It’s one of the most talked about issues on Twitter since Sunday night. The thread of the user Elena Cañizares narrating how her roommates had asked her to leave the common house after having tested positive for covid-19 had reached 56,000 by mid-morning retweets and the 115,000 I like. The post included screenshots of the WhatsApp group conversation that they all shared and reproductions of the voice notes they had exchanged. Some of the more than 5,000 responses that the young woman, a nursing student, received alerted her that the content she was spreading could be illegal. Hours later, the post has been deleted.
Apart from other considerations, this episode raises some legal doubts. Is it legal to spread the content of a WhatsApp chat without the authorization of its participants? What rights can be violated with its publication? What consequences does it have for those who share it? Several privacy experts analyze the issue.
Is it legal to broadcast a WhatsApp conversation?
The jurists consulted agree that it is not a crime, but they disagree on the possibility that it is considered a violation of data protection regulations (which could lead to an administrative sanction). “It does not violate article 197 of the Criminal Code, which regulates the crime of disclosure of secrets, because whoever disseminates the content of the conversation has not illegally accessed it, but is part of the chat,” explains the expert lawyer in digital law Borja Adsuara.
Adsuara also does not appreciate the violation of privacy regulations because the European Regulation and the Organic Law on Data Protection (LOPD) “are designed to sanction massive processing of information by companies and administrations and not infringements at a particular level.” However, the lawyer admits that his interpretation is not in accordance with the criteria of the Spanish Data Protection Agency (AEPD), which “has considered that, by publishing something on social networks, the domestic scope is being exceeded” and, therefore, it is a conduct that may be subject to a fine if it is carried out without the consent of those affected. “A reasoning with which I do not agree,” he remarks.
Fewer doubts raised the question to Eduard Blasi, lawyer and professor of the postgraduate course in data protection at the UOC. The lawyer explains that the legislation on privacy applies “not only to the identified data, such as the name and surname, but also the identifiable”, that is, those that without “disproportionate efforts allow to know the person behind them “. The unauthorized publication of the participants of a WhatsApp conversation on a social network makes it relatively easy to know who is involved in it through context information: user who broadcasts it, their names in the chat, data exposed in the dialogue, etc. .
In a similar vein, Leandro Núñez, Audens partner, recalls that although the European Regulation does not apply to data processing for “exclusively personal or domestic” use, in 2003, the Court of Justice of the European Union (CJEU ) stated that this area is exceeded when information is disseminated on the Internet “so that it is accessible to an undetermined group of people.” Does this mean that this behavior will always be illegal? At this point Núñez introduces a nuance. “There is a treatment of personal data, but not all treatments require the consent of the affected person,” he points out. The key, therefore, is to determine whether freedom of expression and information, as fundamental rights, could be a sufficient basis to legitimize their dissemination.
What if what is broadcast are voice notes?
The case of Elena Cañizares presents the peculiarity that not only screenshots are broadcast, but also voice notes. Does the previous assessment change anything? Not at the beginning. The voice is also personal data, but it does not add gravity to the behavior. “What it does give are more details so that the participants in the chat were identifiable,” says Blasi. An idea that Núñez subscribes, which highlights that the voice “is one more element”
Has Elena Cañizares exceeded herself?
Núñez expresses his doubts about how behavior like Elena Cañizares should be valued. In his opinion, it is “unquestionable” that personal data has been disseminated that allows the participants in the conversation to be identified. “Their first name, the city, the voice, the fact of being students and sharing a flat appears.” The question lies, he continues, in that although it is possible to report the same events without giving so much information (“and not expose your companions to a public lynching,” he says), in turn it is a fact that, in the current pandemic context, “may be newsworthy.” “I think both positions can be defended with the possibility of success,” he says.
“I do see a violation of data protection,” Blasi responds instead, adding another circumstance: the information that Cañizares gives in his Twitter profile allows us to deduce who the rest of those present in the WhatsApp group are. Adsuara, for its part, understands that there is no substance to justify a sanction because it is a case of freedom of expression and information and should be resolved in court. “Although from the Agency (the AEPD) I expect anything,” he warns.
Does the success of the thread add gravity to the behavior?
“The mere fact of spreading the conversation on social networks is already an infringement regardless of the followers or the retweets that accumulates “, says Blasi. The key is, details, the dissemination of information about which there was an expectation of privacy and is published without authorization.” The scope of the thread or followers of its author are criteria that the AEPD can take into account when graduating the possible sanction “.
“The success of the thread does not add gravity but it can cause greater damage,” adds Núñez in the same direction. This circumstance may be relevant if the matter reaches the courts and the judge understands that he must impose compensation that compensates the damages caused to the companions.
What sanction can the AEPD impose?
If finally there is a complaint before the AEPD and it imposes a sanction, Núñez discards that in a case like the one analyzed (which affects individuals) it was very high, because the body takes into account the economic capacity of the offender and the circumstances of the case. However, apart from this particular assessment, such events can give rise “potentially to a very high fine” in another context, warns the lawyer.
How can the other participants in the chat act?
Whoever understands that their privacy has been attacked by the publication of a WhatsApp conversation in which they participated, has two ways. The first, go to the AEPD and file a complaint before it. The second is to act directly in court, filing a claim for violation of rights. Before the judge, you can also claim compensation for damages “provided there is real and quantifiable damage,” emphasizes Blasi.
Adsuara understands that this second way, that of going to court, is the most successful in a case like Elena Cañizares. “A case like this is more related to the right to honor or privacy than to data protection legislation,” he reflects, “which are matters that have their own judicial channels and in which the Agency (the AEPD) does not should get in. “
There are some recent cases in which the Spanish Data Protection Agency (AEPD) has acted on publications of individuals who have shared private content of others on social networks. Thus, in December 2019, he fined a man 10,000 euros for disclosing intimate photos and screenshots of conversations between a woman and a third party without her consent. The content, which had been stolen from a pen drive that the affected woman had, the man published it in his WhatsApp status accompanied by humiliating comments. A year earlier, in 2018, the agency warned a woman without a fine for recording hospital workers and, later, spreading the images on YouTube without her consent. In 2017, however, he did fined a citizen 2,000 euros for disseminating videos of the local police on WhatsApp during one of his actions. In both cases, the Agency argued that the persons recorded were at their workplace performing their professional tasks, so that the conduct was outside the “personal and domestic sphere” and the European Regulation was applicable.