POPIA WhatsApp compliance South Africa

WhatsApp Groups and compliance with the Protection of Personal Information Act 4 of 2013

This article serves to clarify the legality of adding members to a “WhatsApp” (or any other form of social media) group without their consent. We have also included a disclaimer which can be included in any WhatsApp group invitation sent to potential group members.

Section 11(1)(a) of the Protection of Personal Information Act 4 of 2013 states:

“Personal Information may only be processed if the data subject, or competent person where the data subject is a child, consents to the processing.”

In order to interpret the above provision, we need to define three key points or phrases. These phrases are defined in Section 1 of Act 4 of 2013.

1. The data subject is “the person to whom the personal information relates”.

2. Personal information is “information relating to an identifiable, living, natural person and where applicable, an identifiable, existing juristic person, including but not limited to,

any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other particular assignments to the person; ande name of the person if it appears with other personal information relating to the person or the disclosure of the name itself would reveal information about the person.”

3. Processing is “any operation or activity or any set of operations, whether or not by automatic means, concerning personal information including:

the collection, receipt, recording, organization, collation, storage, updating or modification, retrieval, alteration, consultation or use;
dissemination by means of transmission, distribution or making available in any other form; or
merging, linking, as well as restriction, degradation, erasure or destruction of information.

It is clear from the interpretation of Section 11(1)(a) of the Act as well as the definitions listed above that consent of a data subject (in this case a member of a WhatsApp group, whether pre-existing or not) is imperative. Any failure to obtain such consent will be a breach of the Protection of Personal Information Act 4 of 2013.

A WhatsApp group potentially contains names, numbers, photos or other contact information of up to 100 people. People who did not necessarily give their consent to become members of the group or have their information shared now have this information available to other group members.

In order to comply with the provisions of the Act, we suggest the following measures:

The group admin should send each subject an invitation link (see the process to be followed below), which should also be accompanied by the disclaimer as included hereunder. The invitation will allow the subjects to choose whether to join the group and consent to share their information.

For any existing WhatsApp Groups, where the group members were added by a group admin directly and not through an invitation link, all such group members are to be removed, and a new invitation link to join the group should then be sent.

Consent is critical, so the members must consent to become a member of a group.

3. You will now have the option to Copy link or Send link via WhatsApp.

4. You can now send this link to all the data subjects separately (as to avoid the invitation to include every invited subjects information ) along with the following disclaimer:

Disclaimer to be sent:

“By joining this group, you agree not to post, share, or circulate any illegal, harmful, abusive, dangerous messages, which may violate any laws, which are otherwise inappropriate or objectionable. Members are also prohibited from sharing or posting the contact information of any person to the group or sharing any personal information of any member of this group to any other person or group. The Group admin will not be held responsible for any messages or posts of any group members. By joining this group, you consent that you are willing to share your contact, name, number, profile photo or other contact information available on your profile with the group. Once this information has been shared, you acknowledge that any other group member will have access to this information and may share your information within or outside the group. The Group Admin has no control over such actions. If you have any privacy concerns, DO NOT JOIN the group and do not accept the invitation link. You may leave the group at any stage by selecting the Exit Group option. You further acknowledge that you will be responsible for any messages you shared or posted to the group, whether or not such message originated from you or not. Anything shared or posted in the group may be shared by group members with any other groups or people in the public domain without your prior permission. The Group Admin retains the right to remove any group member at any time without any limitation or reason.”

Posted on June 25, 2021 by Silvana Pereira

Category: Blogs