The National Privacy Commission (NPC) issued a statement on Thursday, Jan. 21, raising its concerns over the new privacy terms of messaging app WhatsApp.
WhatsApp is set to change its privacy policy in a way that would allow the sharing of data with third-party companies hosted by its parent firm Facebook, the NPC said.
“The move, according to WhatsApp’s new privacy terms, is exclusively intended to expand the application as a growing platform for business transactions and customer service with the extension of marketing features,” it noted.
The broad language WhatsApp used in its new privacy terms has stirred confusion and concern, the agency said. “Critical privacy questions such as the scope of data that Facebook and its family companies will be able to harvest from WhatsApp and whether agreeing to the new policy is mandatory remain unanswered,” it noted.
Although WhatsApp has assured users on its continued end-to-end encryption of messages and calls, the NPC noted that encryption is a bare minimum requirement for ensuring data protection.
“In addition, WhatsApp’s source code is proprietary and is not viewable by concerned experts who may want to validate the security and privacy of the application. Thus, we are limited to taking its privacy promises at face value,” it said.
“More importantly, privacy does not only concern the messages we send and receive nor the calls we make and take, but should apply to the extent of surveillance to which all activities done on the platform are subjected.”
The NPC said its Data Security and Technology Standards Division has raised the following issues on the expanded data processing authority of WhatsApp when the new policy kicks in:
- Involves third parties in operating the service
- Being provided ”as is” and to be used at the users’ sole risk
- Having authority to delete your account without prior notice or a reason
- Makes no warranty regarding uninterrupted, timely, secure or error-free service
- Uses your personal data for advertising
- May use tracking pixels, Web beacons, browser fingerprinting, and/or device fingerprinting on users.
- May use your personal information for marketing purposes
- Can or otherwise transfer your personal data as part of a bankruptcy proceeding or other type of financial transaction.
- Forces users into binding arbitration in the case of disputes
- Keeps user logs for an undefined period of time
- Gathers information about you through third parties
The privacy body also echoed a similar worry aired by the public about the sharing of WhatsApp of its data with its parent firm Facebook, which has not had a stellar record in personal data protection and management.
“Like other data privacy regulators around the world, the NPC has repeatedly flagged Facebook for various concerns, some of which have yet to be addressed,” it said.
“Rest assured that the Commission is closely monitoring developments and will directly coordinate with WhatsApp to extract specific details on the new policy, as we seek to understand more the data protection measures it currently adopts or will possibly adopt in light of the new privacy terms,” the agency said.
“We take this as an opportunity to work with digital movers like WhatsApp to ensure that transparent and easily understandable consent processes, especially in a fast-thriving digital environment, are consistently observed.”
