5 ms·

> users in the EU are exempt from the new privacy policy How does this work if someone outside of the EU is in the same group or private chats as an EU user?

> users in the EU are exempt from the new privacy policy How does this work if someone outside of the EU is in the same group or private chats as an EU user? Surely by sharing information about those chats they would be breaking the GDPR if that's the case.

signal11 6y ago
I don’t know the details and would love to know. However if I were asked to “get this done”, this is what I’d do: The user’s phone number is a unique ID as far as WhatsApp is concerned, so any metadata related to phone numbers in the “European region” (eg numbers starting with +33, +44, +49, etc) would be treated as if the 2020-era privacy policy applies.
- cassianoleal 6y ago
  That wouldn't cover, for example, for people who are EU residents but still hold phone numbers from outside of the EU. That was my case until recently, and of many other expats I know.
  - signal11 6y ago
    I appreciate your quandary, but I wonder if most people realise how little explicit profile data WhatsApp has for its users. It doesn’t have a name, country of residence, ... anything really. Just a phone number. I know looking at a phone number’s country code is imperfect, but pretty much every other method is problematic too. * the most explicit would be for EU residents to contact WhatsApp with proof of residency. Unfortunately it creates a vast bureaucracy and most people should be wary of sharing scans of their documents, with Facebook of all companies. * The WhatsApp app could look at which network the phone it’s on is connected to. If it’s a EU network (say connected to a EU network for 6+ months to filter out tourists), protections could apply, but I this would probably adversely impact EU nationals in non-EU countries. So yes, a number of options are possible, each have pros and cons. How far Facebook would go would depend on regulatory direction, almost certainly.
veqz 6y ago
All PII (personally identifiable information) of EU/EEA citisens and residents would have to be filtered out, yes. Chat messages in themselves are not necessarily PII, but then again WhatsApp isn't claiming to freely read the messages. I suppose the messages in the chat could be mined for keywords to give ads to the non-EU/EEA persons.
- cassianoleal 6y ago
  In theory those messages are E2EE so they don't have access to them anyway. The same is not true for all the metadata.
llimos 6y ago
The GDPR covers EU citizens wherever in the world they are. Is there a way for me to tell WhatsApp that I am an EU citizen not currently based in the EU?
- esperent 6y ago
  I'd guess it's based on your phone number. Use an EU number to sign up and they'll treat you as an EU citizen.
- throwaway2245 6y ago
  > The GDPR covers EU citizens wherever in the world they are. No. In law, EU GDPR absolutely does not cover EU citizens who are physically outside the EU. GDPR makes no reference to citizens or residents and is understood to apply to any person whenever they are physically present in the EU, and to data which is created/located physically inside the EU's borders (and to data which has crossed the border within the rules). Citation e.g. first search result https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-living-in-the-us/ https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-... which suggests only that businesses might find it easier to give GDPR protections more widely. I would not expect that advice to be taken by Facebook.
throwaway2245 6y ago
While they were figuring out the EU's ePrivacy Directive, Facebook Messenger turned off certain features to all chats with an EU user in, whether or not there were non-EU users in that chat. (I assume they have or will come up with a work-around, as far as legally possible)

signal11 6y ago

I don’t know the details and would love to know. However if I were asked to “get this done”, this is what I’d do: The user’s phone number is a unique ID as far as WhatsApp is concerned, so any metadata related to phone numbers in the “European region” (eg numbers starting with +33, +44, +49, etc) would be treated as if the 2020-era privacy policy applies.

cassianoleal 6y ago
That wouldn't cover, for example, for people who are EU residents but still hold phone numbers from outside of the EU. That was my case until recently, and of many other expats I know.
- signal11 6y ago
  I appreciate your quandary, but I wonder if most people realise how little explicit profile data WhatsApp has for its users. It doesn’t have a name, country of residence, ... anything really. Just a phone number. I know looking at a phone number’s country code is imperfect, but pretty much every other method is problematic too. * the most explicit would be for EU residents to contact WhatsApp with proof of residency. Unfortunately it creates a vast bureaucracy and most people should be wary of sharing scans of their documents, with Facebook of all companies. * The WhatsApp app could look at which network the phone it’s on is connected to. If it’s a EU network (say connected to a EU network for 6+ months to filter out tourists), protections could apply, but I this would probably adversely impact EU nationals in non-EU countries. So yes, a number of options are possible, each have pros and cons. How far Facebook would go would depend on regulatory direction, almost certainly.

veqz 6y ago

All PII (personally identifiable information) of EU/EEA citisens and residents would have to be filtered out, yes. Chat messages in themselves are not necessarily PII, but then again WhatsApp isn't claiming to freely read the messages. I suppose the messages in the chat could be mined for keywords to give ads to the non-EU/EEA persons.

cassianoleal 6y ago
In theory those messages are E2EE so they don't have access to them anyway. The same is not true for all the metadata.

llimos 6y ago

The GDPR covers EU citizens wherever in the world they are. Is there a way for me to tell WhatsApp that I am an EU citizen not currently based in the EU?

esperent 6y ago
I'd guess it's based on your phone number. Use an EU number to sign up and they'll treat you as an EU citizen.
throwaway2245 6y ago
> The GDPR covers EU citizens wherever in the world they are. No. In law, EU GDPR absolutely does not cover EU citizens who are physically outside the EU. GDPR makes no reference to citizens or residents and is understood to apply to any person whenever they are physically present in the EU, and to data which is created/located physically inside the EU's borders (and to data which has crossed the border within the rules). Citation e.g. first search result https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-living-in-the-us/ https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-... which suggests only that businesses might find it easier to give GDPR protections more widely. I would not expect that advice to be taken by Facebook.

throwaway2245 6y ago

While they were figuring out the EU's ePrivacy Directive, Facebook Messenger turned off certain features to all chats with an EU user in, whether or not there were non-EU users in that chat. (I assume they have or will come up with a work-around, as far as legally possible)