In deepening troubles for WhatsApp in India, the Centre has asked the Facebook-owned instant messenger to “respect the informational privacy and data security of Indian users” and withdraw its controversial privacy update programme in the country.
Sources said the government has raised “strong concerns” over the privacy update programme rolled out globally, which would allow the company to share certain data of WhatsApp users with its parent Facebook and other platforms such as Instagram.
“Given the huge user base of WhatsApp and Facebook in India, the consolidation of this sensitive information also exposes a very large segment of Indian citizens to greater security risks and vulnerabilities creating a honeypot of information.”
A detailed questionnaire has been sent to the company as part of the communication from the IT ministry to the WhatsApp CEO Will Cathcart. TOI was the first to report on the government’s concerns over WhatsApp’s privacy update in its edition dated January 14. A questionnaire sent to WhatsApp on the matter remained unanswered.
The government is particularly displeased with two others measures that have been proposed by WhatsApp as part of the upgrade, the first being a forced adoption plan for users to either accept the update or be ready to be booted out of the ubiquitous platform, the sources said. The other concern for the government is the seemingly-lenient privacy update for Europeans (in view of the citizen data protection law) vis-à-vis the plan for India and users here.
The government said that the Indian government is also in the process of formulating a data protection law for India, and undertaking any such privacy update is not suitable at this hour. “Since Parliament is seized of the issue, making such a momentous change for Indian users at this time puts the cart before the horse. Since the Personal Data Protection Bill strongly follows the principle of ‘purpose limitation’, these changes may lead to significant implementational challenges for WhatsApp should the Bill become an Act.”
On different privacy update programme for European subscribers, the government said it is a “differential treatment” for users in India. “…the differential and discriminatory treatment of Indian and European users is attracting serious criticism and shows lack of respect for the rights and interests of Indian citizens, who form one of the largest user bases for WhatsApp. Such a differential treatment is prejudicial to the interests of Indian users and is viewed with serious concern by the government.”
The IT ministry said the Indian government “owes a sovereign responsibility to its citizens to ensure that their interests are not compromised”.
On the ‘all-or-nothing approach’ adopted by the company with regards to accepting the privacy update, the government said that this method takes away any meaningful choice from Indian users. “This approach leverages the social significance of WhatsApp to force users into a bargain, which may infringe on their interests in relation to informational privacy and information security. It is expected that Facebook will value the principles of privacy and consent as laid down by the Supreme Court of India in its judgment of Justice (Retd.) K S Puttaswamy vs Union of India (2017).”
The government has asked the company to provide details of difference between WhatsApp privacy policies in other countries and India.
The exhaustive list of questions (14 in total) sent to the company includes queries around the exact categories of data that the company collects from Indian users. Also, the government asked the company to give details of the permissions and user consent that it seeks from users, and thereafter provide utility of each of these with respect to the functioning and specific service provided.
“Does WhatsApp conduct profiling of Indian users on the basis of their usage of application? What nature of profiling is conducted?” the government asked.
Also, the government wants to know whether WhatsApp captures information about other apps running on the mobile device of the user? “If yes, what information is being captured by the app and what purpose is it being collected and used?”
The government also asked the company details about the server where the data of Indians is stored, and seeking information on whether it provides access to third parties to access a user’s personal data. Also, the government asked WhatsApp whether its app harvests user data. “Has the company faced any action in any country for surreptitiously harvesting user data?”