UK regulator to write to WhatsApp over Facebook data sharing

Information commissioner says the chat app committed in 2017 not to share contact and user information

The UK’s data regulator is writing to WhatsApp to demand that the chat app does not hand user data to Facebook, as millions worldwide continue to sign up for alternatives such as Signal and Telegram to avoid forthcoming changes to its terms of service.

Elizabeth Denham, the information commissioner, told a parliamentary committee that in 2017, WhatsApp had committed not to hand any user information over to Facebook until it could prove that doing so respected GDPR.

But, she said, that agreement was enforced by the Irish data protection authority until the Brexit transition period ended on 1 January. Now that Britain is fully outside the EU, ensuring that those promises are being kept falls to the Information Commissioner’s Office.

“The change in the terms of service, and the requirement of users to share information with Facebook, does not apply to UK users or to users in the EU,” Denham told the digital, culture, media and sport sub-committee on online harms and disinformation, “and that’s because in 2017 my office negotiated with WhatsApp so that they agreed not to share user information and contact information until they could show that they complied with the GDPR.”

Asked by the committee chair whether there was any more recent agreement than the 2017 one, however, Denham said there was not. “Up until 1 January, it was the Irish data protection authority’s job to oversee the activity of WhatsApp. As long as we were in the transition period, the one-stop-shop meant it was my Irish colleague who was responsible for WhatsApp. That’s changed now.”

The information commissioner also revealed that she uses Signal, a privacy-focused competitor to WhatsApp, for her personal messaging, and does not have an account with either Facebook or WhatsApp.

“What’s really interesting about WhatsApp’s announcement on its ongoing sharing with Facebook is how many users voted with their virtual feet and left the platform to take up membership with Telegram or Signal,” she added.

“Users expect companies to maintain their trust and not to suddenly change the contract that they have with the users, and I think it’s an example of users being concerned about the trustworthiness and the sustainability of the promises made to users.”

The user exodus from WhatsApp began in early July, when the company announced plans to implement a new privacy policy on 8 February. Those plans, which have now been delayed to early summer, caused substantial panic among the app’s users. Some of the concern was around changes that explicitly spelled out, for the first time, the existing data-sharing arrangements between WhatsApp and Facebook outside the “European region”, which includes the EU and UK.

Others were concerned by misinformation, ironically spread on WhatsApp itself, that the new terms of service would allow Facebook to read user messages. That is not the case – the end-to-end encryption applied by WhatsApp prevents Facebook from accessing message contents even if it desired, but the claim spread far enough for WhatsApp to buy advertising declaring: “Neither WhatsApp nor Facebook can read your messages or hear your calls.”

Signal and Telegram, the two big beneficiaries of the panic, have added millions of users each in the first three weeks of January. Signal, which was not in the top 1,000 apps in Britain at the beginning of the year, spent several days as the most downloaded app in the country, and has gained 7.5 million users globally.


Alex Hern Technology editor

The GuardianTramp

Related Content

Article image
WhatsApp sharing user data with Facebook would be illegal, rules ICO
Data protection watchdog forces firm to sign an undertaking declaring it will not share user data with parent company before GDPR

Samuel Gibbs

14, Mar, 2018 @1:33 PM

Article image
WhatsApp, Facebook and Google face tough new privacy rules under EC proposal
European ePrivacy directive revision looks to protect communication confidentiality, block nonconsensual tracking and lessen cookie warnings

Samuel Gibbs and agencies

10, Jan, 2017 @3:54 PM

Article image
EU data watchdog raises concerns over Facebook integration
Irish commission that regulates site requests urgent briefing on platforms merger

Alex Hern

28, Jan, 2019 @5:40 PM

Article image
WhatsApp raises minimum age to 16 for Europeans ahead of GDPR
Facebook-owned messaging service will demand users confirm they are old enough to use app after raising age limit from 13

Samuel Gibbs

25, Apr, 2018 @9:02 AM

Article image
WhatsApp faces EU taskforce over sharing user data with Facebook
Article 29 Working Party steps up action over user consent and privacy following Facebook’s failure to address breaches of EU law

Samuel Gibbs

26, Oct, 2017 @12:14 PM

Article image
France orders WhatsApp to stop sharing user data with Facebook without consent
Messaging app has one month to comply or it will face sanctions for sharing user phone numbers and usage data for ‘business intelligence’ purposes

Samuel Gibbs

19, Dec, 2017 @9:45 AM

Article image
Facebook among 30 organisations in UK political data inquiry
Information commissioner is investigating use of personal information in political campaigns

Alex Hern

05, Apr, 2018 @4:28 PM

Article image
Facebook 'pauses' WhatsApp data sharing after ICO intervention
Information Commissioner’s Office raised concerns over social network’s collection of messaging app’s data

Alex Hern

08, Nov, 2016 @10:12 AM

Article image
WhatsApp design feature means some encrypted messages could be read by third party
Trade-off between security and usability unlikely to permit systematic surveillance, experts say

Guardian staff

13, Jan, 2017 @11:00 AM

Article image
EU charges Facebook with giving 'misleading' information over WhatsApp
Social network could face fine of up to 1% of global turnover in 2014 prompted by privacy policy change for WhatsApp that shared user data with Facebook

Samuel Gibbs

20, Dec, 2016 @2:39 PM