What does WhatsApp Business Mean for Privacy?

Introduction   

In early 2021, WhatsApp caused an uproar with a change in its privacy policy. People believed that its promise of end-to-end encryption was a mere façade. After updating its privacy policy and experiencing a drop in user confidence, WhatsApp issued a clarification assuring users that it does not share any private conversations, messages, or call history with Facebook. There have been some significant adjustments made to the privacy policy regarding chats with business accounts. WhatsApp has made an effort to explain how some factors may alter when interacting with a business account on the network.  

What is WhatsApp Business?   

Users can create a business account on the standalone WhatsApp Business app to connect with their clients. Small businesses may communicate with hundreds of potential consumers using the messaging app, seek their feedback, and more.   

Quick replies, labels, catalogs, business profiles, and other features are available on the app. It’s vital to keep in mind that the content shared when messaging with a business on WhatsApp may be seen by a number of people within that business. This means that messaging a business on WhatsApp is different from having a private conversation with a friend or family member. Many more employees will be able to see these messages, and a different company may be used to store, read, or respond to them.  

WhatsApp business cannot be used for regulated industries or when there are heightened confidentiality requirements for personal data, such as in healthcare, financial, or legal services entities  

You can use WhatsApp Business for business, however:   

• One is portrayed as a company or brand rather than as an individual.  

• It can only be used between a business and clients; it cannot be used between organizations (since its policy states that it is “not intended for intracorporate usage”).  

Additionally, some companies might be collaborating with third-party service providers (like Facebook) to help them manage their consumer communications.  

The Changes  

While it might seem like a periodic change that is mundane but the severe backlash it faced caused the multibillion-dollar messaging app to clarify its policies. It is thus imperative for businesses that use WhatsApp business application and other people to understand the policy changes and implications they have.  

1.Hosting by Meta  

Some companies may utilize Meta (including Facebook) “hosting services” to control WhatsApp chats. To manage client interactions, answer inquiries, and deliver helpful information like purchase receipts, these hosting services are employed. Depending on the business, WhatsApp conversations with customers may be recorded for later internal scrutiny. For instance, if a person buys something from an e-commerce website and orders alerts with information about delivery and other aspects also appear on WhatsApp and the business uses Facebook’s hosting services, the information may be shared with the social network. WhatsApp further states that the company may use the information shared in business chats “for its own marketing purposes, which may include Facebook advertising.”  

As a result, after speaking with a company about buying something from them, one may then see a Facebook advertisement for the same product. According to WhatsApp, conversations with businesses that choose to use Facebook hosting services” will be clearly labeled. 

2.Data Privacy and Advertising 

With the addition of features like Shops, WhatsApp Business now allows companies to advertise their products inside the application. In December 2020, the platform began to roll out this Facebook-branded offering.  

Users will be informed of how their data is shared with Facebook should they choose to use Shops on the platform, according to WhatsApp, which makes it clear that if one chooses to interact with Shops, their shopping activity can be used to personalize Shops experience and the ads one sees on Facebook and Instagram. The Shops functionality is not enabled on all business accounts. Some are straightforward business accounts that do not allow customers to make purchases directly from the messaging app. However, as more companies use WhatsApp to do business, they are likely to use similar functionalities.  

Users “may see an ad on Facebook with a button to message a business using WhatsApp”. According to WhatsApp, one will have the opportunity to communicate with that company if WhatsApp is installed on their phone. Facebook may use this information to personalize the advertisements that you see on the social network if a user does interact with these ads. 

3.Processing Information in the United States of America  

According to the amended policy, companies using WhatsApp Business have to agree to the transfer and processing of information that is collected, stored, and used in the United States (and other countries globally where WhatsApp has facilities). The laws, regulations, and standards of the country in which the information is stored or processed may be different from those of the business’ own country.  

4.Putting the Onus on Businesses  

These Policy Terms designate the Company as the Data Controller under the General Data Protection Regulation (GDPR) of the European Union (the data controller is the one who determines the purposes for which and the means by which personal data is processed). The company chooses the message recipients and instructs WhatsApp to process such Personal Data for the duration of these Terms.  

According to this new policy, it is the business that must obtain all relevant authorizations, consent, licenses, and rights (such as consent to share consumer contact information and other private information with WhatsApp).  

Furthermore, according to the terms, the businesses using WhatsApp Business must defend, hold harmless, and indemnify the WhatsApp Parties from and against any and all liabilities, damages, losses, and expenses of any sort. 

5.Sharing Company Content with WhatsApp  

WhatsApp can share the information pertaining to the company If has a good faith belief that disclosing the business’ information, including Company Content, is reasonably necessary to: WhatsApp can share the information pertaining to the company if it has a good faith belief that disclosing the business’ information, including Company Content, is reasonably necessary to:   

(a) respond to legal processes, government requests, or applicable laws;   

(b) enforce these Business Terms and any other applicable terms and policies, including looking into potential violations;   

(c) detect, investigate, prevent, and address fraud and other illegal activity, security or technical issues  

(d) protect the rights, property, and safety of the users, WhatsApp, Facebook Companies, or others.  

Conclusion   

Because of privacy laws like the GDPR and other industry-specific rules, many of the terms are especially difficult for larger organizations. It is not yet known what visibility, audit trails, or proper record-keeping will be available to businesses using WhatsApp to interact with customers given that WhatsApp messages are end-to-end encrypted. The WhatsApp Business rules that businesses must accept (as previously said) make it plain that any risks associated with this are being transferred to the business and are not Facebook’s concern, so businesses will need to proceed with extreme caution.  

What this will mean for a normal WhatsApp user is currently unclear. For instance, if you communicate with a company using WhatsApp, what information do they receive from you, are they permitted to view and keep your communications, and if so, how broadly across their organization? And what control do you have over that? The answers will differ depending on the local laws in every country. 

Understanding the type(s) of data being held, how it has been categorized, the standards that regulate the data, the source of that data, and who has accessibility to it are essential for an efficient privacy program. By automating some of this activity, it is possible to reduce the possibility of human error and further guard against oversight that can result from overstretched staff.  

The guidelines for better Privacy management and administration are straightforward once you understand them. Once they become ingrained in your behavior, they will aid in defending you from frequent scam tactics. Get in touch with us at info@tsaaro.com If you want to run an audit of your consent practices, check out our Regulatory Compliance Service, and Schedule a call with our experts by clicking here. Take the first step towards a secure your organization’s data by scheduling a call with our privacy expert team at Tsaaro Solutions today.