Work Whatsapp Groups and GDPR

Now that it’s summer, the kids’ school groups are quieter (practically silent), but what about company WhatsApp messages and work WhatsApp groups? What about GDPR compliance?

Is the phone number personal data?

Indeed, our mobile phone number is considered “personal data” as defined in Article 4.1 of the General Data Protection Regulation (GDPR).

Therefore, the GDPR data protection rules also apply to WhatsApp (in all its versions: WhatsApp Messenger and WhatsApp Business), as well as to other communication channels such as email and SMS.

Can a company use WhatsApp?

WhatsApp is the mobile messaging app with the largest number of users (2 billion), and for this reason, many companies use it to communicate with both their customers and their own employees.

A company can use WhatsApp for internal and even commercial communications, as long as it complies with the General Data Protection Regulation (GDPR).

Therefore, it is essential that companies inform data subjects about the processing of their data and ensure that WhatsApp will not use this information for unauthorized purposes.

Therefore, for communications with its employees, the company can use WhatsApp Messenger (the one we use for our personal communications). For communications with clients, it must use WhatsApp Business.

WhatsApp Business and Data Protection

WhatsApp Business It is a version of the app designed specifically for communication between companies and customers, but it collects the same personal data as the Messenger version: name, phone number, profile photo, and location.

Compared to the standard version, WhatsApp Business offers additional features:

• Response automation.
• Creation of product catalogs.

In terms of data protection, the company that uses WhatsApp Business is the Data Controller (Article 4.7 of the GDPR) and must therefore ensure that the personal data communicated through the application complies with the regulations and must:

• Inform users about how their data will be processed.
• Obtain explicit consent to send them marketing messages.
• Ensure that any data processing is transparent and limited to the purposes for which consent was obtained.
• Ensure that WhatsApp complies with its role as Data Processor (Article 28.1 of the GDPR).

Without consent, there is no WhatsApp group

The Spanish Data Protection Agency (AEPD) has classified including a person in a WhatsApp group without their consent as a serious offense (from €40,001 to €300,000).

This decision, which does not affect the domestic and family sphere, seeks to protect the privacy of personal data and the purpose for which it is transferred.   

Exception: Contacting employees in case of emergency

Supreme Court Ruling 257/2024 establishes that it is lawful for companies to request personal data (mobile phone number and personal email address) from their teleworking employees in order to contact them in the event of “service emergencies.”

The judges did not exempt the company from using corporate media to communicate with employees, despite requesting their personal cell phone and email addresses.

However, the ruling notes that, in emergencies, corporate resources may not be available, and the company must be able to contact its employees.

The Supreme Court considers that it is not disproportionate for companies to request this data from their employees, provided they do not abuse its use and do not violate the right to digital disconnection.

What is the right to digital disconnection?

As we explained in a previous post the right to digital disconnection is a right that all employees have to not connect to any digital device, of a professional nature, during their breaks or outside of working hours (this includes vacations and leave).

Therefore, this right legitimizes workers not to respond to emails, calls, WhatsApp messages, video calls, or any type of digital communication outside of their working hours.

This right applies to all employees, regardless of their work type (in-person or remote), contract type, or any other specific employment condition.

Supreme Court Resolution 257/2014 does not repeal the right to digital disconnection, but it reminds us that this is not an absolute right.

In urgent situations, if the use of a personal cell phone has been agreed upon and the action is taken within working hours and proportionately, timely contact is legally protected.

Author: Sandra Santiago, Lawyer.

If you need help, contact us!

Information on data protection

Company name
LEGAL IT GLOBAL 2017, SLP
Purpose
Providing the service.
Sending the newsletter.
Legal basis
Compliance with the service provision.
Consent.
Recipients
Your data will not be shared with any third party, except service providers with which we have signed a valid service agreement.
Rights
You may access, rectify or delete your data and exercise the rights indicated in our Privacy Policy.
Further information
See the Privacy Policy.