WhatsApp’s policy of rolling out separate privacy and data sharing policies for Europe and India has raised fresh demands for a stringent data protection law in India from legal and privacy rights experts. While WhatsApp users in India will soon have no other option than sharing their data with Facebook and other group platforms, the messaging app has clarified that its policies on data-sharing remain unchanged for users in Europe. Niamh Sweeney, Director of Policy for WhatsApp, Europe said “there are no changes to WhatsApp’s data-sharing practices in Europe arising from this update. It remains the case that WhatsApp does not share European Region WhatsApp user data with Facebook for the purpose of Facebook using this data to improve its products or ads”.
The same was also updated on WhatsApp Europe’s FAQ webpage. WhatsApp official further said that its terms of service and privacy policy update did not require users in the European Region to agree to the sharing of data with Facebook in order to continue using the service. So, what forces WhatsApp to give concession to European citizens and what allows it to get away with a more stringent policy in India?
“The General Data Protection Regulation (GDPR) in Europe is a stringent and robust law protecting privacy and data of its people, unlike India where Personal Data Protection bill is yet to be enacted into a law” Dr. Karnika Seth, Cyber law expert and Founding Partner at Seth Associates tells India Today. GDPR is a well-defined law with provisions of hefty penalties which puts an obligation on businesses and service providers to collect only essential information which is absolutely necessary to provide services, whereas in India current laws lack clarity and enforcement mechanism. “Section 43A of the IT Act, 2000 puts an obligation on businesses to adopt reasonable security practices to protect user’s personal data and adopt clear privacy policy in this regard” says Seth. This includes- what information is collected, how it is being collected, for which lawful purpose, and requires express consent of a user for any transfer, declaration of who are intended recipients of information and how it will be used. “However, enforcement is a challenge, user often cannot discharge burden of proving their data has been collected illegally or for unlawful purpose, or based on ambiguous terms and cannot prove such data’s misuse to claim compensation” explains Seth.