The use of WhatsApp in companies
These days ago we have experienced a 180 degree change on the part of the Spanish Data Protection Agency regarding the use of the instant messaging application WhatsApp, which is integrated into the American company “Meta”, owned by Mark Zuckerberg. This change in criteria refers to the use of WhatsApp groups within the workplace by many organizations, both private and public.
It is important to focus attention on the sanctioning procedure, which has been the subject of multiple opinions and criticisms. In this case, it is the file with number EXP202105690.
This procedure begins as a result of a worker's complaint to her company, dedicated to courier delivery, for the inclusion of her telephone number in two WhatsApp groups, where the rest of her colleagues meet and information and data related to delivery routes, the people who carry them out, the hours, the location of the vans at the end of the work day, as well as various work information.
Initially, due to the scarcity and development of the rights foundations by the Spanish Control Authority, it is understood that they include the personal phone of the worker in the two WhatsApp groups, where the rest of her colleagues are and where, in addition, there is a flow of information.
Firstly, it is observed that there is data processing and communication of the worker's personal telephone number to the rest of her colleagues. Obviously, in order to process this information, the company, as data controller, must apply one of the bases of legitimacy established in article 6 of the General Data Protection Regulation 2016/679.
Legitimation of the worker's express consent
Traditionally, as a consequence of other resolutions and sanctioning procedures by the Spanish Data Protection Agency, it has been used as a basis for legitimation of consent worker express (article 6.1 – A of the RGPD 2016/679), although in many cases the use of this consent in an employment relationship may be “unbalanced” because of the position of power that the company occupies with respect to the worker.
Free, express, informed and unequivocal consent was required. Here it should be noted that beforehand, the employer must give the worker multiple options for communication channels. company communication internally and even providing it with telephone equipment, since, in this case, for example, through the two groups created, multiple information related to the rest of colleagues and clients was managed and shared.
The Spanish Data Protection Agency, which is usually very restrictive regarding the use of personal phone numbers of the workers, which has already been seen in numerous resolutions by the Control Authority has promoted a change in criteria that goes from the express consent of the worker (article 6.1 – A of the RGPD 2016/679) to relying on the execution of a contract, arising from the employment relationship, or even from the collective agreement (article 6.1 – B of the RGPD 2016/679).
A change in criteria supported by a resolution that does not clearly clarify and detail certain issues such as who owns that phone? A resolution, then, that can generate legal uncertainty in the sector and whose clarification is necessary by the Spanish Data Protection Agency through a Legal Report or an explanatory note on the sanctioning procedure.
Additionally, another issue of interest to consider after this resolution by the Spanish Data Protection Agency is due to an alleged collision with certain rights contemplated in Title X of Organic Law 3/2018, of December 5. , Protection of Personal Data and guarantee of digital rights.
Specifically, we refer to article 88 regarding the “right to digital disconnection in the workplace” and which establishes that ““Workers and public employees will have the right to digital disconnection in order to guarantee, outside of legally or conventionally established working time, respect for their rest time, permits and vacations, as well as their personal and family privacy.”.
Is there really a true digital disconnect if we provide our personal phone number to be included in work WhatsApp groups?
We all know that we can silence conversations or groups in this app, but if a worker gives their personal number, inevitably when they access the application they will find all the messages and notifications, so there is no true digital disconnection.
An assumption regarding the use of personal telephones of workers by companies is, for example, the annulment by the Supreme Court of the Telepizza project Court to force delivery drivers to provide their personal cell phone for geolocation during delivery.
This project implied the obligation for the worker with the category of delivery man to provide a personal mobile phone with an Internet connection to use the company's computer applications on it in order to facilitate its geolocation during delivery. Read it in full here.
In short, this decision by the Spanish Data Protection Agency, which does not believe jurisprudence any, as this is a purely administrative body, may be the subject of various contentious-administrative appeals before the National Court, the Supreme Court, and, ultimately, an appeal for protection before the Constitutional Court as this is a fundamental right established in he article 18.4 of the Spanish Constitution.
We will, therefore, be aware of the future of the aforementioned decision and subsequent consequences.
Don't miss any details thanks to our Master in Compliance and Data Protection.
