The rapid emergence and evolution of technology has created a new world of cyber world. As the world’s information technology has advanced, it has created a vast opportunity for people to access and store their personal data. Unfortunately, this has led to the inevitable misuse of this technology, which has resulted in various cybercrimes being carried out at both the domestic and international levels. Today, social media has become a vital part of our lives. It has transformed our lives by allowing us to create our own content and share it with our friends. Before, there were various print media outlets that we could rely on such as newspapers, television, and radio. However, now, with the rise of social media, users can now create their own content and spread it with thousands of people. The rise of social media has allowed people to interact with each other regardless of their backgrounds or professional interests. It has also become a platform for cybercrime. Therefore, it is important that the government has the necessary tools to protect the privacy of our information. The field of social media law is a growing area of law that covers both civil and criminal aspects. It commonly deals with issues related to the hosting and transmission of user-generated content. Due to the nature of social media, various legal issues have been raised regarding its privacy and protection. Some of these include the right of third parties to use photos without the permission of the individuals depicted. Other issues include defamation and advertising law. Social media platforms have a direct relationship with privacy laws. Social media platforms collect and process vast amounts of personal data from their users, including information such as names, email addresses, location data, browsing habits, and social connections. This data can be used for targeted advertising, personalization of content, and other purposes.Privacy laws aim to regulate how social media platforms handle this personal data, ensuring that individuals’ privacy rights are protected. These laws typically require social media platforms to:
1. Obtain user consent: Platforms must inform users about the types of data collected, the purposes for which it will be used, and any third parties with whom it may be shared. Users should have the ability to provide or withdraw consent freely.
2. Data protection and security: Platforms must implement appropriate technical and organizational measures to safeguard personal data from unauthorized access, disclosure, alteration, or destruction. This includes ensuring the integrity, confidentiality, and availability of the data.
3. User rights and transparency: Privacy laws often grant individuals certain rights, such as the right to access their personal data, the right to rectify inaccuracies, the right to data portability, and the right to erasure (also known as the right to be forgotten). Social media platforms must provide mechanisms for users to exercise these rights and be transparent about their data practices.
4. Data breach notification: In the event of a data breach that poses a risk to individuals’ rights and freedoms, social media platforms are generally required to notify the affected users and relevant authorities within a specified timeframe.
5. Cross-border data transfers: Some privacy laws impose restrictions on transferring personal data outside of the jurisdiction unless certain conditions are met, such as ensuring an adequate level of protection or obtaining user consent.
The social media platforms need to obtain explicit consent and authorization from all the users about processing the personal data of the users. In order to obtain such consent, websites usually incorporate the required terms and conditions within the Privacy Policy or General Terms and Conditions of the website. It is often noticed that the users agree to the Terms and Conditions of the website without even reading it properly and thereby end up giving consent for data sharing or data processing. Such consent is typically a result of lack of attention and lack of awareness from the user’s end.
The social media applications or platforms tend to employ Standard Contracts wherein the other party or the user in this case, does not have the option to negotiate or alter the terms of the contract. Therefore, as a result, the users compulsorily need to accept the Terms and Conditions or Privacy Policy in order to use the particular social media application or website.
Several social media giants such as WhatsApp, Instagram, Facebook, Telegram, etc. have such Terms and Conditions which mandatorily need to be accepted and acknowledged by the users. However, on the broader aspect, the aforementioned Terms and Conditions or Privacy Policies end up violating the fundamental Right to Privacy of the users and puts the user information at risk for breach or exploitation. Due to the lack of Data Privacy Legislation in the country, the social media platforms stand largely unregulated from the aspect of data privacy and consumer data protection.
All the websites use “cookies” to track the personal information of the users, which is thereafter used to display advertisements to the target audience. Cookies remember and store the personal information of the user, after taking consent from the user, and thereafter track the user activities as and when the user visits the particular website. Use of such intricate technological advancements shall be regulated once the Personal Data Protection Bill, 2019 (PDP Bill) is enacted.
The PDP Bill which is expected to become India’s first Data Protection law soon is unquestionably a move in the right way. The purpose of the PDP Bill is to regulate the collection, usage, storage, and transmission of personal data of individuals, i.e., the Data Principals, by commercial organizations and governments, which fall under the ambit of Data Fiduciaries.
It is essential that users have certain rights against Data Fiduciaries in a data protection framework that claims to be rights-based. Users shall be entitled to the Right to Confirmation and Access, the Right to Rectification and Deletion, the Right to Data Portability, and the Right to be Forgotten under the PDP Bill. It’s worth noting that the specific requirements and regulations can vary between countries and regions. The GDPR, as mentioned earlier, is a comprehensive privacy regulation that applies to social media platforms operating within the European Union. Other countries, such as India, the United States, and Brazil, have their own privacy laws that social media platforms must comply with when operating in those jurisdictions.
Data privacy is an evolving issue in the present-day Internet-driven society. As companies and multi-national conglomerates collect information from and about online users in bulk, and as the government seeks greater access and surveillance capabilities, it is critical that India prioritizes privacy and implements strong safeguards to protect the privacy of both Indian citizens and foreigners whose data resides in India temporarily or permanently.
Overall, privacy laws play a crucial role in shaping how social media platforms handle and protect users’ personal data, ensuring accountability, transparency, and respect for individuals’ privacy rights. The PDP Bill is the need of the hour, so that the data processing and sharing mechanism is strictly regulated. The alarming potential of these social media platforms to collect endless amounts of information from their users without their knowledge or agreement, along with the users’ lack of attention in this respect, is what privacy activists are most concerned about.
Dr S. Krishnan is an Associate Professor in Seedling School of Law and Governance, Jaipur National University, Jaipur. Aastha Singhal is an Advocate with Rajasthan High Court, Jaipur.