Facebook can’t share info without consent

THE INFORMATION Regulator (IR) of South Africa says Facebook cannot share any contact information it collects from WhatsApp users in South Africa without first obtaining authorisation.

In a statement yesterday, the IR said it noted with concern the statement released by WhatsApp, detailing changes that a user would face if they ignored Facebook’s terms by the May 15 deadline.

WhatsApp issued a statement on January 15 in which the company informed users that it was preparing a new privacy policy, under which it could share some data, including location and phone numbers, with Facebook and its other units such as Instagram and Messenger.

The company insisted that it would always protect users’ personal conversations with end-to-end encryption so neither WhatsApp nor Facebook could see these private messages.

“We also can’t see your shared location and we don’t share your contacts with Facebook,” WhatsApp said.

“This update does not expand our ability to share data with Facebook.”

The IR said however that if a user would not accept WhatsApp’s terms, for a short time users would be able to receive calls and notifications, but not be able to read or send messages from the app.

The agency said it had written to Facebook South Africa and provided an analysis of the concerns that the IR had about the privacy policy of Facebook as it related to South Africa.

“It is the IR’s view that the processing of cellphone numbers as accessed on the user’s contact list for a purpose other than the one for which the number was specifically intended at collection, with the aim of linking the information jointly with the information processed by other responsible parties (such as Facebook companies) does not require consent from the data subject, but prior authorisation from the IR,” the IR said.

The regulator added that WhatsApp could not process any contact information of its users for a purpose other than the one for which the number was specifically intended at collection, with the aim of linking that information jointly with information processed by other Facebook companies, without obtaining authorisation from the IR in terms of section 57 of Protection of Personal Information Act (POPIA).

The agency said it had also raised a central concern that citizens of the EU would receive significantly higher privacy protection than people in South Africa and Africa.

Chairperson of the IR, advocate Pansy Tlakula said the IR was very concerned about the various standards that applied to South African users.