S African Information Regulator addresses privacy concerns about proposed WhatsApp changes

The IR said it was concerned that WhatsApp cannot process phone numbers from users’ mobile phones and pass them on to a third party, in this case Facebook, as this could be a contravention of South African privacy laws, specifically the Protection of Personal Information Act (POPIA). 

WhatsApp has issued an ultimatum to users to accept new terms, which will allow this before May 15, or face cutting off the facility to send or receive messages on the app, although they will still be able to receive calls and notifications. . 

"The IR has written to Facebook South Africa and provided an analysis of some of the concerns that it has about the privacy policy of Facebook as it relates to South Africa," the organisation said in a statement. 

"WhatsApp cannot, without obtaining prior authorisation from the IR in terms of section 57 of POPIA, process any contact information of its users for a purpose other than the one for which the number was specifically intended at collection, with the aim of linking that information jointly with information processed by other Facebook companies," it said. 

The IR also queried why South Africa was being treated differently from EU countries which would receive significantly higher privacy protection than people on the African continent. 

"We are very concerned about these different standards that apply to us (as) our legislation is very similar to that of the EU. It was based on that model deliberately as it provides a significantly better model for the protection of personal information than that in other jurisdictions. 

"We do not understand why Facebook has adopted this differentiation between Europe and Africa," said the chairperson of the IR, Adv. Pansy Tlakula. 

The IR has indicated to Facebook SA that it is willing and committed to have a round-table discussion regarding the issues raised to ensure that there is full compliance by the WhatsApp privacy policy with the provisions of POPIA and other pertinent international legal instruments. 

The POPIA Act, introduced in 2013, aims to promote the protection of personal information processed by public and private bodies by, among others, introducing certain conditions for the lawful processing of personal information so as to establish minimum requirements for the processing of such information. 

The Information Regulator (South Africa) is, among others, empowered to monitor and enforce compliance by public and private bodies with the provisions of the POPIA Act.