A five-judge Constitution Bench of the Supreme Court on Wednesday directed instant messaging platform WhatsApp and social media giant Facebook to file affidavits stating what user data they shared with “third parties.”
The Bench led by Chief Justice Dipak Misra is hearing a petition filed by two law students alleging that a contract entered into between Facebook and WhatsApp in 2016 on data sharing was a violation of a citizen’s right to privacy. The data, according to them, included photographs, messages, pictures and other personal documents shared by users on WhatsApp.
Initially, senior advocate Kapil Sibal representing WhatsApp, submitted that the instant messaging platform does not share any personal data of its users with third parties. He said only four details, ‘telephone number, type of device, last access of the user and registration date,’ are shared.
The petitioners, represented by advocate Madhavi Divan, countered that the court should injunct WhatsApp from sharing user data with third parties. Ms. Divan submitted that European privacy watchdogs have warned WhatsApp against sharing user information with parent company, Facebook. WhatsApp was acquired by Facebook in 2014. The petitioners argued that the same restriction should be imposed in India.
The Centre, represented by Additional Solicitor General Tushar Mehta, submitted that an expert committee had been set up under former Supreme Court judge, Justice (retired) B.N. Srikrishna, on July 31, 2017 to identify “key data protection issues” and suggest a draft Data Protection Bill.
The Office Memorandum of the Justice Srikrishna Committee notes that the “government is cognisant of the growing importance of data protection in India. The need to ensure growth of the digital economy while keeping personal data of citizens secure and protected is of utmost importance”.
Mr. Sibal argued that the material shared by users among themselves on WhatsApp was encrypted and Facebook was no “third party.” He said billions used WhatsApp and there had never been a single instance of breach.
“Petitioners are concerned with certain information you will come to know, which will reveal the pattern or behaviour of the user, like his communication of health details and reports with his doctors,” Justice A.K. Sikri, on the Bench, observed.
But Mr. Sibal dismissed such fears as merely speculative. “There is no data we are parting with. There is end to end encryption.” Mr. Sibal suggested that the court may not have the technical expertise to decide on this “complex issue” and should wait till the Srikrishna Committee came out with its report.
Senior advocate K.V. Vishwanathan, also for the petitioners, said a recent nine-judge Bench verdict upholding privacy as a fundamental right had held that the right to informational privacy extended to non-state actors like WhatsApp and Facebook.
Alleging that the 2016 contract between the two companies as “duplicitous,” Ms. Divan submitted that it created certain third party rights without taking the “informed consent” of the users.
Appearing for Facebook, senior advocate Arvind Datar countered by quoting Justice Rohinton Nariman’s separate judgment in the privacy verdict of July 24 that the regulation of user data sharing was a complex issue and should balance both private and public interests. “Justice Nariman has said that privacy is applicable for information you [user] have not parted with, and not the information which is already in the public domain”, Mr. Datar said.
The court said it would first consider the affidavits filed by the two companies within the next four weeks and then take a call. The next hearing has been fixed for November 28.
