8

I have never used WhatsApp so I have never shared my phone’s contacts with them or consented to their terms. Many of my friends and family do use WhatsApp and they will all have me in thier contacts under the same name and phone number. Therefore I must have node WhatsApp’s social graph?

It might be only my name and number that they have, but It’s certainly enough for them to tie it to my Facebook account and to infer a profile of me by analysing the activity of the social graph around me.

If this is the case do I have any right to ask WhatsApp to delete my node as I’ve never consented to be included? (I live in the UK).

  • 5
    There's an interesting paradox here - if they delete all mention of your existence, then they will just pick you up again next time they scan your friends' contacts. If you want to be "permanently deleted", then they would have to keep some side record of who you are to know that you should be excluded from their main database. – Nate Eldredge Mar 18 '18 at 17:05
  • 2
    I agree. It seems to me that almost everyone with phone number will be a node on their social graph whether you like it or not. Your point on the node infers information about you, so they are creating a profile of you with or without your consent. – Tom Mar 18 '18 at 22:50
  • @NateEldredge WhatsApp can record a hash of the number to be blocked in order to protect users who do not want to be added by others. – Jonas Stein Feb 24 at 20:49
  • A German newspaper wrote about the data collection taz.de/!5108316 more on netzpolitik.org/2017/… – Jonas Stein Feb 24 at 21:03
4

I'm pretty sure that under GDPR, you can indeed request them to send all data they have on you. If it's a complex request, they may charge you something like £10. If they have a lot of data on you, they may list the categories of data they have and ask you to pick one, rather than them having to collect and send everything. They should respond within one month, but iirc in the UK implementation, they can inform you (within that month) that they will respond within three months instead.

For the rest, I only know current Dutch law. GDPR is not that different from what we already had (in general terms) and in many cases it even extends it. Under our law (WBP), you can also request a correction of the data in case it is incorrect, or deletion if they no longer need it for the purpose for which it was collected and stored. I don't really know how that works out in practice though, as Facebook can of course claim that "being able to connect you to your friends when you sign up for WhatsApp or Facebook with that number" is a legitimate purpose (in their eyes).

They might also not have your full name and therefore not be able to connect your data to your request. Or, perhaps, they have only your full name (and there are probably more people with your name), so they'll have a hard time verifying that it's really your data which they would be handing over or deleting. The company is required to verify your identity before acting on your request. How they implement that is up to them. Under Dutch law, if I remember correctly, any data that can be connected to your person by any party is personally identifiable information (PII). While Facebook might not be able to find who's behind a phone number, your carrier most certainly can. Therefore, the data falls under PII protection laws and they will have to implement a way to verify you and get you your data.

Finally, whether your local laws apply to Facebook, I don't know exactly. There's lots of information on this though, so you should be able to find it. Generally, countries say that if something happened within their territory (e.g. you signed up for WhatsApp while in the UK), their law applies. Companies, I've read, will instead try to claim that their main office is in SomeCountry and therefore SomeCountry's laws apply. But I'm pretty sure you'll be able to find a Facebook office somewhere where GDPR applies, so that's probably fine.

While not an exact answer and while I am not sure about everything, I hope this gave you some pointers to go on!

  • Thanks @luc I shall put in a GDPR request and see what happens. – Tom Mar 18 '18 at 22:45
  • 1
    @Tom I'm interested in the results! I might want to put a request in as well, since I also don't have WhatsApp and was thinking the same thing about them having a shadow profile of me. If you post an answer here or something, could you ping me by commenting again on this post? (Or if you don't post the results publicly, please use a contact method from my profile.) – Luc Mar 18 '18 at 23:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.