WhatsApp Faces Heat Over POPIA Breaches in South Africa

(The Post News)– WhatsApp is under the spotlight in South Africa after the Information Regulator found it had breached several key provisions of the Protection of Personal Information Act (POPIA), leading to the issuing of a formal enforcement notice.

The watchdog served the enforcement notice to WhatsApp on 10 September 2024, although the full document only appeared on its website in April this year. The notice gave WhatsApp 60 days to provide proof that it had addressed the issues raised. At the time of writing, the Regulator hasn’t confirmed whether WhatsApp met the deadline, despite being asked by MyBroadband. According to the Information Regulator, WhatsApp breached at least six sections of the Act, Sections 9, 11, 13, 15, 17, and 19, in the way it processes personal information of South African users.

POPIA’s Section 9 restricts the reasons and methods for processing personal data. The Regulator emphasized that WhatsApp’s European privacy policy explicitly lists legitimate justifications for data use, such as user consent and contractual need. However, the policy did not include the same justifications for South African consumers. Due to their direct connection to the legal explanations mandated by South African law, these missing components are crucial.

The Regulator discovered that WhatsApp forces users to accept specific terms and conditions without providing a legitimate reason for processing their data, in violation of Section 11, which deals with consent. It emphasized that users’ consent must be “voluntary, specific, and informed” and cannot be coerced.

WhatsApp also fell short of explaining why it collects specific types of data, such as device operation and connection information as required under Section 13. The Regulator said the company must spell out these purposes in its Revised Privacy Policy.

Section 15 adds that data collected must only be used for the original reason it was gathered. But WhatsApp reportedly shares user data with other Meta companies and third parties, which the Regulator argues amounts to “further processing” that could be incompatible with its original intent.

Meanwhile, sections 17 and 19 deal with openness and data security. WhatsApp reportedly argued that it didn’t need to follow local documentation rules under PAIA (Promotion of Access to Information Act) because it isn’t based in South Africa. The Regulator disagreed, insisting that WhatsApp must document all processing activities as outlined in Section 51 of PAIA.