In a public civil action (5018090-42.2024.4.03.6100) filed this Tuesday (07/16) at the Federal Regional Court of the 3rd Region in São Paulo, the MPF and IDEC request compensation of BRL 1.7 billion for collective moral damages, because of a violation of the data subjects’ rights by WhatsApp.
According to the entities, Meta, owner of WhatsApp, has been violating the General Data Protection Law (LGPD) since 2021, when it changed its privacy policies. These entities also claim that WhatsApp violated the rights of the app users in Brazil by forcing adherence to the new rules and, in doing so, enabled the abusive collection and sharing of personal data with other platforms, including Facebook and Instagram, both belonging to Meta.
It is interesting to note that among the defendants in the public civil action is the ANPD, which is accused of “serious failures in action (...) against WhatsApp’s conduct” by the entities, in addition to omission and lack of cooperation. However, the agency may become one of the plaintiffs of the action with the MPF and IDEC, changing sides and recognizing the flaws in its activities, since the idea is that the Judiciary condemns the ANPD and creates some type of regulation of its inspection standards.
The MPF issued an official statement explaining that the compensation amount is based on fines already applied to WhatsApp in Europe, as well as the request for changes to privacy policies that, even after an appeal against the favorable decision, the change was upheld. It was also taken into consideration that Brazil has around 150 million WhatsApp users, making it one of the countries where the application is used the most. The value of the fine will be allocated to projects financed by the Diffuse Rights Defense Fund (FDD).
Therefore, it is not surprising that, as in Europe, the entities requested that the Defendant be required to “immediately stop sharing personal data for purposes specific to other companies in the Meta Group, such as the personalized display of third-party advertisements”, in addition to allowing users to refuse the current privacy policies, with the application being prohibited from preventing users who do not agree from using the application, which is the case since the change. One of the requests is that users who have joined be able to cancel their acceptance without being prohibited from using the services.
The MPF also stated that “when implementing the current version of its privacy policy, WhatsApp failed to inform users about the changes that would be made and practically forced them to express their consent to these changes. The announcement came in early 2021, at the toughest period of the Covid-19 pandemic, when the use of the app became even more necessary for communicating with family and friends, requesting services, and accessing news”. It also added that “from January of that year, when opening WhatsApp, millions of Brazilians were faced with a brief and generic notice about changes to the privacy conditions. The warning stated that everyone should accept the new terms by the following month; otherwise, they would be prevented from accessing the application”.
Another argument presented was the unnecessary collection of data that is not essential for the operation of the platform, violating the minimization principle brought by the LGPD. It was argued that WhatsApp has been collecting information such as profile pictures, group names, approximate user location, contact numbers, and even the route from home to work and the time the user usually sleeps and wakes up, among others. Data that, if shared with other companies, may be used for targeted advertising to users on other social networks.
The Technology, Media, and Telecommunications team of Azevedo Sette Advogados remains available for any clarifications.