On September 2, 2021, the Irish Data Protection Commission (DPC) announced that it adopted an infringement decision against WhatsApp Ireland Ltd. (WhatsApp), issuing a €225 million fine against WhatsApp for breach of the European Union’s General Data Protection Regulation (EU GDPR). The DPC found that WhatsApp breached its transparency obligations and provided insufficient detail about their data sharing and processing operations, infringing articles 5(1)(a), 12, 13 and 14 of the EU GDPR.
In December 2018, the DPC commenced an investigation into WhatsApp’s compliance with its transparency obligations. The DPC submitted a draft decision to other data protection authorities in the same month, finding that WhatsApp failed to meet its transparency obligations in respect of both users and non-users. The draft decision also proposed to fine WhatsApp an amount between €30million and €50million. The DPC was then prompted to submit the draft decision to the European Data Protection Board (EDPB) for dispute resolution after receiving objections from multiple data protection authorities.
On July 28, 2021, the EDPB reached a binding decision regarding the DPC’s initial draft decision and WhatsApp’s infringements. In its decision, the EDPB instructed the DPC to reassess the amount of the administrative fine to be imposed on WhatsApp. The full decision by the EDPB can be found here.
Following the reassessment, the DPC imposed a fine of €225 million on WhatsApp. In addition, the DPC ordered WhatsApp to bring its data processing into compliance and take measures to increase its transparency within 90 days. WhatsApp has stated that it intends to appeal the decision.
Summary By: Steffi Tran
Disclaimer: This Newsletter is intended to provide readers with general information on legal developments in the areas of e-commerce, information technology and intellectual property. It is not intended to be a complete statement of the law, nor is it intended to provide legal advice. No person should act or rely upon the information contained in this newsletter without seeking legal advice.
E-TIPS is a registered trade-mark of Deeth Williams Wall LLP.