WhatsApp Ireland Limited was fined a further 5.5 million euros — adding to the 225 million euro fine levied back in September 2021 — by the Irish Data Protection Commission (DPC) for GDPR breaches, since it forced users to consent to the processing of their data in the Terms of Service.
📌 Background
The investigation was prompted by a complaint about WhatsApp submitted by a German data subject on May 25, 2018. Before the GDPR went into effect on May 25, 2018, WhatsApp Ireland updated its Terms of Service and informed users that if they wanted to continue using the WhatsApp service after the GDPR went into effect, existing (and new) users were asked to click “agree and continue” to indicate their acceptance of the updated Terms of Service.
The services would not be accessible if users declined to do so.
WhatsApp Ireland considered that a contract was made between WhatsApp Ireland and the user when they agreed to the amended Terms of Service.
Additionally, it claimed that the processing of users’ data in connection with the provision of its service was required for the fulfilment of that contract, including the provision of service enhancement and security features, and that as a result, such processing operations were legal under Article 6(1)(b) of the GDPR (the “contract” legal basis for processing).
💡 Want to know more about the legal basis for processing? Find out here, Legal basis for processing data →
Contrary to WhatsApp Ireland’s declared position, the complainant argued that WhatsApp Ireland was actually trying to utilize permission as a legal justification for processing user data. They claimed that WhatsApp Ireland was in fact “forcing” users to consent to the processing of their personal data for service development and security by making the use of its services contingent upon acceptance of the amended Terms of Service.
This, according to the complainant, violated the GDPR.
📌 The Investigation
In compliance with Article 60 GDPR, the DPC created a draft decision after conducting a thorough investigation and sent it to its peer authorities in the EU/EEA, generally known as Concerned Supervisory Authorities (“CSAs”).
Notably, the DPC discovered:
- Users were not given a clear explanation of the legal basis WhatsApp Ireland was using, in violation of its transparency obligations. As a result, users were not adequately informed about the processing operations being carried out on their personal data, the purposes for which they were being used, and which of the six legal bases listed in Article 6 of the GDPR was being used. A lack of transparency on such essential issues, in the DPC’s opinion, violated Articles 12 and 13(1)(c) of the GDPR.
The DPC did not suggest the imposition of any additional fine or corrective measures, having already done so in a previous inquiry, given that it had already imposed a very significant fine of €225 million on WhatsApp Ireland for violations of this and other transparency obligations over the same period of time. This portion of the draft decision of the DPC was approved by all 47 CSAs.
- The “forced consent” portion of the complaints could not be upheld since the DPC determined that WhatsApp Ireland did not, in fact, rely on users’ consent as providing a lawful basis for its processing of their personal data. The DPC then considered whether WhatsApp Ireland was required to use permission as its legal justification for the provision of the service, including for the purposes of service enhancement and security.
The DPC determined that consent was not necessary in this case for WhatsApp Ireland. Since the CSA did not object to this analysis, this complaint’s element has been dismissed. In accordance with Article 60(9) GDPR, the German Supervisory Authority where the initial complaint was filed is now in charge of making a separate decision for those portions that have been rejected, notifying the complainant and alerting WhatsApp Ireland.
The DPC then considered whether WhatsApp Ireland’s reliance on the contractual legal foundation it claimed was prohibited by the GDPR in theory, but came to the conclusion that it was not.
📌 The decision
The binding judgment made by the EDPB, as described above, is reflected in the final decision made by the DPC on January 12, 2023. As a result, the DPC’s decision states that WhatsApp Ireland is not permitted to rely on the contract legal basis for the delivery of service improvement and security (aside from what the EDPB refers to as “IT security”) for the WhatsApp service and that it’s the processing of this data up to this point, in purported reliance on the contract legal basis, constitutes a violation of Article 6(1) of the GDPR.
Due to this new GDPR violation, the DPC has sanctioned WhatsApp Ireland with an administrative fine of €5.5 million and mandated that within 6 months, WhatsApp Ireland must restore its processing operations in line with the GDPR.
Separately, the EDPB has also allegedly instructed the DPC to launch a new probe that would cover the entire,
“WhatsApp IE’s processing operations in its service in order to determine if it processes special categories of personal data (Article 9 GDPR), processes data for the purposes of behavioural advertising, for marketing purposes, as well as for the provision of metrics to third parties and the exchange of data with affiliated companies for the purposes of service improvements, and in order to determine if it complies with the relevant obligations under the GDPR.”