Privacy watchers flag WhatsApp's data-sharing rule change

MANILA, Philippines — Philippines' data privacy regulators on Thursday called out WhatsApp for the company's planned changes to its privacy policy that would allow the sharing of users' data with its parent firm Facebook, joining their counterparts abroad in flagging the changes.

In a statement, the National Privacy Commission (NPC) said the "broad language" that the popular messaging app used in its new privacy terms "has stirred confusion and concern." 

Specifically, privacy checkers were worried about how the updated terms will allow additional sharing of information between WhatsApp and other "third-party" applications such as Instagram and Facebook Messenger. WhatsApp said shareable information include contacts and profile data, but not messages which remain encrypted.

The NPC added that WhatsApp’s source code is "not viewable by concerned experts who may want to validate the security and privacy of the application."

"Critical privacy questions such as the scope of data that Facebook and its family companies will be able to harvest from WhatsApp and whether agreeing to the new policy is mandatory remain unanswered," NPC said.

"While the Commission takes positive note on WhatsApp’s emphatic assurance on its continued end-to-end encryption of messages and calls, we would like to note that encryption is a bare minimum requirement for ensuring data protection," it added. "Thus, we are limited to taking its privacy promises at face value."

As users switch to rivals Telegram and Signal, deemed more secure due to end-to-end encryption among users, WhatsApp last week canceled its February 8 deadline for accepting the new requirement, saying it would use the pause to clear up misinformation around privacy and security.

The updates were meant to help Facebook monetize WhatsApp by allowing businesses to contact clients via the platform, making it natural for the internet giant to centralize some data on its servers.

Elsewhere, the Turkish Competition Authority has launched an investigation and required WhatsApp to suspend data sharing obligation on its users. Italian data protection agency GPDP, for its part, said WhatsApp's notice to users lacked clarity and privacy implications need to be carefully evaluated.

At home, the NPC said it will sit down with WhatsApp to address privacy concerns raised by several users.

"Rest assured that the Commission is closely monitoring developments and will directly coordinate with WhatsApp to extract specific details on the new policy, as we seek to understand more the data protection measures it currently adopts or will possibly adopt in light of the new privacy terms," it said. — with a report from AFP