The request was issued on Friday (7) by Brazil's data protection agency ANPD, national consumer body Senacon, the Federal Prosecution Service and competition watchdog Cade. WhatsApp and its owner Facebook must respond to the requests from the government today (10). Failure to comply could lead to action from the federal prosecutor to guarantee the fulfillment and protection of collective rights, in addition to other measures that may be applied by other Brazilian authorities.
The authorities also expressed concerns over the potential effects on competition stemming from the upcoming WhatsApp policies, given the lack of a previous regulatory design and that there are no meaningful alternatives to Facebook's services. Last week, WhatsApp has relaunched its payments service in Brazil nearly a year after its suspension amid concerns from regulators over potential threats to the national financial services system.
WhatsApp's new policies fail to comply with Brazil's general data protection law, which has been introduced in Brazil in 2020 and outlines how personal data should be collected, stored, used and deleted in the country, according to Francisco Gomes Júnior, a Brazilian lawyer focused on digital law. According to the specialist, it is up to each individual to manage when and by whom their data can be used, and the messaging app does not meet that principle of user consent, which is core to how personal data can be shared.
"WhatsApp, apparently, does not want to offer the choice to the holder of personal data. Administrative and consumer protection questions already exist about these new terms, but so far there is no indication that WhatsApp will accept negotiating changes to comply with the Brazilian data protection law and the user's right to choose", he noted.
In April, consumer protection body Idec notified Brazilian several authorities with unanswered questions over privacy rights and data protection, which then led to the latest recommendations from the government - however, the way the country's authorities are treating the case is seen as insufficient, since no actual moves towards intervention have been made.
"[The government's requests] are not binding, since [WhatsApp and Facebook] can choose to not accept the recommendations. In addition, most users have already accepted the [privacy] changes and other users will still be receiving notifications to accept them", according to the lawyer leading the digital rights program at Idec, Michel Roberto de Souza.
The specialist added the recommendations from the Brazilian authorities are "an important partial victory, but only a small step towards the protection of consumers, personal data and against the exploitative abuses of the concentration of economic power." Contacted by ZDNet, WhatsApp did not respond to requests for an update on the request from the Brazilian authorities.