The UK’s data regulator is writing to WhatsApp to demand that the chat app does not hand user data to Facebook, as millions worldwide continue to sign up for alternatives such as Signal and Telegram to avoid forthcoming changes to its terms of service.
Elizabeth Denham, the information commissioner, told a parliamentary committee that in 2017, WhatsApp had committed not to hand any user information over to Facebook until it could prove that doing so respected GDPR.
But, she said, that agreement was enforced by the Irish data protection authority until the Brexit transition period ended on 1 January. Now that Britain is fully outside the EU, ensuring that those promises are being kept falls to the Information Commissioner’s Office.
“The change in the terms of service, and the requirement of users to share information with Facebook, does not apply to UK users or to users in the EU,” Denham told the digital, culture, media and sport sub-committee on online harms and disinformation, “and that’s because in 2017 my office negotiated with WhatsApp so that they agreed not to share user information and contact information until they could show that they complied with the GDPR.”
Asked by the committee chair whether there was any more recent agreement than the 2017 one, however, Denham said there was not. “Up until 1 January, it was the Irish data protection authority’s job to oversee the activity of WhatsApp. As long as we were in the transition period, the one-stop-shop meant it was my Irish colleague who was responsible for WhatsApp. That’s changed now.”
The information commissioner also revealed that she uses Signal, a privacy-focused competitor to WhatsApp, for her personal messaging, and does not have an account with either Facebook or WhatsApp.
“What’s really interesting about WhatsApp’s announcement on its ongoing sharing with Facebook is how many users voted with their virtual feet and left the platform to take up membership with Telegram or Signal,” she added.
“Users expect companies to maintain their trust and not to suddenly change the contract that they have with the users, and I think it’s an example of users being concerned about the trustworthiness and the sustainability of the promises made to users.”
The user exodus from WhatsApp began in early July, when the company announced plans to implement a new privacy policy on 8 February. Those plans, which have now been delayed to early summer, caused substantial panic among the app’s users. Some of the concern was around changes that explicitly spelled out, for the first time, the existing data-sharing arrangements between WhatsApp and Facebook outside the “European region”, which includes the EU and UK.
Others were concerned by misinformation, ironically spread on WhatsApp itself, that the new terms of service would allow Facebook to read user messages. That is not the case – the end-to-end encryption applied by WhatsApp prevents Facebook from accessing message contents even if it desired, but the claim spread far enough for WhatsApp to buy advertising declaring: “Neither WhatsApp nor Facebook can read your messages or hear your calls.”
Signal and Telegram, the two big beneficiaries of the panic, have added millions of users each in the first three weeks of January. Signal, which was not in the top 1,000 apps in Britain at the beginning of the year, spent several days as the most downloaded app in the country, and has gained 7.5 million users globally.
