4

There are articles commenting that the European Commission has recently told its staff to switch to the encrypted Signal messaging app. When I look into Signal's privacy policy, as linked from their app, I find several points which don't fulfill GDPR in my understanding (just listing the most obvious):

  • Their webpage is available in several languages of EU countries (e.g. German) and they offer a service (for free), so they have to fulfill GDPR
  • They store the user's phone number (and optionally more), so they process private information, but they don't name an EU representative located in the EU
  • They don't tell the user the rights like deleting data, making requests and so on.

So do I miss something or is Signal in violation of GDPR?

Improve this question
6
  • Your conclusion “they store private information” -> “they process private information” is quite dubious.
    – gnasher729
    Jan 7, 2021 at 16:56
  • 3
    @ gnasher729: Article 4 of GDPR says "‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;"
    – UweD
    Jan 7, 2021 at 17:12
  • I was referring to the legal definition as given in GDPR. From a technical point of view personally I would not define "storing information" as "processing information".
    – UweD
    Jan 7, 2021 at 17:16
  • Yes, but good luck suing them.
    – JonathanReez
    Jan 8, 2021 at 0:21
  • You are entirely correct that (a) Signal is subject to GDPR, and (b) that their privacy policy doesn't provide all required information per Art 13 GDPR. However, Signal is market leader when it comes to data minimization and security of processing (compare Art 4(1)(c), Art 32). There is also an argument (which I don't subscribe to) that Signal would only be responsible for processing of personal data on their servers (which is extremely minimal due to E2EE), and not responsible for processing of personal data on user's devices.
    – amon
    Jan 8, 2021 at 11:45

1 Answer 1

Reset to default
1

Probably

A phone number is categorically personal information under the GDPR and collecting it makes you a data controller if you provide goods or services in the EU.

It seems unlikely that this would not be considered a service provided in the EU.

If the terms of service were purely in English then an argument could be raised that they are intended purely for anglophone countries, since all but one are (now) not members of the EU. However, that is an argument that is undercut by having terms in German. While there are many people outside the EU with fluency in German, the majority of German speakers are in the EU.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .