Last year, the Competition Commission of India (CCI) had passed an order penalizing the social media colossus – Meta – to pay approximately $25 million in fines for misusing its dominant market position. The CCI found WhatsApp’s 2021 Privacy Policy to be in violation of Section 4(2)(a)(i) of the Competition Act of India. This order by India has opened windows of conversation on the power of the government to oversee the operations and policies of industry titans and regulate their activities, if need arises to protect the rights of the citizens.
What exactly is the order about?
Meta had released a new Privacy Policy in 2021, expanding the scope of data collection and sharing to permit itself to share and process non-personal data with its subsidiary companies – Facebook, Messenger, Instagram and WhatsApp. This policy was communicated to the users in a take-it-or-leave-it fashion, compelling the users to accept the policies, as they had grown dependent on the instant messaging platform for daily communication within their network. In a way, WhatsApp leveraged its dominant position in the instant messaging software market to make users comply to its dictates, or sacrifice being connected to their social network.
Why and how did the CCI take up the case?
CCI has noted the central role of data in helping companies, such as Meta, improve their services and offer free-of-charge platforms to users. CCI has observed that users’ personal and non-personal data is critical to the functioning of these companies as it adds to their competitive strength and market dominance. The data collected from users help to refine the services based on users’ unique requirements and preferences and deliver personalized advertisements in addition to partnering with the leading third-party advertisers. In spite of the criticality of the user data, there is a lack of transparency around how the data is utilized and lack of standards on data processing and sharing, which affect the users’ right to grant informed consent and create entry barriers for their competitors.
Therefore, while India’s data governance framework is developing, the CCI decided to shift more power in the hands of the users regarding collection and use of data. Moreover, Meta has been ordered not to share WhatsApp data for advertising purposes for five years. Meta has also been ordered to include in WhatsApp’s Privacy Policy a detailed explanation of the concept and purpose of data sharing, along with linking each type of user data with its associated purpose and Meta’s subsidiaries. Moreover, users must have an option to opt-out of sharing of their data with subsidiaries that do not offer WhatsApp services. Users must get an in-app notification for taking this decision and must be able to modify their choice using a tab in WhatsApp settings.
Will this order indeed help?
The CCI has tried to foster competition in the market by reducing the dominant power of Meta and has tried granting power to users. Yet, the complex nature of datasets and privacy policies, and the difficulty in tracking users’ data can make the implementation of this order difficult. Moreover, WhatsApp users in India may not be capable enough to understand the intricate explanations and data-sharing practices in privacy policies. Not to forget, India currently lacks an implemented Digital Personal Data Protection Act 2023 and any law on personal data protection that can bring large corporations to book for violating a data protection law. A single law may not be capable enough to govern mixed datasets.
How has Meta responded?
Meta has challenged the ruling at India’s National Company Law Appellate Tribunal. Therefore, it is yet to be seen how the CCI order will influence privacy policies at Meta and other companies in the same league.
Why does it matter?
The ruling matters because it paves the way for other developing countries to take some cues from India’s example and investigate how the data privacy and protection policies of the multinational corporate titans affect the unassuming users on the various platforms. It also shows that governance and competition can go together with business growth and proliferation of social media platforms. Though the data protection landscape in India is yet to mature further, it does set a good precedent for governments to oversee the impact of privacy protection policies on their citizens.
