OTT messaging app's new privacy policy may fall foul of European data protection rules.
The European Commission has called on WhatsApp to stop sharing user data with parent Facebook until it can ascertain whether the popular OTT messaging app is complying with data protection rules.
The Article 29 Working Party (WP29) – which advises member states about how to apply the EU's data protection rules – sent a letter to WhatsApp founder Jan Koum last week, in which it expressed serious concerns about his company's updated terms of service and privacy policy.
The new terms were rolled out in August, and state that WhatsApp will share select user data with Facebook to enable the social network to serve better-targeted adverts to its members.
Last month, Germany's privacy watchdog ordered Facebook to stop collecting data from WhatsApp users, alleging that the practice violates the country's data protection law.
WP29's letter last week questioned "the manner in which the information relating to the updated terms of service and privacy policy was provided to users and consequently about the validity of the users' consent.
"WP29 also questions the effectiveness of control mechanisms offered to users to exercise their rights and the effects that the data sharing will have on people that are not a user of any other service within the Facebook family of companies."
WP29 asked WhatsApp to divulge what sort of information it is collecting about its users and how it is gathered, provide a list of recipients of that data, and explain how the transfer of data effects users and potential third parties.
"This extensive information is essential for enabling WP29 members to correctly conclude whether any changes are necessary in order to ensure that the processing is compliant to the European legal framework," WP29 said.
"In order to avoid the possibility that the processing of personal data by WhatsApp or the Facebook family of companies is not compliant with EU legislation, WP29 urges WhatsApp not to proceed with the sharing of users' data until the appropriate legal protections can be assured."