WhatsApp with consent: Are you informed?
Is it fair, ethical, moral to use data in ways that users were not made aware or cognisant of, at the point of consent?
Online debates have been sparked upon the realisation that "authorised police officers may invoke Criminal Procedure Code (CPC) powers to request users to upload their TraceTogether (TT) data for criminal investigations". This debate was not centred on whether the police can or cannot use TT data. Ultimately, the CPC empowers the Singapore Police Force to obtain any data. The real issue was whether or not the public had been explicitly informed of its potential for such use.
Perhaps you are aware of this seemingly mundane and regular change, perhaps not. You may have received an innocuous pop-up window, which lured you to click on the bright green "Agree" button. You may not even recall having done so. What is the big deal? More dramatically, why did Elon Musk call on his Twitter followers to "Use Signal" a few days after this policy update?
There are many questions. Perhaps the most important one of them all, is this: if you had agreed to the new WhatsApp terms and conditions, do you know what you have agreed to?
The full and exact policy text is available on the WhatsApp website. It says that the company collects user information "to operate, provide, improve, understand, customise, support, and market our Services". Translated to human-speak, this means that WhatsApp can share with the Facebook companies, affiliates and partners, information such as: your phone number, your contacts' numbers, logs of WhatsApp use, information on how you interact with others - device identifiers, IP addresses, operating systems, browser details, battery health information, application version, mobile networks, languages, time zones, transaction and payment data, cookies, location information, etc.
True, your messages may be encrypted and protected but what about everything else? Perhaps the messages themselves are no longer needed in order to get an intimate understanding of who you are and what makes you tick. Afterall, if anyone is to sell your time to someone else, the skill at which such time is then taken away from you is premised on how well they understand you. The knowledge of you and the consequential ability to attract and capture your attention is the true golden goose.
You may agree, and be perfectly comfortable, with Facebook and its subsidiaries collecting your WhatsApp data for their monetisation in exchange for the free use of WhatsApp services. For some, many perhaps, this is a fair barter and should not be dismissed. This is not about whether it is right or wrong, ethically questionable or not. Neither is it about which application one prefers over another. It is the seemingly simple question of being "informed". Are you informed?
Recent discourse, and this exact scenario, touches on the extent by which data collection needs to be done under overt and explicit consent. Is it fair, ethical, moral to use data in ways that users were not made aware or cognisant of, at the point of consent? This brings up an interesting point - that it is not only consent that needs to be regularly reaffirmed and sought out for issues to do with changes to terms and conditions, but that there is a need for a mechanism to validate users' understanding.
TICKING THE AGREE BOX
How can the collection of personal data and its distribution, the potential sensitivity of which far exceeds that of TraceTogether, be done without the validation of users' understanding. In my opinion, the "tick" on the "Agree" box is designed to legally protect the company, not the consumer. It does nothing to validate the consumers' understanding. We can innovate beyond the boundaries of our imagination. However, we must do so with transparency, dignity and respect for those we innovate for.
It is not only individuals who must ask themselves these questions. Ultimately, individuals interact with large groups, and individuals are the persons who make up companies and governments. What does this collection of information from individuals on such a large scale mean to a government agency? The knowledge of where people are, who they are talking to, who they are speaking to more frequently or less frequently, the time of day at which such conversations are taking place, etc - empowers intimate inferences, the use of which could go well beyond advertisements.
To be fair, it is not as though choice is not given. Choose between clicking the green "agree" button to unconditionally accept the new terms and conditions by Feb 8, or stand to have your account deleted. I have read through the terms, researched the impact and have exercised my informed choice to not agree. I have saved WhatsApp some hassle in proactively deleting my WhatsApp account. It is an inconvenience, but those who want to contact me will continue to do so, through the myriad of alternative messaging apps or perhaps a good-oldfashioned phone call.
There is no right or wrong outcome in this case. Ultimately, the question of "Do you know what you have agreed to?" needs to be considered with more weight than the diminutive act of shutting down yet another pop-up notification.
- The writer is senior adviser for data and artificial intelligence at UnionBank Philippines. He is concurrently an external adviser to Singapore's Corrupt Investigation Practices Bureau (on AI) and to the Central Provident Fund Board (on data science). He was previously the Monetary Authority of Singapore's first Chief Data Officer.
Source: Business Times © Singapore Press Holdings Ltd. Permission required for reproduction.