4 ms·
The article says Whatsapp will now share: * User phone numbers * Other people’s phone numbers stored in address books * Profile names * Profile
by Namari 6y ago
The article says Whatsapp will now share:
* User phone numbers
* Other people’s phone numbers stored in address books
* Profile names
* Profile pictures and
* Status message including when a user was last online
* Diagnostic data collected from app logs
and already was getting:
Purchases
Financial information
Location
Contacts
User content
Identifiers
Usage data and
Diagnostics
- castorp 6y agoDoesn't this mean that anybody agreeing to those terms needs to ask permission from each and everybody in their address book? And if they don't, can I sue them (at least in the EU) or ask my contact to be removed before the agree to the terms?
- yulaow 6y agotechnically it is facebook in violation of GDPR considering that all the data in the addressbook is easily considered personal data for a commercial entity and so facebook should ask the permission to each owner of those numbers before collecting them.
- omk 6y agohttps://faq.whatsapp.com/general/contacts/about-contact-upload https://faq.whatsapp.com/general/contacts/about-contact-uplo... Based on this they do not store information of users who have not signed up and only store a cryptographic hash. The hash isn't created on the device, so the servers definitely get it.
- stiray 6y agoJust a small detail about cryptographic hash: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" Cryptographic hash of phone number is still uniquely identifying natural person and is by GDPR still under the definition of personal data. The GDPR authors knew what they were doing - or they were lucky although also other parts of GDPR suggest that they had some technical think-tank behind it. Anyway, hashing doesn't solve anything, whatever "obfuscation" is used/invented, as long as information points to "natural person" it is considered personal data.
- pfortuny 6y agoThere are just 10^9 phone numbers in Spain. Say 0.01 sec/hash (which is A LOT), you have 10^8 seconds. You can decrypt all the hashes in 0.3 years... "Cryptographic hash" is as bullshit as "MD5 encrypted passwords".