Introduction

At the beginning of the year, precisely on 4th January 2021, WhatsApp introduced a new privacy policy (the New Policy) to share more commercial user data with its parent company, Facebook and indicating its intention to enforce same on 8th February 2021. The New Policy sparked widespread outcry from WhatsApp users; prompting WhatsApp on 12th January 2021, to clarify that they do not share personal chat messages with Facebook. Instead, the update includes changes related to messaging a business on WhatsApp, which is optional, and provides further transparency about how Whatsapp collect and use data.1

The explanation did not assuage the feelings of the users who felt 'betrayed'. Some users started migrating to alternative platforms like Telegram and Signal (the latter endorsed by Elon Musk).2 The impending foreseeable mass exodus of users, coupled with the trenchant criticisms, made WhatsApp to retract and delayed the implementation of the New Policy until 15th May 2021.3

Particularly striking is the fact that the New Policy is discriminatory in nature as it grants the right to opt-out to only users in the European Union. Consequently, many privacy/cyber-security experts, and entrepreneurs have come out to urge people to migrate to alternative platforms.4 Given that the New Policy has now been implemented, NITDA, Nigeria's data privacy regulator, on 17th May 2021, issued an advisory opinion (the NITDA Advisory) to Nigerians on requisite responsive actions.5

Summary of NITDA's Advisory

NITDA is empowered under section 6(f) NITDA Act 2007 to provide advisory opinions to Nigerians. Thus, the NITDA Advisory resulting from the meeting it had with Facebook, (WhatsApp's parent) in conjunction with the African Network of Data Protection Authorities following the implementation of the New Policy.6 Essentially, NITDA advised as follows:

  1. "Nigerians may wish to note that there are other available platforms with similar functionalities which they may wish to explore. Choice of platforms should consider data sharing practices, privacy, ease of use among others; and
  2. "Limit the sharing of sensitive personal information on private messaging and social media platforms as the initial promise of privacy and security is now being overridden on the bases of business exigency."7

"Data WhatsApp Shares with Facebook"

The Facebook team confirmed that WhatsApp will share data with Facebook which was quoted in the NITDA Advisory: "As part of the Facebook companies, WhatsApp receives information from and shares information with the other Facebook Companies. We may use the information we receive from them and they may use the information we share with them, to help operate, provide, improve, understand, customise support and market our services and their offerings, including the Facebook company products."

Therefore, WhatsApp shares the following information with Facebook Company:

  1. Account registration information;
  2. Details on how users interact with others;
  3. Mobile device information;
  4. Internet protocol address;
  5. Location data;

The NITDA Advisory stated that the Facebook Team confirmed that private messages shared on WhasApp consumer version are encrypted and not seen by Facebook. However, "the metadata (data about the usage of the service), which happens to be personal data is shared with the other members of the Facebook group".

Privacy Costs: NITDA'S Belated Response

Whilst NITDA's engagement with Facebook in collaboration with its sister African regulatory bodies in April 2021 is commendable, the purpose of the NITDA Advisory would have been better served if it was issued before the New Policy's effective date of 15th May 2021. The NITDA Advisory was issued on 17th May 2021, two clear days after the 15th May 2021 effective date of the New Policy. Prior to its issuance, some Nigerians might have taken steps to accept the New Policy, effectively putting them in a position of crying over spilt milk. This is unlike South Africa's regulators who met as early as 13th January to analyse the New Policy and how it affects South African citizens and took steps to alert their citizens on the implications.8 Also South Africa and other countries like United States and India have requested WhatsApp to stop the New Policy.9

Also, the fact that the NITDA Advisory was only publicised on the NITDA's website and Twitter account is rather underwhelming. One would have expected a more rigorous publicity campaign, utilising additional online channels, and also including newspaper, radio and television advertisements during prime time slots. Airtime especially on Federal and State Government radio and television networks would have helped with greater diffusion.

The likelihood that a large chunk of Nigerian Whatsapp users never got wind, or will become further belatedly aware, of the NITDA Advisory is very high, because only a fraction of them are on Twitter10 and they are may still not see the NITDA Advisory for one reason or the other. And if they are no aware, of course they would not even have any motivation for checking NITDA's website on the issue. The entire reactive approach is inconsistent with NITDA's own recognition of data privacy and protection being serious national issues, as mentioned in the NITDA Advisory. Clearly regulatory nimbleness and proactivity cannot be over-emphasised, in the data privacy space.

Conclusion

The New Policy appears to be operative on a "take it or leave it" model, which runs contrary to the provisions of the Nigerian Data Protection Regulation 2019 (NDPR), that consent must at all material times, be freely given.11 The consequence of refusing to accept the New Policy is to shut the WhatsApp door against such 'recalcitrant' user. On one hand, the choice of having to do away with WhatsApp may be pyrrhic, when quantified in terms of the contacts and transactions that may be lost thereby.

On the other, the apparent double standard of the New Policy means that the citizens of European countries could opt-out of the New Policy, without losing their WhatsApp. The fascinating excuse for this is that Europe already has a robust data privacy protection regime vide the General Data Protection Regulation 2018 (GDPR).12 This sends a wrong, if not condescending, signal about the privacy regimes of other countries.

The foregoing development underlines the need to hasten the development of a unified data protection framework for Africa,13 and for Nigeria to swiftly pass the Nigerian Data Protection Bill 2019 towards making our data protection regulation framework, more robust.

Nonetheless, it is apt to close with the concluding paragraphs of the NITDA Advisory, thus:

"Nigeria's engagement with Facebook continues. We have given them our opinion on areas to improve compliance with the NDPR. We have also raised concerns as to the marked difference between the privacy standard applicable in Europe, under the GDPR and the rest of the world.

Given the foregoing and other emerging issues around international technology companies, NITDA, with stakeholders, is exploring all options to ensure Nigerians do not become victims of digital colonialism. Our national security, dignity and individual privacy are cherished considerations we must not lose. Because of this, we shall work with the Federal Ministry of Communications and Digital Economy to organize a hackathon for Nigerians to pitch solutions that can provide services that will provide functional alternatives to existing global social platforms."14

Footnotes

* This Regulatory Alert benefitted from the review and input of Afolabi Elebiju, Esq. Principal, LeLaw Barristers & Solicitors. However, the author is wholly responsible for the views expressed herein.

1. WhatsApp, 'Answering Questions About WhatsApp's Privacy Policy', 12.01.2021: https://faq.whatsapp.com/ general/security-and-privacy/answering-your-questions-about-whatsapps-privacy-policy/?lang=en (last accessed 19.05.2021).

2. Rae Hodge, 'What is Signal? Everything You Need to Know About Elon Musk's App Recommendation', Cnet, 28.01.2021: https://www.cnet.com/how-to/what-is-signal-everything-you-need-to-know-about-elon-musks-app-recommendation/ (last accessed 20.05.2021).

3. Mike Isaac, 'WhatsApp Delays Privacy Changes Amid User Backlash', New York Times, 15.01.2021: https://www.nytimes.com/2021/01/15/technology/whatsapp-privacy-changes-delayed.html#:~:text=SAN%20FRANCISCO%20%E2%80%94%20WhatsApp%20said%20on,what%20it%20planned%20to%20do (accessed 19.05.2021).

4. See for example, 'The India Tech Chiefs Follow Musk, Signal Move Away From WhatsApp', The Economic Times, 12.01.2021: https://economictimes.indiatimes.com/tech/technology/indias-tech-chiefs-follow-musk-signal-move-away-from-whatsapp/articleshow/80216186.cms (last accessed 19.05.2021).

5. NITDA, 'WhatsApp Privacy Policy Changes: Implications for Nigerian Users', Public Advisory, 17.05.2021: https://nitda.gov.ng/public-advisory-whatsapp-privacy-policy-changes-implication-for-nigerian-users/(last accessed 19.05.2021). The NITDA Advisory was signed by Mrs. Hadiza Umar, NITDA's Head of Corporate Affairs and External Relations.

6. Per excerpts from Paras 1 and 2 NITDA Advisory: "[NITDA] . wishes to provide this advisory to Nigerians to address Nigerian concerns on changes to WhatsApp Terms of Service and Privacy Policy which took effect on 15th May, 2021. Millions of Nigerians use WhatsApp platform for business, social, educational, and other purposes. The platform is the social media platform of choice for many Nigerians.

To understand the issues and give an opportunity to explain its views, NITDA in collaboration with the African Network of Data Protection Authorities engaged Facebook Incorporated, the owners of WhatsApp platform, specifically, its global Policy officials on 9th April, 2021. After the engagement, NITDA, as Nigeria's data privacy regulator, wishes to advise Nigerians on how Facebook's business decision affects their privacy rights."

7. Emphasis supplied. Prior to these two specific points of advice in the NITDA Advisory, it considered inter alia dataset collected by WhatsApp and data that WhatsApp shares with Facebook under the New Policy.

8. Staff Writer, 'South Africa Regulator Reviewing New WhatsApp Policy Changes', BusinessTech, 14.01.2021: https://businesstech.co.za/news/technology/460866/south-african-regulator-reviewing-new-whatsapp-policy-changes/ (accessed 20.05.2021).

9. 'India Takes on WhatsApp with Fresh Warning Against New Data Policy', Wionnews, 19.05.2021: https://www.wionews.com/india-news/india-takes-on-whatsapp-with-fresh-warning-against-new-data-policy-386110 (accessed 20.05.2021).

10. According to 2020 statistics, only 28 million out of 206 million Nigerians use social media; Whatsapp (at 93%) is considerably more widely used than the figure of 61.4% Nigerian Twitter users. See graphics in 'Most Used Social Media Platforms in Nigeria as of the 3rd Quarter of 2020', Statista, February 2021: https://www.statista.com/statistics/1176101/leading-social-media-platforms-nigeria/ (accessed 20.05.2021). See also, GlobalStats, 'Social Media Stats in Nigeria - April 2021', Statcounter: https://gs.statcounter.com/social-media-stats/all/nigeria (accessed 20.05.2021), which shows Facebook at 43.88% and Twitter at 32.06%. Others are: Instagram (10.28%), Pinterest (8.93%), YouTube (3.38%) and LinkedIn (0.85%).

11. Article 1.3(iii) NDPR.

12. Yasmin Ahmed, 'Why WhatsApp Users in Europe Can Opt-Out of New WhatsApp Privacy Policy But Users in India Cannot?' India Today, 21.04.2021: https://www.indiatoday.in/technology/news/story/why-whatsapp-users-in-europe-can-opt-out-of-new-whatsapp-privacy-policy-but-users-in-india-cannot-1793555-2021-04-21 (accessed 20. 05.2021).

13. According to a commentator, a coalition of African countries including Nigeria, has agreed to develop a data protection framework with the goal of centralising data protection law and digital economy across Africa. See Michelle A. Read, 'Coalition of African Nations to Coordinate Data Protection Framework', Mondaq, 29.10.2020: https://www.mondaq.com/southafrica/privacy-protection/999468/coalition-of-african-nations-to-coordinate-data-protection-framework (accessed 19.05.2021).

14. Emphasis supplied. This is quite pragmatic, given observations by a commentator (in January 2021) that: "At the moment, Africa's regulatory oversight for digital rights is barely effective enough to make demands." See Daniel Adeyemi, 'WhatsApp Wants to Keep Your Data for Life: Even After Deleting the App', Tech Cabal, 08. 01.2021: https://techcabal.com/2021/01/08/what-do-whatsapps-new-privacy-rules-mean-for-africans/ (accessed 20.05. 2021).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.