Fine of 5.5 million euros on WhatsApp for violation of the GDPR

The Data Protection Commission of Ireland imposed a fine of 5.5 million euros on WhatsApp for breaches of the GDPR relating to its service. The Commission’s announcement states the following:

“The Data Protection Commission (“DPC”) has today announced the conclusion of an inquiry into the processing carried out by WhatsApp Ireland Limited (“WhatsApp Ireland”) in connection with the delivery of its WhatsApp service, in which it has fined WhatsApp Ireland €5.5 million (for breaches of the GDPR relating to its service). WhatsApp Ireland has also been directed to bring its data processing operations into compliance within a period of six months.

The inquiry concerned a complaint made on 25 May, 2018 by a German data subject about the WhatsApp service. In advance of 25 May 2018, the date on which the GDPR came into operation, WhatsApp Ireland updated its Terms of Service, and informed users that if they wished to continue to have access to the WhatsApp service following the introduction of the GDPR, existing (and new) users were asked to click “agree and continue” to indicate their acceptance of the updated Terms of Service. (The services would not be accessible if users declined to do so).

WhatsApp Ireland considered that, on accepting the updated Terms of Service, a contract was entered into between WhatsApp Ireland and the user. It also took the position that the processing of users’ data in connection with the delivery of its service was necessary for the performance of that contract, to include the provision of service improvement and security features, so that such processing operations were lawful by reference to Article 6(1)(b) of the GDPR (the “contract” legal basis for processing).

The complainant contended that, contrary to WhatsApp Ireland’s stated position, WhatsApp Ireland was in fact seeking to rely on consent to provide a lawful basis for its processing of users’ data. They argued that, by making the accessibility of its services conditional on users accepting the updated Terms of Service, WhatsApp Ireland was in fact “forcing” them to consent to the processing of their personal data for service improvement and security. The complainant argued that this was in breach of the GDPR.

Following a comprehensive investigation, the DPC prepared a draft decision and submitted it to its peer regulators in the EU/EEA, also known as Concerned Supervisory Authorities (“CSAs”) in accordance with Article 60 GDPR. Notably, the DPC found that:

  1. In breach of its obligations in relation to transparency, information in relation to the legal basis relied on by WhatsApp Ireland was not clearly outlined to users, with the result that users had insufficient clarity as to what processing operations were being carried out on their personal data, for what purpose(s), and by reference to which of the six legal bases identified in Article 6 of the GDPR. The DPC considered that a lack of transparency on such fundamental matters contravened Articles 12 and 13(1)(c) of the GDPR. The DPC, having already imposed a very substantial fine of €225 million on WhatsApp Ireland for breaches of this and other transparency obligations over the same period of time, did not propose the imposition of any further fine or corrective measures, having done so already in a previous inquiry. All 47 CSAs agreed with this element of the DPC’s draft decision.
  2. In circumstances where the DPC found that WhatsApp Ireland did not, in fact, rely on users’ consent as providing a lawful basis for its processing of their personal data, the “forced consent” aspect of the complaints could not be sustained. From there, the DPC went on to consider whether WhatsApp Ireland was obliged to rely on consent as its legal basis in connection with the delivery of the service, including for service improvement and security purposes. Here, the DPC found that WhatsApp Ireland was not required to rely on consent. No CSA raised an objection to this analysis and, accordingly, this element of the complaint has been rejected. The German Supervisory Authority with which the complaint was originally lodged is now responsible for adopting a separate decision for those parts that have been rejected and notifying it to the complainant and informing WhatsApp Ireland in accordance with Article 60(9) GDPR. 

The DPC went on to consider whether, in principle, the GDPR precluded WhatsApp Ireland’s reliance on the contract legal basis it asserted and concluded it was not precluded.

Six of the 47 CSAs raised objections and took the view that WhatsApp Ireland should not be permitted to rely on the contract legal basis on the basis that the delivery of service improvement and security could not be said to be necessary to perform the core elements of what was said to be a much more limited form of contract.

The DPC disagreed, reflecting its view that the WhatsApp service includes, and indeed appears to be premised on, the provision of a service that includes service improvement and security.  In the view of the DPC, this reality is central to the bargain struck between users and their chosen service provider, and forms part of the contract concluded at the point at which users accept the Terms of Service.

Having engaged with the CSAs, it became clear that a consensus could not be reached. Consistent with its obligations under Article 60(4) GDPR, the DPC then referred the matters in dispute to the European Data Protection Board (“the EDPB”).

The EDPB adopted its determination on 5 December 2022.

The EDPB determination rejected a number of objections raised by the CSAs. They also upheld the DPC’s position in relation to the breach by WhatsApp Ireland of its transparency obligations, subject only to the insertion of an additional breach (of the Article 5(1)(a) “fairness” principle). However, the EDPB took a different view to the DPC on the legal basis question, finding that, as a matter of principle, WhatsApp Ireland was not entitled to rely on the contract legal basis as providing a lawful basis for its processing of personal data for the purposes of service improvement and security.

The final decision adopted by the DPC on 12 January 2023 reflects the EDPB’s binding determination, as set out above. Accordingly, the DPC’s decision includes findings that WhatsApp Ireland is not entitled to rely on the contract legal basis for the delivery of service improvement and security (excluding what the EDPB terms as “IT security”) for the WhatsApp service, and that its processing of this data to-date, in purported reliance on the contract legal basis, amounts to a contravention of Article 6(1) of the GDPR.

In terms of sanctions, and in light of this additional infringement of the GDPR, the DPC has imposed an administrative fine of €5.5 million on WhatsApp Ireland, and ordered that WhatsApp Ireland must bring its processing operations into compliance with the GDPR within a period of 6 months.

Separately, the EDPB has also purported to direct the DPC to conduct a fresh investigation that would span all of “WhatsApp IE’s processing operations in its service in order to determine if it processes special categories of personal data (Article 9 GDPR), processes data for the purposes of behavioural advertising, for marketing purposes, as well as for the provision of metrics to third parties and the exchange of data with affiliated companies for the purposes of service improvements, and in order to determine if it complies with the relevant obligations under the GDPR.”

The DPC’s decision naturally does not include reference to fresh investigations of all WhatsApp data processing operations that were directed by the EDPB in its binding determination. The EDPB does not have a general supervision role akin to national courts in respect of national independent authorities and it is not open to the EDPB to instruct and direct an authority to engage in open-ended and speculative investigation. The direction is then problematic in jurisdictional terms, and does not appear consistent with the structure of the cooperation and consistency arrangements laid down by the GDPR. To the extent that the direction may involve an overreach on the part of the EDPB, the DPC considers it appropriate that it would bring an action for annulment before the Court of Justice of the European Union in order to seek the setting aside of the EDPB’s direction”. (source: dataprotection.ie / photo: freepik.com)

Comments

Post a Comment

Editorial

Editorial
George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Daily Mail publisher wins case against ‘success fees’ paid to lawyers (ECtHR)

Image
Obligation on publisher of the Daily Mail to pay substantial “success fees" in defamation and breach of privacy cases was excessive. The case Associated Newspapers Limited v. the United Kingdom (application no. 37398/21) concerned the fact that Associated Newspapers Limited the publisher of the Daily Mail and the Mail on Sunday had been obliged to pay extensive costs incurred by claimants who had successfully sued it in privacy and/or defamation proceedings following articles it had published in print or online in 2017 and 2019.  Since one of the claimants had entered into a conditional fee arrangement (CFA) with his legal representative, and both had taken out “after-the-event” (ATE) insurance, Associated Newspapers Limited had been liable not only for their base costs, but also for fee uplifts including the “success fee” in the CFA and for their ATE insurance premiums.  In Chamber judgment (12.11.2024) in the case, the European Court of Human Rights held, unanimously, that t...
Read more

ECtHR elects a new Vice-President of the Court and two new Section Presidents

Image
The European Court of Human Rights has elected on 23.9.2024 a new Vice-President of the Court – Judge Ivana Jelić (elected in respect of Montenegro). She will take up her duties on 1 November 2024.  The Court has also elected at the same date two new Section Presidents – Judges Lado Chanturia (elected in respect of Georgia) and Ioannis Ktistakis (elected in respect of Greece). They will also take up their duties on 1 November 2024. Ivana Jelić was born on 17 March 1975 in Podgorica, Montenegro and was elected Judge of the European Court of Human Rights on 12 July 2018. Lado Chanturia was born on 14 April 1963 in Tsalenjikha, Georgia, was elected Judge of the European Court of Human Rights on 8 January 2018 and is Vice-President of Section since 18 May 2023. Ioannis Ktistakis was born on 3 January 1971 in Thebes, Greece and was elected Judge of the European Court of Human Rights on 8 March 2021. (source/photo: echr.coe.int) Read more here
Read more

Intellectual property: the figurative sign consisting of the phrase ‘RUSSIAN WARSHIP, GO F* *K yourself’ in Russian and English cannot be registered as an EU trade mark

Image
In its Judgment in Case T-82/24 (Administration of the State Border Guard Service of Ukraine v EUIPO) (RUSSIAN WARSHIP, GO F**K YOURSELF) the General Court ruled that the figurative sign consisting of the phrase ‘RUSSIAN WARSHIP, GO F* *K yourself’ in Russian and English cannot be registered as an EU trade mark. That phrase, which has become a symbol of Ukraine’s fight against Russian aggression, is not perceived as an indication of a commercial origin.  The Administration of the State Border Guard Service of Ukraine (Kyiv, Ukraine) requests the General Court of the European Union to annul the decision of the European Union Intellectual Property Office (EUIPO) of 1 st December 2023, which refused registration of the following figurative sign as an EU trade mark: ‘RUSSIAN WARSHIP, GO F* *K yourself’ That mark is a war cry uttered by the Ukrainian border guard on Snake Island on 24th February 2022, the first day of the full-scale Russian invasion of Ukraine. Registration was sou...
Read more

The banks Crédit agricole and Credit Suisse participated in a cartel in the sector for suprasovereign bonds, sovereign bonds and public agency bonds denominated in US dollars

Image
According to the Judgment of the General Court in Cases T-386/21 (Crédit agricole and Crédit agricole Corporate and Investment Bank v Commission) and T-406/21 (UBS Group and Credit Suisse Securities (Europe) v Commission), the banks Crédit agricole and Credit Suisse participated in a cartel in the sector for suprasovereign bonds, sovereign bonds and public agency bonds denominated in US dollars (‘SSA Bonds’).  The General Court of the European Union confirms the Commission’s finding of an infringement and maintains the amount of the fines imposed in 2021. In 2018, the European Commission initiated proceedings for infringement of the competition rules involving Deutsche Bank, Bank of America, Crédit agricole and Credit Suisse (now UBS Group [1] ).  In 2021, the Commission found that those banks had entered into an agreement on the secondary market for suprasovereign, sovereign and agency bonds denominated in dollars (SSA bonds). According to the Commission, traders employed by ...
Read more

European Ombudsman asks Commission to publish details of its handling of senior staff move to law firm

Image
The European Ombudsman has asked the European Commission to publish details about how it has handled the planned move by a former director in its competition department to the Brussels office of a US corporate law firm as a partner. Any restrictions that have been placed on the activities of the former director to mitigate potential conflicts of interest should be made public without delay, said the Ombudsman. She noted that public information about the move came from the law firm and gives the impression that the Commission has allowed a senior official to work for a company that anticipates major benefits from their inside knowledge.  The Ombudsman also noted that the Commission declined to give details about the individual’s professional experience despite the fact that the law firm itself has put out a press release detailing it. The Ombudsman has previously criticised a tendency in the EU administration to underestimate the potential negative effects of staff moves to th...
Read more

A national court is not required to apply a decision of its constitutional court that infringes EU law (ECJ)

Image
In its Judgment of 26.9.2024 in Case C-792/22 (Energotehnica) the Court of Justice ruled as regards the right to an effective remedy that a national court is not required to apply a decision of its constitutional court that infringes EU law. In such a case, the national court may not be penalised.  Following the death of an electrician by electrocution during a maintenance operation, an administrative procedure was initiated against his employer. At the same time, criminal proceedings for negligence and manslaughter were initiated against the supervisor. The victim’s next of kin also became civil parties to the criminal proceedings.  The administrative court hearing the dispute concluded that the present case did not involve an ‘accident at work’. It annulled the administrative penalties imposed on the employer. According to national legislation, as interpreted by the Romanian Constitutional Court, that administrative decision prevents the criminal court from reconsidering whe...
Read more