When whistle-blowers revealed the Facebook-Cambridge Analytica scandal in 2019, the extent to which Facebook enables third parties not only to shape our consumption habits and online behaviour, but attempt to influence voters’ choices, was exposed. Although Facebook issued an apology and undertook to comply with the European Union’s General Data Protection Regulation (GDPR) in its business practices, its privacy practise continues to attract scrutiny. It currently faces fines of billions of dollars for accidentally storing millions of users’ passwords in plain text.
In typically anti-competitive form, Facebook bought WhatsApp in 2014 in a transaction that has become the subject of an anti-trust case in the United States. The tech giant is currently grabbing headlines for requiring WhatsApp users to accept changes to how their data is used by Facebook. Users have until 8 February 2020 to agree to these changes or lose access to the service. For users who agree, Facebook will know who else they contact through Whatsapp, how often and when they use WhatsApp, and will be able to combine this knowledge with information acquired from other data sources, including Facebook and Instagram. The changes have provoked a publish backlash and prompted widescale media debate—but while there have been some useful insights, too much of this commentary risks obscuring the bigger picture.
Some argue that there’s not much to worry about because WhatsApp doesn’t have access to the content of texts and calls, but they fail to give an account of how much metadata can reveal. There is also an admonishment to adjust their privacy settings on WhatsApp and other platforms, but users understand from the changes to WhatsApp that no matter what setting they choose, the platform has the power to unilaterally change what data is used for what purposes at any time. The most pernicious assertion is that the loss of privacy is inevitable—that users’ consent to give up privacy in exchange for a no-charge app. The common trait of these claims is that they frame the problem as a middle-class consumer choice. What is missed is the difference of power between a multinational global corporation and ordinary South Africans.
WhatsApp is used by more than two billion people in over 180 countries. While there is no upfront charge for installing Whatsapp, it is everything but ‘free’. The no charge policy isn’t charitable but to drive the massive adoption that, in turn, has bolstered Facebook’s share price. By contrast, many South Africans use prepaid data coupled with Whatsapp as the only affordable way to communicate, not just with family and employers, but many also use it to support businesses and income generation. Many people use phones that will not support more than one messaging app, while the cost of the data to download or use a new app is prohibitive to many South Africans. While these factors often inhibit users from leaving Whatsapp, the reason most users have little choice but to use Whatsapp is because they need to communicate with others using Whatsapp.
Communications networks tend towards winner-takes-all outcomes. If most people are on a communication network then that is the network that a person has to join to communicate with them. Imagine a situation in which you had to be on the Vodacom network to talk to others using Vodacom, but on the MTN network to talk to people using MTN. You would have to carry two or three cell phones or at least two or three SIM cards. But because cellular networks are interoperable, you can use one network to call someone on another. Interoperability is hard to define and even harder to enforce, but it’s the basis of competition in communications networks. But there is no regulation requiring interoperability for services like Whatsapp that offer voice and text communication using data.
Why are we so dependent on a single communication service like WhatsApp today, when South Africa – and Africa – had strong local players like Mxit a few years ago?
An unhappy confluence of factors including network effects, competition regulation and policy choices, led to a political economy in which digital dominance is continuously rewarded. Permissive competition regulation coupled with a corporate-friendly tax regime and state-backed funding for venture capital in the United States resulted in the dominance of a handful of technology platforms. In South Africa, a decade-long delay in promulgating and implementing the Protection of Personal Information Act, POPIA, has left South Africans with few practical protections for our privacy. The cost of voice and text telephony drove the switch to apps that enable calls and messaging using data; but the high cost of data connectivity pushes people to prefer WhatsApp bundles. Would local messaging alternatives exist if regulators had required consumers be charged no more than 1c for an SMS, which would have still made it profitable, when the idea was mooted in 2009?
It is important to note that Facebook is not imposing the privacy changes on users in the European Union – apparently due to the EU General Data Protection Regulation (GDPR). Although not yet fully in force, POPIA is fairly similar to the GDPR. The South African Information Regulator, which is investigating the change stated “In terms of the revised policy, it appears that there are different terms of service and privacy policies for users in European countries and in non-European Countries”. Why?
Some South Africans will switch to other messaging services such as Signal, an open source platform whose encryption technology is used by WhatsApp, but which has a far greater commitment to privacy. Others will find switching impossible. The Information Regulator can devote some of its limited resources to assessing whether WhatsApp’s new terms pass muster under POPIA. Our competition authorities can assess whether Facebook’s conduct is abuse of its dominant, arguably monopoly, position. But effective regulatory action against a multinational corporation is difficult. Africa could be treated more like Europe if we accelerate the setting of common standards on data protection, which are the underpinning of various continental harmonisation efforts such as the African Continental Free Trade Agreement, which came into force on 1 January this year.
