Facebook agrees to pause unauthorised sharing of WhatsApp user advertising data in UK
Facebook has agreed to pause its collection of WhatsApp user data in the UK for advertising purposes, following a probe by the Information Commissioner's Office.
In August, WhatsApp changed its privacy policy to allow more data -- including phone numbers -- to be shared with the "Facebook family of companies", which includes Instagram and Facebook Messenger. People using WhatsApp were given 30 days to opt out of the data exchange policy and were notified of the changes on the first updated use of the app.
Featured
In a blog post, information commissioner Elizabeth Denham said she began investigating the the privacy policy change about eight weeks ago with "concerns" that WhatsApp's 1 billion users weren't being properly protected.
"It's important that we have control over our personal information, even if services don't charge us a fee," Denham wrote.
"We might agree to a company using our information in a certain way in return for us getting a service for free, but if that information is then exploited more than agreed, for a purpose we don't like, then we're entitled to be concerned."
In October, the Article 29 Data Protection Working Party wrote to WhatsApp highlighting that it had serious concerns [PDF] about the manner in which user data is being shared across Facebook's acquired companies.
Denham, who started her role in July this year, advised Facebook and WhatsApp to better explain the changes to users and that lack of compliance could instigate a fine.
"We have now asked Facebook and WhatsApp to sign an undertaking committing to better explaining to customers how their data will be used, and to giving users ongoing control over that information," Denham said.
She added that WhatsApp users should have an "unambiguous choice" before Facebook uses their data "for advertisement and product improvement purposes" and that they should have the ability to opt out at any time in the future, not just within a 30-day window.
According to the information commissioner, Facebook has agreed to halt its plan to harvest data from WhatsApp in the UK for advertising purposes. WhatsApp will continue to share data with Facebook to prevent spam and bugs, according to a company representative.
A Facebook spokesperson told ZDNet that WhatsApp's privacy policy and terms update was designed to give users "a clear and simple explanation of how the service works, as well as choice over how their data is used."
"These updates comply with applicable law and follow the latest guidance from the UK Information Commissioner's Office," the Facebook spokesperson added. "We hope to continue our detailed conversations with the [Information Commissioner's Office] and other data protection officials, and we remain open to working collaboratively to address their questions."
At the end of September, officials in Germany ordered WhatsApp to stop sharing collected user data with Facebook and for the social network to delete data already collected from the 35 million WhatsApp users within the country.
In a similar case against Facebook in December 2015, a Belgian court ordered the social network to stop placing data-tracking cookies on non-Facebook users' computers unless they explicitly agree to the social network's updated privacy policies.
In May 2018, a new data-privacy policy will take effect across Europe called the General Data Protection Regulation. The updated rules, which will replace the ones established in 1995, aim to unify data privacy across Europe to simplify regulations for international businesses doing business in Europe.
Update at 9:30PM AEDT: Headline originally said Facebook agreed to stop unauthorised sharing of WhatsApp user data. This was clarified to reflect only the temporary cessation of advertising data. Quotes from a Facebook spokesperson were also added.