'WhatsApp is storing our data on servers which are physically located in another country.'
'We might be having good relations with a particular country at this very moment, where WhatsApp's data servers are located, and in which our data is stored, but tomorrow we might be having bad relations with them, then what is going to happen to that data.'
Advocate Rohilla spoke with Prasanna D Zore/Rediff.com about why he feels it violates our right to privacy. He believes the government should intervene and ensure that the personal and private data of Indian citizens is adequately protected and secure.
Being a user (of WhatsApp) I got a notification from WhatsApp that I'm supposed to accept some terms and conditions.
If I didn't accept it, then they would be cancelling my subscription, my service and also terminate my account.
That particular thing made me uncomfortable and so I read the policy in detail. Upon reading the policy in detail I found that this policy is absolutely in violation of my right to privacy.
They were sharing more data about users than I thought they were actually doing.
Every citizen of this country has a right to say to anyone that this (sharing of personal private data without permission) is none of your business. Yes, I would want to keep things (one's private data) to myself.
In a nutshell, this is what right to privacy is all about. But what WhatsApp is doing is it is basically sending everything (all the data collected from users), whatever I'm sharing with other people.
If I'm talking to any business entity (say an online insurance app) on WhatsApp, then other business entities in the same industry would be able to see all those messages and that data would be visible to them.
It is all clearly mentioned in the policy. That means whatever I am sharing with my friends or family about anything it would be stored on their data servers and it would be shared with Facebook's partners.
Hasn't WhatsApp clarified that the sharing of such data will be only for business entities and that it will not share personal chat data?
This is not just about (sharing) business (related data). What WhatsApp is trying to do is convert Facebook, Instagram and WhatsApp into an integrated social media platform so that they will be able to target their audience based on their behavioural traits.
They will be collecting data and then they will be studying the behaviour of users about certain things, upon visiting certain Web sites (a business entity) and then they would be sending us targeted advertising in a particular way.
But WhatsApp has issued a clarification (external link) that this updated policy will not affect data in your personal chats...
WhatsAppp keeps saying that they won't be sharing your personal chat with Facebook, but it is not just about personal chats. It is also about whatever I'm sharing.
Let's say I'm visiting a Web site and I like the content of this Web site. Let's say I'm doing some online shopping, and like the content of it, or I like the product that they are offering and I share it with a friend on WhatsApp.
So WhatsApp will know whatever I have shared and eventually then send that data to Facebook. And then Facebook will target me and start showing me similar products related to my online search.
In this context, it is also a big-time threat to our national security.
How is it a threat to national security?
WhatsApp is storing our data on servers which are physically located in some other countries. Their updated policy specifically mentions that all such data will be stored and processed in the United States of America.
Such data and its use will be subject to the privacy laws of that particular country. There is no need to say this, but the privacy laws of that country may be different from what we have in India.
We might be having good relations with a particular country at this very moment, where WhatsApp's data servers are located, and in which our data is stored, but tomorrow we might be having bad relations with them, then what is going to happen to that data.
In such a scenario, who will be guaranteeing the safety and security and privacy of our data?
But how is it a threat to our national security?
Let's say, for example, the USA government asked Facebook or WhatsApp to share plain data or behavioural data that they (Facebook and WhatsApp) have studied or they have collected from Indians over a period of time, and we have no idea to what extent and what all they have collected and how they have spliced and studied it, and how the US government will use this data.
Now, there is a very interesting thing that exposes WhatsApp.
Given the strict European GDPR (General Data Protection Regulation) laws, WhatsApp has different set of privacy updates in Europe and for countries like India, where we still don't have comprehensive privacy laws that protects our data.
WhatsApp knows that people in India are vulnerable because there is no specific (privacy) law that protects and secures and guarantees the privacy of our data (and so they have different privacy updates for Indians).
This choosy behaviour cannot be allowed. This is what I found problematic and the Indian government must not allow it.
What is your plea before the Delhi high court?
In my prayer before the Delhi high court, I have requested the ministry of and electronics and information technology (MEITY) through the Union of India to frame guidelines that will restrict and prohibit WhatsApp from sharing this data with its parent company (Facebook) or any third party that does business with Facebook.
If you are storing my data that I provide to you then you cannot share it with Facebook to help them in their business by sharing this data with third parties.
I am giving you my data for a particular intended purpose that helps me avail your services. You cannot share such data with third parties and benefit from it by violating my right to privacy.
In 2017, the Supreme Court had declared that the Part III of our Constitution (contained in Articles 12 to 15 dealing with fundamental rights) recognises our right to privacy.
It also said that it is every individual's right to share whatever they want to share and they may not be subject to any compulsion.
The Data Protection Bill, 2019, is still pending in Parliament, which needs to be enacted; Section 5 of this Data Protection Bill also talks about data shared for intended purposes cannot be used for other purposes.
You are not supposed to share it for other miscellaneous purposes for which it was never given to you.
Let's say, today you accept it. Then from today onwards whatever things you will share with your friends and family on WhatsApp, it will be shared with Facebook and other Web sites.
This is more like a 360-degree surveillance that WhatsApp and Facebook will be engaging in and I don't want that.
If I'm choosing not to share my location with any particular application, that means I'm not comfortable with it (sharing my location). So, arbitrarily they are going to share my location or have access to wherever I am.
This is not at all acceptable. This is my right to privacy (which this privacy update violates).
Also, the behavioural data (in possession of and studied by Facebook and WhatsApp) affects the election process.
In 2016, this is what happened in the USA. Facebook was penalised for sharing this behavioural data with a particular candidate who was contesting the 2016 presidential election.
Is WhatsApp lying to its users because according to you they will be sharing data from personal chats as well with Facebook and third parties, and which is strongly refuted by WhatsApp?
But you said earlier that if I'm sharing something I liked on an online shopping portal with my friend then this data too will be shared by WhatsApp with Facebook and third parties?
This is one of the examples; this is how they work with third-party services. It says if you interact with a third-party service or another Facebook company product linked through their services then my IP address and my location will also be shared.