When a company does not want to cooperate or do business with an aggressor country, it usually takes a certain amount of time from the company's decision to its direct exit (legal and physical). And it depends on many factors - the composition of the owners, the availability of physical production facilities, the sales market, the company's market share, the volume and nature of the business, and many others.
For a year and a half, we have been watching how companies, one by one, leave the Russian market, however, it is already clear today that "leaving Russia" legally does not mean "leaving" definitively. Especially if it concerns businesses that "live" in the network, where geographical boundaries are not an obstacle to data transfer from one "place" to another.
Today, using the example of Getcontact LLP (a software development company in London, Great Britain) and its product - messenger, caller ID GetContact - we will talk about what personal data risks remain when using this program after the company has volunteered. leave the Russian market.
As can be seen from the Rozkomnadzor register, Getcontact LLP has a registration number in this register of 319-RR, and has been registered since September 1, 2021. If you look at the column "Access", you can see that (as of June 2023) there is a mark "not limited". That is, despite all the company's statements about leaving the Russian market, there are actually no legal restrictions to continue working there.
At the same time, Youcontrol's report shows that Getcontact really does not yet cooperate in the terrorist country market.
According to the GDPR, when using GetСontact, personal data may be exposed to the following risks: identification of a person without his consent, storage, processing, transfer of his data in the absence of legal grounds. By downloading the program, the user puts himself and the persons in his phone book at risk because the program collects all contact book data based on the consent of only the user who downloaded the program.
Yes, the contact data of persons in the phone book (that is, their phone number, name, surname, or any other data that allows identifying a person) will be processed without their proper consent and without legal grounds.
Based on the information contained in the contact data of persons, it is possible to identify the person, that is, to find out the name and surname, and that is why the phone number and other data about the person will be considered personal data. Often, users of the program sign a contact not only with a first and last name, but also indicate information that can reveal other personal data, namely: place of work, address of residence or registration, family ties, and even medical or sexual ties, which according to the GDPR must be treated as sensitive data.
As per Getcontact's privacy policy, you may request access to your contact book (all your numbers and their details). If you opt out, you will not be granted access to further use the application. This approach of accessing and granting permission to use the user's data is not justified and is a violation, because the user had no other option to use the program (recall that this application primarily positions itself as a messenger) except to agree to such conditions.
Getcontact's privacy policy states:
"Getcontact does not take any responsibility for the names and numbers in your contact book that you voluntarily share"
“Personal data of third parties shared by you for any purpose… You will not be liable for any inquiries, claims or claims for damages caused to such people, and you agree that Getcontact reserves the right to contact you for compensation for damages caused to Getcontact in connection with judicial and administrative sanctions imposed on Getcontact".
Such terms of personal data processing impose obligations on the user, although the program itself processes, receives and transmits such data in violation of privacy practices.
Investigating the privacy labyrinths of Getcontact, we quite easily found examples of how today (in wartime!) you can easily identify a military person from a contact in the phone book, find out his name, rank, part number, make of car, place of residence of the family, wife's name and other data. Collectively, the information provided can be used against that individual for various purposes.
In the course of our research, we did not find any decisions where Getcontact was a party, but there are decisions in which this application was mentioned. The decision on case No. 758/11219/16-k and the decision on case No. 991/6712/20, adopted by the Supreme Anti-Corruption Court, during the review of the Protocol for the review of search results in the GetContact mobile application, drawn up by the NABU detective, were not taken into account by the court, because they did not content and functions from relevant application, including the legality of collecting personal data about a person in it.
As can be seen from this reference, the supervisory authorities of Ukraine pay very little attention to such applications as Getcontact, and have little interest in what happens to the personal data of Ukrainians during the war.
The developers themselves warn that deleting a profile in GetContact does not delete the number from the application database. However, for your own protection, it is recommended that you deactivate your account.
How to do it:
It should be noted that your data will not be visible in the application until you log in to GetContact again. To completely delete data from the program, go to https://www.getcontact.com/en/unlist, log in, scroll down the page and click Visibility settings. Then switch the slider to Off mode and confirm the action.
LinkedIn
YouTube
Instagram
Facebook
Telegram
Medium
Violetta Loseva
,
