Whatsapp groups in the company

The Spanish Data Protection Agency has recently published different resolutions on the prohibition or not of using workers’ phone numbers to add them in Whatsapp groups of the company.

These resolutions may seem contradictory to each other, which has caused confusion for the public, as they have been published with only days of difference between one and the others.

Examples of these resolutions are the following:

Resolution of September 22, 2021 of the Spanish Data Protection Agency (AEPD).

The Spanish Data Protection Agency (AEPD) sanctioned a sports club to pay €4,000 for adding a user to two Whatsapp groups without her consent.

It pointed out the vulneration of:

Art. 6 GDPR, referring to the consent of the affected party when allowing her phone number to be included in Whatsapp groups.

Art. 5 GDPR, referring to the retention of personal data longer than necessary.

The Spanish Data Protection Agency also mentioned that providing a phone number to third parties is a breach of confidentiality.

 Resolution of January 9, 2023 of the AEPD

In this case, an employee filed a claim against his company to the Spanish Data Protection Agency (AEPD). 

The reason for the claim was the inclusion in a WhatsApp group of the company without his consent.

In this WhatsApp group, as it is a logistics company, work information is diffused (delivery routes, location of vans, etc).

It was considered that this information diffused is considered as necessary to develop the labor relationship of the worker with the company.

Faced with this situation, the AEPD determined that the inclusion of the worker’s phone number in WhatsApp groups for work purposes would be justified by the employment contract, or in compliance with the rules of the conventions.

It also mentions in its resolution the principle of data minimization.

That is, “the adequate, relevant and limited to what is necessary in relation to the purposes pursued”.

It alsa is the principle of confidentiality, which means “that they are not going to be accessed by outsiders”.

In relation to the case, the Spanish Data Protection Agency (AEPD) considers that the company in question complies with these principles, excluding any conduct that would go against the correct treatment of the personal data of its employees.

In addition, it points out the company’s compliance with the duty to inform its workers.

“It has informed the workers of the purpose of the processing in the whatsapp groups created for the purpose of using this method of communication in matters related to the employment contract, working conditions, organization and development of work tasks and distribution and maintaining confidentiality about them.“

Resolution of January 10, 2023 of the Spanish Data Protection Agency (AEPD).

A cleaning employee who worked in a community of neighbors filed a complaint to the Spanish Data Protection Agency.

The reason for this complaint was the inclusion of her phone number in the WhatsApp group of the community of neighbors in which she worked. 

Faced with this situation, the Spanish Data Protection Agency (AEPD) determined that neither compliance with the agreements nor the employment contract were a reasons to justify the inclusion of the claimant’s number in the WhatsApp group of the neighbors’ community in which she worked.

 It will depend on the type of employment contract

Depending on the type of employment contract involved, the AEPD will consider licit or not the existence of Whatsapp groups in the company.

It is true that the case of the cleaning employee is not the same (since her personal data is transferred to a plurality of natural people), as the case of the logistics company (the transfer of personal data is made only to the entity).

Therefore, each case will have to be studied separately, observing whether the necessary requirements established by law are complied with.

From Auratech we are at your disposal.