Whose data is it anyway? WhatsApp and GDPR

By Gary Taylor,

Wanting to expand our range of communications channels to our local members, CIPR Yorkshire & Lincolnshire started using WhatsApp a few years ago. Once a fortnight we sent a text newsletter out under the HiPR! banner with links to PR stories and CIPR activities to anyone who wants to receive it, whether they are CIPR members or not.

And this was all fine and lovely, we had lots of subscribers, people found it an interesting read. Not many other organisations were doing it, so we were very much ahead of the game.

But, of course, there were unintended consequences.

We’re grateful to CIPR CEO Alastair McCapra for sharing with us a link to WhatsApp’s data failings.

When people use WhatsApp they allow the App access to their contacts. That access is granted to WhatsApp, not to the individual or organisation you’re conversing with.

So if you decide to sign up to HiPR!, CIPR Yorkshire & Lincolnshire does not, and more importantly, cannot control that data.

With GDPR, there are several things to remember, including:

  • businesses are required to be able to audit who has access to what data.
  • organisations must now keep a record of permissions from people whose data you store
  • data needs to be disposed of securely if a client wants to exercise their “right to be forgotten,”
  • you need to be able to ensure the protection of client data, even outside of the EU.

Under GDPR, CIPR Yorkshire & Lincolnshire is classed as the data controller – it’s our newsletter – and thus liable for the protection of subscribers’ data, even though we don’t hold it ourselves, don’t know exactly where it’s held, don’t hold a record of permissions you gave the App and can’t access the data to delete it; it’s all held by WhatsApp, who have no interest in adhering to the EU’s GDPR as they think that the US privacy laws are fine.

And that means it’s the end for HiPR! on WhatsApp.

Of course, if WhatsApp sees the light and becomes GDPR compliant it may make a return. Until then it’s back to the member newsletters. Who said email was dead?

Photo by Rachit Tank on Unsplash


Leave a Reply

Your email address will not be published. Required fields are marked *