Last Thursday, WhatsApp made a drastic change to its privacy policy, which allowed it to start sharing user data - including cellphone numbers - with Facebook.

Users had feared this ever since Facebook acquired WhatsApp for US$19 billion (S$26 billion) in 2014. Their fears have now been realised, and their rumblings have reached the ears of Singapore's privacy watchdog. The Personal Data Protection Commission is seeking clarification from WhatsApp and Facebook on the recent changes.

"We will be finding out more about WhatsApp's notification process, its 30-day opt-out period, and what user data WhatsApp intends to share with Facebook," said a spokesman for the commission.

First, WhatsApp's privacy change notice is so vaguely worded there is no way of telling what personal data will be shared and how the data will be used. For instance, is the sharing limited to a user's phone number, or will his list of contacts be shared too? It is also not clear if the user's social profile - from the numbers he is in frequent contact with - will be shared with Facebook so that it can suggest more phone contacts as friends.

The Personal Data Protection Act requires organisations to inform consumers what information is collected and for what purpose.

Questions have also been raised on whether WhatsApp has done enough to seek consumers' explicit consent for data sharing, as required by the Act. WhatsApp posted a notice of its new privacy terms to users via the app. Anyone who wanted to turn off data sharing would have had to click on a link to another page.

Those who unwittingly accepted the new terms can still opt out using the settings menu - but only within 30 days of accepting the new terms.

The 30-day opt-out period is another grey area. Under the Act, consumers have the right to opt out any time they want. WhatsApp - or at least its parent Facebook, which has an office in Singapore - owes consumers an explanation.