EU privacy watchdogs seek answers from WhatsApp and Yahoo about users’ data

European Union privacy watchdogs have warned WhatsApp CEO Jan Koum to stop sharing users’ data with parent company Facebook until they investigated whether the transfers comply with EU data protection law. They also want Yahoo’s Marissa Mayer to come clean about recent leaks and spying allegations.

In an open letter to Koum published Friday, an umbrella group representing the EU’s national data protection authorities expressed its serious concerns at the way WhatsApp users were informed of changes to the company’s terms of service and privacy policy, and questioned whether the company had their valid consent to the changes.

Privacy groups including the Electronic Frontier Foundation have criticized WhatsApp for mishandling privacy changes, and others have filed complaints with the U.S. Federal Trade Commission.

The umbrella group, known as the Article 29 Working Party (WP29) has few powers of its own, but coordinates the activities of the national DPAs, which do have the power to fine companies if they do not change their ways.

“In order to avoid the possibility that the processing of personal data by WhatsApp or the Facebook family of companies is not compliant with EU legislation, WP29 urges WhatsApp not to proceed with the sharing of users’ data until the appropriate legal protections can be assured,” said the letter, signed by WP29 chairwoman Isabelle Falque-Pierrotin.

Among other things, WP29 is concerned about the effect of the policy change on people who are not WhatsApp users, but whose personal information is contained in WhatsApp users address books.

The DPAs want WhatsApp to disclose the exact categories of data it transfers, where it obtained that data, and to whom it transfers it, and for what purpose.

Also on Thursday, WP29 wrote to Yahoo CEO Marissa Mayer seeking information about the effect of the recently revealed 2014 data breach on EU citizens, and about reports that the company scanned its customers’ email messages on behalf of U.S. intelligence agences.

“The reports are concerning to WP29 and it will be important to understand the legal basis and justification for any such surveillance activity, including an explanation of how this is compatible with EU law and protection for EU citizens,” it wrote.

The data protection watchdogs have created a new subgroup to coordinate enforcement of EU data protection law. WhatsApp and Yahoo will both be on the agenda when it meets for the first time next month.