In one of the most closely watched digital rights cases in recent years, the Supreme Court of India is currently hearing appeals involving Meta Platforms and its messaging service WhatsApp over alleged breaches of data privacy linked to WhatsApp’s controversial 2021 privacy policy. At the heart of the dispute is the Competition Commission of India’s (CCI) finding that WhatsApp’s policy coerced users into accepting sweeping data-sharing terms with Meta entities—offering no meaningful opt-out and forcing users to accept broad data sharing with Meta—to be unfair and abusive in violation of competition law and the Digital Personal Data Protection Act 2023. As a result, CCI imposed a ₹213.14 crore/17 million GBP penalty on Meta and directed substantial changes to data handling and consent mechanisms.
As regulators and courts scrutinise consent, data sharing, and market dominance, organisations must proactively embed privacy governance into decision-making. This is where Data Protection Officers (DPOs) become indispensable, playing a key role in ensuring compliance by:
- Making privacy a core governance issue: DPOs should be positioned as independent advisors reporting to senior leadership or the board, empowered to challenge business decisions that create privacy or competition risks. Early involvement prevents “take-it-or-leave-it” policies that courts increasingly view as coercive.
- Designing consent mechanisms: the Meta–WhatsApp case highlights judicial intolerance for manufactured consent. DPOs should ensure that:
- consent is freely given, granular, and revocable;
- access to essential services is not conditioned on unnecessary data sharing; and
- consent notices are clear, concise, and understandable, not buried in legal jargon.
Regular consent audits led by DPOs can identify dark patterns or coercive design before regulators do.
- Mapping and minimising data sharing: cross-platform and intra-group data sharing are a core concern. DPOs should oversee:
- comprehensive data-mapping exercises;
- strict purpose limitation and data minimisation; and
- internal approvals for any data sharing that goes beyond the original user expectation. If data sharing cannot be clearly justified, it should not proceed.
- Embedding privacy-by-design and DPIAs: DPOs should mandate Data Protection Impact Assessments (DPIAs) for high-risk processing activities, particularly when introducing new policies, Artificial Intelligence systems, or monetisation models. DPIAs help organisations anticipate regulatory concerns and demonstrate accountability if challenged.
- Aligning competition and privacy compliance: the Meta case shows how privacy practices can trigger competition law liability. DPOs should collaborate with antitrust and legal teams to assess whether data practices reinforce market dominance or unfairly restrict user choice.
- Maintaining transparent regulator engagement: proactive engagement with regulators, rather than defensive litigation, often mitigates enforcement risk. DPOs can act as trusted points of contact, ensuring consistency and credibility in regulatory communications.
As this case unfolds, the message is clear – companies, with DPO support, must place user autonomy and privacy at the centre of digital services as a strategic imperative, not as a legal afterthought. As an experienced DPO, HewardMills is here to help organisations achieve long-term digital growth and user trust, whilst managing risks, by embedding and enforcing privacy-first measures. Contact us to find out more.
