[paxys]

> My question: what should I answer to that e-mail in order to force WhatsApp to collect as few metadata as possible coming from my activity?

Simple answer – you aren't going to be able to. Do you think they are going to release a new version of the app just for you? Their current policy has undoubtedly been approved by legal teams in the EU and across the world and unless you can find better lawyers than theirs or sympathetic government officials to back your cause you aren't really moving the needle.

[netsharc]

> Do you think they are going to release a new version of the app just for you?

They would probably do this server-side, something like (if the metadata comes from/is related to the user with the phone number $FOO, flush it, don't store it)

[Msurrow]

Well, you are wrong if OP is based in the EU. Every member state has DPA - Data Protection Authorities that citizens can contact and/or report companies that are voilating. They have the authority to investigate and hand out fines(1), which in GDPR can be rather significant.

https://commission.europa.eu/law/law-topic/data-protection/r...

(1): Its incorrect to say they have the authority to hand out fines, but I dont know the word it, and its perhaps not the most important part of this.

[paxys]

Sure and what EU policies is WhatsApp violating?

[_8ysf]

If you read my link above, WhatsApp literally told me that I could object to some data collection as per the EU regulations.

WhatsApp showed me a popup telling me that!

[Msurrow]

Well, thats not the point. The comment above asserted that OP cannot “move the needle”. I’d say thats incorrect. If WhatsApp is voilating gdpr.

[paxys]

That is precisely the point. "Hey guys how can I take down Facebook?" Well you need proof of wrongdoing first, and don't have any. How is writing yet more emails in different words going to help?

[_8ysf]

I think you totally missed the point. Let me rephrase it: as per the EU legislation, I got a popup in WhatsApp that was saying that I have a right to object to their data collection. I followed those links and got the e-mail above.

They are essentially telling me: "You need to put the right words in your e-mail if you want us to take you seriously, but we are counting on the fact that you don't, and therefore we work around your right to object".

Hence my question here. If somebody found a way to send the right words to WhatsApp and shared them, I could send the exact same e-mail. Or differently, if we could find a "good e-mail" to send and WhatsApp still refused to acknowledge it, then EU-based users could complain to the EU and possibly get the law with them.

I think it can move the needle.

[Msurrow]

One of the roles of the DPA is to investigate and collect formal prof of wrongdoing. So no, you do not need proof og wrongdoing, you just need enough to get the DPA to investigate. For example, a fundamental priciple of gdpr is that of data minimization; a data controller must do whatever they can do minimize the data they collect and process. Another fundamental right is the right of access, meaning the right to get told all the data a data controller is collecting and processing about tje subject. Say WhatsApp list the data they collect, and say that list is very long. Then I dont think it would be difficult to argue [to the DPA] that WhatsApp is breaking the principle of minimization. Perhaps enough to start an investigation.

There are a bit more to it than that, lile ligitimate interests etc, but on the other hand gdpr has many more priciples and fundamental rights for companies to break