French data protection agency Cnil has issued a formal notice to WhatsApp, ordering the company to stop transferring the data of its users to Facebook, which it had been found to do without their consent. The company has one month to comply with the notice.
Cnil noted that when WhatsApp was acquired by Facebook in 2014, it released a statement saying it would transfer its user data to Facebook for three purposes: targeted advertising, security and evaluation, and the improvement of services (business intelligence). The WP29, which unites EU data protection regulators, asked WhatsApp to stop the transfer of personal data for targeted advertising.
An investigation was started to make sure WhatsApp complied. The French agency said it was told by the company that the data of its 10 million French users had never been processed for targeted advertising purposes. However, the regulator's investigation found violations of the French Data Protection Act, namely for the sharing of data for 'business intelligence'.
WhatsApp was found to share information about users, such as their phone number or their usage habits on the application. The Cnil said that while there could be a case to share such info for the efficient functioning of the application, it was not the case for the 'business intelligence' purpose, which aims at improving performance and optimising use of the application through the analysis of user behaviour. "Neither the users’ consent nor the legitimate interest of WhatsApp can be used as arguments in this case," Cnil said.
Data was invalidly collected as it was not specific to this purpose. When installing the application, users must accept that their data are processed for the messaging service, but also, in general, by Facebook for accessory purposes such as the improvement of its service. Furthermore, the only way to refuse the data transfer for 'business intelligence' purposes is to uninstall the application. This means there is no way WhatsApp can provide sufficient guarantees to preserve the interest or the fundamental freedoms of users since there is no mechanism whereby they can refuse while continuing to use the application.
No further action will be take by the Cnil if WhatsApp complies with the order. If it does not, the agency may appoint an internal investigator.
