New Delhi: In a significant development, the Competition Commission of India on Wednesday ordered a probe into the new privacy policy of WhatsApp, after making a prima facie observation that it was violative of the Competition Act 2000.
“..the Commission is of the considered opinion that WhatsApp has prima facie contravened the provisions of Section 4 of the Act through its exploitative and exclusionary conduct, in the garb of policy update”, said the order passed by the CCI.
The CCI observed that the privacy policy terms on sharing of personalised data with Facebook companies was “neither fully transparent nor based on specific, voluntary consent of users”.
“On a careful and thoughtful consideration of the matter, the conduct of WhatsApp in sharing of users’ personalised data with other Facebook Companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie unfair to users.
The purpose of such sharing appears to be beyond users’ reasonable and legitimate expectations regarding quality, security and other relevant aspects of the service for which they register on WhatsApp. One of the stated purposes of data sharing viz. targeted ad offerings on other Facebook products rather indicates the intended use being that of building user profiles through cross-linking of data collected across services. Such data concentration may itself raise competition concerns where it is perceived as a competitive advantage”, the 21-page order of the CCI said.
It made a prima facie observation that the policy was an abuse of dominant position resulting in violation of Section 4 of the Competition Act.
“The impugned conduct of data-sharing by WhatsApp with Facebook apparently amounts to degradation of non-price parameters of competition viz.quality which result in objective detriment to consumers, without any acceptable justification. Such conduct prima facie amounts to imposition of unfair terms and conditions upon the users of WhatsApp messaging app, in violation of the provisions of Section 4(2)(a)(i) of the Act”.
The anti-trust regulator termed the privacy policy terms “take-it-or-leave-it’ terms set by a dominant messaging platform, without providing much information to the users, and observed that the policy prima facie appeared to be “unfair and unreasonable”.
“..users are required to accept the unilaterally dictated ‘take-it-or-leave-it’ terms by a dominant messaging platform in their entirety, including the data sharing provisions therein, if they wish to avail their service. Such “consent”cannot signify voluntary agreement to all the specific processing or use of personalised data,as provided in the present policy. Users have not been provided with appropriate granular choice, neither upfront nor in the fine prints,to object to or opt-out of specific data sharing terms,which prima facie appear to be unfair and unreasonable for the WhatsApp users”.
The CCI bench comprising Ashok Kumar Gupta(Chairperson), Sangeeta Verma(Member) and Bhagwant Singh Bishnoi(Member) observed that “a thorough and detailed investigation is required to ascertain the full extent, scope and impact of data sharing through involuntary consent of users”.
Accordingly, the Commission directed the Director General (‘DG’) to cause an investigation to be made into the matter under the provisions of Section 26(1) of the Act. The Commission also directed the DG to complete the investigation and submit the investigation report within a period of 60days from the receipt of this order.
The Commission has clarified that the observations are preliminary in nature and will not amount to a final expression of opinion on the merits of the case. “The DG shall conduct the investigation without being swayed in any manner whatsoever by the observations made herein”, the order added as a caveat.
Notably, the order has been passed in a suo moto case taken by the Commission titled “In Re: Updated Terms of Service and Privacy Policy for WhatsApp Users”.
WhatsApp LLC and Facebook Inc were arrayed as opposite parties in the case.
The suo moto case was taken by the Commission on January 19, 2021, based on the reports about the new privacy policy update of the messenger platform.
It is also pertinent to note that the Union Ministry of Electronics and Information Technology has taken a stand against the new privacy policy of WhatsApp. In an affidavit filed in the Delhi High Court in response to a PIL challenging the policy, the Centre has urged the Court to restrain WhatsApp from implementing the new policy, pending the passage of the Personal Data Protection Bill.
Abuse of dominance
Section 4 of the Act proscribes abuse of dominance by an entity commanding dominant position in relevant market.
The CCI noted that WhatsApp is dominant in the relevant market for OTT messaging apps through smartphones in India, as was held in an earlier decision.The Commission further noted that the previous privacy policies of WhatsApp dated 25.08.2016 as well as 19.12.2019 provided users an option to choose not to have their WhatsApp account information shared with Facebook.
However, under the latest policy, this choice is no longer available to users.
In this regard, the CCI observed :
“This(removal of opt-out choice) implies that data of users, including that of those who are not users of any other service within the Facebook family of companies, will now be shared across Facebook Companies. Simply put, it appears that consent to sharing and integration of user data with other Facebook Companies for a range of purposes including marketing and advertising, has been made a precondition for availing WhatsApp service”
This “take-it-or-leave-it” policy of WhatsApp requires further examination as to whether it violates the provisions of the Competition Act.
The Commission also took note of the “strong lock-in effect” for users as regards their dependence on WhatsApp for messaging services. Switching to another platform for users gets difficult and meaningless until all or most of their social contacts also switch to the same other platform. Users wishing to switch would have to convince their contacts to switch and these contacts would have to persuade their other contacts to switch. Thus, while it may be technically feasible to switch, the pronounced network effects of WhatsApp significantly circumscribe the usefulness of the same.
It noted that despite the increased downloads of alternate platforms like Telegram or Signal, the user base of WhatsApp has not suffered significant loss.
The Commission further opined that users, as owners of their personalised data, are entitled to be informed about the extent, scope and precise purpose of sharing of such data by WhatsApp with other Facebook Companies. However, it appears from the Privacy Policy as well as Terms of Service (including the FAQs published by WhatsApp), that many of the information categories described therein are too “broad, vague and unintelligible”.
For instance, information on how users “interact with others (including businesses)”is not clearly defined,what would constitute “service-related information”, “mobile device information”, “payments or business features”, etc.are also undefined. At numerous places in the policy, while illustrating the data to be collected, the list is indicative and not exhaustive due to usage of words like ‘includes’, ‘such as’, ‘For example’, etc., which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy.
“Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services. It is also not clear from the policy whether the historical data of users would also be shared with Facebook Companies and whether data would be shared in respect of those WhatsApp users also who are not present on other apps of Facebook i.e.,Facebook, Instagram, etc”, the CCI said in the order.