Source: Chatarmin Youtube
WhatsApp Business Channels: A new feature with privacy risks
WhatsApp Business Channels are a relatively new feature that provides companies with an overview of their customer communications. Via the company profile, customers can contact the company directly and engage in conversations. These channels are designed to improve customer service and further boost customer loyalty.
However, the use of WhatsApp Business Channels also entails some data protection risks. Since these communication channels can only be used via the WhatsApp Business app, the same data protection regulations apply as for the private version of WhatsApp. This means:
- WhatsApp collects personal data such as location, call lists, SMS, access to microphone, camera, photo albums and SD cards.
- Metadata such as device information, frequency of use and IP addresses are collected.
- The automatic synchronization of contact data from address books is carried out without the consent of the persons concerned and thus violates the GDPR.
- Usage data such as time and frequency of messages are stored and used for analysis.
- WhatsApp shares phone numbers, usage information, device data and IP addresses with Facebook companies to improve the service and for advertising purposes.
Although creating WhatsApp Business Channels is free and easy, companies should not underestimate the associated data protection risks. For professional and GDPR-compliant customer communication, it is therefore advisable to use the WhatsApp Business API. This offers advanced features and allows data to be processed on the company's own servers in accordance with the applicable data protection regulations.
WhatsApp and GDPR: A New Challenge
As businesses increasingly rely on WhatsApp as a communication channel, it is crucial to understand how GDPR applies to this platform. When businesses use WhatsApp for marketing or customer engagement purposes, they collect personal data such as phone numbers, names, and potentially more detailed information about individuals. As a result, GDPR data protection rules also apply to WhatsApp, just as they do to other communication channels like email and SMS.
Whether businesses use the WhatsApp Business app or the WhatsApp Business Platform (API), the principles of GDPR compliance remain the same. However, there are some differences in how these two options handle GDPR compliance.
WhatsApp Business App
The WhatsApp Business app is designed for small businesses or individuals who communicate with a limited number of people. While using the app, businesses must handle consent manually and ensure that data is stored securely and handled responsibly. Although complying with GDPR on the app may require more manual work, businesses can still achieve GDPR compliance by following the principles outlined by the regulation.
The WhatsApp Business Platform (API) is a more robust solution for larger businesses that send messages to a larger audience. It offers automation capabilities, allowing businesses to set up automatic flows that keep their WhatsApp communications GDPR compliant, such as double opt-in welcome flows. The API also enables businesses to store consent information automatically and make data easily accessible. Data storage is also safer with the API, as businesses can choose to store customer data in EU servers to ensure GDPR compliance. However, it's important to note that using the "on-premises" API and storing data outside the EU may breach GDPR regulations.
Ensuring GDPR Compliance on WhatsApp
While WhatsApp provides the platform for businesses to communicate with their customers, it is ultimately the responsibility of businesses to ensure GDPR compliance. Here are some key steps businesses can take to ensure GDPR compliance on WhatsApp:
- Obtain proper consent: Ensure you have the necessary permissions from users before you engage them on WhatsApp.
- Provide easy opt-outs: Users should have the ability to opt-out of your communications easily.
- Handle data responsibly: Protect the personal data of your users and use it in a responsible manner.
- Be transparent: Be clear with your users about how you're using their data.
- Assess data retention periods: Regularly review how long you're retaining personal data, and ensure it's not kept longer than necessary.
- Train employees: Make sure your team understands the principles of GDPR and how to handle personal data.
- Work with GDPR-compliant partners: If you work with third parties, ensure they're also adhering to GDPR.
- Offer full data transparency to end users at any time: Users should be able to access the personal data you hold about them.
- Offer to delete full data track record on customers’ requests, anytime: If a user requests it, you should be able to delete their personal data.
- Store customer data on permanent storage, at least for the legally required timeframes: Make sure you're securely storing customer data for the minimum required time periods.
By following these steps, businesses can enhance their GDPR compliance on WhatsApp and build trust with their customers.
The Importance of GDPR Compliance
While GDPR compliance may seem like an additional burden for businesses, it is crucial for protecting personal data and maintaining the trust of customers. GDPR ensures that individuals have control over their personal information and how it is used by businesses. Compliance with GDPR not only helps businesses avoid hefty fines but also establishes a positive reputation for data privacy and security.
Moreover, GDPR compliance is not limited to businesses operating within the EU. It is increasingly becoming a global standard for data protection, and customers worldwide expect businesses to treat their data with the same level of respect and responsibility as GDPR ensures in the EU.
Conclusion
In conclusion, businesses using WhatsApp must ensure GDPR compliance to protect the personal data of their customers. Whether using the WhatsApp Business app or the WhatsApp Business Platform (API), businesses should obtain proper consent, handle data responsibly, and provide easy opt-out options. It is essential for businesses to understand their responsibilities under GDPR and work towards maintaining compliance on WhatsApp. By doing so, businesses can build trust with their customers, protect personal data, and uphold the principles of data privacy in the digital age.
Remember, while this article provides insights into GDPR compliance on WhatsApp, it should not be considered legal advice. For full information on your legal obligations under GDPR, consult the official GDPR site provided by the European Commission.
Request further information on why and how the WhatsApp Business API fulfills GDPR compliance, simply by messaging us here.
Bonus Addendum: Situation in Switzerland
As of September 1, 2023, the new data protection law came into force in Switzerland. Currently, there is no valid adequacy decision between Switzerland and the US. This means that Swiss companies wishing to transfer data to the US must conclude standard contractual clauses to ensure the permissibility of the data transfer.
Note on the legal situation within the EU: However, since July 2023, a new adequacy decision has been issued for the USA in the form of the Data Privacy Framework. This decision allows for a GDPR-compliant transfer of personal data to the US. The list previously assigned to the Privacy Shield was updated accordingly and adapted to the new framework.
Certifications have been obtained from both WhatsApp LLC and Meta Platforms Inc. and are currently valid. It is expected that a new adequacy decision for Switzerland will also be available in the coming months. A list of countries for which an adequacy decision exists can be found here1 in Appendix 1.
The use of chatarmin is DPA compliant, provided certain measures are taken:
- Concluding standard contractual clauses with WhatsApp LLC.
- Obtaining consent for communication via WhatsApp. chatarmin enables a double opt-in procedure and logs the consent given by users.
- Any profiling must be covered by consent.
- Transparent information to users about the processing of their data.
- Chatarmin provides an order processing contract that specifies the specific data protection obligations and responsibilities.
