On January 4, 2021, the messaging platform WhatsApp issued a statement reporting certain modifications to its terms and conditions of use that would affect more than two billion registered users, and whose acceptance as of February 8 would be a necessary condition to continue using its messaging service.
The news caused alarm worldwide amid the widespread belief that the modifications included provisions allowing WhatsApp, acquired since 2014 by Facebook, to share the content of messages transmitted through its infrastructure with Facebook itself and other affiliates (such as Instagram), which have been the subject of various criticisms and scandals related to the processing of the personal data of their own users. In this regard, the Mexican regulator on the matter, the National Institute for Transparency, Access to Information and Protection of Personal Data (“INAI”), issued a statement on January 12, 2021, seeking to explain some of the effects of the aforementioned modifications and recommending that its clients carefully read the terms and conditions before granting their consent. For its part, WhatsApp, in response to an alleged wave of misinformation and in the face of a growing number of users who abandoned the application in favor of those of its competitors, issued a second statement on January 15, 2021, extending the deadline to accept the terms and conditions until May 15, 2021. What is the basis for the concern among WhatsApp users? How true is the information circulating among users that it is necessary to switch to other messaging platforms? In reality, and after having carried out an analysis of the changes that WhatsApp intends to implement to its terms and conditions, the stir caused is attributable to misinformation and little knowledge of the scope of the proposed changes. On the one hand, such changes do not modify the manner in which WhatsApp already obtains, accesses, and shares the personal data of its users. The conditions of its privacy policy, established since 2016, already allow WhatsApp to access telephone numbers, usage habits, internet connection location and various aspects of the devices used by its users—but not the content, data and attached documents, or locations, whether fixed or in real time, that users share through the application. Both before and after the modifications in question, this content is not only beyond the reach of Facebook and the other third parties with whom WhatsApp has corporate and commercial ties, but is inaccessible to WhatsApp itself. On the other hand, and even before the reforms, it would not be necessary for users to grant WhatsApp their consent to share any personal data with Facebook or its subsidiaries: since both companies have belonged to the same business group since 2014, they are permitted to exchange the information of their respective users freely, as they fall within an exception provided by the applicable legislation. As a general rule, the content transmitted through WhatsApp is only accessible to the person who sends and the person who receives messages, since it is stored only temporarily and subject to technology known as “end-to-end encryption.” This rule would not be modified by the announced changes, although it is worth noting that WhatsApp's terms and conditions do provide for two exceptions, in which a third party other than the sender and recipient of a message may have access to certain information about it. Such exceptions are: (i) when the user uses certain WhatsApp features relating to financial transactions (a service not yet available in Mexico), in which case the financial intermediaries involved in such transactions are required to share information with certain third parties; and (ii) the engagement of providers by a participant in a WhatsApp conversation to manage the receipt or sending of data messages (e.g., a business user who engages third parties to receive orders and questions from customers or to deliver payment receipts to them), a situation in which the engaged third party could access the private content according to the instructions and purposes of its relationship with the recipient. This latter scenario is the one that has caused the misunderstanding regarding the modifications in question: the amended text of the terms and conditions refers to the possibility that the participant in a conversation subcontract third parties to answer, store, or analyze the messages received in their WhatsApp account, including among such third parties Facebook (a platform whose range of services, as of 2021, will include data storage services that companies may contract to manage and/or store their WhatsApp business account). Although in this case the exchange of messages is no longer considered protected by end-to-end encryption, insofar as a third party would be accessing the messages exchanged between a sender and a recipient, this does not mean that WhatsApp intends to open a previously private channel to Facebook or to any other third party indiscriminately, but rather that its business model allows those who already participate in a closed conversation to share their own information with third parties, provided they so notify their counterpart. The statement issued by the INAI in relation to these modifications is correct in recommending that the user carefully read WhatsApp's terms and conditions and privacy policies before granting any consent in this regard. Both in Mexican legislation and in various foreign laws on the protection of personal data, the fundamental principle of all processing is the informed consent that the owner of the personal data must grant for the use of their personal data. Under this principle, the owner of the personal data has the responsibility to review the terms and conditions before granting their consent, a situation that must be observed not only in the case of WhatsApp but for every application that the user uses, such as Waze, Uber, Facebook or Instagram. In summary, although the modifications that WhatsApp proposes on this occasion do not represent a greater danger to the privacy of its users, it is worth noting that these same users concerned about a possible transfer of their personal data in favor of Facebook frequently make use of other Facebook products or services, or those of other companies, that do not offer the same level of protection as WhatsApp, for the most part having consented to other terms and conditions without even knowing it. In our opinion, it is necessary to promote a culture that encourages the user to make decisions about the use of their personal data based on the prior reading and review of the terms and conditions of any application they use, thus avoiding being victims of rumors and misinformation. The redeeming aspect of the WhatsApp situation is that it invites us to reflect that, now more than ever, users have the responsibility to make properly informed decisions, especially as WhatsApp and other similar applications are increasingly used in the business environment. For further information, please contact our experts: Luis Burgueño, Partner: +52 (55) 5258 1003 | lburgueno@vwys.com.mx Gloria Martínez, Associate: +52 (55) 5258 1014 | gmartinez@vwys.com.mx Rubén Villegas, Associate: +52 (55) 5258 1003 | rvillegas@vwys.com.mx
