Experian, the $40 billion credit monitoring company, has asked a U.S. judge to force WhatsApp to provide users’ call and message records to aid it in fighting separate lawsuits, according to court records obtained by Forbes.
The government often compels tech companies to provide user data as part of criminal proceedings, but Experian’s request marks a rare case in which the Meta-owned messaging provider has been pressured to hand over data by another company in a civil case. At a time when WhatsApp and other end-to-end encrypted services are fighting attempts by governments to provide easier access to user information, the tussle with Experian presents a new kind of legal challenge for privacy-focused companies and their customers.
In February, Experian sent two subpoenas to WhatsApp, asking for information that included all phone numbers and call and message logs of eight individuals during a specific period of time. The data requests are part of two suits where Experian is fighting claims its reports led to people being unfairly rejected from mortgage applications. The company’s lawyers suspect the numbers were used by individuals who conspired to produce a faked letter from a loan provider explaining why Experian’s credit reporting was responsible for the mortgage rejections.
When WhatsApp declined to provide the information, Experian went to a judge to compel WhatsApp to respond to the subpoenas. The judge has not yet ruled.
Often, law enforcement compels WhatsApp to collect information about its users with a technology known as a “pen register.” This gathers up real-time information on specific people, including the numbers they called and messaged at given times. But WhatsApp says it does not store that data outside of such law enforcement requests, so it won’t have the kind of historical records Experian is seeking.
Joshua Breckman, a Meta spokesperson, told Forbes, “Experian is asking for information we don’t have.” Experian declined to comment.
Legal experts told Forbes Experian’s pursuit of the case was baffling. “I have not seen anything like this,” said Jerome Greco, supervising attorney of the Legal Aid Society’s Digital Forensics Unit. “It is odd… unless Experian doesn’t believe WhatsApp or there is some strategic reason they want WhatsApp to reply that they don’t keep those records.”
“I don’t understand why Experian is disputing,” Jennifer Granick, surveillance and cybersecurity counsel at the American Civil Liberties Union, told Forbes. “If WhatsApp doesn’t have the data, it’s hard to understand what Experian is asking for.”
Experian wrote in its appeal to the judge last week that WhatsApp should be able to produce the metadata it was requesting, on the basis of the Stored Communications Act (SCA), a law that regulates how and when companies can be compelled to provide customers’ data to another party.
But WhatsApp argued it could not be compelled by the SCA to hand over user information to a plaintiff in a civil lawsuit.
At the end of February, Meta lawyers suggested to Experian that it subpoena the specific WhatsApp users named in the court filing instead because those individuals will have access, on their smartphones, not just to historical call and message logs, but to the content of those messages too, writing, “Requests for account information, including content, should be directed to WhatsApp users, who can access, collect and disclose any relevant information.”
