Competition Regulator Should not be Burdened with WhatsApp Privacy Issue

WhatsApp’s recent decision to share commercial user data with its parent Facebook has set off waves of outrage in India. In the absence of personal data privacy law, the chorus for considering privacy breaches as a competition law issue is increasing by the day.

Boasting of around 400 million users in India, WhatsApp's messaging app has found uniform appeal for everything--from sharing meetings of school buddies to planning corporate events. The Coivd-19 induced lockdown imposed in March 2020 has further increased our reliance on WhatsApp and similar messaging applications.

Naturally therefore, any suggestion that user data may be transferred from one entity to another for commercial purposes has sparked privacy concerns. The Indian Constitution guarantees the right to privacy as an integral part of right to life and liberty. As a country, we must stay vigilant against any infringement of right to privacy either by the State or private enterprises. There is no gainsaying on this account.

Yet, it’s equally bewildering to see demands suggesting that the Competition Commission of India (CCI) should intervene to arbitrate privacy concerns.

The potential theory of harm advocated by privacy and antitrust commentators is simple. Users “pay” for the services offered by digital platforms by bestowing their attention on ads and sharing information about themselves.

If information is the price users pay, then – the argument goes – antitrust should limit these companies’ ability to collect, analyze and use such information. Examined through this lens, user data privacy is an inherent aspect of the quality of services offered by multisided platforms. Accordingly, any harm to such privacy raises competition concerns.

Such an argument appears compelling on first blush. But scratch the surface and it collapses under the weight of its own contradictions.

Privacy should not be scrutinized by competition regulator

Traditional firms, if protected from competition by an insurmountable moat, may compromise on (product or service) quality to lower costs, thereby capitalizing on their monopoly.

Digital platforms though, do not function this way. They must continually invest to improve the quality and range of their product features to remain relevant. With today’s ubiquitous multi-sided platforms, the goal is not to compete to acquire users on price (since these digital services are typically offered for free). Instead, digital platforms have to ceaselessly innovate to offer newer features and better services.

No cost savings arise from the apparent reduction in quality by way of changes to privacy policy. Equating privacy with quality to construct an antitrust theory of harm must account for this inherent contradiction.

Second, the only anchor to tie the claim of privacy as an antitrust issue appears to be the discipline on “unfair and discriminatory conditions in the purchase or sale of goods or services” under Section 4 of the Competition Act, 2002 (Competition Act). Indeed, the Competition Act seeks to prohibit unfair prices or terms in provision of goods or services.

The Competition Act though unmistakably requires the CCI to “promote and sustain competition in markets, protect the interests of consumers and to ensure freedom of trade carried on by other participants in markets”.

These laudable goals are strung together with a single irreplaceable thread- the thread of economic assessment. An economic assessment under the Competition Act invariably requires a weighing of pro-competitive benefits ( for example, lower prices and better quality) with potential anti-competitive harms (such as, creation of barriers to entry and expansion and forced exit of competitors). If pro-competitive gains outweigh potential harms, the laudatory goals of the Competition Act are upheld.

Treating a change in the privacy policy, as a unilateral change in the contract between users and service provider and categorizing it as an “unfair condition” without a weighing of potential gains and harms would reduce the Competition Act to a statute full of ticketing offences.

Antitrust law has a very specific purpose - to correct market failures and prevent consumer harm as a consequence of unfair market practices, aiming always to maximize consumer welfare.

On the other hand, privacy law that is rooted in human rights discourse and places the users at the centre is a significantly better tool to deal with privacy breaches than antitrust law.

Opening the doors of the Competition Act to privacy concerns would expand its reach beyond its remit. In turn, the sharp tool that the legislature has created to protect and promote competition would become a blunt sledgehammer.

Need to move ahead with data privacy law

Many countries are enacting laws recognizing the right to privacy, while India's version is still being drafted. These laws seek to regulate the manner in which personal data may be collected by companies and also prohibit the abuse of personal data to discriminate, exacerbate bias or cause other harm to the individual.

While it is prudent for policymakers to build in as many safeguards as possible before introducing the Data Protection Bill in Parliament, endlessly agonizing over it won’t serve many purposes. The breathtaking pace of technological change may always introduce new elements that are unanticipated.

At some point debates on proposed legislation have to give way to statutory enactments. Glitches if any can be addressed by amendments or through judicial pronouncement.

Continuing the impasse on the introduction of a personal data protection law will only hurt India’s economic interests. Any attempt in the meantime to classify privacy infractions as antitrust concerns will help neither in upholding the right to privacy nor in promoting and sustaining competition in markets that require the CCI’s more immediate attention