We previously shared our thoughts on WP29 investigation into WhatsApp sharing users’ personal data with its parent company, Facebook.  The Information Commissioner Office (ICO) is concerned that Facebook has not properly informed users as to how their personal data would be used. As a result, WhatsApp may not have obtained a valid consent from its users to share their data.

In response to ICO’s request, Facebook has now paused using personal data from UK WhatsApp users for the purposes of advertising or product improvement:

It’s one of the roles of the Information Commissioner to pull back the curtain on how organisations use personal data, and I wanted to give you an update on what we’ve done so far.

I had concerns that consumers weren’t being properly protected, and it’s fair to say the enquiries my team have made haven’t changed that view.  -  ICO

Facebook acquired WhatsApp nearly three years ago. Current provisions in relation to company mergers mean that customers’ personal data are an asset which can be bought or sold as part of the transaction. In some cases, companies are bought purely for this reason. There is a real possibility, if not likelihood, that the buyer already holds some data and that once it obtains new information, the customers may lose control over how their data is matched and used.

Most of us use digital services on a daily basis. Our online presence, however, creates a map of our interests and activities. It is important that the businesses that have access to it recognise its importance and deal with it with appropriate care and attention.

The ICO is discussing the issues with the industry, competition regulators and consumer groups and as a result, a clarification of M&A laws in this area is likely to follow.