gdpr
Access device contact but show names as they exist from an app&#39; servers
<p>Someone has created an app that asks users if it can have access to their contacts from their smartphone. If the user grants this access the app uploads the email addresses and telephone numbers of their contacts to a function on the server to work out which of their contacts also use the app and display those users only to this user in the app.</p>
<p>The same approach is taken by WhatsApp and Signal. The contacts are not stored, they are simply checked against known users of the app to provide the user with a list of their own contacts that also use the app only.</p>
<p>However, what this business intends to do is show the username of the user's contacts as it appears with the app rather than the name the user has stored in their phone's contacts.</p>
<p>For example:</p>
<p>If a user has a <strong>John Smith</strong> stored in their contacts on their phone with a telephone number of <strong>888-888</strong> then when they allow the app to access their contacts, the phone number <strong>888-888</strong> is uploaded. This number is a user of the app but under the name of <strong>Joan Smithe</strong>. Rather than show <strong>John Smith</strong>, the client wants to instead show the name as recorded in the app's servers - so <strong>Joan Smithe</strong> would be that contact's name in the app to the user that uploaded their contacts.</p>
<p>Is that legal? Is that GDPR legal?</p>

<p>This going to depend what the legal basis is for processing and sharing the personal information of other users is, and what ism stated in the apps privacy policy.</p>
<p>If the Privacy policy clearly states that names may be given to other users of the app who have contacts with matching telephone numbers, and if users have given content for such distribution, there is probably no problem under the GDPR. Otherwise there might well be a problem.</p>
