Indian Platform Markets, Data, and Privacy

By Dr. Geeta Gouri¹

The attractiveness of Indian data and privacy platforms with nationalist overtones in the context of a global backlash against foreign platforms has been articulated in various ways. While protectionism is easy to comprehend in offline markets bound by national boundaries, the same approach of applying the tools of traditional economics towards online platform markets is beset with awkward competitive analyses.

The Government of India has announced policies to facilitate and usher an e-commerce “India platform” to counter foreign platform markets, of which Amazon is the most prominent. In their effort, the Government has issued rules pertaining to Foreign Direct Investment (FDI) in these markets. Restrictions have been placed on their operations, following a policy intended to provide protection to Indian platform markets. Ambitious projects are in the offing with the Government’s planned Open Network for Digital Commerce (ONDC), which has been reported by local media as an open, neutral platform whose aim is to democratize e-commerce and ensure that small retail firms (Mom-and-Pop stores) will get an equal opportunity to compete with big retail firms. The concept is similar to the Unified Payments Interface (UPI), a digital payments domain developed by the National Payments Corporation of India, where multiple bank accounts is combined into a single digital payment method that facilitates payment mechanisms, similar to Google pay.

In their effort to create an Indian platform market, the Competition Commission of India (CCI) has issued a Suo Moto Order on the social communications app WhatsApp on the premise of possible anticompetitive abuses, from the sharing of personal data with Facebook compromising privacy and weakening control of personal data. The order issued in Case No. 01 of 2021 In Re: ‘Updated Terms of Service and Privacy Policy for WhatsApp Users’ is a policy order (hereafter referred to as the “order”) draws inferences to ‘abuse of dominance’ in a reversal of it’s the CCI’s earlier decisions on Vinod Gupta v WhatsApp (Case No. 99 of 2016) and Harshita Chawla v WhatsApp (Case No.15 of 2020). I do not recall such a categorical order issued by the Commission, and one in complete sync with Government policies. The order marks the beginning of non-price competition by considering a reduction in quality and data degradation as antitrust abuse. In a recent newspaper report the Minister of Electronics and Technology refers to the worldwide movement towards “splinternet” in opposition to the internet currently controlled by Big Tech companies. In referring the Cambridge Analytical scandal that involved Facebook to the High Court of Delhi, the single bench declined to interfere or comment on a subject where the Supreme Court has upheld the constitutional right to a fundamental level of privacy (K. S. Puttaswamy (Retired) and Anr. v. Union of India & Ors., (2015) 8 SCC 735) leaving it up to the CCI to investigate any competition implications of the privacy policies of messaging apps.

The CCI’s order lifts the veil over two policies awaiting government approval: i) the Draft Bill on personal and non-personal data; and ii) the India Data Accessibility and Use Policy 2022 a follow up on the earlier National Data Accessibility Bill 2017 and the Right to Information Bill, 2005

Data localization is also flagged in the current debate on data and privacy as an extension of the support shown to Indian platforms. A code of ethics is on the drawing board, requiring foreign platform markets to confirm their agreement. This attempt by a sovereign power to shape platform markets is an interesting venture, similar in its approach to earlier policies such as import substitution industrialization.

India’s Digital Economy and Indian Platform Markets

The digitalization of business in India has been rapid and widespread. Most firms in India, large and small including local Kirana (grocery) stores, are using digital platforms and operating both offline and online.² It is estimated that there were about 50,000 startups in 2018 as per estimates by the Ministry of Commerce.³ The proliferation of apps and the availability of cheap smartphones produced in the country are both outcomes of digital markets . Consumer surveys estimate that over 68 percent of the population is on the internet.

The dynamism of Indian business firms in the digital space raises two basic questions: i) Is there a need for government intervention? And ii) what is the best form of government intervention as a support policy for platform markets? For the CCI, concerns include access to data and the possible restraints imposed by large platforms acting as Gatekeepers. In a data-driven economy, entry barriers can be erected if access to data is restricted. Anti-competitive measures for dealing with such entry barriers are still in the offing. Meanwhile, rising competitive constraints affecting 50,000 start-ups, especially Fintech companies where data is presumably firewalled and cannot be shared as per the Reserve Bank of India directive, all pose similar questions: When and where should the CCI intervene?

Contradictory answers arise as platform markets become dominant but not necessarily abusive, and there exists a thriving data market for the sale of data as a commodity, with distinctions in competitiveness between three types of markets – i) traditional product markets; ii) platform markets; and iii) data markets. The economics of each market are quite different. Traditional markets covered in standard textbooks are wary of dominant enterprises under the terms in which the Competition Act 02 (CA02) is framed, whereas in platform markets the same binaries are inappropriate. The economics of platform markets are defined by data network effects, where access to large volumes of data facilitates innovation and expansion. These network effects weigh in favor of large or dominant platform markets, while data markets are quasi-public goods.

Data localization is an important part of India’s policy to support Indian platforms for emerging data markets. The advantage enjoyed by India lies in harnessing rich and diverse personal data with implications for health policy. In the pharma sector, for instance, we find manifestations of techno-nationalism regarding data localization, such the ‘Indian data’ a clumsy phrase that flows from the wider moral issues raised by the US FTC and EU regarding the sharing of personal data that dominates the discourse on data protection and rules. The government is also planning to release a code of ethics and a three-tier grievance redressal mechanism to control and monitor platform markets. This code would be applicable to news media, online publishers, and OTT platforms.

Policy Framework – Foreign Direct Investment

The Government of India’s policy towards FDI in platform markets as stated earlier focuses on creating a national platform market and, therefore, restricts platforms such as Amazon to B2B markets only, blocking the company’s famous B2C inventory-based model. The B2B markets includes certain conditions that are not applicable to the B2C inventory-based model of ecommerce. Clause 5.2.15.2.1 of India’s FDI policy implemented:

• Subject to the provisions of the FDI Policy, e-commerce entities would engage only in Business to Business (B2B) e-commerce and not in Business to Consumer (B2C)
• B2B e-commerce entities are not allowed to have inventory storage facilities
• A 25% cap on foreign platforms for purchases from one single local vendor

These clauses on foreign investment have been in the news recently due to the negotiations between Reliance Jio, an Indian Internet platform market and Future Coupons Ltd, a large retailer in which Amazon is a major stakeholder. In order to skirt the conditions imposed on its market-based platform (B2B), Amazon invested in Future Coupons and its related companies while including a ‘non-compete’ clause. Currently, this clause is under litigation between Amazon and Future Coupons, as Reliance Jio seeks to tie up with Future Coupons to expand its platform market in retail sales. Newspapers report that Reliance Jio has taken over the retail outlets owned by Future Coupons in lieu of the latter’s prevailing debt, while Amazon has approached the arbitration courts. Another foreign market platform, Flipkart (Walmart’s B2B venture), has acquired fashion garments retailing company Myntra. Likewise, the Tata group, a large industrial conglomerate, has recently set up an e-commerce platform, ‘Tata Neu.’ Amazon’s investment in Future Coupons was cleared by CCI.

Of the 50,000 startups mentioned earlier, several are fintech firms. Online firms have their own websites and can build their own platform markets. Many of these firms may have also hitched on to major foreign platforms, which include Amazon. The choice depends on whether these startups are leaning towards one-way interaction as in websites or prefer two-way interactions with their customers that generate personal data in the process. It would be interesting to study the factors that determine this choice. These businesses nonetheless create competitive constraints on the five Big Tech companies, besides generating data on consumer preferences. We should also mention ‘Koo’, a social media intermediary similar to Twitter launched by India’s government, which is still seeing limited usage.

Against the backdrop of the Government’s goal of developing Indian platform markets we can consider the CCI’s order on data and privacy directed at WhatsApp and Facebook. A draft policy on data accessibility and usage awaits Parliamentary clearances. The CCI’s order is a forerunner to India’s approach to data privacy.

CCI – The Order and Issues on Data and Privacy

The CCI considered it important to seek information from Facebook and WhatsApp regarding the “potential impact” of the new Policy and Terms for WhatsApp users on a Suo Moto basis, without waiting for a complaint to be filed which is the normal procedure. Under Section 19 of Competition Act, 2003 (“CA02”) , the CCI can institute an “Inquiry into certain agreements and dominant position of enterprise” whether certain practices impact competition and constitute a Section 4(1) abuse of dominance or not.

The CCI’s choice of Section 4 ‘abuse of dominance’ of CA02 and not Section 3 – which deals with agreements that lead to ‘appreciable adverse effect on competition’ – is interesting. First, it confirms that WhatsApp is seen as dominant in social communications messaging services while Facebook is dominant in social media, echoing the subjective assessment of Vinod Gupta (Case no 99 0f 2016) of 55.6% using proxy indicators to determine that 95% of smartphone users have Android installed on their devices. The numbers were corroborated by CCI as intuitively in sync with information available from the public domain in the Over the Top (OTT)messaging apps through smartphones (Para 18-20). Second, and more significantly, the decision protects Indian platform markets from being assessed for ‘abuse of dominance’ as there can be only one dominant enterprise under Indian competition law. By way of clarification for those not familiar with procedures of CCI decisions are known as orders; Two orders are normally issued. Firstly, an initial order or prima facie order which is to the Director General to proceed with investigation if anti-competitive violation is suspected. Secondly, the final order post investigation.

Change in Discourse

What made CCI change its discourse in issuing a Suo Moto Prima facie order for updated terms of service and privacy policy for WhatsApp users? In earlier decisions, such as Vinod Gupta v. WhatsApp (Case no 99 of 2016) the CCI’s view was that the sharing of data by WhatsApp with Facebook falls within the economics of platform markets in generating revenue through targeted advertisements, the issue of dominance and assertion of market power was not seen as especially significant as there are several alternative messaging apps that can be downloaded freely. In the Harshita Chawla v WhatsApp (Case No, 15 of 2020) CCI opined that data sharing and data localization need not be looked at under competition law (the market was defined as the OTT platform for messaging, communications etc.)

CCI considered it important to seek information from Facebook and WhatsApp on the “potential impact” of the new Policy and Terms, and to explore new territories in the area of sharing data and privacy as exploitative and extortionary tools and as “subject matters of examination under the competition law” (Para 13) . The CCI opined that new policies and terms making it mandatory for businesses using WhatsApp to share their data with Facebook was exploitative, as it would strengthen the dominance of WhatsApp in a data-driven economy. Extortionary as actionable conduct has already taken place from a position of dominance.

History of Agreements

The CCI’s order refers to the third agreement issued on February 8, 2021, and not to the two earlier agreements dated August 28, 2016, and December 19, 2019. It is now mandatory for all firms using WhatsApp to accept the terms and conditions in their entirety, including the provision allowing WhatsApp to share information with Facebook. This was not the case in the earlier Agreements. Now, in return for sharing its data, WhatsApp offers users further transparency regarding how WhatsApp collects and uses personal data. The earlier option regarding the sharing of information with Facebook was withdrawn, and all WhatsApp data will now be shared with Facebook. The new terms and policies also removed the 30-day window for agreeing with the terms, included in earlier agreements.

The ‘take-it-or-leave it’ stance taken by the new agreement places consumers in an awkward position, as any social messaging app only has value for users if there is interoperability within the group. Data networks are important to communication apps as they lower the cost of supplying information and are very similar to network economies. Incremental or marginal costs for expanding the consumer base are near zero. Data networks can also create switching costs that dissuade consumers from shifting to other social communications and social media apps. This raises the question of whether communications apps be with new entrants such as Telegram or Search? Multi-homing with consumers downloading different communication apps dilutes the market power of dominant players such as WhatsApp and Facebook, but not their popularity.

One important feature of WhatsApp and Facebook is their usage on a variety of mobile operating systems, including iOS, Android, Windows Phone etc. Facebook is available on smartphones as well as PCs, while WhatsApp essentially is a smartphone app. As an Over-the-Top (OTT) messaging app, WhatsApp has the advantage of sharing data on a one-to-one basis or within a group. In addition to text messages, video clipping, photos etc. can all be shared using these services, establishing greater ease of communication. The app’s convenience ease of use are hard to replace, which has persuaded the CCI to conclude that in India “network effects have indubitably set in for WhatsApp, which undergird its position of strength and limits its substitutability with other functionally similar apps/platforms” (Para 26).

The third privacy agreement widened the scope of data sharing between WhatsApp and Facebook, raising competition concerns. Privacy agreements protect WhatsApp from competition from other apps such as Signal and Telegram. Consumers get locked-in but gain from interoperability. Facebook can restrict access to only members of a group. In WhatsApp’s case, a notification on the app states that data is encrypted from end-to-end, amounting to a privacy agreement. In updating its privacy agreements with businesses, however, WhatsApp diluted the encryption of data privacy as seen in messages sent to users, asking them to permit full data-sharing with Facebook in exchange for full functionality on WhatsApp. The message sent to users contained information on:

• WhatsApp’s service and how they process user data.
• How businesses can use Facebook services to store and manage their WhatsApp chats.
• How WhatsApp is partnered with Facebook to offer integration across Facebook’s full range of Company Products.

CCI tried to elicit the nature of the information used by businesses on WhatsApp to be shared with Facebook. The information on data was broad and vaguely related to:

“transactions and payments data; data related to battery level, signal strength, app version, mobile operator, ISP, language and time zone, device operation information, service related information and identifiers etc.; location information of the user even if the user does not use location related features besides sharing information with Facebook on how user interacts with others” (Para 24).

CCI was apprehensive with this information, as the list is indicative and not exhaustive with words like ‘includes,’ ‘such as,’ ‘For example,’ etc. This suggests that the scope of data-sharing may extend beyond the information categories that have been expressly mentioned in the policy. The CCI held that “opacity, vagueness, open-endedness, and incomplete disclosures hide the actual data cost that a user incurs for availing WhatsApp services” (Para 27).

Control Over Data and Privacy

The core antitrust violation being investigated is control over personal data and the dilution of privacy. Control over personal data is a fundamental constitutional right (Puttuswamy v Union of India) in India’s legal system This right entitles users of WhatsApp to have control over their personal data, including for cross-product processing of their data unless permission is granted by way of voluntary consent …… and not as a precondition for availing WhatsApp’s services. (Para 28). WhatsApp users expect their data to be secure. Sharing data with Facebook compromises said security, and when Facebook uses personal data to build personalized profiles for product development and advertisement quality is compromised too. As for businesses using WhatsApp, their discomfort with sharing data comes from the scope this would allow for WhatsApp to undercut their strategies and thus creating entry barriers, as noted in the order: “Such data concentration may itself raise competition concerns where it is perceived as a competitive advantage”. Such sharing goes beyond the legitimate expectations of consumers.

Privacy agreements mandated by WhatsApp for users are not an example of voluntary consent. The Commission has pointed to the scope granted to a dominant enterprise to compromise on the quality of data. Under competition law, degradation of data and the withdrawal of voluntary consent by allowing ‘opt out’ options is an imposition of unfair terms and conditions on users, violating Section 4(2)(a)(i) of the Act.

There shall be an abuse of dominant position :

(a) Directly or indirectly, imposes unfair or discriminatory –

i) condition in purchase or sale of goods or services;

Likewise, the CCI’s views hold that degradation of quality is an abuse of non-price competition. To quote:

“On a careful and thoughtful consideration of the matter, the conduct of WhatsApp in sharing of users’ personalized data with other Facebook Companies, in a manner that is neither fully transparent nor based on voluntary and specific user consent, appears prima facie unfair to users.”

Issues to Ponder

Government policy to support Indian platform markets raises two basic questions: i) is there a need for Government policy intervention? And ii) What form of Government intervention is best as a support policy for platform markets? The burst of platform markets on digital spaces, with 50,000 startups including Fintech companies and industrial conglomerates such as Reliance Jio or Tata Neu provides no insights on the efficacy of protectionist government policies. Neither has the popularity of Amazon waned despite restrictions placed on foreign investment in the B2B marketplace. Consumer preferences for WhatsApp and Facebook have not diminished with the availability of cheaper smartphones. The presence of competitive constraints has seen WhatsApp woo consumers first with soft agreements, then shifting to harsher versions of ‘take-it-or leave it.’ Google is exploring ways of enabling greater privacy and control over personal data. Maintaining their lead is a challenge for the Big Tech companies, just as much as it is for regulator interventions.

CCI has raised concerns over data and dominance erecting entry barriers and degrading the quality of data. There is no indication, however, on how data privacy should be controlled, or on voluntary mechanisms of control. The arguments in the order are hypothetical, based on assumptions rather than on evidence, as can be seen in the use of terms such as ‘unreasonable collection of data,’ and ‘expansive and disproportionate.’ It suggests that feasible regulatory mechanisms are still nowhere near a workable design.

Under these circumstances it may be appropriate to let consumers and market forces take the initiative. Businesses who are open to sharing their data in order to receive the full functionality of WhatsApp by signing privacy agreements may represent a least-cost approach for the use of social messaging and communications apps with routine business information as the CCI order indicates. The suggestion made by the FTC’s Chairperson and by EU authorities in setting limits to collection of data shifts the debate to the design of algorithms and whether the algorithms can be designed with judgement on good data and bad data. The question of what good data is varies with socio-economic differences, income differences, cultural values, and more. Regulatory intervention over the scope and scale or even oversight of data privacy is restricted when translating normative value into positive action policies. While regulatory oversight is imminent, its implementation and monitoring may have to lean heavily on self-regulation.

The order is also silent on data accessed by Indian platform markets. How is the data stored? Is data localization a viable proposition; is data affected by where it is stored? Who controls the data? Is the firewalling of data used by Fintech companies ordered by the RBI feasible? Enquiries and debates on Indian platform markets or on Amazon open unexplored areas in data privacy. For the regulatory authorities in India, the emerging challenges are in the design of nuanced and selective regulatory approaches, not just for platform markets but for emergent data markets. Data investigations and privacy require research, and hopefully the probe ordered by CCI will fill some of the gaps with empirical evidence to help establish dominance; to prove the appearance of entry barriers.

Click here for a PDF version of the article

1 Former Member, Competition Commission of India.

2 There are wholesale platform markets with apps that work on Android and iOS apps such as Coutloot which helps connect online and offline small seller directly with consumers eliminating the need for middlemen. Emphasis is on small quantities. Coutloot is a D2C direct to consumer market place model.

3 Startup India. India has about 50000 startups in 2018 , 8,900 – 9,300 of these are technology led startups 1300 new tech startups were born in 2019 alone implying there are 2-3 tech startups born every day. Department for Promotion of Industry and Internal Trade, Ministry of Commerce, Government of India