South Africa’s Information Regulator (IR) says WhatsApp cannot share user information with Facebook without its authorization and has raised concerns that African users are receiving significantly lower privacy protection than users in the European Union (EU).

The Information Regulator put out a statement this week saying it was concerned with WhatsApp’s planned changes to its privacy policy, initially set to come into force in early February but later pushed back to May.

In January, the messaging app received a lot of backlash after telling users it was updating the policy leading to concerns over the company’s data sharing practices with parent company, Facebook.

The app saw a mass exodus of users, including many in SA, who decided to delete it and opt for rival messaging services like Signal and Telegram.

WhatsApp has since made several statements trying to clarify the policy saying it will not affect the privacy of user messages with friends or family.

“The changes are related to optional business features on WhatsApp, and provides further transparency about how we collect and use data,” the messaging app said in a blog post.

However, SA’s Information Regulator this week wrote a letter to Facebook South Africa stating some of the concerns that it has about the privacy policy of Facebook as it relates to the country.

“WhatsApp cannot without obtaining prior authorisation from the IR in terms of section 57 of Protection of Personal Information Act (POPIA), process any contact information of its users for a purpose other than the one for which the number was specifically intended at collection, with the aim of linking that information jointly with information processed by other Facebook companies,” the Information Regulator said in a statement.

A WhatsApp spokesperson said that the company was reviewing the letter from the local authority.

“To be clear, this update does not expand our ability to share data with Facebook and does not impact the privacy of your messages with friends or family wherever they are in the world,” the spokesperson said.

“WhatsApp does not share your contacts with Facebook and that policy applies to users everywhere, including in South Africa. We remain fully committed to delivering secure and private communications for everyone,” they added.

However, most users have probably already had data, like their phone number and profile name, shared with Facebook since about 2016, unless they manually opted out during a short period when that was allowed.

The SA regulator also said it was concerned that citizens of the EU “will receive significantly higher privacy protection” than people in South Africa, and Africa in general.

“We are very concerned about these different standards that apply to us; our legislation is very similar to that of the EU. It was based on that model deliberately, as it provides a significantly better model for the protection of personal information than that in other jurisdictions. We do not understand why Facebook has adopted this differentiation between Europe and Africa,” said Pansy Tlakula, chairperson of the Information Regulator.

She was alluding to the fact that EU WhatsApp users have a different terms of service and privacy policy than in the rest of the world, due to the strict General Data Protection Regulation (GDPR) in the region.

The IR said it would like to have a round-table discussion with Facebook SA to discuss these issues “to ensure that there is full compliance by the WhatsApp Privacy Policy with the provisions of POPIA and other pertinent international legal instruments.”


author