Terming its new privacy policy unilateral, unfair and unacceptable, the ministry of electronics and information technology (MeitY) on Tuesday asked WhatsApp to withdraw it and reconsider its approach to information privacy, freedom of choice and data security.
In a strongly-worded letter to CEO Will Cathcart, the ministry has also sought a detailed information about its data sharing protocols and business practices. MeitY has also raised objections to the differential treatment accorded by WhatsApp to its users in India compared with those in the European Union.
WhatsApp’s new privacy policy was to be implemented from February 8 but has been put on hold till May 15 due to user backlash; the policy aims to share commercial user data with parent Facebook.
In its letter, MeitY has said the terms of service and the proposed privacy policy are an ‘all-or-nothing’ approach, which take away any meaningful choice from Indian users. The ministry has also sought detailed answers to a set of 14 questions.
The letter mentions that WhatsApp has notified its users’ that it will collect a vast amount of highly invasive and granular metadata from their chats with business accounts and share it with other Facebook companies.
“With this, any meaningful distinction between WhatsApp and Facebook companies will cease to exist. Given the huge user base that WhatsApp and Facebook have in India, the consolidation of this sensitive information also exposes a very large segment of Indian citizens to greater security risks and vulnerabilities creating a honeypot of information,” MeitY noted.
The government is particularly concerned about the lack of options for Indian users of WhatsApp as the new policy does not provide a mechanism for them to opt put. “This approach leverages the social significance of WhatsApp to force users into a bargain, which may infringe on their interests in relation to informational privacy and information security,” the ministry has said.
Further, the ministry has said Parliament is already examining the Personal Data Protection Bill and making such a momentous change for Indian users at this time puts the cart before the horse. Since the Bill strongly follows the principle of “purpose limitation”, these changes may lead to significant implementational challenges for WhatsApp should the Bill become an Act.
Raising objections against differential and discriminatory treatment meted out to Indian users, the ministry said it owes a sovereign responsibility to its citizens to ensure their interests are not compromised. The discriminatory treatment of Indian users shows lack of respect for the rights and interests of Indian citizens, who form one of the largest user base for WhatsApp.
The ministry has sought details about exact categories of data that WhatsApp collects from Indian users. The app has been asked about permissions and user consent sought and the utility of each of these with respect to the functioning and specific service provided. WhatsApp has been asked to provide details about the difference between its privacy policies in India and other countries. Also, the government wants to know if WhatsApp conducts profiling of Indian users on the basis of their usage of application and the nature of profiling conducted. “Does WhatsApp share data with any other app or business unit of the same company or associated companies,” the ministry has asked. The government has sought details about the server where data of Indians is hosted and transmitted.
MeitY has also sought to know whether the app captures information about the other apps running on the mobile device of the users and whether WhatsApp has provided any access to a third party to a user’s personal data.
