The Hamburg Commissioner for Data Protection and Freedom of Information has issued an administrative order that prohibits Facebook with immediate effect to collect and store data of German WhatsApp users. Facebook is also ordered to delete all the data that has already been forwarded by WhatsApp.
Facebook and WhatsApp are independent companies that process their users’ data on the basis of their own Terms and Conditions and Data Privacy Policies. After the acquisition of WhatsApp by Facebook two years ago, both parties have publicly assured that data will not be shared between them.
According to the Commissioner, the fact that this is now happening is not only to have misled users and the public, but also constitutes an infringement of national data protection law. Such an exchange is only admissible if both companies, the one that provides the data (WhatsApp) as well as the receiving company (Facebook), have established a legal basis for doing so.
Facebook, however, has neither obtained an effective approval from the WhatsApp users, nor does a legal basis for the data reception exist. It is clear that Facebook must respect German data protection law after the ECJ confirmed in its ruling in July that national data protection laws are applicable if a company processes data in connection with a national subsidiary. Facebook is doing this through its subsidiary in Hamburg, which is responsible for the operation of the marketing business in German-speaking regions.
