Syllabus: GS2/ Governance
In Context
- The Supreme Court of India strongly cautioned WhatsApp and its parent company Meta for “surveillance capitalism” model and breaching the right to privacy of Indian users through data sharing and commercial exploitation.
Background
- In 2021, WhatsApp updated its terms of service, mandating that users share metadata with its parent company, Meta (then Facebook).
- Unlike the European Union, where the General Data Protection Regulation (GDPR) prevented such a move, Indian users were given a “take-it-or-leave-it” ultimatum: accept the terms or lose access to the platform.
- The Competition Commission of India (CCI) identified this as an Abuse of Dominant Position under the Competition Act, 2002.
- In 2024, the CCI imposed a ₹213.14 crore penalty, noting that the “consent” sought was “manufactured” and forced.
Key Issues Highlighted By the SC
- Vulnerability of the Masses: In a country where WhatsApp has become a “digital utility” for banking, government services, and livelihood, “opting out” is often synonymous with social and economic exclusion.
- Commercial Exploitation: Enables Meta to monetize user behavior via cross-platform ads (e.g., Instagram, Facebook), turning users into “products” without revenue share.
- Even if a message is end-to-end encrypted, the behavioral metadata (the “silos of data”) has immense market value.
- Lack of Clarity: Dense legal jargon inaccessible to rural/poor users, as SC noted—e.g., a Tamil Nadu vendor can’t navigate English terms.
- Asymmetry of Power: The court observed that the platform capitalizes on the “addiction” of consumers, turning them from users into “products” without their informed consent.
- The Gap in the DPDP Act (2023): While the Digital Personal Data Protection Act addresses the right to be forgotten and data processing limits, the SC noted it lacks provisions for “rent-sharing”.
- The SC asked the Ministry of Electronics and Information Technology (MeitY) to compare the DPDP Act with the EU’s Digital Services Act (DSA).
India’s Data Protection Framework
- Right to Privacy as a Fundamental Right: In Justice K.S. Puttaswamy v. Union of India (2017), the Supreme Court recognised Right to Privacy as a fundamental right under Article 21 & linked privacy to dignity, autonomy and liberty.
- Justice B.N. Srikrishna Committee (2017): It was constituted after the Puttaswamy judgment. It recommended treat companies as data fiduciaries, strong safeguards against power asymmetry
- Digital Personal Data Protection (DPDP) Act, 2023: India’s first comprehensive law on digital personal data.
- Key provisions include consent-based data processing, purpose limitation and data minimisation & establishes Data Protection Board of India for enforcement.
- However SC slammed that this mainly focuses on privacy protection but does not address economic value of data or compensation for data monetisation.
- Competition Commission of India (CCI): Recognised misuse of data as a form of abuse of dominant position.
Source: TH
Previous article
News In Short 03-02-2026
