Facebook's decision to change WhatsApp's privacy policy hasn't gone down well. And now the UK's data protection regulator is taking action.
The Information Commissioner's Office (ICO) has asked Facebook and WhatsApp to better explain the changes to customers. If they don't, the information commissioner has said it could hand out a fine.
"We have now asked Facebook and WhatsApp to sign an undertaking committing to better explaining to customers how their data will be used, and to giving users ongoing control over that information," information commissioner Elizabeth Denham wrote in a blog post.
Facebook, according to the ICO, has "agreed to pause using data from UK WhatsApp users for advertisements or product improvement purposes" following contact from the regulator.
However, Facebook says that not all data sharing has been stopped. It is still sharing data for some specific purposes: WhatsApp is sending data to stop spam messages, for example.
On August 25, 2016 WhatsApp changed its privacy policy to allow more data to be shared with the "Facebook family of companies". This includes the social network and other apps such as Instagram and Facebook's Messenger.
Since then the European Commission's privacy group has started an investigation, with German and US officials also raising concerns.
Included in the permitted sharing is customers' phone numbers. People using WhatsApp were given 30 days to opt out of the sharing and on the first updated use of the app, had to click through to a separate screen to learn more about the changes.
Denham says she had "concerns" about the agreement eight weeks ago. "I don’t think users have been given enough information about what Facebook plans to do with their information, and I don’t think WhatsApp has got valid consent from users to share the information."
However, Facebook disagrees. "These updates comply with applicable law, and follow the latest guidance from the UK Information Commissioner's Office," a spokesperson said in a statement. It also said it will "remain open" to working with data protection officials and continue "detailed conversations with the ICO.
The commissioner, who started in the position this year and is responsible for data protection regulation in the UK, says people should have an "unambiguous choice" before Facebook uses their data.
"We think consumers deserve a greater level of information and protection, but so far Facebook and WhatsApp haven’t agreed. If Facebook starts using the data without valid consent, it may face enforcement action from my office." Under the Data Protection Act 1998 the ICO is able to fines and monetary penalties.
The statement of intent by the ICO follows the European Commission saying it would investigate the sharing. The Article 29 Data Protection Working Party (W29), on October 28, wrote to WhatsApp saying it had "serious concerns" about the data sharing of WhatsApp's one billion members.
Isabelle Falque-Pierrotin, the chairman of the group, said personal data shouldn't be shared with Facebook "until the appropriate legal protections can be assured". And it was considering whether the changes were in line with European data protection laws.
Since then the European Commission's privacy group has started an investigation as well as German and US officials raising concerns.
At the end of September, officials in Germany ordered Facebook to stop gathering user data. It also said all data already connected should be deleted.
Update 08/11/2016: This post has been updated to clarify that not all data sharing between WhatsApp has been stopped. Data to stop spam messages is still being shared.
This article was originally published by WIRED UK
