WhatsApp’s new terms: keep it personal and you won’t see change

The recent well-publicised update from WhatsApp which requires users to accept new terms in order to continue using the platform is raising major privacy concerns for Malaysians.

Government authorities and data privacy experts say that Malaysia’s Personal Data Protection Act 2010 (PDPA) cannot be applied to companies located outside Malaysia.

The update sparked consternation and confusion as WhatsApp’s parent Facebook announced users must accept their new terms of service or see their access to WhatsApp cut off from February 8.

A clarifying statement from WhatsApp states the policy update does not affect the privacy of messages sent between friends or family.

Instead, the update encompasses changes associated with how WhatsApp collects and uses data when users message companies to conduct a business transaction, such as buying something, through the app.

Experts say users can rest assured that the new terms will not affect their personal messages with friends, family, and co-workers, with WhatsApp itself saying it would postpone its data-sharing change and use the pause to clear up misinformation around privacy and security.

However, the Department of Personal Data Protection Malaysia (JPDP) advises Malaysians to think carefully before sharing personal information via WhatsApp especially when interacting with business accounts.

Experts say users can rest assured that the new terms will not affect their personal messages with friends, family, and co-workers.

“WhatsApp users are strongly advised to always be prudent in sharing their personal data via the platform,” a spokesman for JPDP told MalaysiaNow, adding that commercial entities within Malaysia are bound by PDPA standards and rules.

Regarding the app’s imminent changes on privacy policy, JPDP said that the social media platform will continue to operate as usual in the country: “This department has no plans to restrict the usage of WhatsApp in Malaysia in light of the forthcoming changes in terms of service and privacy policy.”

JPDP commented that Malaysia’s privacy laws do not have extraterritorial jurisdiction over companies located outside Malaysia such as US-based WhatsApp.

Deepak Pillai, a lawyer of over 20 years’ experience specialising in technology, media and telecommunications, explained that WhatsApp is a free service made available for public use and users are subject to its terms of service.

“It is up to individuals to accept or decline those terms. Should they not be acceptable, then unfortunately a user’s only option is not to use the service,” he told MalaysiaNow.

He said that if WhatsApp has no company equipment in Malaysia to process personal data, then it is very likely that it does not need to comply with the PDPA.

“Though there is non-compliance with local PDPA, WhatsApp still complies with major data protection laws around the world that are largely similar,” he said.

His opinion is that for the time being, users need not worry about the new policy update as all messages, voice and video calls will remain encrypted and will not be shared with anyone else.

“Though there is non-compliance with local PDPA, WhatsApp still complies with major data protection laws around the world that are largely similar.”

He added however, that when using new functionality which allows users to message businesses and make payment transactions through WhatsApp, users need to be aware that WhatsApp can share their data related to that transaction with Facebook and third-party merchants in order “to help us operate, provide, improve, understand, customise, support, and market our services”.

The conclusion seems to be that little will change for users WhatsApping their friends to update them on the latest gossip.

It’s only when buying something through the app that users should definitely bear in mind a 21st century twist to the Latin advice: caveat emptor, let the buyer beware.

And as more people turn to e-commerce in the pandemic: caveat venditor, the seller should be careful too.