Information Regulator (InfoReg) of South Africa has issued a stern enforcement notice to WhatsApp, raising concerns about the company’s privacy practices in the country. The enforcement comes as South Africa’s Protection of Personal Information Act (POPIA) continues to shape how data privacy is handled by businesses, following growing scrutiny on tech companies worldwide over their data handling practices. This action by South Africa mirrors broader moves across the continent to hold Big Tech accountable, further deepening the debate on user privacy and corporate responsibility in Africa.
At the heart of the dispute is WhatsApp’s practice of offering different privacy terms and conditions to users in the European Union (EU) under the General Data Protection Regulation (GDPR) compared to users outside Europe, including South Africa. This discrepancy has drawn sharp criticism from South African regulators, who argue that despite the shared principles between GDPR and POPIA, African users are receiving inferior privacy protections.
South Africa’s Regulator Reads WhatsApp the Riot Act
The InfoReg’s chairperson, Advocate Pansy Tlakula, disclosed that the regulator’s investigation had revealed the privacy policies WhatsApp users in South Africa fall short of the standards applied in the EU. “The privacy safeguards for users in the European region appeared to be better than those for users in South Africa, even though GDPR and POPIA have similar standards and protections,” said Tlakula.
The regulator directed WhatsApp to update its privacy policy to comply with all the conditions of lawful data processing outlined in POPIA. The messaging app was also instructed to conduct a personal information impact assessment and maintain adequate documentation of its data processing activities, as required by the Promotion of Access to Information Act (PAIA).
WhatsApp, owned by Meta Platforms, has been facing increased scrutiny globally after updating its privacy policy in January 2021 to allow greater data sharing with its parent company. This change sparked a global backlash, with many users concerned about the implications for their personal data. In response to this, the European Union forced Meta to adopt more stringent data-sharing rules under GDPR, but similar protections have not been extended to users in other regions, prompting accusations of double standards.
WhatsApp’s Global Privacy Controversy and Africa’s Response
The enforcement notice against WhatsApp comes after months of tension between the government of South Africa and Meta’s South African subsidiary. The Information Regulator had previously sent a letter to Facebook South Africa, outlining concerns about WhatsApp’s handling of South African users’ data. The regulator had prohibited Facebook from sharing any WhatsApp contact information collected without proper authorisation, but Meta did not respond, leading to the current enforcement action.
The stance of South Africa on this issue has broader implications across the African continent. In Nigeria, the Federal Competition and Consumer Protection Commission (FCCPC) imposed a $220 million fine on Meta and WhatsApp earlier this year, citing violations of the Nigeria Data Protection Regulation (NDPR) and the Federal Competition and Consumer Protection Act (FCCPA). Nigerian regulators found Meta guilty of abusive practices, including the unauthorised transfer of personal data and discriminatory treatment of Nigerian users compared to users in other regions.
This enforcement action sets a new precedent for data protection in Africa, indicating that African regulators are no longer willing to tolerate what they see as exploitative practices by Big Tech. The Nigerian and South African cases highlight the growing role of African governments in holding global tech companies accountable for their operations on the continent, signaling a potential wave of regulatory reforms and enforcement actions across African markets.
A New Era of Accountability
The developments in South Africa and Nigeria are part of a broader global shift toward increased regulatory oversight of tech companies. Governments and regulators worldwide have intensified scrutiny over the last few years, particularly regarding how these companies handle sensitive user data. POPIA, like GDPR in Europe, requires that companies operating in South Africa protect users’ personal information and ensures that users have control over their data.
Under POPIA, companies found to have breached data protection rules face severe penalties, including fines of up to R10 million (roughly $550,000) or prison sentences of up to 10 years, depending on the severity of the violation. Beyond monetary fines, breaches can lead to significant reputational damage, especially for tech companies heavily reliant on user trust.
Tlakula also raised concerns about the growing number of data security incidents in South Africa, noting that the InfoReg had received 980 security compromise notifications since April 2023. This alarming trend suggests that many public and private institutions may not have the necessary measures in place to safeguard personal information.
A Landmark Moment for Data Protection in Africa
While WhatsApp has vowed to appeal against the regulatory actions in both South Africa and Nigeria, the outcomes of these legal battles could shape the future of data privacy in Africa. These cases may encourage other African nations to scrutinise Big Tech more closely and push for stronger privacy protections, ensuring that African consumers are not treated as second-class citizens in the global digital economy.
With WhatsApp serving as the most widely used messaging platform on the continent, any changes to its privacy policies could have far-reaching consequences for millions of users. As countries in Africa begin to more rigorously enforce their data protection laws, the tension between global tech companies, such as WhatsApp, and national regulators is likely to intensify, setting the stage for further confrontations.
The battle over data privacy in Africa is just beginning, and the stakes are high. For companies like Meta, which have built their empires on user data, the continent’s evolving regulatory landscape represents both a challenge and an opportunity to reshape their practices to better align with the expectations of African users and governments.