NPC cites ‘concerns’ on WhatsApp’s new privacy policy

MANILA – The National Privacy Commission (NPC) on Thursday raised some concerns on the new privacy policy of popular messaging application (app) WhatsApp, which allows the sharing of its users’ data to parent firm Facebook.

In a statement, the NPC said the “broad language” used by WhatsApp in its new privacy terms created confusion and concerns, with critical privacy questions remaining unanswered such as the scope of data that Facebook and its other companies will be able to harvest and whether the new policy will be mandatory.

“While the Commission takes positive note on WhatsApp’s emphatic assurance on its continued end-to-end encryption of messages and calls, we would like to note that encryption is a bare minimum requirement for ensuring data protection,” the NPC said.

It noted that privacy does not only apply to messages or calls made on the app but should also apply to all activities done on the platform.

The NPC’s Data Security and Technology Standards Division also raised some initial specific concerns on the expanded data processing authority of WhatsApp:

1. Involves third parties in operating the service

2. Being provided ”as is” and to be used at the users’ sole risk

3. Having the authority to delete your account without prior notice or a reason

4. Makes no warranty regarding uninterrupted, timely, secure, or error-free service

5. Uses your personal data for advertising

6. May use tracking pixels, web beacons, browser fingerprinting, and/or device fingerprinting on users.

7. May use your personal information for marketing purposes

8. Can or otherwise transfer your personal data as part of a bankruptcy proceeding or other type of financial transaction.

9. Forces users into binding arbitration in the case of disputes

10. Keeps user logs for an undefined period of time

11. Gathers information about you through third parties

Aside from these concerns, the NPC said the “mere sharing” of user data with companies associated with Facebook was a point of contention to the public due to the company’s lapses in personal data protection and management.

“Like other data privacy regulators around the world, the NPC has repeatedly flagged Facebook for various concerns, some of which have yet to be addressed,” the NPC said.

To alleviate some concerns of WhatsApp’s Filipino users, the NPC said it is “closely monitoring development” and will directly coordinate with WhatsApp to gather specific details on the new policy.

“Pending the result of our discussions, we encourage the public to prepare backing up their data stored in WhatsApp in case moving to a different platform turns out to be the more prudent choice,” the NPC said.

Early in January, WhatsApp announced its new privacy policy that was scheduled for rollout beginning Feb. 8, 2021.

However, due to some backlash such as the Indian government asking the app to withdraw its new policy and many of its users migrating to other messaging apps, WhatsApp has decided to delay the rollout to May 15, 2021.