WhatsApp in its privacy policy describes the types of information it receives, collects, uses and shares. WhatsApp acknowledges that other than the standard practices laid down in their privacy policies for data practices, they adhere to the laws, regulations and standards of the country in which the user’s information is stored or processed.
WhatsApp mentions that user’s privacy is by default in these instances:
- End to end encryption: The Conversations in WhatsApp through messages or calls stay between the users. No one else can read or listen to its content. Not even WhatsApp.
- Messages are stored on the user’s device: The user’s messages belong to him. WhatsApp does not share them with advertisers.
WhatsApp has divided its services according to regions i.e. European region and the non-European region.
If the user lives in the European region, the services are provided by WhatsApp Ireland Limited, being the controller responsible for the user’s information when they use WhatsApp.
If the user lives in any other country except the European region. The services are provided by WhatsApp Inc. Who is the data controller responsible for the information of the user.
What kind of information is collected by WhatsApp from the user?
WhatsApp collects different kinds of information from European region users and outside European region users.
- There is information which the user himself provides to WhatsApp while using their service. Such as:
- Information related to the User’s account. Such as mobile phone number, all the contacts in the contact book, profile name, profile picture and status message.
- WhatsApp collects information about users’ online and last seen status. Along with the updated status message.
- If the user uses payment services, WhatsApp processes purchase and transaction information thereto.
2. WhatsApp automatically collects certain information from the user. Such as:
- If a transaction has been made by the user for using WhatsApp services, it may receive payment receipts. Such receipts can be from the app store or any other third party.
- The user’s activity is recorded by WhatsApp. Such as the user’s log files. All of these includes information about when the user registered to the services. Along with features used by the user such as messaging, calling, status or group features, profile, about, whether the user is online when the user last used the service.
- Information of Device, from which the user access WhatsApp. Such as operating system, model of the device, battery level, signal strength etc.
- User’s Location. When a user shares his location information with his contacts, or when the User views nearby locations. For troubleshooting problems faced by the user.
- User’s choices and Preferences through Cookies.
3. WhatsApp also collects information about the user from third parties. Such as:
- Subsequent User’s.
WhatsApp requires each user and business to have lawful rights to collect, use or share user’s information before providing any information to WhatsApp.
- Third-Party Service Providers. For instance: the app store may provide a report to WhatsApp to fix service issues.
- If the user uses third-party services with WhatsApp as a medium. WhatsApp may receive information from them about the user. For instance: if the user shares a news article from a news channel to a WhatsApp group or any service.
*WhatsApp says that if the user uses a third-party service. The third-party services terms and privacy policies will govern the use of those services
- These businesses on WhatsApp provides information about their interaction with WhatsApp.
How does WhatsApp use the collected information from the user’s in the European region and Outside the European region?
WhatsApp says that they use the information collected by the user to:
- Provide safety and security by verifying accounts and their activities,
- Marketing of their services and Facebook family companies,
- For commercial purposes,
- Operation,
- Providing customer support or fixation of problems,
- Improve,
- Understand,
- Support and
- Market their services.
WhatsApp joined the Facebook family of companies in 2014. WhatsApp mentions that It receives and shares information from and with the family companies. WhatsApp may use the information they receive from the family companies and vice-versa. WhatsApp informs that in such process, user’s WhatsApp messages will not be shared in Facebook and Facebook will not use WhatsApp messages for any purpose other than assisting in providing services.
Affiliated Companies, WhatsApp Privacy Policy
Last modified: July 20, 2020
How can the user manage his information in Europe and outside the European region?
By limiting or deleting the information through settings.
- Through block feature.
- By changing the mobile number, profile name, profile picture or status anytime.
- By deleting the WhatsApp account. (Deleting the account just limits further sharing of information. What is shared cannot be reversed)
Can WhatsApp collect, use and share users’ information for the purpose of law and protection in European and Outside European region?
Yes, if WhatsApp believes in good faith that it is reasonably necessary to do so. These are the circumstances in which WhatsApp may respond:
In the case of government requests, legal process or adherence to applicable law or regulations.
- Enforcement of terms and policies of WhatsApp. (For investigation of violations)
- Detection, investigation, prevention of any fraud or illegal activity.
- Protection of rights, property or safety of users. (WhatsApp and Facebook companies)
- For prevention of death and imminent bodily harm. (Applies to the European region only)
LEGAL FRAMEWORKS FOR EUROPEAN REGIONS
European region adheres to The General Data Protection Regulation (GDPR).
GDPR is the legal base for processing user’s information:
WhatsApp collects, uses and shares the information mentioned above.
- To fulfil their terms
- Inconsistency with user’s consent. Which is revocable anytime.
- To comply with legal obligations.
- To protects the vital interest of the user and others.
- In the necessity of public interest.
- In the necessity of legitimate interest of WhatsApp. Along with WhatsApp’s interest in providing innovative, relevant, safe and profitable service to users and partners.
Exception: Unless the interests mentioned above infringe the user’s interest, fundamental rights and freedom require the protection of personal data.
How can the users exercise their rights?
Under GDPR or other applicable laws.
- The user has the right to access, rectify, port and erase his information.
- The user has the right to restrict and object to certain processing of his information. Such as when information is processed by WhatsApp for direct marketing (can be blocked by using block feature of the app or by using unsubscribe link), performing a task of public interest or pursuing their legitimate interest or third party.
Such an objection will be considered and processing of the user’s information will be ceased. Unless such processing is based on legitimate grounds or legal reasons.
LEGAL FRAMEWORKS FOR THE NON-EUROPEAN REGION
There are certain frameworks WhatsApp adheres to while preserving the privacy of the user in the Non-European Region.
1. EU-U.S. PRIVACY SHIELD FRAMEWORK AND THE SWISS-U.S. PRIVACY SHIELD FRAMEWORK:
WhatsApp Inc. has certified to the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework with the U.S. Department of Commerce. With regards to the collection and processing of personal data from their business partners in the European Union and Switzerland.
The primary function of the EU US and EU-Swiss privacy shield is to create a legal framework that can facilitate easy transfer/processing of personal data from the EU to the US or EU to Switzerland.
2. THE CALIFORNIA CONSUMER PRIVACY ACT OF 2018 (“CCPA”):
This act applies to California residents only. The CCPA gives consumers more control over the personal information that businesses collect about them. This landmark law secures new privacy rights for California consumers.
Under CCPA, the user has the right to access personal information WhatsApp has collected during the last 12 months from them. The user also has the right to request the deletion of personal information collected from the user.
All the manual requests need verification of identity. This is fulfilled by providing the following information:
- User’s the full name
- Email address
- User’s WhatsApp phone number
- Phone model (for example, iPhone 8 or Samsung Galaxy S10)
- The software version of the user’s phone’s operating system.
- Whether the user is a California consumer according to Cal. Civ. Code Sec. 1798.140(g).
If the user would like to know the specific pieces of Personal Information that WhatsApp have collected about him or to delete his Personal Information, the user will need to provide the following additional information to verify his identity:
- A phone bill or similar proof of ownership of the WhatsApp number.
3. THE BRAZILIAN GENERAL DATA PROTECTION LAW (THE “LGPD”): THIS LAW APPLIES TO PERSONAL DATA PROCESSING ACTIVITIES UNDER BRAZILIAN LAW:
The LGPD believes in creating a new legal framework for the use of personal data in Brazil (both online and offline).In both the private and public sectors.
Under the Brazilian General Data Protection Law (the “LGPD”), the user has the right to access, rectify, port, erase and confirm the data processing by WhatsApp.
In certain circumstances, the user also has the right to object to and to restrict the processing of his data.
REFERENCES
- WhatsApp privacy policy, WHATSAPP (05 Nov. 2020, 09:30 PM), https://www.whatsapp.com/legal/privacy-policy.
- WhatsApp privacy policy, WHATSAPP (05 Nov., 2020, 10:00 PM), https://www.whatsapp.com/legal/privacy-policy-eea?eea=1.
- The Brazilian General Data Protection Law.
- The California Consumer Protection Act of 2018.
- The General Data Protection Regulation of 2018.
- EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework :
Disclaimer: “Vestralex assumes no responsibility or liability for any errors or omissions in the content of this Article. The information contained in this article is provided on an “as is” basis as sourced with no guarantees of completeness, accuracy, usefulness or timeliness. This article contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. This article and the information contained herein is not intended to be a source of advice or analysis with respect to the material presented, and the information and/or documents contained in this article do not constitute advice. All copyrights and trademarks contained herein are properties of their respective owners, any representation of such rights and marks is purely for informational purposes only. This article is not a substitute for professional legal advice. This article does not create an attorney-client relationship, nor is it a solicitation to offer legal advice.”
Vestralex Winter Internship Program
Vestralex Winter Internship Program (VWIP) is an initiative undertaken by Vestralex to help raise legal literacy and general awareness about practices and procedures in law through intern participation and content creation.
