Right to Privacy Under Article 21 of the Constitution of India:The court acknowledged the petitioners' argument that the new privacy policy infringed on the right to privacy. However, it pointed out that the legal position on the fundamental right to privacy was yet to be authoritatively decided, referring to the pending case of K.S. Puttaswamy v. Union of India. The court concluded that since WhatsApp's terms of service were not based on any statutory provisions, the issue was not amenable to writ jurisdiction under Article 226 of the Constitution.Conclusion:The court disposed of the writ petition with the following directions:1. Users who delete their WhatsApp accounts before 25.09.2016 will have their data completely deleted from WhatsApp's servers and not shared with Facebook.2. For users who remain on WhatsApp, their existing data up to 25.09.2016 will not be shared with Facebook.3. The Union of India and TRAI should consider regulating internet messaging applications like WhatsApp under a statutory framework.The court emphasized the voluntary nature of users' agreement to WhatsApp's terms and the option to delete accounts if they disagreed with the new privacy policy.