The EU's national data protection regulators have called on the Irish watchdog to conduct an urgent investigation into the recent changes in WhatsApp's privacy policy and how it shares data with parent company Facebook, amid concerns the companies have violated privacy law. The regulators stopped short of taking action against Facebook, saying it was still too unclear how the company was using data on WhatsApp users.
The EDPB, which unites national privacy regulators across the EU, looked at the case following a request from the Hamburg supervisory authority. The latter already ordered Facebook to stop processing WhatsApp user data for its own purposes, amid fears this may violate the EU's General Data Protection Regulation. The Hamburg authority then turned to Ireland's Data Protection Commissioner to investigate, as Facebook's European business is based in Ireland and hence ultimately falls under Irish supervision.
The Hamburg regulator found efforts by Ireland's DPC insufficient and asked the EDPB to intervene. The latter did not find the Irish regulator lacking and said the change in WhatsApp's terms was not enough to justify urgent action.
According to the EDPB, there is a "high likelihood" that Facebook is using WhatsApp user data for its own purposes, both to ensure security as well as develop products. "However, in the face of the various contradictions, ambiguities and uncertainties noted in WhatsApp’s user-facing information, some written commitments adopted by Facebook IE and WhatsApp IE’s written submissions, the EDPB concluded that it is not in a position to determine with certainty which processing operations are actually being carried out and in which capacity," the board said in a statement.
Nevertheless, the EDPB said it sees a "high likelihood of infringements" and called for "swift further investigations". In particular, it wants to look into whether Facebook is cross-referencing WhatsApp user data with data from its other services, facilitated by the use of unique identifiers.
The EDPB asked the Irish regulator to carry out, "as a matter of priority", a statutory investigation to determine whether such processing activities are taking place or not, and if this is the case, whether they have a proper legal basis under the GDPR. Furthermore, it should look at Facebook's role in how data are processed for marketing purposes, cooperation with the other Facebook companies and the WhatsApp Business API. Facebook and WhatsApp were also informed of the decision.
