WhatsApp has been fined EUR 225 million by Ireland's Data Protection Commission for violations of the EU's General Data Protection Regulation. This follows an investigation started in December 2018 over whether WhatsApp made it clear how it collects and uses personal data, including disclosing how it shares data with other Facebook companies.
Completion of the IDPC's investigation was held up by a disagreement with other privacy watchdogs in the EU. While Ireland is the lead regulatory authority for all WhatsApp's activities in the EU, other national regulators may weigh in on its decisions. In this case, several called for tougher measures against WhatsApp compared to what the Irish regulatory proposed in a draft decision issued in December 2020.
The European Data Protection Board (EDPB), which unites the national data protection authorities in the EU, told the DPC in July to reassess and increase its proposed fine of EUR 30-50 million. The EDPB said there were multiple infringements that needed to be taken into account when setting the fine, even if these covered the same or linked data processes. The amount of the fine should also be based on the parent company Facebook's turnover, not just WhatsApp's revenues, the board said.
Furthermore, the EU board called for a shorter timeframe for WhatsApp to bring its practices into compliance with the GDPR and make its policies more transparent. As a result, the company has three months to implement remedies, rather than the six proposed by the Irish regulator.
In addition to a lack of transparency for its own users about how it handles their personal data, WhatsApp was also found to be violating rights of non-users. This is a result of its Contacts feature, which checks a user's contacts list on the phone to propose contacts in the app. The investigation found the contact data collected by WhatsApp was not anonymised.
Since the investigation was first started, WhatsApp has updated its privacy policy, raising fresh concerns of increased information sharing with Facebook. In July, the EDPB called again for an urgent investigation by the Irish DPC to assess whether WhatsApp's latest changes were in compliance with the GDPR. In June the EU Court of Justice also found that other national regulators may sue Facebook for suspected privacy violations, and the company did not answer only to the Irish authority.
