In the beginning of 2021, WhatsApp indicated that they would conduct an update to their privacy policy. This update led to many speculating and stating that user's information would no longer be protected. This update has been rumoured ever since a massive acquisition, which saw Facebook part with $16 billion to become the new owners of the WhatsApp domain.
The update in effect leaves users with no choice but to accept WhatsApp's latest privacy policy. This news was retaliated with a massive influx of negative social media responses by disgruntled users. Most of this was due to rumours that data from the domain could be used by Facebook. Such data includes user's phone numbers, profile names, pictures, last online status and general status messages. Facebook and WhatsApp attempted to silence the rumours by assuring users that this data usage was specific to WhatsApp Business and that it did not apply to non-business WhatsApp. Furthermore, that it only uses data about data (metadata) for marketing.
Extent of POPIA conflict
Any data that a company processes can only be done with prior consent of the user or data subject. Any data that is processed must be data that was intended to be processed by the users when they commenced usage of the app. WhatsApp is required to obtain prior authorisation from South Africa's Information Regulator, in terms of section 57 of POPIA if it intends to process any unique identifiers of data subjects (i.e. WhatsApp users and their personal information) or a purpose other than the purpose for which the unique identifier was specifically intended at collection and more so, with the intention of linking the information together with information processed by other responsible parties (i.e. Facebook).
Even though WhatsApp has assured users that the processing of data will be specific to WhatsApp Business, it must be noted that this is still in non-compliance with POPIA. Information from businesses is also protected, as they fall within the scope and definition of personal information in terms of POPIA.
In order to combat the concerns raised around privacy, WhatsApp stated that they will update users and do a better job around the confusion that has been caused. They intend to use their status feature to update users on any new developments. They further intend to remind users to review the changes to their privacy policy and to accept such changes before continuing to use WhatsApp. Consent is defined in POPIA as any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information. Whether this threshold will be attained by WhatsApp will have to be seen.
WhatsApp is now squarely within the crosshairs of the Information Regulator and time will tell whether the Information Regulator enforces POPIA on WhatsApp come 1 July 2021 or whether WhatsApp will take steps to address these apparent non-compliance issues with POPIA.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
