Jenny always uses Facebook carefully. She knows the company probably knows more about her than most of her friends – the location settings might show she spent time in hospital last week, for instance – but she’s careful with what she posts. Her WhatsApp is similar. Nothing too sensitive. But the app does have access to her phone contacts, so could see the number of her counsellor, and of the addiction clinic she’s been in touch with. If those two sets of data were put side by side, Jenny’s personal, private information suddenly wouldn’t seem quite so private.

That’s the worry that many could be facing as a result of Facebook’s decision to co-opt some of the data of WhatsApp customers. It’s a worry I share. I don’t think people have been given enough information about what Facebook plans to do with WhatsApp users’ data, and that’s left people concerned about how extensive the data sharing could be. And I don’t think users have been given enough control over what’s happening.

My office has asked both companies to pause what they’re doing, which they have, and we’ve asked them to commit to doing things differently, which so far they have not.

Consumers are protected by the law. The Data Protection Act requires businesses to use people’s information fairly, and in this case that means telling them what is happening. What’s more, we’re clear that WhatsApp needs to get its users’ permission to use the data in some of the ways it plans to, and the “are you happy with our new terms and conditions?” option it has taken so far doesn’t do that.

Clearly our work here is ongoing. As it stands, unless you opt out of data sharing within the first 30 days, the only option if you’re not happy is to delete your account. As a Canadian living in Cheshire who uses WhatsApp to stay in touch with my kids, I know from personal experience how impractical that is.

We all rely on digital services for important parts of our lives. But these apps create rich portraits of who we are, even when we are careful what we post, and the companies have legal responsibilities to treat that data with proper care and respect.

There’s always a concern when personal data becomes an asset to be bought and sold

Of course we could all be more careful ourselves. Most of us would benefit from a quick audit of what access we’re giving to our apps: are location settings turned on? Does it really need access to our contacts? Using the highest privacy settings when you first create a profile, then gradually adjusting them as you feel comfortable is always a good rule of thumb.

In some cases we’re happy to accept making information available. We can appreciate that to get a good service – to get a free service – we sometimes have to share our data. That’s our entry fee, and so long as it’s clear what information is being gathered, and what it’s being used for, then that’s fine.

But what about Jenny’s problem? We might be happy with the data deal we’ve agreed with one service, happy with the deal with a second, but not happy when the two services come together.

This is a growing problem. There’s a clear trend of technology companies buying up smaller services specifically to access their customers’ information. Social media companies are of particular value here. There’s always a concern when personal data becomes an asset to be bought and sold. That concern is greater still when the value of a merger is based primarily on how a company thinks they can match up customer details they’re buying with customer details they hold themselves.

The difficulty with digital services is that because we’re so invested in them, we become dependent on a service that we can’t always easily extricate ourselves from. As big companies buy up their competitors, are there realistic alternative services out there? And even if I can find an alternative messaging service to WhatsApp, that only works for me if my friends and family move service too. In those situations, we need to have better protections for consumers.

And that’s just the consumer angle. Do these deals cause ripples of concern among diplomats and politicians, who are said to rely on tools like WhatsApp?

It’s a problem that overlaps data protection and competition law. We need to start thinking more about the obligations that follow personal data, and how people are being protected. If a company makes a promise, then that promise needs to be honoured, irrespective of corporate manoeuvres.

A successful digital economy is important to us all. The economy wants the jobs it brings, the companies want the profits it offers, and we all want the services that make our lives easier. But the whole building begins to crumble if the foundations aren’t secure. If people feel they are losing control of information that profiles entire aspects of their lives, that should be a very real concern.