The Supreme Court (SC) has issued notices to Internet companies Google, Twitter and Facebook, and the government of India following a petition which questioned the lack of data localization and the issue of user data sharing by WhatsApp, reports Bar&Bench. The petition was filed by SC Advocate on Record Pallav Mongia. The case was heard yesterday by a 5 bench panel including newly appointed Chief Justice Dipak Misra and Justice AK Sikri, Amitava Roy, AM Khanwilkar and M Shantanagoudar.
An ET report pointed out that, the court had also directed Facebook and WhatsApp to separately submit “sworn” statements on whether they share data collected from its users to third parties. The bench said that it will move forward with the case on basis of statements submitted by both firms. The petition also comes at a time when SC upheld privacy as a fundamental right last month, limiting the rights of the government and companies to make laws/rules that infringe on these rights.
WhatsApp’s legal troubles in India started last year when it updated its privacy policy to allow itself to share user data, including phone numbers and contact lists, with its parent company Facebook. Following this, a petition was filed with the Delhi HC in September 2016. The Delhi HC, at that time, ruled that WhatsApp should not to share such information with Facebook. Note that Twitter also updated its privacy policies in May to share user data with third parties.
The new petition filed SC advocate Mongia not only looks at data sharing policies, but also on how user data is collected (by Facebook, Google, Twitter, WhatsApp), locations of servers that store Indian citizen’s user data, and whether user consent is taken for data collection. This is more on the lines of SC’s new ruling on right to privacy, unlike last year’s Delhi HC petition which only looked at user data sharing. More on this below
What the fresh petition is looking at
- Indian subsidiaries have no control over user data: The petition pointed out that India units of US companies Twitter, Google, YouTube, Facebook “neither handle nor control the content/information/data.” “The same is evident from statements made by these companies or affidavits filed by them before various courts that the collection and processing of data as entered by the subscribers /account holders are not in their control,” the petition said.
- 13 other countries passed data localization laws; India has none: The petition said that out that “13 countries have passed some degrees of ‘data localization’ laws mandating that the data pertaining to their citizens be stored within the border of their countries” including those of Facebook, Google, Twitter. In India, there are no regulations which looks at “the movement of data across the border” and the law does not mandate user consent to be taken before collecting info, the petition added.
- Without a consent and data localization law, these companies get away from legal suits: The petitioner argued that whenever the issue of data sharing or data localization is discussed in India courts, “the rights of the plaintiffs/prosecutors is subject to goodwill and consent of the foreign holding internet companies.” “This creates a serious impediment in seeking legal redress or enforcement of the rights of the Indian citizens,” the petition said.
- Need to classify all user data collected as ‘sensitive data’: There is no definition of what constitutes ‘sensitive data’ in the Indian law and there is no comprehensive definition in any regulation/law which looks at user privacy. “It is submitted that all data/information provided by a user must be protected as the same is capable of being abused and pose threat to the user.”
Disclosure: MediaNama founder Nikhil Pahwa is a co-founder of the Internet Freedom Foundation, which is a petitioner in this case. Nikhil was not involved with writing this post (only with the disclosure). IFF’s filing is available here, published by Legally India. A note from IFF about this filing is available here.
