Supreme Court Directs WhatsApp: No Data Sharing with Meta Until Law is Active
The Supreme Court has ordered WhatsApp to submit a formal affidavit, committing that it will not share any Indian user data with its parent company Meta or related entities until the new Data Protection Act is fully operational.
Key Takeaways
- The Supreme Court gave WhatsApp a four-week deadline to file a data-sharing affidavit.
- The Centre must also file its response on the Data Protection Act’s implementation within four weeks.
- The case stems from petitions against WhatsApp’s controversial 2021 privacy policy update.
- The next hearing in the matter is scheduled after eight weeks.
Court’s Directives and Hearing Details
A bench of Justices KM Joseph and BV Nagarathna issued the directive while hearing multiple petitions challenging WhatsApp’s 2021 privacy policy. The bench explicitly stated: “You file an affidavit that you will not share any data with Facebook or any other related party till the Data Protection Act comes into force.”
WhatsApp’s Stance in Court
Representing WhatsApp, Senior Advocate Kapil Sibal informed the court that the company will comply with the newly passed Digital Personal Data Protection Act, 2023. He clarified that the disputed 2021 policy has not yet been implemented in India.
Background of the Legal Challenge
The legal battle began after WhatsApp’s 2021 policy update, which permitted sharing certain user data with Facebook and its group companies. This move triggered widespread public concern and multiple petitions filed in the Supreme Court, arguing that the policy violated the fundamental right to privacy of Indian users.
In September, the apex court had already issued notices to both the Centre and WhatsApp based on a plea by the Internet Freedom Foundation.
The New Data Protection Law
Parliament passed the Digital Personal Data Protection Act in August 2023, and it received presidential assent on August 11. The legislation is designed to safeguard the privacy of Indian citizens by imposing strict limits on how personal data can be collected and processed by companies.
The court has now tasked the Centre with detailing the steps being taken to bring this Act into force.
