Today, messaging is one of the most important forms of communication, and messenger apps such as WhatsApp are among the most frequently used apps on smartphones. For companies, too, they offer an attractive communication channel to their customers. 

The legal landscape surrounding data protection—not least the GDPR and several unfavorably formulated regulations within it—gives many companies the impression that data privacy poses a major hurdle to using these messaging channels. It is therefore important to simply demonstrate how companies can use messaging in compliance with data protection regulations in order to offer service to their customers through this essential communication channel as well.

In doing so, a messenger like WhatsApp is not actually that different from other digital tools that are taken for granted in day-to-day business operations, such as websites, company apps, or email marketing. Here is how you can successfully implement WhatsApp in compliance with data privacy regulations.

What data is processed? 

Every company is responsible for the personal data it collects and processes. Naturally, this also applies to the use of messenger services such as WhatsApp or Facebook Messenger. 

For this processing to be lawful, one of the legal bases of the GDPR must apply, and users must be informed about the data collection in accordance with Art. 13 GDPR. 

The starting point is therefore the question of which personal data is processed in the first place. 

Very obvious examples for WhatsApp include the username and mobile phone number, and for other messengers, user IDs that are necessary to “reach” the users. 

However, the content of the communication between the user and the company is also an important aspect here. It should be noted that users can provide a wide range of information via free text in the chat.

Finally, metadata—which is also collected by some messaging services, such as Facebook Messenger—must not be overlooked.  

The data and processing activities must now be documented in such a way that lawfulness can be proven in case of doubt. It should therefore be documented in the record of processing activities,    

Legal bases? Check the legitimate basis and, in case of doubt, obtain consent

In order for personal data to be processed, one of three legitimate bases must be met: 

• Contractual performance requires the data (Art. 6(1)(b) GDPR). The data is therefore required to fulfill an agreement entered into between the user and the company. 

• Legitimate interests exist that justify the data processing (Art. 6(1)(f) GDPR) 

• The users consent to the processing of their data (Art. 6(1)(a) GDPR). Here, it is important to obtain active consent, as opt-out options are not sufficient. 

Since there is sometimes a certain room for interpretation regarding the first two points, it is recommended in case of doubt to take the path of user consent, thereby placing messenger communication on a legally secure foundation.   

Informing users

However, for consent to be truly valid under data protection law, users must be adequately and clearly informed about who is processing which data for what purpose. This can, however, be done electronically or even through “clear affirmative action.” 

The company must inform users about further data processing upon the initial collection of data. At this point, users should be provided with the privacy policy containing all the information required under Art. 13 GDPR. 

Protecting user data from disclosure to third parties

This is one of the most significant hurdles when using WhatsApp in companies and also the reason for widespread skepticism. 

As a rule, WhatsApp is installed as an app on a smartphone, accesses the phone numbers in the device's address book, and transmits them to WhatsApp. 

In doing so, no distinction is made between phone numbers of users who use WhatsApp themselves and those who do not. Nor is there any consent from the respective contacts for this. This practice is inherently problematic and is deemed by data protection authorities to be a clear breach of data protection laws when used in a corporate context. 

To deploy WhatsApp in compliance with data privacy in the enterprise, this unsolicited transfer of contact data to the messenger provider, such as WhatsApp, must be strictly avoided. 

Aside from piecemeal “security workarounds,” the safest and most reliable solution to this problem is using the WhatsApp Business API via specialized messaging software for enterprises, such as Mercury.ai 

In this setup, the entire messaging communication of the company is handled via the Software as a Service (SaaS) platform, meaning the company does not need to install WhatsApp on the respective mobile devices. 

All aspects relevant from a data protection perspective are regulated here in the Data Processing Agreement (DPA), making the use of WhatsApp unobjectionable under data privacy law.  

Data transfer outside the European Union

• Another point of criticism frequently raised against the use of messengers—particularly with WhatsApp—is the transfer of data to the USA. 

• Even under the GDPR, the transfer of personal data to the USA is not excluded, but rather readily permissible under the specific requirements for the transfer of personal data to third countries pursuant to Arts. 44 et seq. GDPR. 

• A data transfer to the USA is unproblematic if the receiving company offers the conclusion of the EU Standard Contractual Clauses

So...

In summary, data protection is a very manageable topic and does not stand in the way of using WhatsApp in customer service—provided that privacy-compliant implementation is made an explicit component of an implementation project and the internal stakeholders for legal and data protection matters are involved early on. 

The current changes to WhatsApp's privacy policy are, by the way, directly related to the increasing use of WhatsApp by businesses. They therefore take into account the development that, alongside predominantly private use cases between individuals, corporate communication has now also become an important aspect. WhatsApp has summarized what the update means for the EU region here: https://www.whatsapp.com/legal/updates/key-updates-eea The article Why Messaging Is Essential in E-Commerce illustrates why the channel is worthwhile for customer support.

Incidentally, WhatsApp answers general questions about privacy here.