Senior lawyer Sumit Mehta speaks about how internet and data privacy law have come a long way so far and how they still have a very arduous journey ahead.
In today’s rapidly changing digital world, technology is continuously evolving, and with it, concerns about data protection and user security are becoming increasingly prominent. One of the most controversial and contemporary disputes highlighting this tension is between the Indian government and WhatsApp, a messaging platform owned by Meta. The conflict centers on the Information Technology Rules, 2021, which mandate that the company share or trace the originator of a message. This regulation, however, goes against WhatsApp’s core feature of end-to-end encryption, which ensures that only the sender and recipient can access the message content.
WhatsApp, with over two billion users globally and India being its largest market, has steadfastly refused to compromise on its encryption policies, emphasizing user privacy. End-to-end encryption is crucial in safeguarding user messages from unauthorized access, thereby ensuring privacy.
“It means you realize that neither side is on the wrong but then where is it that you draw the line,” says Sumit Mehta”
The Information Technology Rules, 2021, enforced by the Indian government, require messenger platforms to identify the “first originator” of messages upon a law enforcement agency’s request. WhatsApp has contested this rule in the Delhi High Court, arguing that it violates the user’s right to privacy and undermines the purpose of end-to-end encryption. Enforcing this rule could have significant social and economic impacts on WhatsApp. Users, concerned about their privacy, may abandon the platform, leading to a decline in user base and financial losses for the company. The Indian authorities argue that these rules are necessary to maintain social order and national security. Conversely, WhatsApp, renowned for its robust encryption, champions user data privacy.
In addition to the 2021 rules, the Indian Parliament passed the Digital Personal Data Protection Act (DPDPA) in 2023, marking a significant milestone in India’s data privacy landscape. The DPDPA aims to provide comprehensive data protection, with strict consent requirements and provisions for data fiduciaries to ensure data accuracy, security, and timely breach notifications (The National Law Review) (Carnegie Endowment). The Act introduces the Data Protection Board of India (DPB), focusing on adjudicating grievances and penalizing data breaches, though with more limited regulatory power compared to the previously proposed Data Protection Authority (RegTech Times) (Conventus Law). The Act also scales back on data localization requirements, allowing the government to restrict data transfers to certain countries primarily for national security purposes, providing a more balanced approach to data handling (Conventus Law) (Finology).
The Indian government’s Information Technology Rules, 2021, also raise broader concerns about the regulation of social media intermediaries and their role in digital spaces. While regulations are necessary to address issues like hate speech, misinformation, and online harassment, they must be crafted carefully to respect fundamental rights without exceeding necessary legal boundaries. The Delhi High Court case involving WhatsApp and the Indian government is not just a legal disagreement but represents broader conflicts in our digital era between political authority and individual liberties. Democratic principles, human rights, and the rule of law should guide any regulations to ensure they benefit society without undermining fundamental freedoms.
Encryption is not merely a feature but a fundamental method to protect users’ private information from unauthorized access and surveillance. WhatsApp’s refusal to compromise on encrypted messaging underscores its commitment to user privacy, aligning with international advocates for digital freedoms and individual privacy. However, traceability as a solution raises serious concerns about user privacy. Making all WhatsApp messages traceable could create a chilling effect, deterring users from freely communicating due to surveillance fears.
From the government’s perspective, the need for traceability is justified by the necessity to curb misinformation and unlawful activities that can threaten public order and national security. In India, the spread of fake news and incendiary content through encrypted platforms has led to serious incidents, including violence and public unrest. The government argues that without the ability to trace the origin of such messages, it becomes exceedingly difficult to hold accountable those spreading harmful content.
However, finding a balance is crucial. Regulations must ensure they do not infringe upon the fundamental rights of individuals, particularly the right to privacy and freedom of expression. Digital literacy and counter-narrative strategies can also play a significant role in mitigating the spread of misinformation without compromising encryption standards. Countries like Germany have implemented measures where telecom companies must retain customer data accessible only through court-approved procedures, balancing national security with individual liberties.
Globally, disputes between privacy and security are common. Some countries adopt strict regulations, while others seek balanced approaches to protect personal data privacy and national security. Resolving this dispute requires a compromise that upholds fundamental rights, including privacy and freedom of speech, while addressing legitimate security concerns. Collaborative and smart strategies can ensure a secure, open internet that respects individual freedoms.
Conclusion:
Encryption should be seen as a critical tool for national security and consumer protection. Weakening encryption undermines democracy, free speech, and public trust. A well-defined law, created through stakeholder consultation and democratic debate, is necessary to govern encryption and protect individual rights.
