In September 2016, WhatsApp started to share personal information with its mother company Facebook. The Federation of German Consumer Organisations (vzbv) is fighting for WhatsApp to respect your privacy.
Imagine
You would like to use a specific messenger service on your mobile phone and therefore share your phone number with this provider. Maybe you have checked the company and felt that your data is handled safely. But this company then merges with a social media platform. They state that they are not going to share data with each other.
You feel reassured – but this is not exactly what is going to happen. A few months later, you receive a ‘friends’ request from your boss. Don’t get me wrong, you have a good relationship, you work well together and you do not mind instant messaging with him when needed. But on the social media platform you post more personal experiences, for your friends and family. To keep these private, you use a pseudonym. Now, that the messenger service has shared your data with the social media platform, they were able to connect the two profiles and found your pseudonym – and so did your boss.
Facebook’s acquisition of WhatsApp
Sounds familiar? This is what happened after Facebook acquired WhatsApp. Although WhatsApp had promised not to share its user data with Facebook at the time of the acquisition in 2014, it changed its mind in September 2016. WhatsApp users had to decide either to accept the new general terms and conditions or to stop using the service. For users, this is not a choice.
This is already the second case vzbv has initiated against WhatsApp.
Decisions are being taken for you
The problem is that WhatsApp collects all the contacts that are saved in your smartphone and uploads them to its servers. This means that your friends who decide – often on purpose – not to use Facebook, cannot prevent Facebook from getting hold of their personal data.
In Germany, around 35 million people use WhatsApp. This is nearly half of the population. Worldwide, this number rises to 1 billion users. At the same time, 84 percent of the German population feel that WhatsApp and Facebook collect too much data. 51 percent would prefer to pay for good services that offer high standards of data protection and no advertisements.
But let’s forget for a moment about the huge amount of personal data Facebook collects and processes around the world and focus on whether we want a single company to control all of this information. The right to privacy is a fundamental right in the European Union (EU), enshrined in the EU Charter of Fundamental Rights. It is laid out in detail in the data protection Directive (1995/46/EC) that is implemented in national law. One of the most fundamental principles of this Directive is that individuals have to give their consent for their personal data to be collected and processed. Similarly, if it is being shared or processed for other purposes than originally agreed, you need to get people’s consent. Clearly, WhatsApp does not have that consent – it is not even asking for it.
Confronting big players
The Federation of German Consumer Organisations (vzbv) is therefore taking legal steps to enforce consumers’ right to privacy. With the early implementation into German law of the right to file legal actions independently from individual complaints, laid down in the new EU data protection Regulation ((EU) 2016/679), vzbv can bring infringements on data protection laws to court.
In September 2016, vzbv formally warned WhatsApp not to share its data with Facebook. Since WhatsApp did not sign a cease and desist letter, vzbv is now considering the filing of an injunction in court to make WhatsApp comply with data protection law.
The problem is that WhatsApp collects all the contacts that are saved in your smartphone and uploads them to its servers. This means that your friends who decide – often on purpose – not to use Facebook, cannot prevent Facebook from getting hold of their personal data.
This is already the second case vzbv has initiated against WhatsApp. In a previous court action, a German court had decided that terms and conditions of services targeting German consumers have to be in German. WhatsApp had originally published its general terms and conditions only in English. In addition, the court obliged WhatsApp to provide at least two different ways for consumers to get in touch.
European Commission also watching closely
WhatsApp’s announcement to share user data with Facebook also alerted the European Commission. The Commission had cleared the merger but explicitly took into account that WhatsApp would not share data with Facebook. A European Commission spokesperson confirmed in September 2016 that the Commission is now reassessing this decision as the grounds for it have changed. For vzbv, it is crucial that the European level continues to play a role in enforcing consumers’ right to privacy. WhatsApp offers its services across the EU – not only to German consumers. But even a successful court case in Germany will not have an EU-wide effect.
This was a guest blog by Klaus Müller who is the Executive Director of The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e.V. – vzbv).