gdpr
Is there any restriction in the GDPR on creating a Whatsapp group?
<p>I work with an assistance entity that helps people in situations of social vulnerability (poverty).</p>
<p>Surprisingly everyone has a cell phone and uses Whatsapp. Taking this facility into account, I thought of creating a group on Whatsapp and registering each number of these assisted people, to keep them informed of any news about the entity. However, I was warned if this could violate any GDPR terms.</p>
<p>It is important to note that this would be a group where <strong>participants DO NOT SEND, they only receive our messages.</strong></p>
<p>Could anyone tell me if is there any restriction in the GDPR to create a Whatsapp group?</p>

<p>Certainly.</p>
<p>A phone number is personal information (and on top of that, WhatsApp may provide some &quot;profile info&quot; from the people you contact). It is not difficult to identify a person by its phone number.</p>
<p>So, sharing the phone number of the people affected should take into account the restrictions of GDPR.</p>
<p>For instance, the Spanish Data Protection Agency (<em>Agencia Española de Protección de Datos</em>, AEPD) established in its Resolution R/03041/2017 that the Town Hall of Boecillo had violated the GDPR because it had created a WhatsApp group of citizens. Those citizens had provided their phone numbers to be informed about town hall activities, but they had not agreed to share their numbers with the other members of the group.</p>
<p>And that was a very generic group. Doing a &quot;patients recovering from cancer&quot; or &quot;drug abusers under treatment&quot; or &quot;people who need food assistence&quot; group would involve sharing personal information that gets the maximum protection (in some specific instancies it could be that your information sharing that information is illegal even if the users gave you full consents).</p>
<p>So yes, creating a WhatsApp group could very easily lead to a GDPR violation, and in fact it has been ruled at least once that it has.</p>
<p>The fact that people cannot send messages is irrelevant. It would not make the issue any better or worse. After all, if I send a message through WhatsApp I am implicitly giving permission to everyone in the group to read it.</p>

<h2>There are no restrictions, you just need to comply with the GDPR as a data controller</h2>
<p>That means you need to have a valid legal reason for getting personal data (WhatsApp addresses), sharing it and follow all the normal rules about data security, data integrity and data deletion.</p>

<p>No, not if it's a broadcast list as you seem to describe.</p>
<p>In a broadcast list participants can not know of each other, and thus don't know each others phone number or other information.</p>
<p>At least tits doesn't invoke the Spanish precedent as described above. And I think it would be compliant in general, but whether there are other provisions that it violates I'm not fully certain but I do strongly suspect that it would overall be compliant.</p>
