On March 4, 2021, communications platform WhatsApp announced certain changes to its terms and conditions of use that would affect more than two billion registered users, and whose acceptance as of February 8 would be a prerequisite to continue using its messenger service.
The announcement caused global alarm due to the widespread belief that the changes would include provisions permitting WhatsApp, acquired by Facebook in 2014, to share the content of messages transmitted through its infrastructure with Facebook and other affiliates (such as Instagram), which have been subject to criticism and involved in various scandals related to the processing of the personal data of their users.
In this respect, the Mexican regulator, the National Institute for Transparency, Access to Information and Personal Data Protection (“INAI”) issued a statement on January 12, 2021 attempting to explain some effects of those changes and recommending that users of the app carefully read the amended terms and conditions before giving their consent. WhatsApp, in response to a tidal wave of alleged disinformation and faced with a growing number of users abandoning the platform in favor of those of its competitors, issued a second press release on January 15, 2021, extending the period to accept the terms and conditions until May 15, 2021.
As a general rule, content transmitted through WhatsApp is only accessible to the person sending and the person receiving the messages, since it is stored only temporarily and protected by a technology known as “endto-end encryption”. This rule will not be affected by the announced changes, although it should be mentioned that WhatsApp’s terms and conditions do establish two exceptions by which a third party different from the sender and recipient of a message may access certain information related to their private conversations. These exceptions include: (i) the use of certain WhatsApp functions referring to financial transactions (a service not yet available in Mexico), in which case the financial intermediaries involved in such transactions must be able to access and share information with certain third parties; and (ii) the contracting of providers by a participant in a WhatsApp conversation to handle the reception or sending of data messages (e.g., a commercial user that contracts third parties to receive client orders and questions or to deliver payment receipts to clients), in which case the third-party contractor could access private content according to the terms and purposes of its relationship with the participating party.
This second scenario is the root of the misunderstanding regarding the changes in question: the amended text of the terms and conditions refers to the possibility that a participant in a conversation subcontracts third parties to answer, store or analyze messages received in its WhatsApp account, with such possible third parties including Facebook (a platform whose array of services will include, as of 2021, data storage services which companies may contract to manage and/or store their WhatsApp business account). While in this case the exchange of messages would no longer be considered as protected by end-to-end encryption, because a third party would be able to access the messages exchanged between a given sender and recipient, this does not mean that WhatsApp intends to open a previously closed channel to Facebook or to any other third party indiscriminately; rather, only that its business model allows those who already participate in a closed conversation to share their own information with third parties as long as they inform their counterparty.
The statement issued by the INAI in relation to these changes is right to recommend that users carefully read WhatsApp’s terms and conditions and privacy policies before agreeing to the same. Under both Mexican and various foreign laws regarding personal data protection, the fundamental principle of all data processing is the informed consent which the owners of personal data must grant others prior to their personal data being processed. Under such guiding principle, data owners have the responsibility of reviewing terms and conditions before granting their consent: a rule which users should observe and keep in mind not only in the case of WhatsApp but for every application that they may take advantage of, whether it be Waze, Uber, Facebook or Instagram.
In summary, while the changes that WhatsApp proposes on this occasion do not pose any substantial danger to the privacy of its users, it should be noted that users worried about a possible transfer of their personal data to Facebook frequently already make use of other Facebook products or services, as well as those of other companies that do not offer the same level of protection as WhatsApp, largely having consented to their corresponding terms and conditions without understanding the same.
In our opinion, it is necessary to promote a culture which incentivizes users to make truly informed decisions on the use of their personal data by reading and reviewing the terms and conditions of any app they may use, thereby avoiding becoming victims of rumors and disinformation. WhatsApp’s current situation invites us to reflect on how, now more than ever, users have the responsibility to make correctly informed decisions, especially to the extent that WhatsApp and other similar applications are used ever more frequently in a business environment.
To obtain additional information, contact our experts:
Luis Burgueño, Partner: +52 (55) 5258 1003 | firstname.lastname@example.org
Gloria Martínez, Associate: +52 (55) 5258 1014 | email@example.com
Rubén Villegas, Associate: +52 (55) 5258 1003 | firstname.lastname@example.org