Supreme Court Scrutiny of Meta Data Sharing and Consent Laws
Source:The Hindu ↗
Why It Matters
This issue lies at the intersection of Constitutional Law (Right to Privacy under Article 21), Digital Governance (DPDP Act 2023), and Economic Regulation (CCI curbing monopolistic data practices). It provides critical examples for questions on data sovereignty, regulatory challenges in digital markets, and the enforceability of fundamental rights against tech giants.
Summary
The Supreme Court of India has sharply criticized WhatsApp and its parent company Meta over their 2021 'take it or leave it' privacy policy, which mandated that users share personal data to continue using the app. The Court highlighted that under the Digital Personal Data Protection (DPDP) Act, 2023, consent must be voluntary. The issue is further compounded by a recent Competition Commission of India (CCI) ruling that fined Meta ₹213.14 crore for antitrust violations and banned it from cross-sharing data for advertising for five years. While Meta argued the petitions are now academic given the DPDP Act and CCI order, petitioners demanded a halt to ongoing data sharing and the deletion of data already collected under the 2021 policy, pointing out Meta's compliance with stricter privacy norms in Europe.
Key Points
- The Supreme Court of India strongly objected to WhatsApp's 2021 privacy policy, which forced users to consent to data sharing with Meta or lose access to the messaging service.
- The Court emphasized that the newly enacted Digital Personal Data Protection (DPDP) Act, 2023 mandates that user consent for personal data sharing must be entirely voluntary.
- The Competition Commission of India (CCI) recently penalized Meta ₹213.14 crore for abusing its dominant market position through the 2021 update and banned data sharing across Meta companies for advertising purposes for five years.
- Petitioners argued that Meta practices 'double standards' by enforcing strict data protection in Europe under the EU Digital Services Act while commercializing Indian users' data.
- While Meta sought to dispose of the petitions citing the new DPDP Act and the CCI order, petitioners insisted that data collected under the coercive 2021 policy must be stopped from being shared and previously gathered data must be deleted.
Important Terms
Digital Personal Data Protection (DPDP) Act 2023
India's first comprehensive legislation for digital personal data protection. It mandates clear consent, provides rights to 'Data Principals,' and establishes the Data Protection Board to penalize non-compliance.
UPSC context
GS Paper II/III: Governance and Data Privacy. Tests understanding of legislative responses to the Right to Privacy (Puttaswamy judgment).
Competition Commission of India (CCI)
A statutory body established under the Competition Act, 2002, responsible for preventing anti-competitive agreements and abuse of dominant position to protect consumer interests in India.
UPSC context
GS Paper II/III: Statutory bodies and regulatory framework. Relevant for market regulation and digital economy antitrust issues.
National Company Law Appellate Tribunal (NCLAT)
A quasi-judicial body formed under the Companies Act, 2013, to hear appeals against orders from the National Company Law Tribunal (NCLT) and the Competition Commission of India (CCI).
UPSC context
GS Paper II: Quasi-judicial bodies. Essential for understanding the appellate hierarchy in corporate and competition law.
Digital Services Act (EU)
An EU regulation focused on online safety and transparency. It mandates that 'Very Large Online Platforms' (VLOPs) manage systemic risks and provides users options to opt out of digital surveillance.
UPSC context
GS Paper II: International comparison of laws. Useful for evaluating global best practices in platform regulation and user rights.
Supreme Court of India
The highest judicial body in India, exercising original, appellate, and advisory jurisdiction. It acts as the final arbiter of the Constitution and the ultimate protector of Fundamental Rights.
UPSC context
GS Paper II: Indian Judiciary. Tests knowledge of judicial review, fundamental rights enforcement, and the apex court's constitutional role.
European Union (EU)
A political and economic union of 27 member states. Its regulations, like GDPR and DSA, often serve as global 'gold standards' for data privacy and digital market governance.
UPSC context
GS Paper II: International relations and global legislation. Significant for comparative studies in data protection and technology policy.
Prelims Trap
The Right to Privacy under Article 21 can only be enforced against the State and its instrumentalities.
While traditionally enforced against the State, recent SC rulings (like Kaushal Kishor) and the Puttaswamy judgment mandate the State to actively protect citizens' privacy from non-state (private) actors.
Static Concepts Connected
How is the Right to Privacy constitutionally protected in India?
- Puttaswamy Judgment (2017): Declared privacy a fundamental right intrinsic to life and liberty under Article 21, overriding earlier precedents.
- Reasonable Restrictions: Any state restriction must pass the three-fold test of legality, legitimate state aim, and proportionality.
- Informational Privacy: Recognized as a core facet, creating a positive obligation on the State to enact data protection laws regulating both state and private entities.
What is the mandate of the Competition Commission of India (CCI)?
- Statutory Body: Established under the Competition Act, 2002, to eliminate practices having an adverse effect on market competition and protect consumer interests.
- Abuse of Dominant Position: Empowered to investigate and penalize monopolies that exploit their market share, such as Meta coercing users into non-consensual cross-platform data sharing.
- Combination Regulation: Regulates mergers and acquisitions to ensure they do not cause appreciable adverse effects on competition in India.
Cross-Topic Patterns
Antitrust as a privacy enforcement tool
The CCI penalizing Meta demonstrates the growing intersection of market dominance and privacy, where forced data-sharing is prosecuted as anti-competitive behavior rather than just a rights violation.
Data colonialism and regulatory arbitrage
Tech giants offering stricter privacy in the EU compared to India highlights regulatory arbitrage. This fuels India's data sovereignty push and strict compliance requirements under the DPDP Act.
A 2026 multi-statement question will likely integrate DPDP Act consent mechanisms, CCI’s digital market powers, & Puttaswamy.
Linked PYQs · 5
Linked PYQs · 5
- 2017MainsGS2
Examine the scope of Fundamental Rights in the light of the latest judgement of the Supreme Court on Right to Privacy.
- 2024MainsGS2
Right to privacy is intrinsic to life and personal liberty and is inherently protected under Article 21 of the constitution. Explain. In this reference discuss the law relating to D.N.A. testing of child in the womb to establish its paternity.
- 2024PrelimsGS1
Under which of the following Articles of the Constitution of India, has the Supreme Court of India placed the Right to Privacy ?
- 2024MainsGS3
Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
- 2018MainsGS3
Data security has assumed significant importance in the digitized world due to rising cyber crimes. The Justice B. N. Srikrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to protection of personal data in cyber space?
