Is the Signal App, although recommended by the EU for internal use, in violation of GDPR?
<p>There are <a href="https://www.theverge.com/2020/2/24/21150918/european-commission-signal-encrypted-messaging" rel="nofollow noreferrer">articles</a> commenting that the European Commission has recently told its staff to switch to the encrypted Signal messaging app. When I look into Signal's <a href="https://signal.org/legal/#privacy-policy" rel="nofollow noreferrer">privacy policy</a>, as linked from their app, I find several points which don't fulfill GDPR in my understanding (just listing the most obvious):</p>
<ul>
<li>Their webpage is available in several languages of EU countries (e.g. German) and they offer a service (for free), so they have to fulfill GDPR</li>
<li>They store the user's phone number (and optionally more), so they process private information, but they don't name an EU representative located in the EU</li>
<li>They don't tell the user the rights like deleting data, making requests and so on.</li>
</ul>
<p>So do I miss something or is Signal in violation of GDPR?</p>

<h2>Probably</h2>
<p>A phone number is categorically personal information under the GDPR and collecting it makes you a data controller if you provide goods or services in the EU.</p>
<p>It seems unlikely that this would not be considered a service provided in the EU.</p>
<p>If the terms of service were purely in English then an argument could be raised that they are intended purely for anglophone countries, since all but one are (now) not members of the EU. However, that is an argument that is undercut by having terms in German. While there are many people outside the EU with fluency in German, the majority of German speakers are in the EU.</p>

gdpr