Updates > Competition Law > CCI's Suo Moto Investigation against WhatsApp
Suo Moto Anti-Trust investigation against WhatsApp & Facebook Inc. on 2021 Privacy Policy & Terms Update
In Re: Updated Terms of Service and Privacy Policy for WhatsApp Users
​
05 APRIL 2021 | 9 MIN READ
CCI orders antitrust probe against WhatsApp over New Privacy Policy. Read a tabular analysis of the submissions made by WhatsApp and Observations by CCI.
​
ANTI-TRUST SCRUNITY IS INVALID
-
New Policy Update (“2021 Update”) falls within purview of the information technology law framework;
-
Privacy law issues are sub-judice before various courts and other fora in India.
-
Allegations of breach of the IT Act & issues related to data localization and data sharing do not fall within the purview of Competition law.
SCOPE OF INQUIRY IS TO ASCERTAIN “ABUSE OF DOMINANCE”
-
Competition Act provisions are in addition to and not in derogation of the provisions of any other law (Section 62 of the Act);
-
Commission’s scope of inquiry and investigation is for ascertaining “Abuse of Dominance”
-
Excessive data collection may have anti-competitive implications, and it requires anti-trust scrutiny.
ALLEGATION OF ABUSE OF DOMINANCE IS PREMATURE
Abuse of dominance is a post-facto analysis under Competition Act,
COMMISSION IS OBLIGATED TO ‘PREVENT’ PRACTICES HAVING ‘ADVERSE EFFECT’ ON COMPETITION.
-
Conduct has already occurred: 2021 Update has already been announced. 15.05.2021 is only the acceptance deadline. Users are already getting prompts for acceptance of updated terms.
-
CCI can intervene for acts about to be committed: Section 33 of the Act, empower Commission to intervene in respect of acts which are in contravention of the provisions of Sections 3/4/6 of the Act if such acts are about to be committed.
2021 UPDATE AIMS TO PROVIDES GREATER TRANSPARENCY
The 2021 Update explains the collection, usage and sharing of data which users had consented to under the 2016 Update and to inform users about how optional business messaging features work when certain business messaging features become available to them.
‘TAKE-IT-OR-LEAVE-IT’ POLICY MERITS ANTI-TRUST INVESTIGATION
Consent to sharing and integration of user data with other Facebook Companies for a range of purposes including marketing and advertising, has been made a precondition for availing WhatsApp service.
The ‘take-it-or-leave-it’ nature of WhatsApp’s new privacy policy and terms of service & the information sharing stipulations merit a detailed investigation in view of the market position and market power enjoyed by WhatsApp.
EARLIER POLICIES PROVIDED OPTION NOT TO SHARE INFORMATION WITH FACEBOOK
In WhatsApp Privacy policies 25.08.2016 and 19.12.2019 existing users were provided with an option to choose not to have their WhatsApp account information shared with Facebook.
This choice is no longer available to users . Data of users, including that of those who are not users of any other service within the Facebook family of companies, will now be shared across Facebook Companies.
2021 UPDATE AIMS AT GREATER CLARITY
2021 Update does not expand WhatsApp’s ability to share data with Facebook and the said update intends to provide users with further transparency about how WhatsApp collects, uses and shares data.
VALIDITY OF ANTI-TRUST SCRUNITY
ANALYSIS OF ABUSE OF DOMINANCE
NATURE OF PRIVACY POLICY
SIMILARITY, DEVIATION WITH PREVIOUS POLICIES
SUBJECT
SUBMISSION BY WHATSAPP
OBSERVATIONS BY CCI
Privacy Policy
OTHER OBSERVATIONS BY COMPETITION COMMISSION OF INDIA
WHATSAPP HAS DOMINANCE AND BENEFITS FROM 'NETWORK EFFECTS'
WhatsApp is the most widely used app for messaging in India. A communication network/platform gets more valuable as more users join it, thereby benefiting from network effects. Users wishing to switch would have to convince their contacts to switch and these contacts would have to persuade their other contacts to switch. The second largest player in terms of market share in the relevant market of instant messaging and thus the next sizeable alternative available to users is Facebook Messenger, which too is a Facebook Group company. Thus, the conduct of WhatsApp/ Facebook under consideration merits detailed scrutiny.
INFORMATION USE CATAGORIES ARE BROAD, VAGUE AND UNINTELLIGIBLE
Users as owners of their personalized data, are entitled to be informed about the extent, scope and precise purpose of sharing of such data by WhatsApp with other Facebook Companies. Many of the information categories described in Privacy Policy as well as Terms of Service (including the FAQs published by WhatsApp), are too broad, vague and unintelligible. For instance, information on how users “interact with others (including businesses)” is not clearly defined, what would constitute “service-related information”, “mobile device information”, “payments or business features”, etc. are also undefined.
NO DATA SOVEREIGNTY WITH USERS AS NO OPT-OUT PROVISION AVAILABLE
Users earlier had such control over sharing of their personal data with Facebook, in terms of an ‘opt-out’ provision available for 30 days in the previous policy updates. However, the same has not been made available to users this time. Thus, users are required to accept the unilaterally dictated ‘take-it-or-leave-it’ terms by a dominant messaging platform in their entirety, including the data sharing provisions therein, if they wish to avail their service. Such “consent” cannot signify voluntary agreement to all the specific processing or use of personalised data, as provided in the present policy. Users have not been provided with appropriate granular choice, neither upfront nor in the fine prints, to object to or opt-out of specific data sharing terms, which prima facie appear to be unfair and unreasonable for the WhatsApp users.
OPAQUE, VAGUE, OPEN-ENDED & INCOMPLETE DISCLOSURE IN 2021 UPDATE
At numerous places in the policy while illustrating the data to be collected, the list is indicative and not exhaustive due to usage of words like ‘includes’, ‘such as’, ‘For example’, etc., which suggests that the scope of sharing may extend beyond the information categories that have been expressly mentioned in the policy. Such opacity, vagueness, open-endedness and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services. It is also not clear from the policy whether the historical data of users would also be shared with Facebook Companies and whether data would be shared in respect of those WhatsApp users also who are not present on other apps of Facebook i.e., Facebook, Instagram, etc.
NO DATA CONTROL TO USERS ON CROSS-PRODUCT PROCESSING
Further, users are not likely to expect their personal data to be shared with third parties ordinarily except for the limited purpose of providing or improving WhatsApp’s service. However, it appears from the wordings of the policy that the data sharing scheme is also intended to, inter alia, ‘customise’, ‘personalise’ and ‘market’ the offerings of other Facebook Companies. Under competitive market condition, users would have sovereign rights and control over decisions related to sharing of their personalised data. However, this is not the case with WhatsApp users and moreover, there appears to be no justifiable reason as to why users should not have any control or say over such cross-product processing of their data by way of voluntary consent, and not as a precondition for availing WhatsApp’s services.
NON TRANSPARENT & INVOLUNTARY SHARING OF PERSONALIZED DATA
The conduct of WhatsApp in sharing of users’ personalised data with other Facebook Companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie unfair to users. The purpose of such sharing appears to be beyond users’ reasonable and legitimate expectations regarding quality, security and other relevant aspects of the service for which they register on WhatsApp.
DATA CONCENTRATION & DATA-SHARING BY WHATSAPP WITH FACEBOOK AMOUNTS TO DEGRADATION OF NON-PRICE PARAMETERS OF COMPETITION
Targeted ad offerings on other Facebook products indicates the intended use of building user profiles through cross-linking of data collected across services. Such data concentration may itself raise competition concerns where it is perceived as a competitive advantage. Conduct of data-sharing by WhatsApp with Facebook amounts to degradation of non-price parameters of competition viz. quality which result in objective detriment to consumers, without any acceptable justification and also amounts to imposition of unfair terms and conditions upon the users of WhatsApp messaging app, in violation of the provisions of Section 4(2)(a)(i) of the Act.
LOSS OF CONTROL OVER PERSONALISED DATA BY USERS & BARRIERS TO MARKET ENTRY
Reduction in consumer data protection and loss of control over their personalised data by the users can be taken as reduction in quality under the antitrust law. Lower data protection by a dominant firm can lead to not only exploitation of consumers but can also have exclusionary effects as WhatsApp/Facebook would be able to further entrench/reinforce their position and leverage themselves in neighbouring or even in unrelated markets such as display advertising market, resulting in insurmountable entry barriers for new entrants.
RISK OF CONSUMER PROFILING, CROSS LINKING AND INTERGRATION OF USER DATA - EXCLUSIONARY EFFECTS FOR NEW ENTRANTS
Data and data analytics have immense relevance for competitive performance of digital enterprises. Cross-linking and integration of user data can further strengthen data advantage besides safeguarding and reinforcing market power of dominant firms. For Facebook, the processing of data collected from WhatsApp can be a means to supplement the consumer profiling that it does through direct data collection on its platform, by allowing it to track users and their communication behaviour across a vast number of locations and devices outside Facebook platform. Therefore, the impugned data sharing provision may have exclusionary effects also in the display advertising market which has the potential to undermine the competitive process and creates further barriers to market entry besides leveraging, in violation of the provisions of Section 4(2)(c) and (e) of the Act.
POSSIBLE EXCLUSIONARY BEHAVIOUR BY FACEBOOK
2021 Update to the privacy policy, a business may give third-party service provider such as Facebook access to its communications to send, store, read, manage, or otherwise process them for the business. It may be possible that Facebook will condition provision of such services to businesses with a requirement for using the data collected by them.
For more on the topic, please get in touch at info@tbalaw.in
Picture Credits to Markus Winkler on Unsplash