Privacy as a Concern for Competition Law in Light of the Digital Personal Data Protection Act, 2023

The authors are Tamanna and Adhiraj Andlay, fifth year students at Jindal Global Law School, O.P. Jindal Global University.

The role of the Competition Commission of India (“CCI”) in regulating concerns pertaining to privacy has persistently been a contentious issue. The discourse concerning the intersection of privacy law and competition law has acquired significance in light of the recent enactment of the Digital Personal Data Protection Act, 2023 (“DPDPA”) by the legislature. The DPDPA, which is aimed at regulating the processing of digital personal data while striking a balance between an individual’s right to protect their personal data and legitimate processing needs, has raised inquiries about how the CCI ought to navigate spaces where privacy law and competition law overlap.

The separatist school of thought believes in the doctrinal and historical distinction between antitrust laws and the consumer protection mandate. Advocates of this view are hesitant to incorporate privacy considerations into antitrust analysis. They believe that this amalgamation would lead to uncertainty in the application of antitrust law’s consumer welfare test which is primarily economic in nature. Proponents of this school would recommend a complete detachment of CCI from privacy concerns in light of the DPDPA.

There exists another school of thought that believes in the incorporation of data privacy into the established antitrust framework. This integrationist school extends the prescription of competition law beyond price and efficiency factors. It accounts for non-price variables such as quality and innovation which contribute to the maximization of consumer welfare. It attempts to broaden the scope of quality by reading privacy-based competition into it.

The latter approach is in tandem with the CCI’s findings in its Market Study on the Telecom Sector in India where it was noted that privacy can take the form of non-price factor in competition. It raised several issues specifically concerning data processing within the digital communications market. It raised concerns regarding what is meant by “free consent” when interacting with a dominant digital entity. It noted that low standards of privacy lead to an objective detriment to consumers which translates to diminished levels of consumer welfare. Here, the CCI expressed an expansive understanding of competition law which brings privacy within its purview, an understanding that is echoed in various other jurisdictions.

In fact, in 2021, the CCI in its prima facie order against WhatsApp (“Order”) acknowledged privacy as a non-price parameter of competition, holding that data-sharing between WhatsApp and Facebook amounted to a degradation of quality.

The WhatsApp Prima Facie Order

The Order concerned WhatsApp’s 2021 privacy policy update concerning the sharing of user data on WhatsApp with Facebook. WhatsApp effected the updated policy by sending users prompts that asked for user consent by a specified date, post which the users would be denied all access to services offered by WhatsApp. The CCI noted that, unlike WhatsApp’s previous policy updates, the 2021 privacy policy did not offer the users an “opt-out” option making the policy “take-it-or-leave-it” in nature. It observed that considering the dominant nature of WhatsApp, consent here could not signify the voluntary agreement of consumers.

The CCI, in its Order, found that WhatsApp engaged in unreasonable data collection and sharing. This conduct combined with its dominant position, resulted in exclusionary effects and reinforced its market power. This exploitative conduct was found to be violative of Section 4 of the Competition Act, 2002 (“Competition Act”).

The DPDPA

Interestingly, the DPDPA can address the aforementioned concerns raised by the CCI. Section 6(1) of the DPDPA demands a heightened standard of “free, specific, informed, unconditional and unambiguous” consent to process personal data. Section 6(3) provides that such a request for consent must be made in “clear and plain language”. In the context of WhatsApp, this would require the application to inform the consumers of its updated privacy policy by specifying the manner of data collection and sharing, and the kind of data that it wishes to share with Facebook.

Further, Section 6(4) of the DPDPA gives consumers the right to withdraw their consent at any time, with the same ease that it was given. Section 6(7) provides that such consent can also be managed or reviewed through a Consent Manager. These sections account for the “opt-out” option that the CCI stressed in the Order and the sections also provide the consumers with greater flexibility regarding their consent.

In parallel to the concept of “Gatekeepers” in the Digital Markets Act of the European Union, the DPDPA introduces the concept of “Significant Data Fiduciary” in Section 10. It places a higher burden on such entities to appoint a Data Protection Officer based in India who serves as a point of contact for grievance redressal. They must also appoint an independent data auditor to undertake periodic Data Protection Impact Assessments to ensure compliance with the DPDPA.

With the DPDPA in effect, there can be some reluctance about competition law intervention in privacy law matters.

The Jurisdictional Conflict

It has been argued that CCI’s authority when there are conflicts with other sectoral regulators has diminished following the Bharti Airtel case. Here, the Supreme Court held that the Telecom Regulatory Authority of India being the special authority on the matter must determine if CCI intervention was needed. It must be noted that the Delhi High Court has noted in its Monsanto Holdings case that the decision in Bharti Airtel is not a general rule and the jurisdiction of the CCI is not automatically ousted in the presence of another sectoral regulator.

However, the recent Telefonaktiebolaget LM Ericson case of the Delhi HC adds another layer of complexity to the jurisdictional issue. Here, the Court underlined the thorough framework offered by the Patents Act to address the issue of unreasonable licensing conditions and anti-competitive practices by patent holders. Consequently, it observed that lex specialis should prevail over the Competition Act, which is a general legislation. The judgement creates room for similar arguments to be made with respect to the DPDPA.

However, an absolute annihilation of the jurisdiction of the CCI is not desirable. It has been recognised by international competition law authorities that privacy issues cannot be excluded from the purview of competition law simply by virtue of their nature. A violation of data protection rules by dominant entities would necessarily attract competition law intervention.

In a similar vein, when WhatsApp contended that the allegations regarding data sharing were related to the Information Technology Act, 2000 and privacy laws, not falling under the jurisdiction of the CCI, the CCI was meticulous in asserting its authority. It brought the issue within the competition law framework, arguing that excessive data collection and processing could provide a competitive advantage, potentially leading to exclusionary effects. This WhatsApp Order justified CCI’s intervention in matters of privacy. With the introduction of the DPDPA, this intervention would become more relevant as the DPDPA, and the Competition Act complement each other.

The Resolution

In matters where multiple sectoral regulators are involved, the enforcement should entail alignment of all the relevant laws. The Competition Act already provides for this harmonization by facilitating communication between regulators. The mechanism is provided under Sections 21 and 21A of the Competition Act where any regulator may refer to a matter for consultation. The referred body is required to provide its opinion within sixty days which would be taken into account by the body adjudicating upon the matter.

The Madras High Court has recognised that this power is qualified by the usage of the word “may” and is therefore not mandatory. However, such consultation if made mandatory by legislative action in situations of jurisdictional overlap, such as between the DPDPA and the Competition Act could lead to a more comprehensive approach to addressing violations. This concurrent model of adjudication would enhance remedies in light of the DPDPA while also ensuring market regulation for similar conduct that results in privacy violations.