The Brazilian Institute for Consumer Protection sent to the Ministry of Justice and the National Data Protection Authority a 20-page document asking for the suspension of the change in the new terms of use of WhatsApp, scheduled for May 2021. WhatsApp terms of use and privacy policy are already subject of a confidential investigation at the National Consumer Secretariat for non-compliance of national regulation. The Institute for Consumer Protection requires authorities to mandate WhatsApp to refrain from transferring data to other companies of the Facebook economic group for the purposes of advertising, marketing and analytics.
In Brazil, Instagram and Facebook have received WhatsApp metadata from users, which have nothing to do with the content of messages. Examples of transferred metadata are the users' type of mobile device, the frequency of use of the app by each person, the name of the groups to which users belong, users' name, among others. This data aggregated with other traces left on Facebook and Instagram help to form detailed profiles about people, which facilitates the segmentation of advertising (business model of Instagram and Facebook).
The policy of data sharing between the three platforms returned to public debate because, now, users who do not agree with the terms of WhatsApp will no longer be able to use the application. The change is global and, in Brazil, it happens after the Central Bank authorised users to make bank transfers via WhatsApp.
The recent enacted Brazilian data protection legislation has 10 legal bases, such as legitimate interest and consent, which must justify the purpose of data collection. In this sense, Facebook should present specific identification of the legitimate interest to share WhatsApp data with Facebook and Instagram, by demonstrating that sharing is strictly necessary to achieve a legitimate purpose, in addition to balancing the interests, rights and freedom of the data subject, in the case of WhatsApp users. So far, the legal basis WhatsApp has to share users' data in Brazil is not clear.