0

I work with an assistance entity that helps people in situations of social vulnerability (poverty).

Surprisingly everyone has a cell phone and uses Whatsapp. Taking this facility into account, I thought of creating a group on Whatsapp and registering each number of these assisted people, to keep them informed of any news about the entity. However, I was warned if this could violate any GDPR terms.

It is important to note that this would be a group where participants DO NOT SEND, they only receive our messages.

Could anyone tell me if is there any restriction in the GDPR to create a Whatsapp group?

Improve this question
1
  • Yes but I suspect that a broadcast list which seems to be what he's describing wouldn't actually trigger these issues because it wouldn't result in order list members learning one's phone number or other information.
    – Joseph P.
    Apr 16 at 5:28

3 Answers 3

Reset to default
3

Certainly.

A phone number is personal information (and on top of that, WhatsApp may provide some "profile info" from the people you contact). It is not difficult to identify a person by its phone number.

So, sharing the phone number of the people affected should take into account the restrictions of GDPR.

For instance, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) established in its Resolution R/03041/2017 that the Town Hall of Boecillo had violated the GDPR because it had created a WhatsApp group of citizens. Those citizens had provided their phone numbers to be informed about town hall activities, but they had not agreed to share their numbers with the other members of the group.

And that was a very generic group. Doing a "patients recovering from cancer" or "drug abusers under treatment" or "people who need food assistence" group would involve sharing personal information that gets the maximum protection (in some specific instancies it could be that your information sharing that information is illegal even if the users gave you full consents).

So yes, creating a WhatsApp group could very easily lead to a GDPR violation, and in fact it has been ruled at least once that it has.

The fact that people cannot send messages is irrelevant. It would not make the issue any better or worse. After all, if I send a message through WhatsApp I am implicitly giving permission to everyone in the group to read it.

Improve this answer
3
  • As I informed in the OP, my only need is to have a group to pass notices and news to all subscribers, who will not be able to post. I ask: is it possible for members of a WhatsApp group not to see each other in the list? This would solve the problem...
    – Rogério Dec
    Apr 17 at 14:10
  • 1
    @RogérioDec I did answer on the basis of what I know about how WhatsApp group work, and I explained the issues with it. If you want to research how WhatsApp groups can be configured, that is not a legal question. And we do not give legal advice here to say you "You will be ok if you check option X of WhatsApp group".
    – SJuan76
    Apr 17 at 14:15
  • 1
    Bottom line: Ask to your organization. This answer is only to provide you some insights on why WhatsApp groups may be problematic, not to find the way that you can achiveve your goals.
    – SJuan76
    Apr 17 at 14:17
1

There are no restrictions, you just need to comply with the GDPR as a data controller

That means you need to have a valid legal reason for getting personal data (WhatsApp addresses), sharing it and follow all the normal rules about data security, data integrity and data deletion.

Improve this answer
0

No, not if it's a broadcast list as you seem to describe.

In a broadcast list participants can not know of each other, and thus don't know each others phone number or other information.

At least tits doesn't invoke the Spanish precedent as described above. And I think it would be compliant in general, but whether there are other provisions that it violates I'm not fully certain but I do strongly suspect that it would overall be compliant.

Improve this answer
5
  • WhatsApp does not allow for a group to not share the contact info, even if nobody but the owner can send.
    – Trish
    Apr 16 at 8:14
  • No broadcast list messages just show up to recipients as direct messages.
    – Joseph P.
    Apr 16 at 8:31
  • 1
    While broadcast recipients don't learn about each other, there doesn't seem to be a feature to create a reusable list to which multiple messages can be sent. Thus, it is likely that OP is asking about a normal group, which would be problematic. This answer presents a possible alternative, but the need to manually select recipients each time could also lead to risks. Relying on the broadcast feature also makes it more difficult to handle opt-outs.
    – amon
    Apr 16 at 9:05
  • I’m pretty sure broadcast lists are fully reusable.
    – Joseph P.
    Apr 16 at 14:30
  • I think that’s their entire point: otherwise it would just be forwarding a particular message to many recipients manually.
    – Joseph P.
    Apr 16 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.