Mobile instant messenger app uploads users' entire list of phone numbers.
Popular cross-platform mobile instant messenger WhatsApp has been accused by Canadian and Dutch data protection authorities of violating international privacy laws.
The Office of the Privacy Commissioner of Canada and the Dutch Data Protection Authority announced their findings for what they call a "collaborative investigation into the handling of personal information." The two say that WhatsApp requiring users to provide their entire contact list to the service violates data and privacy laws.
"The investigation revealed that users of WhatsApp -- apart from iPhone users who have iOS 6 software -- do not have a choice to use the app without granting access to their entire address book. The address book contains phone numbers of both users and non-users," said Jacob Johnstamm, chairman of the Dutch Data Protection Authority.
iPhone users who have iOS 6 installed are asked if they wish to allow an application to access sensitive data on the smartphone including location and contact list data.
WhatsApp requires a user's phone number to create a contacts list within the app. The user's phone numbers are transmitted to WhatsApp to assist "in the identification of other WhatsApp users." However, as opposed to deleting the phone numbers of non-users, WhatsApp retains the numbers in an unreadable hash form.
The practice violates both Canadian and Dutch privacy law. Both state that personal data can only be retained for as long as is needed to fulfill a given service's requirements.
"Both users and non-users should have control over their personal data and users must be able to freely decide what contact details they wish to share with WhatsApp," Johnstamm continued.
"Our investigation has led to WhatsApp making and committing to make further changes in order to better protect users' personal information," added Canadian Privacy Commissioner Jennifer Stoddart.
The Dutch authority will examine the developer's case in a "second phase" where "further enforcement actions" may come to fruition, which includes the possibility of sanctions. The Canadian authority, while it doesn't have the power to instill sanctions, will be monitoring the California-based developer.
WhatsApp's users send 10 billion messages per day, the equivalent of 300 billion messages per month. Social network leader Facebook is rumored to be interested in an acquisition of the firm.