India tribunal lifts WhatsApp data-sharing ban, upholds Meta fine
The National Company Law Appellate Tribunal (NCLAT) set aside the Competition Commission of India's five-year ban on data sharing between WhatsApp and other Meta group entities.
The tribunal simultaneously upheld the CCI's penalty of Rs 213.14 crore imposed on Meta for abuse of dominant position under the Competition Act, 2002.
The CCI's original order, passed in November 2024, had found that WhatsApp's 2021 privacy policy update forced users to accept expanded data-sharing terms with other Meta companies without providing a genuine opt-out, constituting an unfair condition on users of a dominant platform.
The NCLAT held that the data-sharing ban lacked adequate rationale and that matters concerning data protection and privacy fall outside the CCI's statutory mandate, which is limited to competition concerns.
The case may proceed to further appeal before the Supreme Court on the surviving issues.
Abuse of Dominant Position — Section 4 of the Competition Act, 2002
The Competition Act, 2002 (replacing the older MRTP Act, 1969) does not prohibit dominance itself but prohibits its abuse. Section 4 lists specific abusive conduct by an enterprise or group holding a dominant position in a defined relevant market.
Key Details
- Section 4(2)(a)(i) prohibits directly or indirectly imposing unfair or discriminatory conditions in the purchase or sale of goods or services; the CCI's WhatsApp order was based on this provision.
- Dominance is assessed relative to a "relevant market" (relevant product market + relevant geographic market) under Section 2(r), 19(5)-(7); the CCI defined two relevant markets here — OTT messaging apps on smartphones in India, and online display advertising in India.
- Under Section 27, the CCI can impose a penalty of up to 10% of the average turnover of the enterprise for the preceding three financial years, besides ordering behavioural or structural remedies.
- The Competition (Amendment) Act, 2023 introduced deal-value thresholds for merger notification and settlement/commitment mechanisms for Section 4 cases going forward, though the WhatsApp case predates this amendment's settlement route.
The CCI's Rs 213.14 crore penalty and the finding of abuse of dominance under Section 4 were upheld by the NCLAT, confirming that WhatsApp's data-sharing practice around its 2021 privacy policy amounted to imposing an unfair condition on users of a dominant messaging platform.
NCLAT as the Competition Law Appellate Forum
The National Company Law Appellate Tribunal is the statutory appellate body for orders passed by the Competition Commission of India, a role it inherited after the erstwhile Competition Appellate Tribunal (COMPAT) was merged into it.
Key Details
- COMPAT, originally set up under the Competition Act, 2002, was dissolved and its functions transferred to the NCLAT with effect from 26 May 2017, via amendments made by the Finance Act, 2017 (amending Section 410 of the Companies Act, 2013 and Section 53A of the Competition Act, 2002).
- NCLAT also hears appeals under the Companies Act, 2013 and the Insolvency and Bankruptcy Code, 2016, making it a multi-jurisdictional appellate tribunal.
- Further appeal from NCLAT orders on competition matters lies to the Supreme Court under Section 53T of the Competition Act, 2002, on a question of law.
- The CCI itself is a quasi-judicial statutory body set up under Section 7 of the Competition Act, 2002, with a chairperson and up to six members, tasked with eliminating anti-competitive practices, promoting fair competition, and protecting consumer interests.
The tribunal's power to modify or set aside only part of a CCI order (here, lifting the data-sharing ban while retaining the monetary penalty) illustrates the scope of NCLAT's appellate review over CCI orders under Section 53B of the Act.
Jurisdictional Boundary Between Competition Law and Data Protection Law
A central issue in the NCLAT ruling is the overlap and separation between competition regulation and data protection regulation — two distinct legal regimes now operating in India, especially following the enactment of the Digital Personal Data Protection Act, 2023.
Key Details
- The Digital Personal Data Protection Act, 2023 is India's dedicated data protection statute, to be enforced by the Data Protection Board of India once fully operationalised; it governs consent, purpose limitation, and cross-entity data sharing for personal data.
- Competition law under the Competition Act, 2002 addresses market power and its abuse, not privacy or consent standards per se, though the two can intersect when data practices confer or entrench market dominance.
- Courts and tribunals in India (including in this case) have increasingly had to demarcate which regulator — CCI or the data protection authority — has primary jurisdiction over data-sharing practices of dominant digital platforms.
The NCLAT's reasoning that data-sharing and privacy concerns fall outside CCI's competition mandate reflects this jurisdictional boundary, even as it preserved the CCI's finding of abuse of dominance on the competition-specific aspect of the conduct.
- CCI penalty on Meta: Rs 213.14 crore, imposed by order dated 18 November 2024.
- Statutory provision invoked: Section 4(2)(a)(i), Competition Act, 2002 (abuse of dominant position).
- Original CCI remedy: 5-year ban on WhatsApp sharing user data with other Meta entities for advertising purposes.
- COMPAT merged into NCLAT: effective 26 May 2017 (Finance Act, 2017).
- Further appeal route from NCLAT: Supreme Court, under Section 53T of the Competition Act, 2002.
- Relevant markets identified by CCI: OTT messaging apps (smartphones, India) and online display advertising (India).
- Trigger event: WhatsApp's 2021 privacy policy update mandating expanded data sharing with Meta companies.