New Digital Personal Data Protection Bill ready: Attorney General

The Supreme Court was hearing a petition challenging the privacy policy of WhatsApp allowing the sharing of metadata of its users with its parent company, Meta Platforms, Inc. The Attorney General for India has assured that a new Bill, to be introduced in the monsoon session of the Parliament, will deal with all the issues related to privacy concerns. 

 —

What happened today?

TODAY, the Attorney General for India R. Venkataramani informed a Supreme Court Constitution Bench that the Union government will introduce the Digital Personal Data Protection Bill during the upcoming monsoon session of the Parliament commencing in July.

The Attorney General said: "It will meet all the concerns expressed by the petitioners."

What is the background of the case?

The Constitution Bench, headed by Justice K.M. Joseph and comprising Justices Ajay Rastogi, Aniruddha Bose, Hrishikesh Roy and C.T. Ravikumar, is hearing a special leave petition, in Karmanya Singh Sareen & Anr. versus Union of India & Ors., challenging messaging and video-calling app WhatsApp's Terms of Services and Privacy Policy dated August 25, 2016, allowing it to share the metadata of its users with its parent company, the American multinational technology conglomerate then named Facebook (in 2021, it changed its name to Meta Platforms Inc.) and thereby, violating the users' right to privacy.

After Facebook acquired WhatsApp in 2014, the latter changed its privacy policy in September 2016 allowing the account information of its users to be shared with Facebook.

The petition has also flagged the issue of whether the policy should contain a specific 'opt-out' provision for Whatsapp users who do not wish for their information to be shared with Meta.

Moreover, it also has to be determined whether the manner of seeking 'consent' from users who are unable to read and understand the policy amounts to fraud.

Internet Freedom Foundation, a Delhi-based non-governmental organisation that conducts advocacy on digital rights and liberties, is an intervenor in this case. It submitted that protection of privacy extends to protecting the metadata of Whatsapp users. This means that WhatsApp's users' profiles, names, contact details, and location, among other things, being shared with Meta will violate the users' right to privacy.

The petition challenged the privacy policy first at the Delhi High Court.

The petition was rejected by the high court. However, the court directed WhatsApp to delete the data of existing users until September 25, 2016, the day the policy was made effective. However, after this date, the user data would be shared as per the new policy. The court stated that those users who do not want their information to be shared were free to delete their Whatsapp accounts.

A special leave petition was filed against this order before the Supreme Court. A division Bench of the Supreme Court then referred the matter to a five-judge Constitution Bench in 2017.

What has happened so far?

During the hearings before the Constitution Bench, arguments have primarily concerned the need for a data protection law. The court was informed that a committee on 'A Free and Fair Digital Economy Protecting Privacy, Empowering Indians' led by Justice B.N. Srikrishna had been established by the Union government to examine issues of data protection and eventually draft a data protection bill.

The Justice Srikrishna Committee report was released along with the draft data protection law in 2018.

In 2019, the Union government tabled the Personal Data Protection Bill, 2019. However, the Bill has glaring issues, and was criticised for not being based on the Srikrishna Committee report.

The Joint Parliamentary Committee on Personal Data Protection recommended the government make amendments to the Bill.

However, in 2021, WhatsApp rolled out a new privacy policy, as per which it gave time till February 28, 2021 to its users to accept the new terms. It did not allow users to opt out of sharing their data. It eventually extended the deadline to update till May 15, 2021.

A counter affidavit filed by Facebook India before the Supreme Court challenged the maintainability of the petition. It also stated that no writ petition lies because WhatsApp users voluntarily and affirmatively consented to the sharing of their information on WhatsApp.

It also mentioned that 'end-to-end' encryption does not allow both WhatsApp and Facebook to access the content shared.

The Union government introduced a new draft of the Digital Personal Data Protection Bill, 2022, which is now ready to be tabled in the upcoming session of the Parliament.

The Bill, if passed, will replace the remit of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.