Privacy policy update by the WhatsApp recently led to widespread protest from the user forcing company to put the update on hold. If India had made Personal Protection Bill into the law, the privacy policy update would have been illegal. The article deals with this issue.

About WhatsApp

• WhatsApp’s unique blend of text, audio, and voice messaging and calling platform.
• In November 2014, WhatsApp adopted the Signal protocol for end-to-end encryption after its acquisition by Facebook.
• WhatsApp has two billion users worldwide, of which 400 million are in India, the largest in any country.

What the privacy policy update is about

• The updated policy seeks consent from users to allow the platform to share their data with Facebook and its companies,
• It means that WhatsApp would share transaction data, mobile device information, IP addresses, and other metadata on how users interact with businesses on WhatsApp.
• Such sharing would be done with the user being notified before the start of a chat if the business uses Facebook to store and analyze data and the user would have the option of blocking the business.
• The update would defy the principle of purpose limitation that has been the yardstick of addressing privacy concerns at a global level.

What is the principle of purpose limitation

• The Indian government has also sent a strong note to WhatsApp, seeking the company’s response to 14 queries.
• This note has sent a clear message to WhatsApp to not subject Indian users to greater information security risks and vulnerabilities with the consolidation of data from WhatsApp and Facebook.
• In the note, the government referred to the principle of purpose limitation provisions in the Personal Data Protection Bill (PDPB) currently being discussed by a joint select committee.
• Had the bill been passed by now, WhatsApp’s move would have been illegal.
• Provisions in the bill required that every data intermediary has to take explicit permission from the user whose data would be harvested.
• Even the method of data classification into sensitive personal data and critical data has been defined and their processing possibilities mentioned in the bill.

Way forward

• The government should make the Personal Data Protection Bill into law so that such restrictive practices can never be introduced in the first place.
• It is due to such law, WhatsApp did make an exception for its users in the European Union.
• The Competition Commission of India should take note that this is a classic case of an organization using its near-monopolistic power to push through something that is not in the consumer interest.

Consider the question “What is the principle of purpose limitation in the Personal Data Protection Bill? How it can help user protect its privacy?”

Conclusion

As Digital India expands and brings in more users from the current base of 70 crores, and more take to social media for communications and business, they must be ensured a safer digital space, given that most wouldn’t be aware of the reach of the data being generated.

Get an IAS/IPS ranker as your 1: 1 personal mentor for UPSC 2024

Attend Now