Data privacy law considerations in NCLAT’s stay order of the CCI WhatsApp decision

Introduction

On 23 January 2025, the National Company Law Appellate Tribunal (NCLAT) stayed the Competition Commission of India’s (CCI) decision restricting WhatsApp from sharing user data with Meta companies for advertising purposes over the next five years. Refer to our Ergo. NCLAT also directed WhatsApp to deposit 50% of the INR 213.14 crore fine imposed by the CCI within two weeks. The appeals filed by Whatsapp and Meta before NCLAT are pending and will be listed before NCLAT again in March 2025.

Background

Meta’s appeal originated from CCI’s order finding Meta guilty of abusing its dominant position through its “take it or leave it” 2021 privacy policy update of WhatsApp. The privacy policy update required users to accept expanded data collection and sharing with Meta companies as a pre-condition to continue availing WhatsApp’s services.

Broadly, the CCI observed that this sharing of data by WhatsApp with fellow Meta companies restricts user choice and enables Meta a massive competitive edge over its rivals in the market for advertising.

Over and above the monetary fine, the CCI issued prescriptive directives to modify data collection and sharing policies including an embargo on sharing WhatsApp user data with Meta companies for a period of five years for advertising purposes, guidelines for increased transparency and user-friendly data sharing.

Appellate tribunal’s findings

While granting a stay on the prohibition for data sharing for advertising purposes, NCLAT noted that a five year ban could collapse the business model of WhatsApp which is presently free of charge. NCLAT also noted that the enforcement of the Digital Personal Data Protection Act, 2023 (DPDP Act) would provide a clearer regulatory framework on data protection and data sharing and eliminate the need for arguably overlapping remedies by the CCI.

The other directives of the CCI relating to sharing of data for non-advertising purposes were sustained by the NCLAT. These are as follows:

• WhatsApp to outline the types of data shared with Meta companies and specify the purpose of each.
• Use of sharing user data with other Meta entities for purposes beyond available WhatsApp’s services should not be a pre-condition to access WhatsApp services.
• In respect of sharing of WhatsApp user data for purposes other than for providing WhatsApp services, WhatsApp must provide users in India with the ability to opt out of non-WhatsApp data sharing via an in-app notification. Further, users should be able to review and modify their choices within WhatsApp’s settings.
• Future updates to WhatsApp’s privacy policy must comply with these requirements.

Comment

The NCLAT interim order appears to adopt a balanced approach, recognizing the DPDP Act as the primary legal framework for addressing data protection concerns. While the five-year ban on data sharing for advertising purposes was stayed—given its critical impact on WhatsApp’s business model and potential conflict with the requirements under DPDP Act— the directions concerning data collection and sharing for non-advertisement purposes were upheld, as these were not in conflict with the anticipated objectives of the DPDP Act.

Acknowledging the imminent enforcement of the DPDP Act, the NCLAT granted the parties the liberty to seek a modification of its order once the DPDP Act comes into effect. This well-intentioned flexibility ensures that the resolution of the issues aligns with the forthcoming legal framework for data protection.

• Anisha Chand (Partner) and Sumantra Bose (Counsel)

For any queries please contact: editors@khaitanco.com