AEPD: companies can create WhatsApp groups for work purposes with the personal numbers of workers

To date, the Spanish Data Protection Authority (hereinafter and following its acronyms, “AEPD”) has shed light on this matter. The phone number is obviously considered personal data, protected by privacy and data protection legislation, but the WhatsApp application allows individual phone numbers to be exposed to all members of a group chat. This implies that the mobile number is shared without the consent of the user, which is not permitted under privacy legal framework.

However, Spanish watchdog has share its standpoint on this matter. In a recent decision released on January 9th, the AEPD established that the consent of the individual is not compulsory. 

This is based on the creation of WhatsApp groups for work purposes is covered by the employment contract.

In its resolution, the regulator affirms that the employment contract, including compliance with collective bargaining agreements, would give legal coverage to the inclusion of the worker in this type of group chat.

This criterion is based on a case  involving a logistics company, which was resolved by filing an employee's claim against his company for including him without his consent in two WhatsApp group chats that the company created to better spread the workload. 

In these groups, essential information was published to carry out the employees functions, such as the location of the vans at the end of the working day, working hours and data related to the delivery routes assigned to each worker.

The company argued that in order to organize work, which was carried out outside the workplace, the use of WhatsApp as a means of communication between the company and the workers was essential. The company also argued that his workers were duly informed of the use of WhatsApp as a communication channel. It´s a small company and its resources are limited, the AEPD agreed with this criterion and proceeded to file the proceedings.

With the publication of this decision, the AEPD opens the door for companies to include the personal numbers of workers in WhatsApp groups for work purposes without their permission, as long as the data shared complies with the data privacy principles, observed in article 5 of the General Data Protection Regulation.

There is still room for appeal against this decision, however we must bear in mind that it represents a change of criteria with respect to previous resolutions, which used to be more guaranteeing with regard to the protection of personal data, now the AEPD focuses more on the pragmatism of business management.

Analyzing this case, it could be understood that the employment contract performance is a sufficient legal basis to add workers to a WhatsApp group without their express permission in the event that face-to-face communication cannot be established, but in jobs with an assigned workspace there is no need to carry out Whatsapp communication. 

This perspective is justified by a resolution published on January 10th. On this occasion, a cleaning employee was included in the Whatsapp group chat of a neighborhood community, so that she could report on her tasks in real time so that the neighbors could follow up. In the current case, the employment contract does not serve as a legitimizing basis to include her without permission in the WhatsApp group, since it is understood that in this case there is no need to carry out this communication so that the employee can do her work optimally.

Respect for employees’ privacy is incompatible with corporate use of Whatsapp app. The risk of relying on employees' personal devices is very high and the best alternative, according to Data Protection Regulation, could be enable a corporate account in a different application, more reliable than WhatsApp in terms of confidentialy of information. 

However, and despite the latest resolutions of the AEPD, in case of doubt, it is always necessary to analyse the details of the situation, since a simple nuance can overturn the relief on one legal basis or another.