On March 4, 2021, communications platform WhatsApp announced certain changes to its terms and conditions of use that would affect more than two billion registered users, and whose acceptance as of February 8 would be a prerequisite to continue using its messenger service.
The announcement caused global alarm due to the widespread belief that the changes would include provisions permitting WhatsApp, acquired by Facebook in 2014, to share the content of messages transmitted through its infrastructure with Facebook and other affiliates (such as Instagram), which have been subject to criticism and involved in various scandals related to the processing of the personal data of their users.
In this respect, the Mexican regulator, the National Institute for Transparency, Access to Information and Personal Data Protection (“INAI”) issued a statement on January 12, 2021 attempting to explain some effects of those changes and recommending that users of the app carefully read the amended terms and conditions before giving their consent. WhatsApp, in response to a tidal wave of alleged disinformation and faced with a growing number of users abandoning the platform in favor of those of its competitors, issued a second press release on January 15, 2021, extending the period to accept the terms and conditions until May 15, 2021.
Are the worries of WhatsApp users warranted? How true is the information circulating among the public that it could be necessary to move onto other messaging platforms? The actual truth, once having analyzed the changes that WhatsApp intends to implement in its terms and conditions, is that the uproar is backed only by disinformation and a lack of awareness of the scope of the proposed changes. On the one hand, such changes do not change the way in which WhatsApp already obtains, accesses, and shares the personal data of its users to date. The terms of its existing privacy policy, established since 2016, already allow WhatsApp to access the telephone numbers, usage tendencies, general location of internet connection, and different aspects of the devices used by its users- but not the content, attached data and documents, or specific locations, either fixed or in real time, which users share through the app. Both before and after implementation of the changes being discussed, such content is not only beyond the reach of Facebook and other third parties with whom WhatsApp has corporate and commercial ties, but is also inaccessible to WhatsApp itself. Furthermore, and even before the amendments in question, it would not be necessary for users to give WhatsApp their consent to share any personal data with Facebook or its subsidiaries; insofar as such companies have belonged to the same corporate group since 2014, they have been permitted to exchange the information of their respective users freely because they fall under an exception established under the applicable law.
As a general rule, content transmitted through WhatsApp is only accessible to the person sending and the person receiving the messages, since it is stored only temporarily and protected by a technology known as “endto-end encryption”. This rule will not be affected by the announced changes, although it should be mentioned that WhatsApp’s terms and conditions do establish two exceptions by which a third party different from the sender and recipient of a message may access certain information related to their private conversations. These exceptions include: (i) the use of certain WhatsApp functions referring to financial transactions (a service not yet available in Mexico), in which case the financial intermediaries involved in such transactions must be able to access and share information with certain third parties; and (ii) the contracting of providers by a participant in a WhatsApp conversation to handle the reception or sending of data messages (e.g., a commercial user that contracts third parties to receive client orders and questions or to deliver payment receipts to clients), in which case the third-party contractor could access private content according to the terms and purposes of its relationship with the participating party.
This second scenario is the root of the misunderstanding regarding the changes in question: the amended text of the terms and conditions refers to the possibility that a participant in a conversation subcontracts third parties to answer, store or analyze messages received in its WhatsApp account, with such possible third parties including Facebook (a platform whose array of services will include, as of 2021, data storage services which companies may contract to manage and/or store their WhatsApp business account). While in this case the exchange of messages would no longer be considered as protected by end-to-end encryption, because a third party would be able to access the messages exchanged between a given sender and recipient, this does not mean that WhatsApp intends to open a previously closed channel to Facebook or to any other third party indiscriminately; rather, only that its business model allows those who already participate in a closed conversation to share their own information with third parties as long as they inform their counterparty.
The statement issued by the INAI in relation to these changes is right to recommend that users carefully read WhatsApp’s terms and conditions and privacy policies before agreeing to the same. Under both Mexican and various foreign laws regarding personal data protection, the fundamental principle of all data processing is the informed consent which the owners of personal data must grant others prior to their personal data being processed. Under such guiding principle, data owners have the responsibility of reviewing terms and conditions before granting their consent: a rule which users should observe and keep in mind not only in the case of WhatsApp but for every application that they may take advantage of, whether it be Waze, Uber, Facebook or Instagram.
In summary, while the changes that WhatsApp proposes on this occasion do not pose any substantial danger to the privacy of its users, it should be noted that users worried about a possible transfer of their personal data to Facebook frequently already make use of other Facebook products or services, as well as those of other companies that do not offer the same level of protection as WhatsApp, largely having consented to their corresponding terms and conditions without understanding the same.
In our opinion, it is necessary to promote a culture which incentivizes users to make truly informed decisions on the use of their personal data by reading and reviewing the terms and conditions of any app they may use, thereby avoiding becoming victims of rumors and disinformation. WhatsApp’s current situation invites us to reflect on how, now more than ever, users have the responsibility to make correctly informed decisions, especially to the extent that WhatsApp and other similar applications are used ever more frequently in a business environment.
To obtain additional information, contact our experts:
Luis Burgueño, Partner: +52 (55) 5258 1003 | lburgueno@vwys.com.mx
Gloria Martínez, Associate: +52 (55) 5258 1014 | gmartinez@vwys.com.mx
Rubén Villegas, Associate: +52 (55) 5258 1003 | rvillegas@vwys.com.mx