Facebook can’t force SA WhatsApp users to sign over cellphone numbers, Info Regulator says
Facebook needs prior permission from the Information Regulator to cross-process cellphone numbers harvested from South Africans, that regulator has told the platform.
Users who have already handed over their mobile numbers – or telephone numbers of their contacts – can not legally consent to such processing now, the regulator holds.
It has also expressed some displeasure at how Facebook is handling the European Union, compared to SA.
Among other things, it told the social media giant that South African users simply aren’t in a position to give WhatsApp permission to pass on cellphone numbers to the rest of Facebook.
South Africa’s Protection of Personal Information Act (POPIA) lays out strict rules on what companies can – and can not – do with personal information. For some uses of personal information, the agreement of users is not enough; prior permission must be sought from the Information Regulator. And what it believes Facebook plans around cellphone numbers is one such case, the IR says.
It believes WhatsApp may not legally “process any contact information of its users for a purpose other than the one for which the number was specifically intended at collection, with the aim of linking that information jointly with information processed by other Facebook companies.”
WhatsApp requires the mobile phone number of a user signing up. It also offers a “contact upload” service, “an optional feature that allows us to identify which of your contacts in your device’s address book are also WhatsApp users so that we can add them to your WhatsApp contacts, and quickly update your WhatsApp contacts in case your contacts who are not yet using WhatsApp sign up later.”
It does not share user contact books with Facebook, WhatsApp says, and where it receives cellphone numbers for people not yet on its network, it will only only “process them momentarily” to create a cryptographic hash, so that the actual telephone number can be discarded, while WhatsApp can still let you know if that person joins.
Europeans, the IR says, “will receive significantly higher privacy protection than people in South Africa, and Africa” from Facebook, even though SA modelled its privacy legislation on that of the European Union.
Beyond accepting its terms, users have two options, WhatsApp says: delete their own accounts, or wait the roughly 120 days it takes for inactive accounts to be deleted automatically.
Facebook says it requires new permissions from WhatsApp users to enable services that businesses will pay to use, making WhatsApp sustainable as a free-to-use service for consumers.