The notifications WhatsApp plans
Whatsapp's planned reminders to accept its new privacy policy.
  • Facebook needs prior permission from the Information Regulator to cross-process cellphone numbers harvested from South Africans, that regulator has told the platform.
  • Users who have already handed over their mobile numbers – or telephone numbers of their contacts – can not legally consent to such processing now, the regulator holds.
  • It has also expressed some displeasure at how Facebook is handling the European Union, compared to SA.
  • For more stories go to www.BusinessInsider.co.za.

This article has been updated below.

South Africa's Information Regulator (IR) has written to Facebook South Africa "and provided an analysis of some of the concerns that it has" around WhatsApp's new privacy policy, it said in a statement on Wednesday night.

Among other things, it told the social media giant that South African users simply aren't in a position to give WhatsApp permission to pass on cellphone numbers to the rest of Facebook.

South Africa's Protection of Personal Information Act (POPIA) lays out strict rules on what companies can – and can not – do with personal information. For some uses of personal information, the agreement of users is not enough; prior permission must be sought from the Information Regulator. And what it believes Facebook plans around cellphone numbers is one such case, the IR says.

It believes WhatsApp may not legally "process any contact information of its users for a purpose other than the one for which the number was specifically intended at collection, with the aim of linking that information jointly with information processed by other Facebook companies."

WhatsApp requires the mobile phone number of a user signing up. It also offers a "contact upload" service, "an optional feature that allows us to identify which of your contacts in your device’s address book are also WhatsApp users so that we can add them to your WhatsApp contacts, and quickly update your WhatsApp contacts in case your contacts who are not yet using WhatsApp sign up later."

It does not share user contact books with Facebook, WhatsApp says, and where it receives cellphone numbers for people not yet on its network, it will only only "process them momentarily" to create a cryptographic hash, so that the actual telephone number can be discarded, while WhatsApp can still let you know if that person joins.

The IR said it had also raised "as a central concern" the difference in treatment between South African users and those in Europe. Though they use the same network and service, residents of the European region technically deal with WhatsApp Ireland, which has a different end-user agreement and privacy policy to WhatsApp LLC, under which South Africa (and the rest of the world) fall.

Europeans, the IR says, "will receive significantly higher privacy protection than people in South Africa, and Africa" from Facebook, even though SA modelled its privacy legislation on that of the European Union.

In February WhatsApp confirmed that users who do not accept its new privacy policy will be blocked from sending or seeing messages after 15 May. They will, however, for weeks after that deadline continue to receive notifications about incoming messages – which they will be able to read, just as soon as they agree to the new terms.

Beyond accepting its terms, users have two options, WhatsApp says: delete their own accounts, or wait the roughly 120 days it takes for inactive accounts to be deleted automatically.

Facebook says it requires new permissions from WhatsApp users to enable services that businesses will pay to use, making WhatsApp sustainable as a free-to-use service for consumers.

Update: On Thursday morning, Facebook responded to the IR's statement. Its response reads, in full:

"We are reviewing a letter from the Information Regulator in South Africa, which relates to our privacy policy. To be clear, this update does not expand our ability to share data with Facebook and does not impact the privacy of your messages with friends or family wherever they are in the world. WhatsApp does not share your contacts with Facebook and that policy applies to users everywhere, including in South Africa. We remain fully committed to delivering secure and private communications for everyone."

(Compiled by Phillip de Wet)

Receive a daily news update on your cellphone. Or get the best of our site emailed to you

Go to the Business Insider front page for more stories.