HIGHLIGHTS OF THE UPDATE

WhatsApp modified its privacy policy as of 5th January 2021. Considering which some key changes were made in the following areas:

• Additional information has been added on “how WhatsApp use or handle user’s data ” and “processing of user’s data for safety, security and integrity“.

• Improved “communication of the user with business”. As many businesses rely on WhatsApp for communicating with their customers.

• WhatsApp now offers experiences and integrations across Facebook’s family of apps and products.

HEADS UNDER WHICH UPDATES ARE MADE :

Few additions are made by WhatsApp in the Privacy policy, of both, European and outside European Regions.

1. COLLECTION OF INFORMATION BY WHATSAPP

In Both European and Outside European Region

(a) Information provided by the user:

Contacts of the user: While WhatsApp collects contact information of users and non-users. The non-users will remain anonymous to WhatsApp as per the new update.

Transactions and Payments Data: WhatsApp has added and mentions, while the user uses payments services provided by WhatsApp for purchases or other financial transactions. They will process additional information about the user, including payment account and transaction information.

For instance: Information about the user’s payment method, shipping details and transaction amount.

(b) Information provided by Third-party to WhatsApp:

Information provided by subsequent WhatsApp users: WhatsApp mentions that any user, in general, can capture screenshots of user’s chats or make recordings of user’s calls with them, and send them to WhatsApp or anyone else, or post them on any other platform.

User Reports: Any user can report another user and vice-versa. Such as, the other users or third parties may also choose to report users’ interactions and messages with WhatsApp or other Services provided by WhatsApp.

As an instance, while preparing a report for possible violations of the Terms or policies of WhatsApp by the user. WhatsApp tends to collect information on both the reporting user and the reported user.

Businesses on WhatsApp: WhatsApp mentions, that businesses can share the interactions between the business and users with WhatsApp.

The content or messages shared with businesses may be visible to several people in the business.

2. HOW DOES WHATSAPP USE THE INFORMATION COLLECTED FROM THE USER

Outside European Region

To provide WhatsApp Services: Which includes:

• Completing purchases or transactions.
• Connecting WhatsApp Services with Facebook Company Products that user may use.

Safety, Security, And Integrity: WhatsApp uses the information to:

• Combat harmful conduct.
• Protect users against bad experiences and spam.

Business Interactions: WhatsApp says that their new feature allows the user and third parties (Such as businesses), to communicate and interact with each other using the services, such as:

• Catalogues for businesses on WhatsApp through which users can browse products and services and place orders.
• Businesses may send the user notifications of transactions, appointments, shipping products, service updates and marketing.

Such as flight status information for upcoming travel, a receipt for something the user purchased, or a notification when a delivery will be made.

The Messages user receive from a business can also include an offer for something that might be of interest to the user.

In European region

In European areas, the information is used the same as in outside European areas, as mentioned above. Along with Messaging Metadata.

Messaging Metadata consists of information such as user ID or time user sent a message at, used to convey user’s messages or calls.

WhatsApp uses Messaging Metadata:

• For transmitting the communication.
• For operating WhatsApp Services, which includes general traffic management and the prevention, detection, investigation and remediation of failures.
• For ensuring the safety and security of their Services, which includes their availability, authenticity, integrity and confidentiality, and in particular the prevention, detection, investigation and remediation of security incidents, spam, vulnerabilities, malware, and unauthorized use or access to the Services.
• For billing.
• For complying with legal obligations under applicable laws.

3. INFORMATION SHARED BETWEEN USER AND WHATSAPP

In both European and Outside European Region

Third-Party Service Providers: WhatsApp adds, that they work with third-party service providing companies to support their Services, such as:

• Providing technical infrastructure.
• Delivery.
• Marketing of their Services.
• Conducting surveys and research for themselves.
• Protecting the safety, security and integrity of users and others.
• Assisting with customer service.

Third-Party Services: If the user interacts with a third-party service or another Facebook Company Product linked through WhatsApp Services. Such as, when a user uses the in-app player to play content from a third-party platform (like YouTube links), in that process the information about the user, like the user’s IP address and the fact that the user is a WhatsApp user, may be provided to such third party or Facebook Company Product. Such third-party services or other Facebook Company Products, are governed by their terms and privacy policies.

4. HOW WHATSAPP WORK WITH OTHER FACEBOOK COMPANIES

In European region

Since WhatsApp is a part of the Facebook Companies, thereby WhatsApp receives information from and shares information with the other Facebook Companies.

This includes:

• Providing integrations. Such integrations enable the user to connect their WhatsApp experiences with other Facebook Company Products.

For instance, allowing the user to connect their Facebook Pay account to pay for things on WhatsApp or enabling the user to chat with their friends on other Facebook Company Products by connecting the user’s WhatsApp account.

Outside European region

Since WhatsApp is a part of the Facebook Companies, thereby WhatsApp receives information as part of the Facebook Companies.

The information that WhatsApp share with Facebook companies, is used on WhatsApp’s behalf and according to their instructions. Facebook companies cannot use such information for personal purpose.

5. ASSIGNMENT, CHANGE OF CONTROL, AND TRANSFER

Outside European Region

In case of a merger, acquisition, restructuring, bankruptcy, or sale of all or some of the assets of WhatsApp. WhatsApp will share users’ information with the successor entities or new owners in accordance with the data protection laws.

6. MANAGING AND RETAINING USER’S INFORMATION

WhatsApp mentions that they store users’ information for as long as it is necessary for the purposes identified in their Privacy Policy.

Outside European Region

Some purposes include:

• Providing their Services.
• Legitimate purposes. Such as complying with legal obligations, enforcing and preventing violations of their Terms, or protecting or defending their rights, property and users.

The Retention periods are decided and determined, depending on the case-to-case basis. In some cases factors include:

• The nature of the information.
• Why it is collected and processed.
• Relevant legal or operational retention needs.
•  Legal obligations.

In European Region

Some purposes include:

• Legal Obligations, Issues and legal reasons.
• To enforce and prevent violations of their Terms.
• To protect rights, property and users.
• Operational Retention Needs, such as if a message is not delivered immediately, it is kept in encrypted form on WhatsApp servers for up to 30 days as WhatsApp try to deliver it, after which it is deleted.

Generally, WhatsApp does not retain users’ messages once they are delivered. They are deleted from the servers soon after.

• Messaging Metadata is retained until it is no longer needed for transmitting the communication and operating WhatsApp Services. To ensure the safety and security of WhatsApp Services, billing or to comply with legal obligations under applicable law.

The user can also further manage, change, limit, or delete their information, through the following tools:

• Blocking the contact.
• Deleting the WhatsApp Account at any time using the in-app delete my account feature. Once the deletion process is initiated, that account can no longer be logged in.

What happens to users’ Information when user Delete their Account?

When a user deletes their account, WhatsApp claims to delete all the information they have about the user. WhatsApp adds, that they, retain certain information in these circumstances:

• Certain logs: In order to maintain the security of Services. To analyse or investigate a security incident or vulnerability.
• Certain log records remain in WhatsApp’s database but are disassociated from personal identifiers and are no longer linked to the user’s account.
• Legal Obligation: When there is a legal obligation to retain data, to enforce and prevent violations of WhatsApp Terms or if necessary to protect their rights, property and users.

In case the user only deletes the WhatsApp app from their device without using the in-app delete my account feature of WhatsApp, the user’s information tend to be stored with WhatsApp for a longer period.

Information such as user’s messages that remain undelivered, account info and profile photos are deleted from the servers of WhatsApp and the user is removed from all WhatsApp groups. But it takes up to 90 days from the beginning of the deletion process to delete the WhatsApp information.

7. LAW,  RIGHTS OF WHATSAPP AND PROTECTION

Outside European Region

WhatsApp access, preserve and share users’ information collected by them if they have a good-faith belief that it is necessary in order to prevent death or imminent bodily harm.

In European Region

WhatsApp access, preserve and share user’s information with third parties. This includes sharing with regulators, law enforcement, other government agencies, industry partners and others.

8. GLOBAL OPERATIONS OF WHATSAPP

Outside and in European Region

The information of the user’s stored with WhatsApp is shared globally, both internally within the Facebook Companies and externally with their partners and service providers, and with those with whom users communicate around the world, in adherence with WhatsApp Privacy Policy.

For Instance: User’s information can be transferred, transmitted, stored and processed in:

• The United States;
• Countries or territories where the Facebook Companies’ affiliates and partners and service providers are located.
• Any other country or territory globally, where WhatsApp Services are provided outside of where the user lives.

WhatsApp uses the global infrastructure and data centres of Facebook. Including in the United States.

The countries or territories to which the user’s information is transferred may have different privacy laws and protections than what users have in their home country or territory.

In European Region

WhatsApp says that these transfers are necessary to provide their Services. For the transfers made to third countries, WhatsApp uses standard contractual clauses approved by the European Commission, or otherwise rely on the European Commission’s adequacy decisions about certain countries, through which the European Commission recognises that a third country, territory, or one or more specified sectors within that third country ensure an adequate level of protection, or use equivalent mechanisms provided under applicable data protection law, as applicable.

For data transfers from the European Economic Area to the United States, WhatsApp relies on standard contractual clauses.

For an overview of the privacy policy of WhatsApp, Click here.

REFERENCES

• Key Updates, WHATSAPP (May 08, 2021, 11:00 AM), Key Updates – January 04, 2021 (whatsapp.com)