In an era of relentless privatization, nationalization has become a bad word. It is synonymous with populism — Indira Gandhi’s bank nationalization drive — economic failure — the continuing misery of Air India — and the spectre of totalitarianism — the impending takeover of Alibaba by the Chinese State. But instances of nationalizing successful private companies for extraneous, often political, ends have meant that the original logic of nationalization has been lost. Certain companies performing critical public functions must work for the benefit of the public — if they don’t, then governments must step in to the breach. However, as I argue in this piece, this need not necessarily be by taking over ownership and control of the company.
In India, WhatsApp is a public utility. Messaging friends, calling family, reviewing work documents, buying milk and vegetables — everything takes place on this single app downloaded by over 400 million Indians. Moreover, it’s free. This has meant that Indians consider the app an intrinsic part of their daily lives. This is why WhatsApp’s change in its privacy policy that states that all users would have to accept certain terms and conditions or would have to stop using the service came as a rude shock to many. It highlighted in one fell swoop salient facts that every user knew but often preferred to overlook — that WhatsApp was a private corporation and was owned by Facebook, a company whose recent record of safeguarding user data is questionable.
The changes to the privacy policy themselves are of three kinds. First, WhatsApp will collect greater amounts of data, including time, frequency and duration of interactions. Second, chats with business accounts can be read by third parties to provide targeted advertisements. Third, data collected by WhatsApp will be shared with Facebook and other Facebook companies to design their products and improve services. Earlier users could opt out of such sharing, an option which appears to have been taken away. None of these changes affect end-to-end encryption on all personal messages, which continues as before.
WhatsApp has now confirmed that these changes have been deferred by three months. This deferral is on account of misinformation that has spread in the wake of the changes. In the company’s view, the changes solely pertain to communicating with business accounts. It will use the three months to better communicate their meaning and implication for users. In May, however, once the three months are up, the new policy will still remain a take-it-or-leave-it for users.
As far as the changes themselves are concerned, they appear to be pretty mundane and, ordinarily, should not have set alarm bells ringing. Communications with businesses online, typically all online purchases, involve personal data of the user being shared with the company. A cursory look at an Amazon account, for example, will not only show previous orders but also suggestions made by Amazon on the basis of user search history. Saving searches to improve targeting is no different in substance from processing messages sent by individuals to WhatsApp business accounts.
But to say that this is all that the privacy policy update is about, as WhatsApp has done, is misleading. There are significant changes to the information that WhatsApp will collect, how it will share such information, and what these changes signify. It’s another matter that the information that is collected by WhatsApp in terms of metadata, such as frequency of calls, or group names and profile photos, is no more or less than the industry norm. The Faustian bargain that everyone enters into while transacting on the internet and paying through one’s data is not unique to WhatsApp. This is a larger question on whether a supposedly ‘free’ internet, where payment is disguised as harvesting of personal data, is a business model that works for the benefit of the user. WhatsApp is merely following this norm and it cannot be singled out for this. Neither can it be singled out for its intention of sharing information with other Facebook companies. The very purpose of Facebook acquiring WhatsApp for a whopping $19 billion was to ensure greater integration with its suite of products. It can hardly be faulted for seeking user permission for data sharing that will make such integration successful.
Despite the mundane nature of the changes, that they have created such a storm can only be explained by the fact that WhatsApp is perceived as performing a public function, even though it is a private corporation. And when such a corporation privileges commercial gain, a combination of dismay and shock is understandable. At its core, WhatsApp provides a service that has become essential to life as we know it. Typically, such services have come to be regulated as public utilities over time. This entails rules that ensure that the corporation works in the interest of its real stakeholders, the people, and not just its shareholders. For a long time, it was thought that the optimal way of ensuring this was by nationalizing it — the State taking over ownership and control of the corporation. But State ownership of WhatsApp is neither necessary nor sufficient to tether the corporation to public benefit. In fact, this would be a remedy that is worse than the disease.
However, the undesirability of State control should not detract from the need for State regulation. In fact, in the context of private corporations that perform essential public functions, nationalization must be redefined to mean three fundamental tenets of regulation. First, WhatsApp must be subject to a statutorily prescribed privacy policy. This privacy policy should prevent harvesting of data for any purpose other than the purpose for which the individual is signing up. So when an individual provides his/her personal data to WhatsApp, he/she does it for being able to send and receive messages and phone calls, not for Facebook to provide recommendations on what she should watch. Data processing should be limited to this purpose. Second, WhatsApp should be subject to a principle of non-discrimination — it should not provide premium and non-premium versions based on the users’ ability to pay, failing which they are compelled to allow greater harvesting of data. The service must be equally available to all, without conditions. Third, all data of Indians, whether metadata or otherwise, must remain in India. This will ensure a basis for jurisdiction of Indian law enforcement and courts were things to go wrong. This list isn’t necessarily exhaustive but only the starting point of a wider conversation on nationalizing WhatsApp in the modern era of privatization.
The noise around WhatsApp’s privacy policy is not only about what it means for user privacy — most users will be happy to accept the changes, whether willingly or otherwise, as they do with a range of other applications. It is primarily a testament to the centrality of WhatsApp in our lives and a call for a democratically elected State to respond wisely. To not do so would signal the rise of the nations of Silicon Valley supplanting the nation states of today.
The author is Research Director, Vidhi Centre for Legal Policy. Views are personal