DPC (Ireland) - WhatsApp Ireland Limited - IN-18-12-2
From GDPRhub
| DPC (Ireland) - WhatsApp Ireland Limited - IN-18-12-2 | |
|---|---|
 | |
| Authority: | DPC (Ireland) |
| Jurisdiction: | Ireland |
| Relevant Law: | Article 4(1) GDPR Article 5(1)(a) GDPR Article 12 GDPR Article 12(1) GDPR Article 13 GDPR Article 13(1)(e) GDPR Article 13(1)(f) GDPR Article 13(1)(a) GDPR Article 13(1)(b) GDPR Article 13(1)(c) GDPR Article 13(1)(d) GDPR Article 13(2)(a) GDPR Article 13(2)(b) GDPR Article 13(2)(c) GDPR Article 13(2)(d) GDPR Article 13(2)(e) GDPR Article 13(2)(f) GDPR Article 14 GDPR Article 58(2) GDPR Article 60 GDPR Section 110 Data Protection Act 2018 |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 20.08.2021 |
| Published: | 02.09.2021 |
| Fine: | 225,000,000 EUR |
| Parties: | WhatsApp Ireland Limited Data Protection Commission |
| National Case Number/Name: | WhatsApp Ireland Limited - IN-18-12-2 |
| European Case Law Identifier: | n/a |
| Appeal: | Yes CJEU T-709/21 |
| Original Language(s): | English |
| Original Source: | EDPB (in EN) |
| Initial Contributor: | Frederick Antonovics |
The Irish DPA fined WhatsApp Ireland Limited €225,000,000 for negligently violating Articles 5(1)(a), 12, 13 and 14 GDPR. It ordered the company to bring its processing operations into compliance within 3 months.
English Summary
Facts
This DPC decision is the result of an own-volition inquiry pursuant to section 110 Data Protection Act 2018. It was prompted by various complaints sent by individual data subjects as well as a mutual assistance request from the German Federal Data Protection Authority concerning WhatsApp’s transparency obligations following the entry into force of the GDPR in May 2018.
The inquiry focused on:
- WhatsApp’s transparency obligations in the context of non-users under Articles 14 and 12(1) GDPR
- WhatsApp’s transparency obligations in the context of users under Articles 13 and 12(1) GDPR.
- WhatsApp’s transparency obligations in the context of its relationship with other Facebook Companies and any sharing of user data in the context of that relationship.
Following an investigation lasting from December 2018 to December 2020, the DPC submitted a composite draft decision to other DPAs in accordance with Article 60 GDPR. On 24 December 2020, it referred the objections to the EDPB, as required by the Article 65(1)(a) dispute resolution mechanism. The EDPB then adopted its binding Article 65 GDPR decision on July 28 2021.
Consequently, the DPC amended its draft to take into account the EDPB’s determination of the various objections from the other DPAs which it deemed to be “relevant and reasoned” for the purpose of Article 4(24) of the GDPR. Notably, it required the DPC to find that WhatsApp failed to comply with the key principle of transparency set out in Article 5(1)(a) GDPR, a matter it had not originally assessed.
Holding
First, it found WhatsApp denied non-users their right to exercise control over their personal data by failing to provide them with the information prescribed by Article 14 GDPR.
Second, it held WhatsApp failed to provide users with sufficiently meaningful information regarding nearly every category of information to be provided under Article 13 GDPR, making it impossible for them to adequately consider and exercise their data rights.
Third, it included an infringement of the key principle of transparency under Article 5(1)(a) GDPR in its final decision following an objection to its original decision by the Italian SA and a decision by the EDPB.
WhatsApp’s transparency obligations in the context of non-users under Articles 14 and 12(1) GDPR
In its assessment of WhatsApp’s processing of non-user personal data, the DPC first analysed how the ‘Contact Feature’ operates in practice. It found that the data it generates, a table of lossy hashes together with the associated users’ mobile phone numbers, is personal data because non-users are identifiable. It held WhatsApp processed this personal data as a controller due to the degree of control it has over the purposes and means of that processing.
Having concluded WhatsApp processes non-user personal data as a controller, the DPC evaluated its compliance with the transparency obligations set out in Articles 14 and 12(1) GDPR.
WhatsApp argued that it took “appropriate measures” to inform non-users of the “very limited ways” in which it processed their personal data. This was supposedly done by stating users provide the company with all their contacts’ phone numbers in their Privacy Policy.
The DPC rejected this argument, pointing out the lack of a discoverable and accessible “public notice” that would provide non-users of WhatsApp services with the information they are entitled to under Article 14. For example, they should be provided with details about the “circumstances in which any non-user personal data is shared with any of the Facebook Companies”. It emphasised that the burden of preparing such information is outweighed by “the role and utility of the right to be informed”.
€75,000,000 of the total fine are attributable to the infringement of Article 14 GDPR.
WhatsApp’s transparency obligations in the context of users under Articles 13 and 12(1) GDPR
The DPC first considered WhatsApp’s submissions of a general nature, and divided them into four categories. Then, it in turn considered how WhatsApp conveyed to users the information required by the sub-clauses of Articles 13(1) and 13(2) GDPR, asking two questions as part of every assessment:
-“What information has been provided?”
-“How has the information been provided?
Submissions of a general nature
The company contended any changes it made to its policies in response to the Preliminary Draft it was provided should be taken into consideration when the DPC determined whether a breach of the GDPR occurred. The DPC rejected this.
Submissions concerning Legal Certainty
WhatsApp argued official guidance about transparency requirements was lacking and that its policies aligned with those of industry peers. It qualified the standard to which the DPC held them in the preliminary draft as “alternative and even higher” than what is required by the GDPR. The DPC rejected both these points, citing the Article 29 Working Party’s Transparency Guidelines to support their original assessment.
Submissions concerning Inconsistency
WhatsApp suggested there were inconsistencies in the DPC’s interpretation of the Transparency Guidelines, notably about the requirement of a “concise approach” to providing information about the company’s reliance on legitimate interests. The DPC rejected this, explaining its view that there was an “over-supply of very high level, generalised information at the expense of a more concise and meaningful delivery of the essential information” in the Privacy Policies.
Submissions concerning WhatsApp’s pre-GDPR engagement with the Commission
WhatsApp defended its position “in a limited number of respects” by pointing out that the DPC did not take issue with its policies at the time of its pre-GDPR engagement. The DPC rejected this, maintaining that its function is not to approve or review policy documents for individual data controllers
Articles 13(1) and 13(2) GDPR
Article 13(1)(a) - the identity and contact details of the controller
The DPC held this information was provided in a clear and predictable way.
Article 13(1)(b) – the contact details of the data protection officer
The DPC held this information was provided in a clear and predictable way.
Article 13(1)(c) – the purposes of the processing for which the personal data are intended as well as the legal basis for processing
The DPC stated that data subjects must be provided with meaningful information such that they know (i) which of his/her personal data are being processed, (ii) for what processing operation(s), (iii) for what purpose(s), and (iv) in reliance on which legal basis. Such information should be presented in a way that clearly links each of these elements. This “Proposed Approach” represents the minimum information required to adequately give effect to the rights of the data subject.
It analysed whether WhatsApp achieved this in regard to the individual legal bases it identified in its Privacy Policy and found the company did not.
Article 13(1)(d) – where applicable, the Legitimate Interests being pursued
The DPC originally held this information was provided in a clear and meaningful way, but amended its finding to comply with the EDPB’s binding decision.
Article 13(1)(e) – the Recipients or Categories of Recipients
The DPC held “the information provided does not enable the user to understand what categories of personal data will be sent to which category of recipient, [nor] why such transfers are being carried out and, therefore, [their] consequences”.
It criticised the excessive links between different WhatsApp documents and “scattered” manner relevant information is spread throughout them, and stated it should be presented in a clear and concise format instead.
Article 13(1)(f) - Transfers of personal data to a third country
The DPC held controllers are required to provide information such that data subjects are informed either (i) that transfers are subject to an adequacy decision; or (ii) that transfers are not subject to an adequacy decision. The link to “a generic European Commission webpage” WhatsApp provided did not meet this standard. Instead, the DPC stated the “specific set of standard contractual clauses or specific adequacy decision” should be directly accessible.
Article 13(2)(a) – Retention Criteria/Retention Periods
The DPC held WhatsApp failed to provide meaningful information (i) in relation to the criteria that will be used to determine if, and for how long, a user’s personal data will be retained following the deletion of their account; (ii) concerning the fact that certain information will be retained, even after deletion; and (iii) to explain how such retained records are “disassociated from personal identifiers”.
Article 13(2)(b) - the existence of the data subject rights
The DPC held this information was provided in a clear and concise way.
Article 13(2)(c) – the existence of the right to withdraw consent
The DPC held whilst WhatsApp’s Legal Basis Notice referenced the right to withdraw consent, the required extent of information was not included. Further, users were not informed about how to exercise this right.
It again criticised the “piecemeal approach to the provision of the required information”, which made any effort to provide information about this right pointless.
Article 13(2)(d) – the right to lodge a complaint with a supervisory authority
The DPC held this information was provided in a clear and concise way, albeit in a confusing place.
Article 13(2)(e) - whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data
The DPC originally proposed no finding under this heading, but amended its finding to comply with the EDPB’s binding decision.
Article 13(2)(f) – the existence of automated decision-making, including profiling
The DPC proposed no finding under this heading because WhatsApp does not engage in such activities.
WhatsApp’s transparency obligations in the context of its relationship with other Facebook Companies and any sharing of user data in the context of that relationship
The DPC specifically assessed the extent to which WhatsApp explained its relationship with the Facebook Companies and any consequent sharing of data.
It again criticised the manner in which the information is spread out "across a wide range of texts", and how a significant amount of it is so high level as to be meaningless. It pointed out how the Facebook FAQ is only linked to WhatsApp's Privacy Policy in one place. The information being provided is characterised as "unnecessarily confusing and ill-defined".
As such, the DPC held that WhatsApp failed to comply with its transparency obligations per Articles 13(1)(c), 13(1)(e) and 12(1) in relation to how the company works with other Facebook Companies. It notably added that "unless WhatsApp has a concrete plan in place, that includes a definitive and imminent commencement date, to commence the sharing of personal data on a controller-to-controller basis with the Facebook Companies for safety and security purposes, the misleading elements of the Legal Basis Notice and Facebook FAQ should be deleted to reflect the true position".
Whilst the DPC originally found WhatsApp complied with Article 13(1)(d), it changed this assessment following the EDPB's binding decision.
WhatsApp's compliance with the Principle of Transparency per Article 5(1)(a)
The DPC did not include an assessment on this issue in its original draft, but found a violation of Article 5(1)(a) following the EDPB's binding decision.
Exercise of Corrective Powers
The DPC exercised the following corrective powers:
- A reprimand pursuant to Article 58(2)(b).
- An order to bring processing operations into compliance, pursuant to Article 58(2)(d) within 3 months.
- An administrative fine, pursuant to Articles 58(2)(i) and 83, addressed to WhatsApp, in the amount of €225,000,000.
The total fine reflected these individual infringements.
i. In respect of the infringement of Article 5(1)(a) of the GDPR, a fine of €90,000,000
ii. In respect of the infringement of Article 12 of the GDPR, a fine of €30,000,000
iii. In respect of the infringement of Article 13 of the GDPR, a fine of €30,000,000
iv. In respect of the infringement of Article 14 of the GDPR, a fine of €75,000,000
It arrived to these figures after first taking a number of submissions by WhatsApp into consideration, then assessing the Article 83(2) criteria, and finally adopting the EDPB’s binding decision.
Submissions
'New and Subjective Views' Submissions
WhatsApp argued the DPC’s assessment turned on “new and subjective interpretations” of relevant GDPR articles, and that “unprecedented fines” should not be imposed where it was not aware of such a higher standard. The DPC rejected expecting this much, and gave a concrete example of how the company did not meet the standard it claimed to by citing the Transparency Guidelines’ advice on the use of “language qualifiers such as ‘may’, ‘might’, [etc]”.
'Nuanced Nature of Assessment' Submissions
WhatsApp argued that the “nature” of assessing transparency requirements is “subjective and nuanced” and that this made the DPC approach to this investigation inappropriate, pointing to the “material differences” between the views of the original Investigator and Commissioner as evidence. The DPC rejected this, arguing they were the mere “result of a divergence in approach to the inquiry itself”.
'Binary Approach' Submissions
WhatsApp argued that the DPC should not have found “either full compliance or complete non-compliance with each provision”. In response, the DPC repeated much of its earlier justifications for the findings it made to illustrate that it only assessed whether “all” the required information under every article had been provided.
'Careful and Good Faith Efforts' Submissions
WhatsApp, amongst other things, argued it considered that it met the required transparency standard because “its approach [to transparency] is aligned with the approach adopted by many industry peers”. The DPC rejected this, stating that “while an industry-wide failure (if this is, in fact, the case) to achieve compliance with the transparency requirements is a poor reflection on that industry, it is not, however, evidence of a position whereby data controllers in this particular sector are unable to identify what is required of them, in terms of transparency”.
'Willingness to Change' Submissions
WhatsApp argued that because it actively ‘volunteered’ to change the information it provides in response to the preliminary draft decisions it received, the use of corrective powers is inappropriate. The DPC rejected this, highlighting that the company’s express disagreement with the DPC’s points at previous points during the investigation “creates certain limitations, in terms of the weight [it] might attribute to WhatsApp’s willingness to change”.
'Theoretical Risk' Submissions
WhatsApp argued the DPC could not demonstrate that its approach to transparency “has in fact had any negative impact on data subject rights”. The DPC reminded the company it has no duty to demonstrate “evidence” of damage to data subjects.
Article 83(2) criteria
The DPC considered each of the Article 83(2) criteria (subsection a-k) to assess the nature, gravity and duration of the infringements as well as the duration of the infringements. The purpose of this assessment was to determine the sums to be fined in order for them to be “effective, proportionate and dissuasive” as required by Article 83(1) GDPR.
It held a fine is warranted where:
- All four infringements are very serious in nature and severe in gravity. This was the case as WhatsApp only provided "41% of the prescribed information to users and none to non-users"
- The number of affected users was very large. The exact figure of users was redacted in the report, but this was the case. The number of affected non-users was described as "unquantifiable" but likely to be extremely high.
- Users are not able to meaningfully consider and exercise their data subject rights. The DPC held there was a very serious information deficit that led to this.
Further, it took consideration of the limited nature and scope of the processing in question, but stated it could not give it significant weight as a mitigating factor because of the seriousness of the infringements. It characterised all of them as negligent and the Article 14 GDPR one demonstrating "a high degree of negligence", which was taken into account as an aggravating factor.
The only mitigating factors it recognised as valid were the limited categories of personal data processed by WhatsApp and the company's willingness to amend its Privacy Policy and related material.
EDPB’s binding decision
See decision here for commentary.
Appeal
The decision by the EDPB underlying this case has since been appealed by WhatsApp, which brought an action to the CJEU on 1 November 2021.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
In the matter of the General Data Protection Regulation
DPC Inquiry Reference: IN-18-12-2
In the matter of WhatsApp Ireland Limited
Decision of the Data Protection Commission made pursuant to Section 111 of the Data Protection
Act, 2018 and Articles 60 and 65 of the General Data Protection Regulation
Further to an own-volition inquiry commenced pursuant to Section 110 of the Data Protection Act,
2018
DECISION
Decision-Maker for the Commission:
Helen Dixon
________________________________
Commissioner for Data Protection
Dated the 20 day of August 2021
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, IrelandTable of Contents
Introduction ................................................................................................................................7
Basis of Inquiry....................................................................................................................................7
Competence of the Commission.........................................................................................................8
The Inquiry........................................................................................................................................10
Approach of the Decision-Maker......................................................................................................10
Progression of the Decision-Making Stage...................................................................................11
Part 1: Transparency in the Context of Non-Users.......................................................................13
Introduction......................................................................................................................................13
Relevant Provisions.......................................................................................................................13
The Inquiry Stage..............................................................................................................................13
The Decision-Making Stage...............................................................................................................18
Relevant Background and Findings of Fact...................................................................................18
The Questions for Determination.................................................................................................20
Legal Analysis – Questions (a) and (b) ..........................................................................................21
Analysis and Discussion: Does the phone number of a non-user, prior to the application of the
lossy hashing process, constitute the personal data of that non-user?...........................................28
Finding: Does the phone number of a non-user, before the application of the lossy hashing
process, constitute the personal data of that non-user?.................................................................36
Analysis and Discussion: Does the phone number of a non-user, after the application of the lossy
hashing process, constitute the personal data of that non-user?....................................................36
Finding: Does the phone number of a non-user, after the application of the lossy hashing process,
constitute the personal data of that non-user? ...............................................................................40
Relevant Background and Legal Analysis – Question (c) ..............................................................40
The Test to be Applied..................................................................................................................47
Analysis and Discussion: When processing the personal data of non-users, does WhatsApp do so
as a data controller or a data processor?.........................................................................................54
Finding: When processing the personal data of non-users, does WhatsApp do so as a data
controller or a data processor?.........................................................................................................55
Consequent Assessment of Compliance with the Requirements of Article 14............................56
Analysis and Discussion: Article 14 Exemptions and Non-Users ..................................................56
Finding: The extent to which WhatsApp complies with its obligations to non-users pursuant to
Article 14 of the GDPR ......................................................................................................................62
Part 2: Transparency in the Context of Users ..............................................................................62
Introduction......................................................................................................................................62
2 Relevant Provisions.......................................................................................................................62
Review of the Materials being relied upon by WhatsApp................................................................64
Methodology for Part 2: Assessment and Questions for Determination.........................................68
Assessment: Article 13(1)(a) – the identity and contact details of the controller............................75
Assessment of Decision-Maker: What information has been provided?.....................................76
Assessment of Decision-Maker: How has the information been provided?................................77
Finding: Article 13(1)(a) – the identity and contact details of the controller...............................77
Assessment: Article 13(1)(b) – the contact details of the data protection officer, where applicable
..........................................................................................................................................................78
Assessment of Decision-Maker: What information has been provided?.....................................78
Assessment of Decision-Maker: How has the information been provided?................................78
Finding: Article 13(1)(b) – the contact details of the data protection officer, where applicable.78
Assessment: Article 13(1)(c) – the purposes of the processing for which the personal data are
intended as well as the legal basis for the processing......................................................................79
Preliminary Issue: What information must be provided pursuant to Article 13(1)(c)?....................82
Conclusion – Preliminary Issue: What information must be provided pursuant to Article 13(1)(c)?
..........................................................................................................................................................87
Assessment: Application of the Proposed Approach to Article 13(1)(c) ..........................................93
Identified Legal Basis 1: Contractual Necessity.............................................................................94
Identified Legal Basis 2: Consent ................................................................................................100
Identified Legal Basis 3: Legitimate Interests .............................................................................102
Identified Legal Basis 4: Compliance with a Legal Obligation.....................................................106
Identified Legal Basis 5: The vital interests of the data subject or those of another person.....110
Identified Legal Basis 6: Tasks carried out in the public interest................................................111
Finding: Article 13(1)(c) – The purposes of the processing for which the personal data are
intended as well as the legal basis for the processing................................................................114
Article 13(1)(d) – where applicable, the Legitimate Interests being pursued................................114
Assessment of Decision-Maker: What information has been provided?...................................115
Assessment of Decision-Maker: How has the information been provided?..............................115
Finding: Article 13(1)(d) – where applicable, the Legitimate Interests being pursued..............116
Assessment: Article 13(1)(e) – the Recipients or Categories of Recipient .....................................119
Assessment of Decision-Maker: What information has been provided?...................................120
Assessment of Decision-Maker: How has the information been provided?..............................121
Finding: Article 13(1)(e) – the Recipients or Categories of Recipient.........................................121
Assessment: Article 13(1)(f) – Transfers of personal data to a third country ................................123
3 Assessment of Decision-Maker: What information has been provided?...................................124
Assessment of Decision-Maker: How has the information been provided?..............................125
Finding: Article 13(1)(f) – Transfers of personal data to a third country....................................125
Assessment: Article 13(2)(a) – Retention Criteria/Retention Periods............................................128
Assessment of Decision-Maker: What information has been provided?...................................129
Assessment of Decision-Maker: How has the information been provided?..............................130
Finding: Article 13(2)(a) – Retention Criteria/Retention Periods...............................................130
Assessment: Article 13(2)(b) – the existence of the data subject rights........................................132
Assessment of Decision-Maker: What information has been provided?...................................133
Assessment of Decision-Maker: How has the information been provided?..............................133
Finding: Article 13(2)(b) – the existence of the data subject rights............................................133
Assessment: Article 13(2)(c) – the existence of the right to withdraw consent.............................133
Assessment of Decision-Maker: What information has been provided?...................................134
Assessment of Decision-Maker: How has the information been provided?..............................134
Finding: Article 13(2)(c) – the existence of the right to withdraw consent................................134
Assessment: Article 13(2)(d) – the right to lodge a complaint with a supervisory authority.........136
Assessment of Decision-Maker: What information has been provided?...................................136
Assessment of Decision-Maker: How has the information been provided?..............................136
Finding: Article 13(2)(d) – the right to lodge a complaint with a supervisory authority............136
Article 13(2)(e) – whether the provision of personal data is a statutory or contractual requirement,
or a requirement necessary to enter into a contract, as well as whether the data subject is obliged
to provide the personal data and of the possible consequences of failure to provide such data.137
Assessment of Decision-Maker: What information has been provided?...................................137
Assessment of Decision-Maker: How has it been provided?......................................................138
Finding: Article 13(2)(e) - whether the provision of personal data is a statutory or contractual
requirement, or a requirement necessary to enter into a contract, as well as whether the data
subject is obliged to provide the personal data and of the possible consequences of failure to
provide such data........................................................................................................................138
Article 13(2)(f) – the existence of automated decision-making, including profiling......................141
Outcome of Assessment.............................................................................................................141
Part 3: Transparency in the Context of any Sharing of User Personal Data between WhatsApp and
the Facebook Companies ......................................................................................................... 141
Introduction....................................................................................................................................142
The Inquiry Stage............................................................................................................................142
The Decision-Making Stage.............................................................................................................143
4 Approach to Assessment ................................................................................................................145
What information has been provided?.......................................................................................146
How has that information been provided?.................................................................................153
Assessment of Decision-Maker.......................................................................................................154
Article 13(1)(c): the purposes of the processing for which the personal data are intended as well
as the legal basis for the processing...........................................................................................154
Article 13(1)(d): where the processing is based on point (f) of Article 6(1), the legitimate
interests pursued by the controller or by a third party..............................................................158
Article 13(1)(e): the recipients or categories of recipients of the personal data, if any ............159
Finding: Assessment of compliance with the requirements of Articles 13(1)(c), 13(1)(d) and
13(1)(e)............................................................................................................................................163
Part 4: Article 5(1)(a) - Extent of Compliance with the Principle of Transparency........................ 165
Introduction....................................................................................................................................165
Part 5: Exercise of Corrective Powers........................................................................................ 169
Introduction....................................................................................................................................170
Starting Point: Article 58(2) ............................................................................................................195
Assessment of the Article 83(2) Criteria.........................................................................................200
Article 83(2)(a): the nature, gravity and duration of the infringement taking into account the
nature scope or purpose of the processing concerned as well as the number of data subjects
affected and the level of damage suffered by them ..................................................................202
Article 83(2)(b): the intentional or negligent character of the infringement.............................211
Article 83(2)(c): any action taken by the controller or processor to mitigate the damage suffered
by data subjects..........................................................................................................................215
Article 83(2)(d): the degree of responsibility of the controller or processor taking into account
technical and organisational measures implemented by them pursuant to Articles 25 and 32216
Article 83(2)(e): any relevant previous infringements by the controller or processor...............217
Article 83(2)(f): the degree of cooperation with the supervisory authority, in order to remedy
the infringement and mitigate the possible adverse effects of the infringement.....................218
Article 83(2)(g): the categories of personal data affected by the infringement.........................219
Article 83(2)(h): the manner in which the infringement became known to the supervisory
authority, in particular whether, and if so to what extent, the controller or processor notified
the infringement.........................................................................................................................219
Article 83(2)(i): where measures referred to in Article 58(2) have previously been ordered
against the controller or processor concerned with regard to the same subject-matter,
compliance with those measures...............................................................................................220
Article 83(2)(j): adherence to approved codes of conduct pursuant to Article 40 or approved
certification mechanisms pursuant to Article 42........................................................................220
5 Article 83(2)(k): any other aggravating or mitigating factor applicable to the circumstances of
the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the
infringement ...............................................................................................................................221
Decision: Whether to impose an administrative fine and, if so, the amount of the fine...............225
Assessment of any factors requiring the adjustment of the proposed fines .................................238
The Article 83(3) Limitation ........................................................................................................238
Article 83(5) and the applicable fining “cap”..............................................................................248
Summary of Corrective Powers to be Exercised.............................................................................257
Appendix A – Summary of Directions and Findings.................................................................... 259
Appendix B – Glossary of Terms ............................................................................................... 261
Appendix C – Terms of Order to bring processing operations into compliance, made pursuant to
Article 58(2)(d)......................................................................................................................... 264
Appendix D – The Article 65 Decision........................................................................................ 266
6Introduction
1. This is the decision (“the Decision”) of the Data Protection Commission (“the Commission”), made
pursuant to Section 111 of the Data Protection Act, 2018 (“the 2018 Act”) and in accordance with
Articles 60 and 65 of the General Data Protection Regulation (“the GDPR”). I have made this Decision
as the Decision-Maker for the Commission, following an inquiry, conducted pursuant to Section 110
of the 2018 Act, concerning the question of compliance or otherwise by WhatsApp Ireland Limited
(“WhatsApp”) with itsobligations pursuanttoArticles 12,13 and14 of theGDPR. Thepurpose of this
Decision is to record the Commission’s views, as to whether or not an infringement of the GDPR has
occurred/is occurring and the corrective powers that will be exercised, in response to any finding(s)
of infringement. For the avoidance of doubt, the subject matter of this Decision was previously
addressed by way of separate draft decisions, as follows:
a. The Commission’s understanding of the relevantfactual background and its provisional views,
as to whether or not one or more infringements of the GDPR has occurred/is occurring, were
previouslyaddressedbywayofthePreliminaryDraftDecisionthatissuedtoWhatsAppIreland
Limited on 21 May 2020 (“the Preliminary Draft”); and
b. The Commission’s provisional views, as to whether one or more corrective powers should be
exercised in the event of any (concluded) finding that one or more infringements has
occurred/is occurring, were previously addressed by way of the Supplemental Draft Decision
that issued to WhatsApp on 20 August 2020 (“the Supplemental Draft”).
2. This Decision represents the views of the Commission, for the purposes of Article 60 of the GDPR, on
the matters that were previously separately addressed in the Preliminary Draft and Supplemental
Draft decisions. It further reflects the binding decision made by the European Data Protection Board
(“the Board” or, otherwise, “the EDPB”) pursuant to Article 65(2) of the GDPR , which directed
changes to certain of the positions in the draft decision that was presented by the Commission for
the purposes of Article 60, as detailed further below (“the Article 65 Decision”).
Basis of Inquiry
3. Following the entry into force of the GDPR on 25 May 2018, the Commission received a number of
complaints from individual data subjects concerning the data processing activities of WhatsApp.
These complaints were received from both users and non-users of WhatsApp’s services. In addition
tothis, the Commission alsoreceiveda mutual assistance request, pursuanttoArticle61of theGDPR,
from Der Bundesbeauftragte für Datenschutz und Informationsfreiheit (the German Federal Data
Protection Authority). That request touched upon the transparency obligations that are placed on
data controllers by the GDPR in the context of the possible sharing of personal data between
WhatsApp and a variety of Facebook companies.
4. Following a preliminary examination of the complaints, the Commission observed that, while the
precise details of the complaints differed, concerns abouttransparency featured asa common theme
throughout. Having considered the issues arising, the Commission decided to commence an own-
volition inquiry pursuant to Section 110 of the 2018 Act for the purpose of assessing the extent to
1Decision 1/2021 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding WhatsApp Ireland
under Article 65(1)(a) GDPR, adopted 28 July 2021
7 which WhatsApp complies with its transparency obligations pursuant to Articles 12, 13 and 14 of the
GDPR.
5. It is important to note, at this juncture, that, while the decision to commence an own-volition inquiry
was prompted by the common theme running across the various complaints and the above-
referenced mutual assistance request, this inquiry is not an inquiry into any specific or individual
complaint, concern or request. The Commission will (to the extent that it has not already done so)
handle any such individual complaints or concerns by way of separate processes under the 2018 Act,
as might be required. For the avoidance of doubt, neither the Investigator nor I, as Decision-Maker,
have had regard to any individual complaint(s), concern(s) or request(s) for mutual assistance for the
purpose of the within inquiry.
Competence of the Commission
6. Given that WhatsApp delivers services to individuals across Europe, it was necessary to consider the
extent of the Commission’s jurisdiction in the context of the within inquiry. In this regard, Article 56
of the GDPR provides that:
“…thesupervisoryauthorityofthemainestablishmentorthesingleestablishmentofthecontroller
orprocessor shallbecompetentto actasleadsupervisoryauthorityforthecross-border processing
carried outbythatcontroller orprocessorinaccordancewith the procedureprovidedinArticle60.”
WhatsApp’s position as to its establishment in Ireland
7. WhatsApp previously notified the Commission, by way of email dated 25 May 2018 (“the 25 May
Email”), that:
“… WhatsApp Ireland Limited (acting as the data controller for the WhatsApp service in the EU)
will have its main establishment in the European Union in Ireland.”
8. The Investigator, upon commencement of the within inquiry, requested that WhatsApp confirm
whether the processing of personal data which is the subject matter of the inquiry satisfied the
definition of “cross-border processing” set out in Article 4(23)(b) of the GDPR. She further requested
confirmation that the position, asregardsthe identity and location of the main establishment, for the
purpose of the WhatsApp service, remained as outlined in the 25 May Email.
9. WhatsApp confirmed the former and affirmed the latter as part of its response to the Investigator’s
initial questions, dated 25 January 2019. WhatsApp specifically confirmed, in this regard, that:
“WhatsApp Ireland is the controller for the internet-based messaging and calling service (the
“Service”) for EU users. WhatsApp Ireland is solely responsible for, and has the exclusive power to
make, decisions about the purposes and means of processing of personal data of EU users. In
particular, WhatsApp Ireland engages […] personnel located in Dublin, who perform various
services for WhatsApp Ireland, including legal, law enforcement response, customer operations,
information security, trust and safety, and training. In addition, WhatsApp Ireland is responsible
for:
Making the Service available to users in the EU;
Setting policies that govern how EU user data is processed;
8 Controlling access to and use of EU user data;
Handling and resolving data-related inquiries and complaints regarding the Service
from EU users whether directly or indirectly;
Responding to requests for EU user data from law enforcement;
Ensuring the Service's compliance with EU data protection laws and ongoing
evaluation of the Service; and
Guiding the development of products involving EU user data in accordance with EU
data protection laws.
10. WhatsApp further confirmed that “WhatsApp Ireland’s single establishment with respect to personal
data processed for the Service in the EU is located in Ireland.”
Controllership and cross-border processing
11. Accordingly, it is clear, in circumstances where WhatsApp provides services to individuals across the
EU (as detailed above) and engages in the processing of the personal data of individuals for the
purposes of providing such services, that it is engaged in cross-border processing.
12. WhatsApp, in its response of 25 January 2019, as referred to above, has confirmed that it is the data
controller in respect of the personal data of EU users. The Commission notes that this affirmation of
controllership is contained in WhatsApp’s Privacy Policy (second paragraph). Further the “Contact
Information” section of WhatsApp’s Privacy Policy also gives the contact address for the EU
service as that of WhatsApp’s office premises (which address, as detailed further below, is in
Ireland).
The Commission’s consideration of the factual position
13. As concerns whether WhatsApp is a data controller for EU users, it should be noted that there has
been a course of historical and ongoing engagement, by WhatsApp, with the Commission’s
Consultation Unit (through which the Commission carries out its supervision function) dating back a
number of years and predating the application of the GDPR. This engagement has been conducted in
relationtothepreparationandrevisionofWhatsApp’sdataprotectionpoliciesaswellasthehandling
of complaints, amongst other things. Having regard to these ongoing interactions, the Commission is
satisfied that WhatsApp acts as the controller, determining the means and purposes of processing in
respect of the personal data of individuals, in relation to the delivery of its services across the EU.
14. Further, as regards the requirement that, in order to come within the competency of the Commission
as the lead supervisory authority, WhatsApp must demonstrate that it has either its single or main
establishment in Ireland, the Commission confirms that WhatsApp, as controller for its cross-border
processing activities, has its single establishment located in Ireland, with permanent office premises
located at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2. The Commission is satisfied that
WhatsApp’s employees are, in ordinary course, based at these office premises.
15. Finally, and of significance, since 25 May 2018, a total of 88 complaints made against WhatsApp have
beentransmittedtotheCommissionbythesupervisoryauthoritiesofGermany(theFederalauthority
actingon behalf of variousregional authorities), the Netherlands, Austria, Spain, the United Kingdom,
France, Finland and Poland, in circumstances where those authorities were acting as concerned
supervisory authorities (insofar as they have received complaints from complainants). Those
9 complaints have been transmitted to the Commission on the basis that the Commission is the lead
supervisory authority for WhatsApp. In this regard, the Commission notes that no supervisory
authority to date has objected to such designation of the Commission as the lead supervisory
authority in respect of the cross-border processing carried on by WhatsApp.
16. In all of the circumstances detailed above, the Commission is satisfied that, pursuant to Article 56(1)
and Article 4(23)(a) of the GDPR, it is competent to act as the lead supervisory authority, for the
purpose of the cross-border processing activities carried out by WhatsApp.
The Inquiry
17. The Commission notified WhatsApp of the commencement of an own-volition inquiry pursuant to
Section 110 of the 2018 Act by way of letter dated 10 December 2018 (“the Notice of
Commencement”). TheNotice ofCommencementidentified thescope of theinquiry and puta series
of questions to WhatsApp for the purpose of examining the matters in issue. For the avoidance of
doubt, the inquiry was limited to WhatsApp’s consumer services and does not relate to the
“WhatsApp for Business” service. The term “the Service” is used throughout this Decision (and was
used throughout the course of the within inquiry) to refer to WhatsApp’s internet-based messaging
and calling service. Similarly, the term “non-user” has been used throughout the within inquiry to
denote an individual data subject who does not have an account with WhatsApp.
18. For the avoidance of doubt, the scope of the within inquiry is limited to an assessment of the extent
to which WhatsApp complies with its transparency obligations pursuant to the GDPR. Considerations
of WhatsApp’s entitlement to rely on any particular legal basis when processing personal data fall
outside of the scope of this inquiry. Accordingly, nothing in this Decision should be understood to
represent confirmation of WhatsApp’s entitlement to rely on any, or any particular, legal basis when
processing personal data for the purposes of the Service.
19. By way of letter dated 25 January 2019, WhatsApp provided the Investigator with the information
requested (“the Response to Investigator’s Questions”). The Investigator made a subsequent
request for clarification by way of email dated 8 March 2019. WhatsApp provided the clarification
requested under cover of email dated 20 March 2019. Having considered the information furnished,
the Investigator recorded her views and proposed findings in a draft inquiry report dated 30 May
2019(“theDraftReport”). TheDraftReportrecordedtheInvestigator’sunderstandingoftherelevant
factual background as well as her proposed findings as to whether or not an infringement of Articles
12, 13 and/or 14 of the GDPR had occurred/was occurring. WhatsApp responded to the contents of
theDraftReportbywayofletterdated1July2019(“theInquirySubmissions”). Havingtakenaccount
of the Inquiry Submissions, the Investigator concluded her final report on 9 September 2019 (“the
Final Report”). The Investigator passed the Final Report, together with the inquiry file, to me on 9
September 2019. By way of letter dated 4 October 2019, I wrote to WhatsApp to notify it of the
commencement of the decision-making stage.
Approach of the Decision-Maker
20. The Investigator took an approach whereby she reached fifteen separate conclusions (as summarised
in Section G of the Final Report) following her assessment of the extent to which WhatsApp complies
with the obligations set out in Articles12, 13 and 14 of the GDPR. However, for ease of consideration
10 of the issues arising, I have adopted an approach based on an assessment of the issues arising under
three core headings, as follows:
Part 1: Transparency in the context of non-users
Under this heading, I will consider the extent to which WhatsApp processes personal data in
relation to non-users of the Service and whether any such processing gives rise to a requirement
for WhatsApp to comply with the obligations set out in Articles 14 and 12(1) of the GDPR. The
issues that I will consider under this heading correspond to the matters covered by Conclusions
1, 2 and 14 of the Final Report.
Part 2: Transparency in the context of users
Under this heading, I will consider the extent to which WhatsApp complies with its obligations
under Articles 13 and 12(1) of the GDPR, in the context of its processing of personal data relating
to users of the Service. The issues that I will consider under this heading correspond to the
matters covered by Conclusions 3 to 13 (inclusive) of the Final Report.
Part 3: Transparency in the context of any sharing of personal data between WhatsApp and the
Facebook Companies
Under this heading, I will consider the extent to which WhatsApp complies with its obligations
under Articles 13 and 12(1) of the GDPR, in the context of any sharing of personal data between
WhatsApp and the Facebook family of companies. For the purpose of this Decision, I will use the
term “the Facebook Companies” to collectively refer to those members of the Facebook family
of companies that process, for any purpose, personal data, whether as processors or as
controllers, which have been shared with them by WhatsApp.
TheissuesthatIwillconsiderunderthisheadingcorrespondtothematterscoveredbyConclusion
15 of the Final Report.
Progression of the Decision-Making Stage
21. Upon completion of my assessment of the Final Report and inquiry file, I prepared the Preliminary
Draft, recording my understanding of the relevant factual background and setting out my preliminary
views, as to whether or not one or more infringements of the GDPR has occurred/is occurring. I
provided WhatsApp with a copy of the Preliminary Draft as soon as it was ready, on 21 May 2020.
Immediately afterwards, I prepared the Supplemental Draft, setting out my provisional views as to
whether one or more corrective powers should be exercised in the event of my finding that an
infringement of the GDPR has occurred/is occurring. As before, I provided WhatsApp with a copy of
the Supplemental Draft as soon as it was ready, on 20 August 2020.
22. For the avoidance of doubt, the Supplemental Draft was prepared solely by reference to the
provisional views and proposed findings recorded in the Preliminary Draft. In other words, I did not
take account of the submissions that were received from WhatsApp in the intervening period (on 6
July 2020), in response to the Preliminary Draft. I informed WhatsApp of this by way of letter dated
20 August 2020 and expressly confirmed that I would take account of the submissions that had
already been furnished, in response to the Preliminary Draft, and any submissions that might yet be
11 furnished, inresponse to the Supplemental Draft, when finalising the final versions of the Preliminary
and Supplemental Drafts for circulation through the Article 60 process. WhatsApp furnished
submissions in response to the Preliminary Draft under cover of letter dated 6 July 2020 (“the
Preliminary Draft Submissions”). WhatsApp’s submissions in response to the Supplemental Draft
were furnished under cover of letter dated 1 October 2020 (“the Supplemental Draft Submissions”).
23. As is apparent from the within Decision, the Preliminary Draft and the Supplemental Draft were
combined into a single, composite draft decision, which was circulated to the other supervisory
authorities concerned (“CSAs, each one being a “CSA”), in accordance with Article 60 of the GDPR, on
24 December 2020 (“the Composite Draft”). Given that the Service entails cross-border processing
throughout Europe, all other Supervisory Authorities (“SAs, each one being an “SA”) were engaged
as CSAs for the purpose of the co-decision-making process outlined in Article 60 of the GDPR. In
response, the following CSAs raised objections to the Composite Draft:
a. The German (Federal) SA raised an objection on 21 January 2021;
b. The Hungarian SA raised an objection on 21 January 2021;
c. The Dutch SA raised an objection on 21 January 2021;
d. The Polish SA raised an objection on 22 January 2021;
e. The French SA raised an objection on 22 January 2021;
f. The Italian SA raised an objection on 22 January 2021;
g. The Baden-Wurttemberg SA raised an objection on 22 January 2021; and
h. The Portuguese SA raised an objection on 22 January 2021.
24. In addition, the following comments were exchanged:
a. The Austrian SA exchanged a comment on 21 January 2021;
b. The Dutch SA exchanged a comment on 21 January 2021;
c. The Danish SA exchanged a comment on 22 January 2021;
d. The Polish SA exchanged a comment on 22 January 2021;
e. The Belgian SA exchanged a comment on 22 January 2021;
f. The French SA exchanged a comment on 22 January 2021; and
g. The Hamburg SA exchanged a comment on 22 January 2021.
25. Having considered the matters raised, the Commission, by way of a Composite Response
Memorandum dated 1 April 2021, set out its responses together with the compromise positions that
it proposed to take in response to the various objections and comments. Ultimately, it was not
possible to reach consensus with the CSAs on the subject-matter of the objections and, accordingly,
the Commission determined that it would not follow them. That being the case, the Commission
referred the objections to the Board for determination pursuant to the Article 65(1)(a) dispute
resolution mechanism. Inadvance of doingso, the Commission invited WhatsApptoexercise itsright
to be heard on all of the material that the Commission proposed to put before the Board. WhatsApp
exercised its right to be heard by way of its submissions dated 28 May 2021 (the “Article 65
Submissions”). The Board adopted its Article 65 Decision on 28 July 2021 and notified it to the
Commission and all other CSAs on 30 July 2021. As per Article 65(1), the Board’s decision is binding
upon the Commission. Accordingly, and as required by Article 65(6) of the GDPR, the Commission
has now amended its Composite Draft, by way of this Decision, in order to take account of the
Board’s determination ofthe variousobjections fromthe CSAswhichitdeemedtobe “relevantand
12 reasoned” for the purpose of Article 4(24) of the GDPR. This Decision identifies, below, the
amendments to the positions and/or findings proposed in the Composite Draft, that were required
to take account of the Board’s Article 65 Decision. For the avoidance of doubt, this Decision does not
reference, or engage with, any objections which the Board determined either to be: (i) not “relevant
and reasoned”; or (ii) not requiring of any action to be taken on the part of the Commission.
Part 1: Transparency in the Context of Non-Users
Introduction
26. In this part of the Decision, I will consider the extent to which WhatsApp processes personal data in
relation to non-users of the Service and whether any such processing gives rise to a requirement for
WhatsApptocomply with the obligationsset outinArticles 14 and 12(1) of theGDPR. The issuesthat
I will consider under this heading correspond to the matters covered by Conclusions 1, 2 and 14 of
the Final Report.
Relevant Provisions
27. Given that this part of the Decision entails a consideration of the obligations arising in the context of
non-users of the Service, the relevant provisions of the GDPR are Article 14, read in conjunction with
Article 12(1).
28. Article 14 of the GDPR concerns transparency in the context of personal data that have “not been
obtained from the data subject”. Where a data controller has obtained personal data from a source
other than the data subject, Article 14 requires the data controller to provide the data subject with
the information detailed in Articles 14(1) and 14(2).
29. Article 12(1) of the GDPR details the requirement for a controller to:
“take appropriate measures to provide any information referred to in Articles 13 and 14 … to the
data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain
language, in particular for any information addressed specifically to a child.”
30. Thus, while Article 14 addressees the specific information that must be communicated to data
subjects, Article 12 addresses the way in which this information must be communicated.
The Inquiry Stage
The information sought and WhatsApp’s response
31. Question 3 of Appendix A to the Notice of Commencement asked WhatsApp to confirm whether or
not it processes personal data relating to non-users of the Service. Thereafter, Questions 9 – 15,
inclusive, asked WhatsApp to demonstrate compliance with the various provisions of Article 14 and
Article 12(1), in relation to the processing of any data relating to non-users of the Service.
32. WhatsApp stated, in its Response to Investigator’s Questions, that it does not, as a data controller,
process personal data relating to non-users of the Service. It clarified that, while it processes the
telephone numbers of non-users of the Service, it does so:
13 “as a processoronbehalfofits EUuserswhenprovidingits contactlistfeature(a popularvoluntary
feature of the Service) (“the Contact Feature”).”
33. WhatsApp further explained that:
“The ContactFeature allowsusersto requestthat[WhatsApp] access the phone numbers(noother
details) in their address book for the purposes of determining which of their contacts is already
using the Service. On behalf of such a user (e.g. “User A”), [WhatsApp] identifies for User A which
of his/her contacts already use the Service and populates User A’s contacts on the Service enabling
User A to communicate with these users (the specific implementation of this varies slightly by
device platform).
The Contact Feature is technologically possible only if [WhatsApp] accesses the phone numbers in
User A’s address book, which could in principle include the phone numbers of non-users. In such
circumstances, [WhatsApp] will, in a very limited capacity as a processor for User A, process the
phone numbers of such non-users (and no other details) on behalf of User A.
[WhatsApp] processes this data on behalf of User A for two purposes only. First, to establish which
of User A’s address book contacts also use the Service as part of the Contact Feature, and which
are non-users. And secondly, in relation to those non-users’ data, in order to quickly and
conveniently update User A’s contacts list on the Service as and when any of those non-users join
the Service.
To ensure that it provides these services as a processor in line with the principles of privacy by
design, [WhatsApp] only processes the non-users’ phone numbers for the minimum time required
to apply cryptographic lossy hashing, which is generally no more than a few seconds. This process
generates a new value (known as a “lossy-hashed value”) based on the phone number. It is this
lossy-hashed value, and not the non-users’ phone numbers, that is stored by WhatsApp for and on
behalf of User A.
34. By way of a footnote (footnote 1) to the Response to Investigator’s Questions, WhatsApp explained
the applicable lossy hashing process as follows:
35. The Investigator, bywayof afollow-upemaildated8 March2019,requested clarification asto“if and
how a user can opt out of sharing their contacts, or categories of contacts, with WhatsApp”.
36. By way of email dated 20 March 2019, WhatsApp confirmed that “EU users can choose whether or
not to share their contacts with [WhatsApp] when registering for the [Service] … . They also have the
ability to turn off sharing of contacts on or off at any time after registration via their device settings
…”.
The Questions for Determination and the Draft Report
1437. On the basis of the above, the Investigator sought to determine the answers to three specific
questions, namely:
a. Does the phone number of a non-user, prior to the application of the lossy hashing process,
constitute the personal data of that non-user?
b. Does the phone number of a non-user, after the application of the lossy hashing process,
constitute the personal data of that non-user?
c. In the event that either of the above questions is answered in the affirmative, does WhatsApp
process the personal data as a processor (acting on behalf of an individual user who has
activated the Contact Feature) or a data controller?
38. Having considered the position, the Investigator formed the preliminary view that any information
processed by WhatsApp in relation to non-users (both before and after the lossy hashing process)
constituted the personal data of those non-users. The Investigator formed that preliminary view by
reference to:
a. The definition of “personal data”, as set out in Article 4(1) of the GDPR, which confirms that
“’personal data’ means any information relating to an identified or identifiable natural person
…” (emphasis added);
b. Recital 26 to the GDPR, which provides that “[in order to] determine whether a natural person
is identifiable, account should be taken of all the means reasonably likely to be used, such as
singling out, either by the controller or by another person to identify the natural person directly
or indirectly”; and
2
c. The judgment of the Court of Justice of the EU (“the CJEU”) in Breyer .
39. The Investigator furtherformed the preliminaryview that, when processingthe personal data of non-
users, WhatsApp did so as a controller, and not a processor. That preliminary view was based on:
a. The definitionsof “controller” and “processor”, asset outinArticles4(7) and4(8) of the GDPR;
b. Therequirement,setoutinArticle28(3)oftheGDPR,foranyprocessing(byaprocessoracting
on behalf of a controller) to be governed by “a contract or other legal act”;
c. The application of the concept of “data controller”, as considered by reference to the
“household exemption” described in Article 2(2)(c) and Recital 18 of the GDPR and the
judgments of the CJEU in the Facebook Fan Pages Case and the Jehovah’s Witnesses Case ; 4
2
3Breyer v Bundesrepublik Deutschland (Case C-582/14, judgment delivered on 19 October 2016) (“Breyer”)
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH (Case
C-210/16, judgment delivered on 5 June 2018) (“the Facebook Fan Pages Case”)
4Tietosuojavaltuutettu v Jehovan todistajat – uskonnollinen yhdyskunta (Case C-25/17, judgement delivered on 10 July
2018) (“the Jehovah’s Witnesses Case”)
15 d. The view of the Article 29 Working Party, as set out in Opinion 1/2010 on the concepts of
5
“controller” and “processor” ;
e. The fact that a user cannot choose to limit the Contact Feature to apply only to the contact
information of other users of the Service; and
f. The benefit, to WhatsApp, of the processing and a doubt as to whether the storage of non-
user numbers (albeit in the form of hash values) was necessary for the purpose of the Contact
Feature.
WhatsApp’s Response to the Draft Report
40. WhatsApp, by way of its Inquiry Submissions, disagreed with the Investigator’s views and asserted
that:
a. “WhatsApp has no ability to link a non-user’s phone number to a specific individual – even if it
were possible to do so during the few seconds such phone numbers are held”;
b. “The effectof the lossy-hashingprocedure isthatWhatsAppcannotreverse engineer the value
into the original phone number … It is computationally impossible. At most, WhatsApp could
possibly link the value back to a group of up to sixteen different possible phone numbers. In
short,oncethelossy-hashingprocesshasbeenapplied,WhatsApplosestheabilitytoreidentify
the specific non-user’s phone number. The information is genuinely and irreversibly
anonymous in nature”;
c. There are no reasonable means available to WhatsApp that would enable it to associate the
phone number with an identifiable natural person; and
d. The judgment in Breyer is not applicable in circumstances where “no established means or
channels are available to enable WhatsApp to ascertain the identity of the owner of the non-
user phone number, and certainly none are identified in the Draft Report”.
41. InrelationtotheInvestigator’sproposedfindingconcerningWhatsApp’sstatuswhenprocessingnon-
user data, WhatsApp again disagreed with the Investigator’s views and asserted that:
a. The initial action/decision to process data (by way of the Contact Feature) is made by the
uploading user;
b. The Investigator appeared to have ignored the fact that this aspect of the Service is
technologically possible only if WhatsApp accesses all of the phone numbers in an uploading
user’saddressbook. The Investigator’ssuggestion, inthisregard, thatWhatsAppshouldallow
an opt-out in respect of the sharing of non-user contacts ignores this fact as well as the
purpose of importing contacts;
5Article 29 Working Party, Opinion 1/2010 on the concepts of “controller” and “processor”, adopted 16 February 2010
(00264/10/EN WP 169) (“Opinion 1/2010”).
16 c. In any event, an opt-out would be unworkable in practice in circumstances where “users
generally have no way of knowing which of their contacts currently use the WhatsApp service
prior to uploading their contacts, and so would have noway of knowing which friends’ contact
information they were opting-out from sharing”;
d. In addition to the above, any approach that does not involve the storage of lossy-hashed non-
user contacts would (i) impose huge engineering costs on WhatsApp; and (ii) significantly
degrade the experience of WhatsApp users by slowing down the Service and consuming
excessive bandwidth on users’ phones;
e. WhatsApp cannot be said to exert control over the processing of non-user data when its
capacities are limited to storing and deleting(undecipherable hashesof) that data. WhatsApp
submitted, in this regard, that it is clear that the uploading user exerts influence over the
processingofpersonaldatafortheirpurposes,andsoparticipatesindeterminingthepurposes
and means of that processing;
f. The Investigator failed to cite any evidence in support of her conclusion that the storage of
non-user data allegedly served WhatsApp’s purposes more than those of the uploading user.
WhatsAppsubmitted,inthisregard,thatthepurposeoftheContactFeatureisto“enable[the]
user to useWhatsAppasameansofreadilycontacting hisorherfriends,regardlessofwhether
those friends are current users of WhatsApp or may be users in the future”. According to
WhatsApp, this serves the user’s interests.
42. To support its position, WhatsApp provided some additional information to explain the manner in
which the lossy-hashed values are used to “speedily update WhatsApp users’ contacts on their behalf
when their friends join the service”. WhatsApp explained that the applicable process, when a new
user joins the Service and submits his/her phone number as part of the registration process, is as
follows:
a. “The phone number of the new user undergoes the same lossy-hashing method described [as
before];
b. WhatsApp checks if the resulting hash value is already contained in the stored list generated
from non-users’ phone numbers. This list links each stored hash value to the WhatsApp user(s)
who uploaded the non-user phone number from which that hash was generated. As a result,
by checking this list, WhatsApp can identify all existing WhatsApp users who may potentially
have uploaded this new users’ phone number previously(and somay potentially havethis new
user in the contact list);
c. However, because each stored hashed value can be linked to as many as sixteen different
phone numbers, it is impossible for WhatsApp to conclude with certainty as a result of this
process which users will indeed have the new user in their contact list;
d. To address this, a request is sent – to users’ devices, not the users themselves – to the full set
of users WhatsApp has established may have the new user in their contact list. Given the
6The Inquiry Submissions, paragraph 3.4
17 nature of the lossy-hashed value (i.e. because the same value can be generated from hashing
sixteen different numbers), WhatsApp necessarily over-notifies in this regard, albeit the hash
comparing process mitigates the amount of this over-notification;
e. Upon receiving this request, the app on each user’s device will verify if the new user’s phone
number is indeed contained in the contact list on that device; and
f. If the new user is indeed listed on the device’s contact list, their listing will be updated in the
app to display to the relevant user the fact that this new user can now be contacted through
WhatsApp.”
43. Having considered the Inquiry Submissions, the Investigator finalised her report, concluding that the
information processed by WhatsApp in relation to non-users remains, at all times, the personal data
of those non-users. She further found that, when processing this data, WhatsApp did so as a
controller and not a processor.
The Decision-Making Stage
Relevant Background and Findings of Fact
44. Having assessed the information collected during the inquiry stage, I summarised, in the Preliminary
Draft, the background information that I considered to be relevant and by reference to which I
proposed to consider the issues arising. By way of the Preliminary Draft Submissions, WhatsApp
corrected certain information that had previously been provided and added further information that
had not been previously provided. The following now represents the amended factual framework
upon which I propose to base my assessment of the issues arising, for the purpose of this Part 1:
a. The Service includes an optional Contact Feature that allows a user to request that WhatsApp
access the phone numbers stored in the address book of the individual user’s device. The stated
purpose of the Contact Feature is to enable WhatsApp, on behalf of a user, to identify which of
that user’s contacts already use the Service and to populate any user contacts on the Service,
7
thereby enabling the requesting user to communicate with his/her contacts via the Service.
b. While an address book will contain various different types of information, such as names, phone
numbers and emailaddresses, WhatsApp only processes the mobile phone numbersof the user’s
8
contacts for the purpose of the Contact Feature.
c. Given that an individual’s address book may contain the contact details of both users and non-
users, WhatsApp may end up accessing the numbers of both users and non-users of the Service
whenitaccessesanindividual’saddressbookforthepurposeoftheContactFeature. Thereasons
for this are twofold:
I. firstly, this processing is necessary to establish which of the requesting user’s contacts
are already users of the Service (so as to enable the updating of the user’s contacts on
the Service);
7Per the “Information We Collect” section of the Privacy Policy and the Contact Feature Pop-Up
8Response to Investigator’s Questions (response to Question 3a.)
18 II. secondly, in relation to the phone numbers of any non-users, WhatsApp processes this
information so as to be able to quickly and conveniently update the requesting user’s
9
contacts list as and when any of those non-users join the Service.
d. When processing the phone numbers of non-users, WhatsApp typically does so for no more than
a few seconds prior to their deletion. This includes the time it takes to (i) access all mobile phone
numbersonauser’sdevice,(ii)transferthosenumbers,inunhashedform,toWhatsApp’sservers,
(iii) generate irreversible hashes of the non-user numbers once they reach these servers (which
itself takes a matter of microseconds), and (iv) delete the underlying phone numbers . The 10
applicable hashing process may be summarised as follows:
I.
II.
III.
11
e. The effect of the lossy hashing process is that WhatsApp cannot reverse engineer the Lossy Hash
12
into the original non-user’s phone number. Further, the same Lossy Hash can be generated
from a minimum of sixteen different phone numbers . 13
14
f. Lossy Hashes are stored in a list (“the Non-User List”) on WhatsApp’s servers . Each Lossy Hash
15
is linked, in the list, to the user who uploaded the original non-user’s number.
g. When a new user joins the Service, his/her phone number is lossy-hashed in accordance with the
16
process outlined at d. above . The resulting Lossy Hash is compared to the hash values stored in
17
the Non-User List . The purpose of this exercise is to update the contacts of any existing users
whose address books previously included the new user (albeit at a point in time when the new
user was a non-user) . 18
9Response to Investigator’s Questions (response to Question 3a.)
10
The Preliminary Draft Submissions, paragraph 3.3 and the Example provided
11Response to Investigator’s Questions (response to Question 3a.), as supplemented/amended by the Preliminary Draft
Submissions (step 2 of the Example set out at paragraph 3.3)
12
The Inquiry Submissions, paragraph 3.3
13The Preliminary Draft Submissions (steps 2 and 3 of the Example set out at paragraph 3.3 and footnote 22)
14The Inquiry Submissions, paragraph 3.4(ii)
15The Inquiry Submissions, paragraph 3.4(ii)
16
The Inquiry Submissions, paragraph 3.4(i)
17The Inquiry Submissions, paragraph 3.4(ii)
18The Inquiry Submissions, paragraph 3.4
19 h. If the Lossy Hash generated from the new user’s number is matched with a Lossy Hash already
stored in the Non-User List, this does not mean that WhatsApp can identify which users have the
new user’s mobile phone number in their address books. As each stored Lossy Hash can be
theoretically linked to a minimum of sixteen different phone numbers, it is impossible for
WhatsApptoconclude, asa resultof thisprocess, whichof the possible matches havea particular
new user’s number in their contacts. It may even be the case that none of the matches have the
newuser’snumberintheircontacts . TheutilityoftheNon-UserListisnotthatitenablesprecise
matching of new-users to existing users but, rather, it “very significantly” reduces the number of
devices that WhatsApp needs to notify when a new user joins the Service; instead of having to
issue notifications to all WhatsApp users, it is only necessary for notifications to issue to those
20
potential matches identified in the Non-User List .
i. In order to establish which users (if any) have the new user in their contacts, WhatsApp sends a
notification to the devices of any linked users (i.e. any users that were identified as potentially
having the new user in their contact lists pursuant to the step outlined at g. above) . As clarified
by WhatsApp, by way of the Preliminary Draft Submissions, the notification does not include the
Lossy Hash itself, which plays no further role in the process after assisting to reduce the number
of devices WhatsApp needs to notify. Instead, the notification includes of the new
user’s phone number (“the Notification Hash”), which is only generated after the new user signs
up to use the Service .22
j. Upon receipt of the notification, the relevant device will compute the Notification Hash for every
contact it has stored locally and check whether any of those hashes match the Notification Hash
received. If a match is found, the device will send a sync request (with the mobile phone number
in unhashed form) to the WhatsApp server. WhatsApp will then update the WhatsApp contacts
on behalf of those users that actually have the new user’s phone number in their mobile phone
address book, so that the new user is then their WhatsApp contact . 23
The Questions for Determination
45. The above gives rise to three specific questions for determination, namely:
a. Does the phone number of a non-user, prior to the application of the lossy hashing process,
constitute the personal data of that non-user?
b. Does the phone number of a non-user, after the application of the lossy hashing process,
constitute the personal data of that non-user?
c. In the event that either of the above questions is answered in the affirmative, does WhatsApp
process the personal data as a processor (acting on behalf of an individual user who has
activated the Contact Feature) or a data controller?
19The Preliminary Draft Submissions (step 4 of the Example set out at paragraph 3.3)
20The Preliminary Draft Submissions (step 5 of the Example set out at paragraph 3.3)
21The Inquiry Submissions, paragraph 3.4(iv)
22
The Preliminary Draft Submissions (step 5 of the Example set out at paragraph 3.3)
23The Inquiry Submissions, paragraphs 3.4(v) and 3.4(vi) and the Preliminary Draft Submissions (step 5 of the Example set
out at paragraph 3.3)
2046. I propose tofirstly address questions (a) and (b), above, given that the third question will only require
determination in the event that I find that the phone number of a non-user constitutes the personal
data of that non-user (either before or after the lossy hashing process).
Legal Analysis – Questions (a) and (b)
47. To begin, it is useful to recall the definition of “personal data”, as set out in Article 4(1) of the GDPR,
as follows:
“’personal data’ means any information relating to an identified or identifiable natural person
(‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an identification number, location data, an
online identifier or to one or more factors specific to the physical, physiological, genetic, mental,
economic, cultural or social identity of that natural person”
48. It is therefore clear that, in order for information to constitute “personal data”, it must relate to an
“identified” or “identifiable” natural person. While it will usually be self-evident if a data subject has
been “identified”, the meaning of “identifiable” and, in particular, the circumstances in which a
person might be “indirectly” identified, requires further consideration.
49. Turning, firstly, to Recital 26 of the GDPR, which acts as an aid to the interpretation of Article 4(1),
that provision clarifies that:
“… (t)o determine whether a natural person is identifiable, account should be taken of all the
means reasonably likely to be used, such as singling out, either by the controller or by another
person to identify the natural person directly or indirectly. To ascertain whether means are
reasonably likely to be used to identify the natural person, account should be taken of all objective
factors, such as the costs of and the amount of time required for identification, taking into
consideration the available technology at the time of the processing and technological
developments.”
50. Thus, when determining whether or not a natural person is “identifiable”, it is necessary to:
a. Firstly, identify the ways in which a person might be identified, directly or indirectly, either by
the controller or by another person; and
b. Then, consider whether the mechanisms identified above are “reasonably likely” to be used,
by the controller “or by another person”, taking account of all objective factors such as any
associated cost, the time required for identification, the available technology and
technological developments.
Opinion 4/2007
51. The provisions discussed above were considered by the Article 29 Working Party in its “Opinion
4/2007 on the concept of personal data” (“Opinion 4/2007”). While Opinion 4/2007 addresses the
24Article 29 Working Party, Opinion 4/2007 on the concept of personal data, adopted 20 June 2007 (01248/07/EN WP 136)
(“Opinion 4/2007”)
21 issue by reference to the definition of “personal data” set out in Article 2(a) of Directive 95/46/EC 25
(“the Directive”), that definition is materially identical to the definition set out in Article 4(1) of the
GDPR. I further note that the text of the accompanying recital (Recital 26 of the Directive) is very
similar to the text of Recital 26 of the GDPR. While I am further cognizant of the facts that (i) Opinion
4/2007 is non-binding; and (ii) the Article 29 Working Party was replaced, pursuant to Article 68 of
the GDPR, by the European Data Protection Board on 25 May 2018, the views expressed in Opinion
4/2007 nonetheless provide a helpful analysis of the factors that should be taken into account when
considering if a natural person is ”identifiable”.
52. Opinion 4/2007 firstly notes, in this regard, that:
“… a natural person can be considered as “identified” when, within a group of persons, he or she is
“distinguished” from all other members of the group. Accordingly, the natural person is
“identifiable” when, although the person has not been identified yet, it is possible to do it (that
is the meaning of the suffix “-able”).” [emphasis added]
53. Opinion 4/2007 further observes that:
“As regards “indirectly” identified or identifiable persons, this category typically relates to the
phenomenon of “unique combinations”, whether small or large in size. In cases where prima facie
the extent of the identifiers available does not allow anyone to single out a particular person, that
person might still be “identifiable” because that information combined with other pieces of
information(whetherthe latter isretainedbythedatacontroller or not)willallowthe individual
to be distinguished from others.” [emphasis added]
54. Considering,specifically,the“meanstoidentify”aspectofRecital26,Opinion4/2007consideredthat:
“One relevant factor … for assessing “all the means likely reasonably to be used” to identify the
persons will in fact be the purpose pursued by the data controller in the data processing. National
DataProtectionAuthoritieshavebeenconfrontedwithcaseswhere,ontheonehand,thecontroller
argues thatonlyscattered pieces of information are processed, withoutreference to anameorany
other direct identifiers, and advocates that the data should not beconsideredaspersonal data and
not be subject to the data protection rules. On the other hand, the processing of that information
onlymakes sense if itallows identification of specific individuals and treatmentof themina certain
way. Inthesecases,wherethepurposeoftheprocessingimpliestheidentificationofindividuals,
it can be assumed that the controller or any other person involved have or will have the means
“likely reasonably to be used” to identify the data subject. In fact, to argue that individuals are
not identifiable, where the purpose of the processing is precisely to identify them, would be a
sheer contradiction in terms. Therefore, the information should be considered as relating to
identifiableindividuals andthe processingshouldbe subject todataprotectionrules.” [emphasis
added]
55. By contrast, Opinion 4/2007 alsoconsidered the position where stepshave been taken toremove the
possibility of identification of the data subject:
“In other areas of research or of the same project, re-identification of the data subject may have
been excluded in the design of protocols and procedure, for instance because there is no
25Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals
with regard to the processing of personal data and on the free movement of such data (“the Directive”)
22 therapeutical aspect involved. For technical or other reasons, there may still be a way to find out
to what persons correspond what clinical data, but the identification is not supposed or expected
to take place under any circumstance, and appropriate technical measures (e.g. cryptographic,
irreversible hashing) have been put in place to prevent that from happening. In this case, even if
identificationofcertaindatasubjectsmaytakeplacedespiteallthoseprotocolsandmeasures(due
to unforeseeable circumstances such as accidental matching of qualities of the data subject that
reveal his/her identity), the information processed by the original controller may not be considered
to relate to identified or identifiable individuals taking account of all the means likely reasonably
to be used by the controller or by any other person. …”
Relevant Caselaw
56. Noting the above, I must finally consider how these principles have been interpreted by the CJEU in
those cases that required consideration of the circumstances in which an individual might be said to
be “indirectly” identifiable. I note, in this regard, that it has been established that:
a. “the act of referring, on an internet page, to various persons and identifying them by name or
by other means, for instance by giving their telephone number … constitutes ‘the processing of
26
personal data wholly or partly by automatic means’” ;
b. static IP addresses “are protected personal data because they allow those users to be precisely
identified” ; and
c. “[an exam] candidate at a professional examination is a natural person who can be identified,
either directly, through his name, or indirectly, through an identification number, these being
28
placed either on the examination script or on its cover sheet.”
57. Turning to the Breyer judgment , the Court, in this case, considered a scenario whereby an online
media service provider (“Party A”) retained log files of certain information pertaining to access
requests made to its web pages/files. The log files included the IP address of the computer from
which access was sought. The information required to identify an individual user, however, was held
by a third party (the user’s internet service provider) (“Party B”).
58. A further complicating factor in the case was the fact that the IP address in question was a ‘dynamic’
IP address, rather than a ‘static’ one. As set out above, it had been previously established 30that a
static IP address constitutes the personal data of the user because it allows the user to be precisely
identified. Unlikea staticIPaddress, however,a dynamicIPaddresschangeseachtime there isa new
connection tothe internet. Accordingly,a dynamicIPaddressdoes notenablea link tobeestablished
between a given computer and the physical connection to the network used by the internet service
provider.
26
Lindqvist (Case C-101/01, judgment delivered by the CJEU on 6 November 2003) (“Lindqvist”)
27Scarlet Extended v Société belge des auteurs, compositeurs et éditeurs SCRL (SABAM) (Case C-70/10, judgment delivered
by the CJEU on 24 November 2011) (“Scarlet Extended”)
28Nowak v Data Protection Commissioner (Case C-434/16, judgment delivered by the CJEU on 20 December 2017)
(“Nowak”)
29
Breyer v Bundesrepublik Deutschland (Case C-582/14, judgment delivered on 19 October 2016) (“Breyer”)
30Scarlet Extended v Société belge des auteurs, compositeurs et éditeurs SCRL (SABAM) (Case C-70/10, judgment delivered
by the CJEU on 24 November 2011) (“Scarlet Extended”)
2359. Accordingly, the data stored by Party A did not enable the user to be directly identified; Party A could
only do so if the information relating to the user’s identity was communicated to it by Party B. In the
circumstances, a question arose as to whether or not the contents of the log files constituted the
personal data of the user. The answer to this question depended on whether the user was
“identifiable”.
60. Considering the position, the Court firstly observed that a dynamic IP address does not constitute
information relating to an ‘identified natural person’ because that information does not directly
reveal the identity of the natural person whoownsthe computer fromwhichawebsite wasaccessed,
or that of another person who might use that computer. The Court observed, however, that the
inclusion of the word ‘indirectly’ in the definition of “personal data” suggested that, in order for
information to constitute “personal data”, it is not necessary that that information alone enables the
data subject to be identified.
61. Turning to Recital 26 of the Directive, the Court firstly noted that this required account to be taken of
“all the means likely reasonably to be used either by the controller or by any other person to identify”
the said person. The Court observed that this particular wording suggested that, in order for
information to constitute “personal data”, it is not required that “all the information enabling the
identification of the data subject must be in the hands of one person”.
62. Accordingly, a determination was required in relation to whether or not the possibility that the
dynamic IP address held by Party A might be combined with additional data held by Party B
constituted a “means likely reasonably to be used” to identify the data subject. The Court observed
that this would not be the case if the identification of the data subject, inthis manner,was prohibited
by law or practically impossible on account of the fact that it requires a disproportionate effort in
terms of time, cost and man-power, so that the risk of identification appeared, in reality, to be
insignificant.
63. Considering this question in the particular circumstances of the case, the Court noted that German
law (the applicable national law, for the purpose of the assessment) did not permit Party B to directly
transmit the additional data that would enable the identification of the data subject to Party A. The
Court observed, however, that legal channels existed such that Party A could contact the competent
authority (to report, for example, a cyber-attack), so that the competent authority could take the
steps necessary to obtain the identifying information from Party B so as to commence criminal
proceedings. In this way, the data subject would be identified as a result of the combination, by the
competent authority, of the information held by Party A with the identifying data held by Party B.
64. On the basis of the above, the Court concluded that Party A had the means “likely reasonably to be
used” in order to identify the data subject, with the assistance of other persons, namely the
competent authority and Party B, on the basis of the IP addresses stored in Party A’s log files.
65. Accordingly, the Courtfoundthata dynamicIPaddress, registered by PartyA when aperson accesses
its website, constitutes personal data, in the hands of Party A, where Party A has the legal means
available to it to enable the identification of a data subject by way of additional data held, about that
data subject, by Party B.
The Preliminary Draft and the Proposed Findings – Questions (a) and (b)
2466. Applying the above to the within inquiry, I proposed findings, in the Preliminary Draft, that the phone
number of a non-user constitutes the personal data of that non-user both before and after the lossy
hashing process.
67. Inrelation tothe position before the lossy hashingprocess, my view wasthata mobilephone number
is no different in quality to a static IP address (as considered in Scarlet Extended), a (landline)
telephone number (as considered in Lindqvist) or an identification number (as considered in Nowak).
As detailed above, each of these factors have been found, by the CJEU, as being capable of enabling
the indirect identification of a natural person. Accordingly, and adopting the reasoning of the CJEU
in the cases discussed above, I formed the preliminary view that the phone number of a non-user
constitutes the personal data of that non-user in circumstances where the non-user can be indirectly
identified by reference to his/her phone number.
68. In relation to the status of the phone number of a non-user, after the lossy hashing process, my
proposed finding, in this regard, was informed by the purpose of the Contact Feature (which is
designed to “quickly and conveniently” update the relevant users’ contacts lists “as and when any of
those non-users join the Service”). I noted, in this regard, that WhatsApp is able to achieve this
objective because it stores Lossy Hashes in combination with the derivative user contact in the Non-
User List. As a result, WhatsApp can update user contacts to include the details of a new user by:
a. Firstly narrowing down the users who might have the new user in their address books (albeit
originally as a non-user); and
b. Then verifying, fromthe narrowed-down listof possible matches, those userswhoactually have
the new user in their address books.
69. On the basis of the above, it seemed to me that the purpose of the processing of non-user contacts
(including the application of the lossy hashing process) implied the identification of individuals. In
other words, by lossy hashing non-user contacts and storing the resulting Lossy Hash in combination
withthenumberofthederivativeuser,WhatsAppisableto“quicklyandconveniently”matchupnew
users (who were previously non-users) with their contacts. In the circumstances, I recalled the view
expressed by the Article 29 Working Party in Opinion 4/2007, that: “to argue that individuals are not
identifiable, where the purpose of the processing is precisely to identify them, would be a sheer
contradiction in terms”.
70. I further noted that the circumstances appeared to be very similar to those outlined in Breyer. Here,
I observed, WhatsApp is ultimately able to match new users with their friends if the new user was
previouslyanon-userwhosenumberwaslossy-hashedandstoredintheNon-UserListincombination
with the details of the derivative user contact. On this basis, it appeared to me that WhatsApp could,
if requested to do so by a competent authority (such as An Garda Síochána, the Irish competent
authority),achievetheindirectidentificationofthenon-userconcernedbysubjectinganymobile
phone number that might be provided by the competent authority to the new user process with
a view to identifying those existing users who have the number in their address books. This
would then enable the competent authority to contact the identified users to request that they
identify the name of their non-user contact.
WhatsApp’s Response to the Proposed Findings – Questions (a) and (b)
2571. By way of the Preliminary Draft Submissions, WhatsApp disagreed with the proposed findings. It
firstlysubmitted,inthisregard,thatthepurposeandtechnicallimitationsofthelossyhashingprocess
werenotfullyappreciatedandreflectedinthePreliminaryDraft. WhatsAppsubmitted,inthisregard,
that:
a. “the purpose of the processing is not to enable WhatsApp to identify non-users; instead,
its aim and effect is to enable WhatsApp (when directed to do so by existing users) to
facilitate prompt and efficient connectivity for existing users when new users join the
[Service] … To the extent that WhatsApp engages in any processing of data in connection
with themobile phone numbers of non-users,that processing is undertaken exclusively for
31
the purpose of facilitating this user-to-user connectivity.”
b. The Lossy Hash itself is used to ensure that the process can be conducted in a resource-
efficient manner (e.g. by reducing the impact on user devices). It does this by enabling
WhatsApp to only have to send notifications, using the Notification Hash, to a limited
32
group of users, as identified by the Non-User List, as opposed to all WhatsApp users.
c. Based on how WhatsApp’s systems currently operate, it is not technically feasible for it to
extractunhashednon-usernumbersfrom thehashingprocessduringthetransientperiod
it processes them. In order to even access such unhashed non-user numbers, WhatsApp
would need to design and implement code changes in order to process and log additional
information to that which it does currently . 33
72. WhatsApp further submitted that the Preliminary Draft failed to consider the unique circumstances
of Breyer and failed to explain how the principles established in that case could support the proposed
findings;
a. “The conclusion that the processing of the [Lossy Hash] by WhatsApp amounts to the
processing of personal data of non-users does not reflect the fact that what constitutes
personal data is contextualand highly fact-specific. What is personal data in one person’s
hands will not necessarily be personal data in another person’s hands; and whether
indirectidentificationcanbeachievedwilldependonthefactualcircumstancesathand .” 34
b. “There is no third party from whom WhatsApp could, using reasonable means (or indeed
at all), source information in order to combine it with [Lossy Hashes] (or the unhashed
mobile phone numbers, given the manner in which WhatsApp processes them …) so as to
identify an individual.” “An Garda Síochána do not have the power under Irish law to
compel WhatsApp to undertake the actions envisaged by the Commission’s hypothetical
scenario and, even if it did, the exercise of those powers would not result in WhatsApp
itself being able to identify any non-user” 35
31The Preliminary Draft Submissions, paragraph 3.4(A)
32The Preliminary Draft Submissions, paragraph 3.4(A)
33The Preliminary Draft Submissions, paragraph 3.10
34The Preliminary Draft Submissions, paragraph 3.4(B)
35The Preliminary Draft Submissions, paragraphs 22(B), 25 and 26
26 c. “The Commission’s conclusions would produce illogical consequences whereby a person
processing particular information from which an individual cannot be identified will be
processingpersonaldata…simplybecauseathirdparty,actingentirelyofitsownvolition,
unilaterally decides to provide that person with other information so that further
processing can take place which may ultimately enable that third party to then identify a
person. Such an outcome is clearly not consistent with the rationale of Breyer and is
36
irreconcilable with the EU law principle of proportionality .”
73. WhatsApp further submitted that the proposed findings were not consistent with Recital 30 of the
GDPR or the fact that WhatsApp did not collect the information necessary to identify the non-user
data subjects:
a. The Commission “has not explained why unhashed non-user mobile phone numbers in
WhatsApp’s hands (for – at most – a few seconds only and with no access to other identifying
information) could comprise personal data”. Such a conclusion is not supported by the cases
relied upon, nor can it be reconciled with Recital 30. Further, WhatsApp does not have either
the technical nor lawful means to identify non-users during the very short period it processes
these mobile phone numbers. “In any event, it is not consistent with the proportionality
principle to conclude that an entity which processes a mobile phone number for a matter of
seconds can be said to be processing “personal data”. That point applies with particular force
where, as here, that momentary processing is itself undertaken solely for the purpose of
enabling a hashing process that conclusively prevents any subsequent identification of the
original mobile phone number (still less the owner of the number) .” 37
b. Recital 30 of the GDPR makes it clear that online identifiers, such as an IP address, do not
automatically enable the identification of individuals, and it may be necessary to combine
those identifiers with other unique identifiers to enable the individual to be identified. If an
online address such as an IP address is not automatically to be treated as data that enables
the identification of an individual, then it must logically follow that a mere mobile phone
number does not automatically enable such identification either. The implication of Recital
30 is that, in the case of online identifiers, you need to have access to other identifying
information to be in a position where you can be said to be processing personal data. The
38
same must logically follow in respect of mobile phone numbers .
c. In all of the cases relied upon by the Commission, the controller had access to other
information enabling the ready identification of the person to whom the data related, and/or
the nature of the relevant data processing was such that it would have enabled third parties
39
to readily identify the person to whom the data related . None of the judgments cited in the
Preliminary Draftsupport the conclusion thata standalone mobile phone number – processed
as it is for a brief moment and in circumstances where no identification of the non-user
through other means is envisaged or even practically possible – can be treated as personal
data for the purposes of Article 4(1) .40
36The Preliminary Draft Submissions, paragraphs 3.22(C)
37
38The Preliminary Draft Submissions, paragraph 3.6
The Preliminary Draft Submissions, paragraph 3.7
39The Preliminary Draft Submissions, paragraph 3.8
40The Preliminary Draft Submissions, paragraph 3.9
2774. WhatsApp finally submitted that the proposed findings could not be reconciled with the principle of
proportionality:
a. “… even if WhatsApp could be said to be processing personal data during this momentary
period, that processing would itself be so transient and trivial that, by itself, it could not found
an obligation to notify non-users; any other conclusion would of necessity fall foul of the
41
proportionality principle engaged in the application of Article 14 GDPR. ”
b. The application of the proportionality principle leads to the conclusion that the processing of
unhashedmobilephonenumbersbyWhatsAppdoesnotamounttotheprocessingofpersonal
data because of (i) the transient nature; (ii) the fact that the processing is limited to the non-
user’s mobile phone number; and (iii) the processing is undertaken merely as a precursor to a
hashing process resulting in the irreversible anonymization of the number and designed to
enable user-to-user connectivity (as opposed to the identification of non-users). In the
circumstances, it would not be proportionate to treat the processing as amounting to the
processing of personal data. This is particularly the case given the lack of any meaningful
42
privacy consequences for non-users .
Analysis and Discussion: Does the phone number of a non-user, prior to the application of the lossy
hashing process, constitute the personal data of that non-user?
75. In the Preliminary Draft, I proposed a finding that the phone number of a non-user, prior to the
application of the lossy hashing process, constitutes the personal data of that non-user on the basis
that such a number constitutes “information relating to an identified or identifiable natural person”.
WhatsAppdisputedthisproposedfindingonanumberofgrounds,assummarised above. Thecentral
tenetofWhatsApp’spositionisthatthemobilephonenumberofanon-user,intheabsenceoffurther
information concerning the identity of that non-user, does not enable the identification of the non-
user concerned.
76. Article 4(1) defines “personal data” as meaning “any information relating to an identified or
identifiable natural person”. It clarifies that “an identifiable natural person is one who can be
identified, directly or indirectly, in particular by reference to an identifier such as a name, an
identification number, location data, an online identifier or to one or more factors specific to the
physical, physiological, genetic, mental, economic, cultural or social identity of that natural
person.”
77. The above definition makes it clear that, firstly, the concept of “personal data” is highly dependent
on context, rather than the application of fixed rules. Secondly, the inclusion of the possibilities that
an individual might not just be “identified”, but “identifiable”, and that such identification might be
either “direct” or “indirect”,clearly indicates thatthe legislature intended toascribe abroadmeaning
to the term “personal data”. Thirdly, the use of the words “(i)n particular”, prior to the list of sample
identifiers, makes it clear that the list provided is not exhaustive and that there are potentially
innumerable ways in which an individual might be said to be identified or identifiable.
41The Preliminary Draft Submissions, paragraph 3.4(C)
42The Preliminary Draft Submissions, paragraph 3.11
2878. Recital 26, which acts as an aid to the interpretation of Article 4(1), provides further indication as to
the circumstances in which an individual might be considered to be “identifiable”:
a. “To determine whether a natural person is identifiable, account should be taken of all the
means reasonably likely to be used, such as singling out, either by the controller or by another
person to identify the natural person directly or indirectly”.
b. “To determine whether means are reasonably likely to be used to identify the natural person,
account should be taken of all objective factors, such as the costs of and the amount of time
requiredforidentification, takingintoconsideration theavailable technologyatthe timeofthe
processing and technological developments.”
79. It seems to me that Recital 26 envisages a risk-based approach to the question of whether, in any
given set of circumstances, an individual might be said to be “identifiable”; it requires the potential
risk of identification to be assessed by reference to “all of the means reasonably likely to be used”,
either by the controller or by a third party, and for those identified “means” to be assessed by
reference to the factors that might help or hinder identification by way of those identified “means”.
80. Applying the above to the circumstances under assessment, I firstly note that WhatsApp processes
the following information concerning non-users:
a. The mobile phone number of the non-user; plus
b. The name and mobile phone number of the user from whose address book the non-user’s
number has been collected.
81. In terms of what this information discloses about the non-user concerned, I note that it enables me
to:
a. know that the individual concerned is not a user of the Service; and
b. infer the likely existence of some sort of relationship between the individual concerned and
the associated user.
82. The question fordetermination, therefore,is whether ornotthe mobilephonenumberof anon-user,
either by itself or with the other information described in paragraph 80, above, enables the non-user
concerned to be identified, or at least capable of being identified, either directly or indirectly. When
considering this, I must take account of “all the means reasonably likely to be used … either by the
controller or by another person to identify [the individual] directly or indirectly”. When assessing
whether the “means” identified are “reasonably likely to be used” to identify the individual
concerned, I must take account of all objective factors, such as the cost involved and time required
to achieve identification as well as the available technology and technological developments.
83. Considering, firstly, whether or not the non-user can be identified, or rendered capable of
identification, directly or indirectly, from his/her mobile phone number, I note that a mobile phone
number issomewhatuniqueinthatitprovidesa directroute to, and a meansof communicatingwith,
29 the individual concerned. In the circumstances, it is possible that the individual concerned could be
considered to be “identifiable” by several means, including:
a. WhatsApp, or any third party, could dialthe non-user’smobile phone number tomake further
enquiries as to the identity of the non-user concerned;
b. WhatsApp, or any third party, could access the non-user’s voicemail greeting to see if the
individual has identified himself/herself in that greeting;
c. WhatsApp, or any third party, could carry out internet / social media searches, using the non-
user’s mobile phone number as the search criterion;
d. WhatsApp, or any third party, could contact the associated user to make further enquiries as
to the identity of the non-user concerned;
e. WhatsApp, or any third party, could carry out internet / social media searches, using the non-
user’s mobile phone number, in conjunction with the name and mobile phone number of the
associated user, as the search criteria.
84. I note that there are no barriers to the use of the “means” identified above and that they represent
options that are readily available to any interested party. Further, they do not entail a significant
investment of time or money and neither do they require any particular technological expertise or
equipment. Accordingly, I do not think that the “means” identified could be said to require a
disproportionate effort, in terms of time, cost or man-power. I consider, therefore, that they are
means “reasonably likely to be used” to identify the non-user concerned.
85. For the avoidance of doubt, I acknowledge that the identified options only provide for the possibility,
rather than the guarantee of identification of the non-user concerned. My view, inthis regard, isthat
neither Article 4(1) nor Recital 26 require the guarantee of identification in the context of an
assessment as to whether or not an individual might be “identifiable”. As already observed, Article
4(1) and Recital 26 envisage a risk-based approach to the possibility of identification. This risk-based
approachisreflectedinBreyer,wheretheCourtobservedthat,whenconsideringifaparticularmeans
constituted “a means likely reasonably to be used to identify the data subject”:
“… that would not be the case if the identification of the data subject was prohibited by law or
practically impossible on account of the fact that it requires a disproportionate effort in terms of
time, cost and man-power, so thatthe risk of identification appears inreality tobe insignificant.”
[emphasis added] 43
86. The language used by the CJEU, above, strongly supports the proposition that the assessment of
whether an individual might be identifiable does not require a conclusion that an individual is either
absolutely identifiable or absolutely not identifiable. Rather, it is sufficient for the assessment to
discount the possibility of identification by concluding that risk of identification, as assessed, appears
to be “insignificant”.
43Breyer, paragraph 46
3087. In the context of the within assessment, my view is that the risk of identification, by way of the
“means” outlined at paragraph 83 above, cannot be described as “insignificant”. In my view, it is just
as likely as not that an individual might be identified by way of the “means” outlined above, given:
a. The unique nature of a mobile phone number, being both a piece of information as well as a
conduit by which direct contact can be made with the individual concerned; and
b. As regards the possibility of identification by way of internet / social media searches, the ease
of access to, and proliferation of, platforms and apps that are dedicated to facilitating
communication and the sharing of information between individuals, the increasing number of
individuals that are using such platforms and apps and the fact that individuals can reach a
potentially infinite audience through these platforms and apps. The ease with which
individuals can share, with a potentially infinite audience, information about both themselves
and others, including, for example, mobile phone numbers, makes it possible for individuals
to be identified through the traces of their activities which are left online, including where
they have posted, shared or otherwise disclosed a mobile phone number.
88. For the sake of completeness, I note that there is one avenue by which the identity of any non-user
could be ascertained in each and every case, namely the combination of the non-user mobile phone
number with the corresponding name and address held by the relevant telecoms provider. I note
that, similar to the position in Breyer, such a combination would only appear to be possible by way of
the intervention of a third party such as An Garda Síochána (the Irish competent authority) in a case
whereby WhatsApp might seek to identify the owner of the non-user number in connection with a
criminal complaint. In terms of the feasibility of such a possibility, WhatsApp is no different to any
otherdatacontrollerinthatitmayfinditselfthetargetofcriminalactivity,includingcybercrime,from
time to time. It stands to reason that the reporting of any such criminal activity to An Garda Síochána
may necessitate the sharing of information in relation to the individuals potentially responsible with
a view to ultimately identifying those responsible. It is possible for such information to include a
mobile phone number that WhatsApp has not, by way of its own records, been able to associate with
an existing user. In such a scenario, the owner of the non-user mobile phone number held by
WhatsApp could be identified with the addition of the name of the relevant registered owner of the
mobile phone number, as held by the relevant mobile phone network provider with which the phone
number is registered, through the intervention of An Garda Síochána.
89. Aspartof myassessmentofthis issue, I have alsoconsidered the possible consequences of a contrary
finding, whereby, as advanced by WhatsApp, the mobile phone number of a non-user does not
constitute the “personal data” of the individual concerned. Such an outcome would mean that
WhatsApp (or, indeed, any entity) would be free to process this information without limitation;
WhatsAppcouldlegitimatelysharetheinformationwithanyentityitwished,foranyreasonitwished,
and any occurrence of unintended disclosure or interception would be entirely inconsequential. In
order for such a position to be consistent with the GDPR, it would be necessary to classify a mobile
phone number as a piece of information that does not relate to an identified or identifiable natural
person. It is only through such a classification that one could rationally agree that the unintended
disclosure or interception ofthe information would notgive rise to a risk of negative consequence for
the individual concerned.
3190. It is unclear to me how one could reach such a conclusion in the context of the information in issue.
Asoutlined above, the unique natureof a phone numberissuch thatitinherently provides the means
bywhichanindividualcanbeidentified. Thus,intheeventthatamobilephonenumberisintercepted
or otherwise disclosed between the point of its collection and the point in time at which it is lossy-
hashed and irretrievably deleted, the intercepting party might well be able to identify the individual
associated with that mobile phone number.
91. For the reasons set out above, my view is that, on balance, the mobile phone number of a non-user
must be considered to be the personal data of the individual concerned. As regards the particular
counter-arguments raised by WhatsApp in the Preliminary Draft Submissions, I have taken them into
account, as part of my assessment, as follows:
The submission that inadequate account has been taken of the purpose of the processing, which is not
aimed at the identification of non-users, but, rather, the aim of enabling WhatsApp to facilitate prompt
and efficient connectivity for existing users when a new user joins the Service
92. While I accept that WhatsApp does not process the mobile phone numbers of non-users for the
specific purpose of identifying those non-users, it is clear that the processing is designed to impact
upon an individual non-user in the event that he/she subsequently decides to become a user of the
Service. In other words, we are not dealing with separate “users” and “non-users”; rather, we are
dealing with individuals who were originally “non-users” and have subsequently become “users”. In
thisway,whiletheprocessingisnotdesignedtoidentifythenon-usersconcerned,itwill,nonetheless,
have individual and unique impact for the non-user concerned if he/she subsequently decides to
become a user. In terms of that individual impact, it is clear that the processing is designed to make
the individual’s status, as a user, known to all of the other existing users who have the contact details
of this particular user already stored in their devices. In other words, the prior activation of the
ContactFeature, by any existinguserwhose addressbookcontained the mobilephonenumberof the
new user (at a time when that individual was a non-user), will result in that existing user learning that
the new user has joined the Service by his/her automatic addition to the existing user’s contact list
within the app on his/her phone. In these circumstances, it is clear that the impact will be unique to
each individual new user, given that each new user will have a different set of contacts. Thus, while
the processing does not envisage the identification of the non-user, it is designed to have a particular
and unique impact on each individual non-user, in the event that his/her non-user status changes in
the future. In this way, it is arguable that, notwithstanding the lack of identification, the individual
concerned has been ‘singled out’ (or will be singled out subsequently, i.e. upon becoming a user), as
regards his/her treatment, pursuant to the processing.
93. I further note that, in having developed the Contact Feature as part of its product, WhatsApp has
sought to ensure maximumconvenience for its users. Ineffect, WhatsApp has chosen to develop the
Contact Feature as part of its product and has done so on the basis that it will inevitably result in the
processing of non-user data. While I accept WhatsApp’s submissions that the Contact Feature
benefits users, I do not accept that WhatsApp does not also derive a benefit; by ensuring maximum
convenience for its users, WhatsApp ensures that its Service is attractive to potential new users who
have a range of options to choose from, in terms of rival messaging services, thus harnessing the
potential for ever greater numbers of new users signing up to the Service. Inevitably the more
attractive / convenient a service is, the more users it will attract and, the more users a service has,
the greater its commercial value to its owner. The processing of personal data involves risk for the
data subjects concerned, hence the reason why the GDPR allocates significant responsibilities to
32 entities that process personal data. WhatsApp should not expect to be able to avoid those
responsibilities, regardless of the limited scope of any such processing, particularly where it derives a
benefit (direct or otherwise) therefrom.
The submission that, based on how WhatsApp’s systems currently operate, it is not technically feasible for
it to extract unhashed non-user numbers from the hashing process during the transient period it processes
them. WhatsApp has further submitted, in this regard, that it would need to design and implement code
changes in order to even access such non-user numbers
94. While I acknowledge WhatsApp’s position that it has no desire to identify the non-users concerned,
it is clear (from the analysis outlined above) that there are means available by which those non-users
might be identified, both by WhatsApp and by third parties,. If it were the case that the absence of
an intention to identify a data subject meant that the information in question could not constitute
“personal data”, then this would seriously undermine the breach reporting obligation in cases
involving pseudonymised or incompletely-anonymised data. I further note, in this regard, that
WhatsApp has the power to design and control the functionality of its own systems; while it has
decided that it does not currently wish to identify non-users, there is nothing to prevent WhatsApp
fromchangingits position on this. Further, ithasthe power todevelop any requiredcode and amend
its terms and conditions of service to accommodate such a change of position. I am unable to
attribute significant weight to these submissions in circumstances where circumventing any existing
impediment to the identification of non-users is within the control of WhatsApp itself.
The submission that the Preliminary Draft does not take adequate account of the unique circumstances of
the Breyer case
95. Insofar as I have referenced the Breyer case in the context of the pre-lossy hashing analysis, I do not
agree that I am required to consider and put forward the specific circumstances in which WhatsApp
might need or wish to refer a matter to An Garda Síochána for investigation. It is clear that An Garda
Síochána is the competent Irish authority, as regards the investigation of criminal matters. It has a
broadremit,inthisregard. IntheeventthatWhatsAppwishedtoreportamatterofacriminalnature,
including any possible incident of cybercrime, An Garda Síochána is the body to which such a report
would bemade. Aspartof any suchreporting, AnGardaSíochána wouldrequireWhatsApptofurnish
all relevant information, including, where available, any associated mobile phone numbers. I further
note, in this regard, that, while Recital 26 requires me to assess all of the “means reasonably likely to
be used” to identify an individual, I am not required to assess the likelihood of whether or not the
controller or a third party might want or need to avail of those means; once I am satisfied that there
aremeansavailablethatarereasonablylikelytobeused in theeventthatthe controller or thirdparty
forms the intention to identify the individual concerned, that is the end of the matter. Support for
this approach is to be found in the Breyer judgment where it is notable that the CJEU did not carry
out any assessment of the likelihood of an event occurring, pursuant to which the controller might
have grounds to support the making of contact with the competent authority such that the latter
could take the steps necessary to obtain the additional information required to identify the data
subject concerned from a third entity. I note that, in any event, my proposed finding does not
substantially rely on the Breyer judgment, but, rather, the potential for identification inherent in the
nature of a mobile phone number, as assessed by reference to Article 4(1) and Recital 26.
The submission that the proposed finding is not consistent with Recital 30 or the judgments of the CJEU in
Lindqvist, Scarlet Extended or Nowak
3396. I note that Recital 30 refers to the possibility that natural persons may be “associated with” online
identifiers provided by their devices, such as IP addresses, and that “(t)his may leave traces which …
may be used to create profiles of the natural persons and identify them”. Recital 30 simply highlights
the possibility that this type of association can lead to the identification of an individual because
“traces” of the activities that have taken place through the operation of such online identifiers have
enabled a profile to be created of the individual concerned such that he/she might be individually
identified. Recital 30 does not operate to preclude the possibility that certain information, such as
an IP address, might have the inherent possibility of identifying an individual. In any event, the
information at issue is not an online identifier but a mobile phone number, which operates in an
entirely different manner, in terms of providing a conduit to the individual concerned.
97. Further, while I accept that the circumstances of Lindqvist, Scarlet Extended and Nowak were such
that the controller possessed both the information in issue as well as further identifying information,
this does not preclude the possibility that certain information – such as a mobile phone number –
might, in and of itself, enable the identification of an individual. I note, for example, that the CJEU’s
conclusion, in Lindqvist, was that “the act of referring, on an internet page, to various persons and
identifying them by name or by other means, for instance by giving their telephone number or
information regarding their working conditions and hobbies, constitutes ‘the processing of personal
data wholly or partly by automatic means’ within the meaning of Article 3(1) of [the Directive]”.
[emphasis added]. This, in my view, leaves room for the possibility that an individual might be
identified by way of a telephone number, even where – as here – this is the sole or main identifying
factor. This is consistent with the Article 29 Working Party’s Opinion 4/2007.
The submission that the proposed finding is not consistent with the principle of proportionality
98. WhatsApp has submitted, inthis regard, that the momentary processing is undertaken “solely for the
purpose of enabling a hashing process that conclusively prevents any subsequent identification of the
originalmobilephonenumber(stilllesstheownerofthenumber) ”. WhatsApphasfurthersubmitted
that the transient processing does not have any meaningful privacy consequences for non-users. I
note, in this regard, that the Article 29 Working Party considered proportionality in Section II of
Opinion 4/2007, when it remarked that the Directive “contains a broad notion of personal data”. It
further observed that, while the “scope of the data protection rules should not be overstretched”,
“unduly restricting the interpretation of the concept of personal data should be avoided”. Reflecting
on the position further, the Article 29 Working Party suggested that the legislator had provided an
indication as to how it wished the scope of the Directive to be applied, by way of the in-built
exemptions, such as the previous exemption that applied where information was not part of a
relevant filing system and the Recital 26 qualifier, that required the existence of a “means reasonably
likely to be used … to identify the natural person”.
99. The Article 29 Working Party observed that “(i)t is a better option not to unduly restrict the
interpretation of the definition of personal data but rather to note that there is considerable flexibility
in the application of the rules to the data … In fact, the text of the Directive invites to the development
of a policy that combines a wide interpretation of the notion of personal data and an appropriate
balance in the application of the Directive’s rules.” It is, therefore, clear that I should not seek to
restrict the interpretation of “personal data” but, rather, to consider proportionality in the context of
the application of the rules set out in the GDPR to those data. This is the approach that I have taken
44The Preliminary Draft Submissions, paragraph 3.6
34 to the within assessment; I will consider the extent of the obligations arising pursuant to Articles 12
and 14 separately, below.
100. For the sake of completeness, I do not agree with WhatsApp’s assertion that the processing which
leads to the generation of the Lossy Hash does not have any meaningful privacy consequences for
non-users. The right to exercise control over one’s personal data is a key tenet of the GDPR. An
individualmighthave made the deliberate choice nottobecome a user of the Servicebecause he/she
does not want WhatsApp, or any of its processors, to process his/her personal data. The Contact
Feature completely disregards the non-user’s right to exercise control over his/her personal data and
instead places the responsibility on each individual user to either not use the Contact Feature or, in
the alternative, to remove his/her non-user contacts from his/her address book. As such, WhatsApp
has deliberately designed its system to this end.
101. Further, I do not think it reasonable to expect a user to remove a friend or contact from his/her
address book – which is likely to also contain information that enables the user to communicate with
his/her contacts through means other than the Service – in order to ensure that the personal data of
a non-user contact is not processed by WhatsApp as a result of the activation of the Contact Feature.
It is unclear, in any event, how an individual user might be expected to know which, of his/her
contacts, are usersof the Service and which are not. I note, inthis regard, that WhatsApp hasalready
45
acknowledged that an individual user will not be able to make this identification . Lest it be
suggestedthatnon-usersmightinformtheircontactsoftheirstatusasanon-user,itisequallyunclear
how a non-user might be expected to know which, of the individuals that have his/her mobile phone
number stored in their address book, are users of the Service.
102. Further, the fact that the Service currently operates in this manner – whereby the onus is on the
individual user to either remove a contact from his/her address book or, in the alternative, avoid
activating the Contact Feature – is likely to give rise to concern, on the part of non-users conscious of
these issues, arising from the possibility that certain of their friends / contacts might have activated
the Contact Feature, thereby enabling the processing of their personal data by WhatsApp.
103. Finally, and alsoof significance, asregardsthe purportedtransientor limited nature of the processing
concerned, I note that, during the time that WhatsApp processes the information (up to the point of
lossy hashing), it is subjected to the following operations:
a. It is firstly accessed by WhatsApp;
b. It is then transferred to WhatsApp’s servers;
c. The non-user number is then subjected to a lossy hashing process, following which;
d. It is irretrievably deleted.
104. I note, in this regard, that Article 4(2) of the GDPR defines “processing” as meaning “any operation or
set of operations which is performed on personal data or on sets of personal data, whether or not by
automated means, such as collection, recording, organisation, structuring, storage, adaptation or
45The Inquiry Submissions, paragraph 4.7
35 alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or destruction” [emphasis added].
It is, therefore, clear that each of the four operations identified above are individually captured by
the definition of “processing” set out in Article 4(2). I further note that the term “processing”, as
defined, is not subject to any temporal limits such that an operation that is performed on personal
data for a very short period of time might be excluded from the definition set out in Article 4(2).
Accordingly, I am satisfied that the operations performed on the information, by WhatsApp,
constitute “processing”, notwithstanding the short duration of the period of processing.
Finding: Does the phone number of a non-user, before the application of the lossy hashing process,
constitute the personal data of that non-user?
105. Having taken account of WhatsApp’s position, as communicated by way of the various submissions
furnished duringthe courseof the within inquiry, Ifindthat themobile phonenumber of anon-user,
before the application of the lossy hashing process, constitutes the personal data of that non-user.
As set out above, I have reached this conclusion on the basis that an individual is “identifiable” from
his/her mobile phone number. This is so notwithstanding the limited and transient nature of the
processing, in light of the ultimate consequence, for the non-user concerned, that flows from the
processing. As observed above, the unique and individual impact of the processing upon each
individualnon-user crystallises atthe pointintimewhenthatnon-user becomes a user of theService.
At that point in time, any existing user who has previously activated the Contact Feature on their
device and whose addressbook contained the mobile phone number of the new user(ata time when
that individual was a non-user), will learn that the new user has joined the Service by his/her
automatic addition to the existing user’s contact list within the app on his/her phone.
Analysis and Discussion: Does the phone number of a non-user, after the application of the lossy
hashing process, constitute the personal data of that non-user?
106. Turning, then, to the status of a non-user’s mobile phone number after the application of the lossy
hashing process, I proposed a finding, in the Preliminary Draft, that this information also constituted
the personal data of the non-user concerned.
107. WhatsApp, by way of the Preliminary Draft Submissions, provided new information, for the first time
inthe inquiry,whichwasdescribedas “moretechnicaldetail ” astothemanner inwhichtheContact
Feature operates. I note, in particular, that WhatsApp uses a Notification Hash, and not the Lossy
Hash, at the notification stage in order to match up new users with existing users. I considered this
new information to have been highly significant in the context of my assessment of this aspect of
matters because it indicated that the lossy hashing process is not, in fact, the way in which WhatsApp
achieves connectivity between new and existing users; rather, it operates merely as a filtering system
to help reduce the number of devices to which WhatsApp will need to issue a Notification Hash when
a new user joins the Service. In other words, the objective of the Contact Feature (i.e. connectivity
between users) is achieved by the use of the Notification Hash, and not, as it previously appeared, by
way of the Lossy Hash and Non-User List. I note that the Notification Hash is generated from the new
user’smobilenumberonlyafterthenewuserhasjoinedtheService. Inthecircumstances,Iproposed
a finding, in the Composite Draft, that the phone number of a non-user, after the application of the
lossy hashing process, does not constitute the personal data of that non-user. This is because the
46
The Preliminary Draft Submissions, paragraph 3.2
36 a. WhatsApp’s Privacy Policy (as furnished during the course of the inquiry stage) includes
reference to the processing of non-user data in the section entitled “Information We Collect”,
as follows:
“Information You Provide
Your Account Information. … You provide us, all in accordance with applicable laws, the
phone numbers in your mobile address book on a regular basis, including those of both
the users of our Services and your other contacts. …
…
Your Connections. To help you organise how you communicate with others, we may help
you identify your contacts who also use WhatsApp …”
b. By way of an email to the Investigator dated 20 March 2019, WhatsApp clarified that EU users
are invited to share their contacts with WhatsApp when registering for the Service and that
“(t)hey also have the ability to turn sharing of contacts on or off at any time after registration
via their device settings”. A screen shot of the initial invitation was provided (“the Contact
Feature Pop-Up”) – that notification reads:
“WhatsApp” Would Like to Access Your Contacts
Upload your contacts to WhatsApp’s servers to help you quickly get in touch with your friends
and help us provide a better experience”
[Options provided]: “Don’t Allow” or “OK”
c. The information set out above appears to be the extent of the information that users are given
in relation to the processing of non-user data that will take place upon activation of the Contact
Feature.
Legal Analysis
113. To begin, it is useful to recall the definitions of “controller” and “processor”, as set out in Articles 4(7)
and 4(8) of the GDPR, as follows:
“’controller’ means the natural or legal person … which, alone or jointly with others, determines
the purposes and means of the processing of personal data …”
“’processor’ means a natural or legal person … which processes personal data on behalf of the
controller”
114. For the purpose of the within analysis, I will focus on the concept of controllership (in circumstances
where WhatsApp is either a controller, for the purpose of any processing of non-user data, or it is
not). I note, in this regard, that, while the definition of “controller” comprises a number of different
elements, the keyelementfor consideration isthe identification of where the decision-makingpower
lies, as between WhatsApp and an individual user. In other words: which party determines the
“purposes and means” of the processing?
Opinion 1/2010
41115. I note that the Article 29 Working Party considered the concepts of “controller” and “processor” in its
Opinion 1/2010 (“Opinion 1/2010”). (Although updated guidelines were published in September
2020, they post-dated the Preliminary Draft and Supplemental Draft such that they were not taken
into account for the purpose of the analysis of the issues arising in this Part 1. In the circumstances,
the Commission did not consider it appropriate to introduce reference to those updated guidelines
forthefirsttimeintheCompositeDraftand,accordingly,thoseupdatedguidelinesarenotreferenced
in this Decision). While Opinion 1/2010 considers these concepts by reference to the relevant
definitions set out in the Directive, I note that those definitions mirror those set out in Articles 4(7)
and 4(8) of the GDPR, above. As before, I am cognizant of the facts that (i) Opinion 1/2010 is non-
binding; and (ii) the Article 29 Working Party was replaced, pursuant to Article 68 of the GDPR, by the
European Data Protection Board on 25 May 2018. I consider, however, that the views expressed in
Opinion1/2010nonethelessprovideahelpfulanalysisofthefactorsthatshouldbetakenintoaccount
when considering whether a party is more properly classified as a “controller” or a “processor”.
116. Consideringthepurposeandsignificance of the conceptof controller, Opinion1/2010firstly observes
that, in effect, “all provisions setting conditions for lawful processing are essentially addressed to the
controller, even if this is not always clearly expressed.” The basis for this observation appears to be
the manner in which the rights of the data subject have been framed. Opinion 1/2010 notes, in this
regard, that these rights:
“… have been framed in such a way as to create obligations for the controller. The controller is
also central in the provisions on notification and prior checking … Finally, it should be no surprise
that the controller is also held liable, in principle, for any damage resulting from unlawful
processing … .
This means that the first and foremost role of the concept of controller is to determine who shall
be responsible for compliance with data protection rules, and how data subjects can exercise the
rights in practice. In order words: to allocate responsibility.
This goes to the heart of the Directive, its first objective being “to protect individuals with regard
to the processing of personal data”. That objective can only be realised and made effective in
practice, if those who are responsible for data processing can be sufficiently stimulated by legal
and other means to take all the measures that are necessary to ensure that this protection is
delivered in practice. This is confirmed in Article 17(1) of the Directive, according to which the
controller“mustimplementappropriatetechnicalandorganisationalmeasurestoprotectpersonal
data against accidental or unlawful destruction or accidental loss, alteration, unauthorized
disclosure or access, in particular where the processing involves the transmission of data over a
network, and against all other unlawful forms of processing.”
117. Opinion 1/2010 further notes that:
“…thecrucialchallengeisthustoprovidesufficientclaritytoallowandensureeffectiveapplication
andcomplianceinpractice. Incaseofdoubt,thesolutionthatismostlikelytopromotesucheffects
may well be the preferred option.”
71Article 29 Working Party, Opinion 1/2010 on the concepts of “controller” and “processor”, adopted 16 February 2010
(00264/10/EN WP 169) (“Opinion 1/2010”)
72Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 1.0, adopted 2 September 2020
(for public consultation)
42118. Considering the factorsthatmight be used to identify where the decision-making power lies, interms
of the determination of the“purposes andmeansof theprocessing of personaldata”,Opinion 1/2010
suggests that:
“one should look at the specific processing operations in question and understand who determines
them, by replying in a first stage to the questions “why is this processing taking place? Who
initiated it?”
Being a controller is primarily the consequence of the factual circumstance than an entity has
chosen to process personal data for its own purposes.”
119. Opinion 1/2010 further referenced “(t)he need for a typology”, in this regard, observing that:
“The concept of controller is a functional concept, intended to allocate responsibilities where the
factual influenceis,andthusbased onafactualrather than aformalanalysis.…However, theneed
to ensure effectiveness requires that a pragmatic approach is taken with a view to ensure
predictability with regard to control. …
This calls for an interpretation of the Directive ensuring that the “determining body” can be
easily and clearly identified in most situations, by reference to those – legal and/or factual –
circumstances from which factual influence normally can be inferred, unless other elements
indicate the contrary.” [emphasis added]
120. Analysing what it means to determine “the purposes and means of processing”, Opinion 1/2010
observes that this “represents the substantive part of the test: what a party should determine in order
to qualify as controller”. Opinion 1/2010 considers, in this regard, that:
“Determination of the “means” therefore includes both technical and organisational questions
where the decision can be well delegated to processors (as e.g. “which hardware or software shall
be used?”) and essential elements which are traditionally and inherently reserved to the
determination of the controller, such as “which data shall be processed?”, “for how long shall they
be processed?”, “who shall have access to them?”, and so on.
Againstthisbackground,whiledeterminingthepurposeoftheprocessingwouldinanycasetrigger
the qualification as controller, determining the means would imply control only when the
determination concerns the essential elements of the means.
In this perspective, it is well possible that the technical and organisational means are determined
exclusively by the data processor.”
121. Opinion 1/2010 concludes that:
“Determination of the “purpose” of processing is reserved to the “controller”. Whoever makes this
decision is therefore (de facto) controller. The determination of the “means” of processing can be
delegated by the controller, as far as technical or organisational questions are concerned.
Substantial questions which are essential to the core of lawfulness of processing are reserved to
the controller. A person or entity who decides e.g. on how long data shall be stored or who shall
have access to the data processed is acting as a ‘controller’ concerning this part of the use of data,
and therefore has to comply with all controller’s obligations.”
122. Summarising the above, it was the view of the Article 29 Working Party that:
43 a. The primary role of the concept of controller is to allocate responsibility. Responsibility, in this
regard, means responsibility in the context of the protection of individuals with regard to the
processing of personal data. In case of doubt, the solution that is most likely to promote such
effects may well be the preferred option.
b. Being a controller is primarily the consequence of the factual circumstance that an entity has
chosen to process personal data for its own purposes.
c. When considering where the decision-making power lies, it is necessary to assess the specific
processing operations and understand who determines them by firstly asking “why is this
processing taking place? Who initiated it? Being a controller is primarily the consequence of
the factual circumstance that an entity has chosen to process personal data for its own
purposes.”
d. The conceptofcontroller isafunctional concept, intended toallocate responsibilitieswhere the
factual influence is, and thus based on a factual rather than a formal analysis. Determination of
the purpose of the processing is reserved to the controller.
e. Determination of the “means” includes both technical and organisational questions where the
decision can be delegated to the processor (e.g. “which hardware or software shall be used?”).
Essential elements are traditionally and inherently reserved to the controller include
determination as to “which data shall be processed?”, “for how long shall they be processed?”,
“who shall have access to them”, etc.
f. When considering the position, the need for a “typology” is important so as to ensure that the
“determining body” can be easily and clearly identified in most situations by reference to
circumstances from which factual influence can normally be inferred (unless other elements
indicate to the contrary).
Relevant Caselaw
123. Noting the above, I now turn to two CJEU judgments in which the Court considered the allocation of
responsibility in the context of relationships that comprised a natural person working in conjunction
with a larger entity.
124. Turning, firstly, to the Facebook Fan Pages Case , the Court considered the processing of data in the
context of a fan page that was hosted by Facebook but administered by a natural person. In that
case, the Court noted the significance of the following factual realities;
a. Facebook placed cookies on the computer/device of persons visiting the fan page. This was the
case regardless of whether or not the visitor was a Facebook account holder. These cookies, if
not deleted, remained active for two years. In these circumstances, the Court considered that
Facebook must be regarded as primarily determining the purposes and means of processing, in
relation to the personal data of visitors to the fan page.
73Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH (Case
C-210/16, judgment delivered on 5 June 2018) (“the Facebook Fan Pages Case”)
44 b. The Court further noted, however, that administrator of the fan page could obtain anonymous
statistical information on visitors to the page via a function called “Facebook Insights”.
Facebook offered this function to the administrator, free of charge, pursuant to non-negotiable
conditions of use. This function allowed the administrator to request such statistical
information with the help of filters made available by Facebook. These filters enabled the
administrator to define the criteria in accordance with which statistics would be collated by
Facebook, including the ability to designate the categories of persons whose personal data
would be processed, in this regard.
125. The Court noted that the objective of the controllership provision is to:
“ensure,throughabroaddefinitionoftheconceptof‘controller’,effectiveandcompleteprotection
of the persons concerned”. It noted that this concept “does not necessarily refer to a single entity
andmayconcernseveralactorstakingpartinthatprocessing,witheachofthemthenbeingsubject
to the applicable data protection provisions.”
126. The Court observed that:
“WhilethemerefactofmakinguseofasocialnetworksuchasFacebookdoesnotmakeaFacebook
user a controller jointly responsible for the processing of personal data by that network, it must be
stated, on the other hand, that the administrator of a fan page hosted on Facebook, by creating
such a page, gives Facebook the opportunity to place cookies on the computer or other device of a
person visiting its fan page, whether or not that person has a Facebook account.”
127. The Court concluded that the fact that the administrator could, by way of the filters made available
by Facebook, define the criteria in accordance with which the statistics are to be drawn up and even
designate the categories of persons whose personal data is to be made use of by Facebook, for this
purpose, meant that the administrator of a fan page hosted on Facebook contributes to the
processing of the personal data of visitors to its page.
128. The Court further noted that, while the audience statistics compiled by Facebook were transmitted
to the fan page administrator in anonymised form, it remained the case that:
“the production of those statistics is based on the prior collection, by means of cookies installed by
Facebook on the computers or other devices of visitors to that page, and the processing of the
personal data of those visitors for such statistical purposes. The Court noted that “(i)n any event,
[the Directive] does not, where several operators are jointly responsible for the same processing,
require each of them to have access to the personal data concerned.”
129. The Court concluded that:
“In those circumstances, the administrator of a fan page hosted on Facebook … must be regarded
as taking part, by its definition of parameters depending in particular on its target audience and
the objectives of managing and promoting its activities, in the determination of the purposes and
means of processing the personal data of the visitors to its fan page. The administrator must
therefore be categorised, in the present case, as a controller responsible for that processing within
the European Union, jointly with Facebook Ireland.”
130. The Court added, however, that:
45 “the existence of joint responsibility does not necessarily imply equal responsibility of the various
operators involved in the processing of personal data. On the contrary, those operators may be
involved at different stages of that processing of personal data and to different degrees, so that
the level of responsibility of each of them must be assessed with regard to all the relevant
circumstances of the particular case.”
131. Turning to the second case, the CJEU, in the Jehovah’s Witnesses Case , had to determine the
respective responsibilities of various parties in the context of personal data collected during the
course of door-to-door preaching carried out by individual members of the Jehovah’s Witness
Community. In effect, the question for determination was whether “a religious community may be
regarded as a controller, jointly with its members who engage in preaching, with regard to the
processing of personal data carried out by the latter in the context of door-to-door preaching
organised, coordinated and encouraged by that community …”.
132. The Court had regard to the following factual background:
a. The Jehovah’s Witnesses Community organises, coordinates and encourages door-to-door
preaching and, by way of its publications, has given guidelines on the collection of data in the
course of that activity.
b. The relevant supervisory authority previously found that the Jehovah’s Witnesses Community
had effective control over the means of data processing and the power to prohibit or limit that
processing, and that it previously defined the purpose and means of data collection by giving
guidelines on collection.
133. As before, the Court noted that the purpose of the concept of controllership is to:
“ensure,throughabroaddefinitionoftheconceptof‘controller’,effectiveandcomplete protection
of the persons concerned, the existence of joint responsibility does not necessarily imply equal
responsibilityofthevariousoperatorsengagedintheprocessingofpersonaldata. Onthecontrary,
those operators may be involved at different stages of that processing of personal data and to
different degrees, so that the level of responsibility of each of them must be assessed with regard
to all the relevant circumstances of the relevant case.”
134. The Court further observed that:
“a natural or legal person who exerts influence over the processing of personal data, for his own
purposes, and who participates, as a result, in the determination of the purposes and means of
that processing, may be regarded as a controller …”
135. Considering the position, the Court observed that:
a. Individual members who engaged in preaching determined the specific circumstances in which
they collected personal data concerning any persons visited, which specific data are collected,
to that end, and how those data are subsequently processed;
74Tietosuojavaltuutettu v Jehovan todistajat – uskonnollinen yhdyskunta (Case C-25/17, judgement delivered on 10 July
2018) (“the Jehovah’s Witnesses Case”)
46 b. The preaching activity itself, however, was organised, coordinated and encouraged by the
Jehovah’s Witnesses Community. In that context, the data in question were collected as a
memory aid for later use and for a possible subsequent visit. The collection of personal data in
this context was encouraged by the Jehovah’s Witnesses Community.
c. The congregations of the Jehovah’s Witnesses Community kept lists of persons who no longer
wished to receive a visit. Those lists were compiled from the data that were transmitted to the
congregations by individual members who engage in preaching.
136. The Court noted that, in the circumstances outlined above, the collection of personal data by
individual members who engaged in preaching helped to achieve the objective of the Jehovah’s
Witnesses Community itself. Accordingly, it appeared to the Court that the Jehovah’s Witnesses
Community, by organising, coordinating and encouraging the preaching activities of its members
intended to spread its faith, participated, jointly with its members who engage in preaching, in
determining the purposes and means of processing of personal data of the persons contacted.
The Test to be Applied
137. The issue for determination is whether or not WhatsApp is a controller or a processor (acting on
behalf of an individual user) when it processes the personal data of non-users pursuant to the
activation of the Contact Feature.
138. I note the significance of the concept of controllership and the obligations that flow from that
classification. I also note that the role of the concept of controllership is, first and foremost, to
determineandallocateresponsibilityforcompliancewithdataprotectionrules,includingtheexercise
of rights by data subjects.
139. Allied with this is the need to ensure effectiveness, i.e. that any assessment of where the decision-
making capacity lies should take account of predictability, with regard to control, as well as an
outcome that ensures the effective protection of individuals’ data protection rights. The outcome of
the assessment should ensure “effective and complete protection” of data subjects. I note, in
particular, that the CJEU has emphasised the connection between such comprehensive protection of
data subjects and the correlative need to adopt a broad definition of the concept of controllership.
140. I agree that the status of controller is primarily a consequence of the factual circumstance that an
entity has chosen to process personal data for his/her/its own purposes. I further note the
importance of “the need for a typology”, i.e. the importance of ensuring that the “determining body”
can be easily and clearly identified inmost situations by reference to those circumstances fromwhich
factual influence normally can be inferred, unless other elements indicate the contrary.
141. In terms of assessing where the decision-making ability lies in a multi-partite relationship, I note that
the determination of the “purpose” of the processing is something that is solely reserved to the
controller. The Article 29 Working Party noted that “(w)hoever makes this decision is therefore (de
facto) controller”. Similarly, questions which are essential to the core of lawfulness of processing are
reserved to the controller. Such questions concern matters such as “which data shallbe processed?”,
“for how long shall they be stored?” and “who shall have access to them?”.
47142. In relation to the determination of the “means” of processing, this aspect of matters includes
questions that can be delegated to processors, such as decisions concerning technical and
organisational issues (e.g. “which hardware or software shall be used?”). In this way, only decisions
thatconcern theessential elementsofthe meansofprocessingsignify therequired degree ofcontrol.
143. I further note, in the context of situations where the decision-making ability is shared between two
different controllers, that the existence of joint responsibility does not necessarily imply equal
responsibility of the various operators involved. The CJEU has found that: “(o)n the contrary, those
operators may be involved at different stages of that process of personal data and to different
degrees, so that the level of responsibility of each of them must be assessed with regard to all the
relevant circumstances of the relevant case”.
144. I finally note that the classification of controller is not limited to corporate entities and that, as
confirmed by the CJEU in the Jehovah’s Witnesses Case, a natural person who “exerts influence over
the processing of personal data, for his own purposes, and who participates, as a result, in the
determination of the purposes and means of that processing, may be regarded as a controller”.
145. Adopting the type of assessment recommended by the Article 29 Working Party in Opinion 1/2010
(as reflected by the CJEU in the Facebook Fan Pages and Jehovah’s Witnesses Case), I note that the
factual reality of the processing of non-user data in connection with the Contact Feature appears to
be as follows:
a. What is the processing under assessment (by reference to any operations carried out on non-
user personal data)?
The processing comprises five separate data processing operations: (i) the accessing, by
WhatsApp, of the mobile phone numbers contained in an individual user’s address book on a
regular basis ; (ii) the transfer of those numbers to WhatsApp’s servers ; (iii) the generation
77
of irreversible hashes of thenon-user numbersoncetheyreachthese servers ; (iv) thedeletion
of the underlying phone numbers ; and (v) the retention of the Lossy Hash in the Non-User
List on WhatsApp’s servers, in conjunction with the details of the derivative user.
b. What is the purpose of the processing?
As established during the inquiry stage, non-user data is processed for two purposes:
I. It is firstly processed as WhatsApp tries to identify which, of the user’s contacts, are
already users of the Service (so as to update the user’s WhatsApp contacts with those
contacts that are also users of the Service) ; 80
75
76Per the “Information We Collect” Section of the Privacy Policy
The Preliminary Draft Submissions, paragraph 3.3
77Response to Investigator’s Questions (response to question 3a.) and the Preliminary Draft Submissions, paragraph 3.3
78The Preliminary Draft Submissions, paragraph 3.3
79This arises as a consequence of the Board’s determination of the lossy hashing objections, as detailed above, and as
recorded at paragraph 156 of the Article 65 Decision.
80Response to Investigator’s Questions (response to question 3a.)
48 II. It is secondly processed “in order to quickly and conveniently update [a user’s] contacts
list on the Service as and when any of those non-users join the Service.” 81
c. Who decides which (non-user) data will be processed?
In order to be in a position to decide which data will be processed, the user must possess a
certain level of knowledge about the purpose of the processing. The information provided to
the user, however, by way of the Contact Feature Pop-Up, does not contain any reference to
the purpose of the processing of non-user data, as identified above. I note, in fact, that the
Contact Feature Pop-Up does not clearly identify, to the user, that (i) non-user data will be
processed; and (ii) that it will be processed in the manner described at question a. above.
I further note that WhatsApp, in its Inquiry Submissions, explained that an opt-out (as had been
suggested by the Investigator inher DraftReport) wouldbe unworkable incircumstanceswhere
“users generally have no way of knowing which of their contacts currently use the WhatsApp
service prior to uploading their contacts, and so would have no way of knowing which friends’
82
contact information they were opting-out from sharing” . If users have no way of identifying
whichof their contactsare currentlyusersof the Service,itfollowsthatthey lack theknowledge
required to be able to make decisions as to which (non-user) data will be processed.
Accordingly,itseemscleartomethatWhatsAppdecideswhichnon-userdatawillbeprocessed.
In other words, it has designed its system so that all non-user data (insofar as the mobile phone
numberisconcerned)willbeprocessedwhereauserchoosestoallowWhatsAppaccesstotheir
address book contacts.
d. Who decides how long the data will be stored?
Asalreadynotedabove, theBoard hasdetermined thatthe LossyHash,when stored in theNon-
User List in conjunction with the details of the derivative user, constitutes personal data . I 83
note thatneither the PrivacyPolicy nor theContactFeature Pop-Up informtheuser(i)thatnon-
user data will be stored; and (ii) the period of time for which it will be stored. I cannot identify,
from the information furnished by WhatsApp during the inquiry stage, the length of time for
which the information is stored in the Non-User List on WhatsApp’s servers. That being the
case, it appears unlikely that a user would be able to identify this for himself/herself.
Accordingly, itagain seemsclear tome thatWhatsAppdecideshow longthe data will be stored.
e. Who decides who shall have access to the data?
The user decides to grant WhatsApp access to the data, while it is stored in the user’s address
book. As identified at question c. above, however, the information provided to the user, for the
purpose oftheirdecidingwhetheror nottograntaccesstotheir addressbook, doesnotidentify
that non-user data will be processed in the manner described at question a. That being the
81Response to Investigator’s Questions (response to question 3a.)
82The Inquiry Submissions, paragraph 4.7
83The Article 65 Decision, paragraph 156
49 case, it is, in my view, unlikely that the user is even aware that their address book data will be
transferred to WhatsApp’s servers.
In the circumstances, it seems to me that, once the user has granted WhatsApp access to the
address book on his/her device, the user has no ability to decide who has access to the data,
after it has been transferred to WhatsApp’s servers.
f. Who decides the means of processing?
As set out above, the user is not provided with sufficient information concerning the fact or
purpose of processing of non-user data to allow him/her to understand the nature of the
processing which WhatsApp will then undertake on that data. It follows that the user has no
ability to make any decision concerning the means of processing.
g. Can the user exert influence over the processing of personal data, for his/her own purposes,
and participate, as a result, in the determination of the purposes and means of that
processing?
As set out above, the user is not informed, at any point in proceedings, that non-user data will
be accessed and processed in the manner described above. In fact, the purpose of the
processing, as identified at question b. above, is never disclosed to the user. In these
circumstances, it is clear that the user does not have the ability to exert influence over the
processing, for his/her own purposes, and participate, as a result, in the determination of the
purposes and means of that processing. I do not consider that the fact that WhatsApp allows
users a choice as to whether to grant access to their address book negatives the consequences
I have identified here.
h. Can WhatsAppexert influence over theprocessing of personal data, forits own purposes, and
participate, as a result, in the determination of the purposes and means of that processing?
It seems to me, from the above analysis, that WhatsApp is the only party that is in a position to
exertinfluenceovertheprocessingofnon-userdata. WhileWhatsApphasasserted,throughout
the within inquiry, that the processing is for the benefit of the user, it is clear, as I have set out
earlier, that the processing of non-user data benefits WhatsApp. I note, in this regard, that the
ContactFeaturePop-Up advises the userthatthe purpose oftheContactFeature isto“help[the
user] quickly get in touch with [his/her] friends” and “help [WhatsApp] provide a better
experience”.
ThePrivacyPolicyexplainsthat:“(t)ohelp[theuser]organisehow[he/she]communicate[s]with
others, [WhatsApp] may help [the user] identify [his/her] contacts who also use WhatsApp”. 84
On the basis of the above, it is clear that the processing of non-user data, as part of the Contact
Feature, benefits WhatsApp in that it helps WhatsApp to “provide a better experience”. It
therefore seems to me that WhatsApp is in a position to exert influence over the processing of
84Per the “Information We Collect” section of the Privacy Policy
50 personal data, for its own purposes, and participate, as a result, in the determination of the
purposes and means of that processing.
i. What is the “typology” here, i.e. what (legal and/or factual) circumstances are present from
which factual influence could normally be inferred? What other elements are present to
indicate the contrary?
I note that the Service is governed by terms of service that “contractually mandate that
WhatsApp is only for personal use” . I further note that the Service, in and of itself, along with
anyaccompanyingtermsofserviceanduserconditionality,wereproducedbyWhatsApp. Inote
that an individual user cannot use the Service to communicate with the world at large; an
individual user’s ability to communicate is limited to his/her WhatsApp contacts. I further note
that the Contact Feature has been designed by WhatsApp and that WhatsApp alone possesses
the relevant knowledge in relation to how the Contact Feature operates in the context of non-
user data. It is significant, in my view, that WhatsApp alone controls the information that is
given to a user about the Contract Feature, its objective and how it operates. In this way,
WhatsApp also controls the state of knowledge of the user, as regards the nature and manner
of operation of the Contact Feature.
I further note that WhatsApp does not appear to make any attempt to inform the user that it
regards the user to be the data controller, for the purpose of any processing operations carried
outonnon-userdata(andindeedfortheprocessingoperationscarriedoutonthepersonaldata
of other users that happen to be stored in the address book of the user’s device) pursuant to
activation of the Contact Feature.
Taking account of all of the factors outlined above, I am of the view that it would likely come as
a surprise to a great many users of the Service to learn that WhatsApp considers them to be the
data controller, for the purpose of non-user data processed as a result of activation of the
Contact Feature.
In the circumstances, the “typology” is one of a private individual who uses a commercial
messaging service, as a consumer, for purely personal communications. The individual’s ability
to communicate is limited to those other individuals that are users of the Service; the Service
does not enable the user to communicate with non-users or the world at large. That being the
case, the normal “typology”, from a data protection perspective, is one where the service
provider, being the party with the most significant decision-making power, is allocated the role
ofdatacontroller. Theredonotappeartobeanyelementspresent,inthecontextoftheService
under assessment, to indicate the contrary.
j. Are there any other factors that require consideration, in light of the need to ensure
effectiveness and the requirement for a pragmatic approach that ensure predictability with
regard to control?
ItseemstomethatthereisnorealitytoWhatsApp’sassertionthatitismerelyaprocessorwhen
processing non-user data. As set out above, an individual user has no way of knowing, firstly,
85The Inquiry Submissions, paragraph 4.17(A)
51 that WhatsApp processes the data of any non-users that might be contained in the individual’s
address book. Further, as admitted by WhatsApp, an individual is not able to identify which, of
his/her contacts, are usersof the Service, even if he/shewished to assume the role of controller
for the purpose of their personal data.
I further note that, even if WhatsApp’s assertions were correct, and the individual user is the
data controller of any non-user data, the relevant processing activities would likely fall outside
of the scope of the GDPR by virtue of Article 2(2)(c), which provides that “(t)his Regulation does
not apply to the processing of personal data … by a natural person in the course of a purely
personal or household activity”. Such a position would only serve to deprive a significant
number of data subjects of the “effective and complete protection” described by the Article 29
Working Party in Opinion 1/2010.
The position is exacerbated, in my view, by the fact that a non-user, even though he/she might
have actively chosen not to become a user of the Service, cannot avoid having his/her personal
data processed by WhatsApp as a result of the activation of the Contact Feature by a user who
happens to have the non-user’s contact details stored on his/her device. The non-user has no
say in matters whatsoever and the user, even if he/she were to be aware of the consequences
of activating the Contact Feature, is equally powerless in circumstances where he/she has no
way of knowing which of his/her contacts are users of the Service.
The fact that WhatsApp processes the personal data of non-users so as to be able to offer a
betterservicetousersdeniestherightofanon-usertodecidethathe/shedoesnotwishhis/her
personal data to be processed by WhatsApp and disregards entirely the possibility that those
non-users may never become users of the Service.
The Preliminary Draft and the Proposed Finding – Question (c)
146. Byreferenceto the aboveanalysis, I expressedtheview, in the Preliminary Draft, thatWhatsApp(and
WhatsApp alone) appears to have made all of the decisions in relation to the core aspects of the
processing of non-user data. Accordingly, I proposed a finding that, when processing non-user data,
WhatsApp does so as a data controller, and not a processor.
WhatsApp’s Response to the Proposed Finding – Question (c)
147. WhatsApp, by way of the Preliminary Draft Submissions, disagreed with my assessment and
submitted as follows:
a. Purposes of Processing: “The utility of the Service rests in substantial part on existing users
being in a position to communicate readily with their contacts, including from the point that
thesecontactsjoinWhatsAppasnewusers. Thepurposeofthisprocessingistoenableexisting
users to quickly and efficiently keep their WhatsApp contacts up-to-date with other WhatsApp
users who are in their device’s address book. Users are free to use the contact Feature for this
purpose or not. Users are also free to refuse permission for WhatsApp to access their mobile
phone address book or withdraw any permission given at any time. WhatsApp would not be
processing any such data for this purpose if it were not directed to by the user, and the user is
86The Preliminary Draft Submission, paragraph 4.2
52 the one who benefits. The purpose of the processing is limited to the provision of the contact
Feature and WhatsApp does not further process that data for any other purpose, in line with
the fact that it does not have authority from the user to carry out any additional processing.”
b. Which data will be processed: “We consider it would be self-evident to users that they would
grant WhatsApp permission to access their entire mobile phone address book – which by
definition cannot be divided in advance into a WhatsApp user and non-user list – when asked
to “Upload your contacts to WhatsApp’s servers” in order to use the Contact Feature.”
c. Access to the data: “Only WhatsApp (and its sub-processors) has access. Additionally, another
layer of hashing and encryption is applied before storing non-user lossy hashes on the
dedicated storage system and access to the storage system is restricted to WhatsApp’s
engineers and WhatsApp sub-processor personnel through access control rules.”
d. Means of processing: “… it is the user that determines the “how” of the processing. … the
functionality of the Contact Feature is such that the user determines which data will be
processed (their contacts), for how long (until the user decides to delete any contacts or to de-
activate the Contact Feature), and who shall have access (WhatsApp and its sub-processors).
WhatsApp only determines the technical means of the processing.”
e. Influence over the processing: “… it is the user that unilaterally determines if the processing
takes place by enabling (or disabling) the Contact Feature for the purpose of helping the user
“quickly get in touch with [their] friends”. WhatsApp makes no such determination. If a user
decides not to use the Contact Feature, withdraws permission for WhatsApp to access their
contacts … , or if they delete a non-user contact from their address book, the processing does
not happen.”
f. Typology: “… a determination of whether a person is acting as a controller or processor must
be assessed in the context of the specific processing at issue – rather than with the broad
approach advocated by the Commission. In the specific context of the processing through the
Contact Feature … it is the user, rather than WhatsApp who has the decision making power.
The userdeterminesthe purpose andmeansoftheprocessingofothers’ personaldata through
the Contact Feature. WhatsApp makes nosuch determinations and so cannot be allocated the
role of controller in respect of the processing carried out through the Contact Feature.”
g. WhatsApp is processing for the user: “By a user granting access to their contacts, WhatsApp
suggests that it would be reasonable for a user to understand and assume that this entails a
form of processing of all contacts (including non-users) by WhatsApp. While the Contact
Feature doesn’t allow the user to opt out certain contacts, the user still assumes the role of
controller by making the decision that it wants WhatsApp to keep their WhatsApp contacts list
up-to-date, and by determining the purposes and means of the processing …”
h. Household exemption: “… Recital 18 clearly envisages a scenario where a GDPR-regulated
processor can act on behalf of a person that is not subject to the GDPR without that processor
being deemed a controller. If the drafters of the GDPR had a concern about such a scenario
arising and the impact on data subjects it could have legislated to provide that processors
acting in such a capacity in those circumstances shall be treated as controllers – which it did
53 not. Furthermore, purely from a practical perspective, the [Preliminary Draft] does not
acknowledge that given the manner in which WhatsApp processes the data concerned (i.e.
unhashed non-user numbers and lossy hashes) it would be impossible in any event for it to
comply with any data subject requests, such as access and erasure. In light of this and
WhatsApp’s inability to identify and/or contact non-users, either when hashing their phone
numbers … it is unclear what additional protection a non-user would benefit from by finding
that WhatsApp is a controller.”
i. Non-users: “WhatsApp acknowledges that the operation of the Contact Feature is not
technically possible for WhatsApp without the processingof all the contacts ina user’s address
book. However, a non-user is free to ask users to delete their number as a contact as they
wouldbeinanycomparablecontext, such asstoringdetailsonphoneoronlinecommunication
orstoragefacilities. Itistheuserwhodecideswhosenumberstheystoreintheirdeviceaddress
book; itis the user who decides they wouldlike WhatsApp to keeptheir WhatsApp contacts list
updated and determines the purposes and essential elements of the means of the process
through the Contact Feature …”
Analysis and Discussion: When processing the personal data of non-users, does WhatsApp do so as
a data controller or a data processor?
148. I am not persuaded by the arguments raised by WhatsApp, as summarised above. I accept that the
purpose of the processing is as outlined by WhatsApp. I do not, however, accept that the user is the
sole beneficiary of the Contact Feature. WhatsApp has designed its product with maximum
connectivity in mind. The Contact Feature ensures that a new user is able to communicate with
contacts by way of the Service, immediately upon joining. Further, it ensures seamless growth of
users’ contact lists as more users sign up to use the Service. While this undoubtedly represents
convenience for individual users, it also benefits WhatsApp by ensuring that its Service is attractive
to potential new users who have a range of options to choose from, in terms of rival messaging
services.
149. Further, while I accept that it is the user that determines whether or not to activate the Contact
Feature, and that, once activated, the user is free to deactivate it at any time, this is not, in my view
sufficient to outweigh the basic fact that it is WhatsApp, and WhatsApp alone, that designed the
Contact Feature and controls its manner of operation. Further, WhatsApp, and WhatsApp alone, has
the power to decide that the Contact Feature should be modified or updated and, again, it is
WhatsApp alone that can implement any such changes by way of new code and/or amendments to
the terms and conditions of service. In effect, the user is offered the binary choice of either using the
ContactFeature or not; beyondthis, the user hasnoability todetermine any aspectofthe meansand
purposes of the processing. Additionally, and as noted in response to WhatsApp’s submission that
the purpose of the processing is not the identification of non-users, but rather to enable connectivity
between users, I note that the new user has no ability to exercise control over the inclusion of his/her
contact details in the WhatsApp contact list of any existing user who previously activated the Contact
Feature and whose address book contained the mobile phone number of the non-user (at a time
when that individual was a non-user). This occurs as a natural consequence of the Contact Feature,
which itself relies on the prior processing of the non-user’s number to create its effect.
150. I do not agree that it “would be self-evident to users” that, by activating the Contact Feature,
WhatsApp will access and transmit all the numbers that might be stored therein to its servers. As
54 already noted, the user is provided with minimal information concerning the consequences of
activating the Contact Feature. Further, it is unclear how the user might be expected to be in a
position to determine the means and purposes of the processing when he/she is not in a position to
know which of his/her contacts are already users of the Service such that he/she might understand
the different impacts of the processing on his/her user and non-user contacts.
151. While I acknowledge that access to the data concerned might be limited (to WhatsApp and its “sub-
processors”), the point is that the user has no ability to determine otherwise. Asregards WhatsApp’s
submissions under the heading “typology”, I do not agree with the suggestion that the above
assessment represents a “broad approach”, rather than an assessment “in the context of the specific
processingatissue”. Theassessmentoutlined above hasbeen carried outby reference tothe specific
processing operations, the specific features of the processing operations concerned and the specific
impacts of same on non-users.
152. I agree with WhatsApp’s submissions, as regards the interpretation of Recital 18 of the GDPR (the so-
called ‘household exemption’). It is appropriate, however, for me to note, as part of my overall
assessment, the practical impact, from the perspective of the data subject, of a position whereby
WhatsApp might be correct in its assertions that it is merely a processor for an existing user (who
could, if designated the data controller, be subject to the exemptions from the controller obligations,
as a result of the household exemption). Further, I do not agree with WhatsApp’s submission that
the manner inwhich it processes non-user data makes it impossible for it to comply with data subject
requests. The right to information, for example, is oneof the essential rights granted to data subjects
pursuant to the GDPR. Even if a data controller is not in a position to provide a data subject with
access to his/her data, it is still possible for that data controller to provide the data subject with the
information prescribed by Articles 15(1) and (2).
153. Finally, and as already remarked upon earlier in this Decision, I do not think it reasonable to expect a
user to remove a friend or contact from his/her address book in order to avoid the possibility of any
non-user contact data being processed by WhatsApp upon the activation of the Contact Feature. An
individualaddressbook islikely tocontain a variety of information concerningeachcontact, including
landline telephone numbers and email addresses. Removing a contact from an address book,
therefore, will inevitably result in significant inconvenience for both user and non-user concerned.
Further, it is, in my view, somewhat glib to suggest that a non-user is“free to ask users to delete their
number as a contact”. The non-user, firstly, has nopower to compel a user to honour such a request;
further, as already observed, the removal of a contact will likely result in the deletion of all of the
individual’s contact details, and not just his/her mobile phone number, which would inevitably result
in inconvenience to the user as regards communications with that individual. Further, it is unclear
how the non-user might be expected to know which, of all of the individuals that might have his/her
mobilephonenumberincludedintheiraddressbooks,areusersoftheServicesuchthathe/shemight
be expected to ask the user concerned to remove his/her details from their address book.
Finding: When processing the personal data of non-users, does WhatsApp do so as a data
controller or a data processor?
154. For the reasons set out above, I remain of the view that WhatsApp (and WhatsApp alone) appears to
have made all of the decisions in relation to the core aspects of the processing of non-user data.
Accordingly,I findthat,when processingnon-user data,WhatsAppdoessoas adatacontroller,and
not a processor.
55Consequent Assessment of Compliance with the Requirements of Article 14
155. Having found that WhatsApp processes personal data relating to non-users and that, when doing so,
itdoessoasacontroller,thefinalissueformetodetermineistheextenttowhichWhatsAppcomplies
with the obligations set out in Articles 14 and 12(1) of the GDPR.
156. In the absence of any suggestion to the contrary, I noted, in the Preliminary Draft, that it appeared
that WhatsApp has not provided any information to those non-users whose personal data has been
processed pursuant to the Contact Feature. Accordingly, I proposed a finding that WhatsApp has
failed to comply with its obligations to non-users pursuant to Article 14.
157. By way of the Preliminary Draft Submissions, WhatsApp submitted that “(a)ny obligation … to comply
with Article 14 GDPR has already been discharged in anyevent”. WhatsApp submitted, in this regard,
that:
“In addition to the arguments regarding proportionality noted above, given thatWhatsApp cannot
contact these individuals directly, WhatsApp trusts the Commission would accept that Article
14(5)(b) GDPR would apply and that making information publicly available would be sufficient. As
WhatsAppalreadymakesinformationpubliclyavailableontheverylimitedwayinwhichitengages
with non-user data it is not clear what further information the Commission considers WhatsApp
needs to provide in order to comply with Article 14(5)(b), should the Commission consider Article
14 GDPR to apply at all .”
Analysis and Discussion: Article 14 Exemptions and Non-Users
158. I note that Article 14 provides a limited range of exemptions to the obligation to provide information
88
to the data subject. These exemptions were considered in the Transparency Guidelines (which,
although prepared by the Article 29 Working Party, were subsequently adopted and endorsed on 25
May 2018 by the EuropeanData Protection Board). The Article 29 WorkingParty firstly expressed the
view that “(t)hese exceptions should, as a general rule, be interpreted and applied narrowly.” In
relation toArticle14(5)(b), the Article29 WorkingParty considered that thisallowsfor three separate
situations where the obligation to provide the information specified by Article 14 is lifted, as follows:
a. Where it proves impossible (in particular for archiving, scientific / historical research or
statistical purposes);
b. Where it would involve a disproportionate effort (in particular for archiving, scientific /
historical research or statistical purposes); or
c. Where providing the information required under Article 14(1) would make the achievement
of the objectives of the processing impossible or seriously impair them.
159. WhatsApp has not identified which of the three situations it considers applicable. Neither has it
furnished a sufficient explanation as to why it considers that situation to be applicable. The absence
of such clarification (and supporting rationale) does not, however, prevent me from being able to
87The Preliminary Draft Submissions, paragraph 5.1
88Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11 April
2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”) (see, in particular, paragraphs 57 – 65, inclusive)
56 reach a conclusion on this aspect of matters. This is because, even if the circumstances of the
processing are such that WhatsApp is entitled to rely on the Article 14(5)(b) exemption, WhatsApp
would still be required to “take appropriate measures to protect the data subject’s rights and
freedoms and legitimate interests, including making the information publicly available.” [emphasis
added]
89
160. By way of its Article 65 Submissions , WhatsApp asserts that I must conclusively determine whether
or not it is entitled to avail of the Article 14(5)(b) exemption in circumstances where such
determination “would impact on the reasoning and the legitimacy of the findings” in this Decision.
WhatsApp further submits that it would be “misplaced” for this Decision to find that it infringed the
information obligations in Article 14 without establishing whether the main exemption to Article 14
applies. I do not agree with this assertion and remain of the view that such a determination is
unnecessary in circumstances where WhatsApp has not made the prescribed information publicly
available, as required by Article 14(5)(b). In effect, the Article 14(5)(b) exemption does not result in
a situation whereby a data controller is free to ignore the obligations set out in Article 14; it merely
permits the controller, where it satisfies the conditionality of Article 14(5)(b), to make the prescribed
information publicly available, as opposed to providing it directly to the data subject concerned.
Accordingly, theabsence ofa conclusive determination on the applicability orotherwise of theArticle
14(5)(b)exemption does nothaveany,or any significant,impacton the outcome of the within inquiry
(given my conclusion, as set out in paragraph 165 below, that WhatsApp does not currently make the
required information publicly available).
161. I further note, in this regard, that WhatsApp does not consider that Article 14(5)(b) imposes an
“absolute obligation” to make the transparency information publicly available “in all cases, given the
provision requires that the controller shall take “appropriate measures” (with making the information
publicly available appearing as an example), and what is appropriate would fall to be assessed on the
facts of a given case .” To be absolutely clear about the position, the alternative condition, set out
in Article 14(5)(b), requiring the controller to make the prescribed information publicly available is
not optional or something to be assessed on a case by case basis; if a data controller is entitled to
avail of the Article 14(5)(b) exemption, then it must make the prescribed information publicly
available so that the data subjects concerned are nonetheless enabled to receive the Article 14
transparency information. This is clear not only from the text of Article 14(5)(b) but also from the
limited nature of the exemptions provided by Article 14, which support the default position that the
data subject must be provided with the prescribed information, save in very limited circumstances
(which do not include those described by Article 14(5)(b)).
162. Notwithstanding the above, WhatsApp considers that it has complied with this requirement by
making information publicly available “on the very limited way in which it engages with non-user
data”. It relies, in this regard, on the “public disclosure in the second paragraph of the Information
We Collect section of the Privacy Policy” that states:
89The Article 65 Submissions, paragraphs 50 - 52
90The Article 65 Submissions, paragraph 51.15
57 “You provide us, all in accordance with applicable laws, the phone numbers in your mobile address
book on a regular basis, including those of both the users of our Services and your other contacts.
(emphasis added) ”91
163. I firstly note that the above statement has been included in the Privacy Policy that is directed to users
of the Service. It is unclear why a non-user of the Service would have reason to seek out this
information by way of the Privacy Policy set out on WhatsApp’s website. I secondly note that the
information provided, by way of the above statement, is insufficient for the purpose of Article
14(5)(b). My view is that, in order to comply with the final sentence of Article 14(5)(b), the data
controllerconcernedmustmakepubliclyavailablealloftheinformationprescribedbyArticle14. This
is clear from the language of Article 14(5)(b) itself, which provides that:
“Paragraph 1 to 4 shall not apply where and insofar as … the provision of such information
proves impossible or … In such cases, the controller shall take appropriate measures …
including making the information publicly available” [emphasis added]
164. The statement relied upon by WhatsApp does not provide the non-user data subject with all of the
information that he/she is entitled to receive pursuant to Article 14. In particular, it does not inform
the non-user of the consequencesthatwill flow fromtheprocessing, inthe eventthathe/she decides
to sign up to become a user of the Service. This information is vitally important so as to enable the
non-user to make an informed choice, in the event that he/she might consider joining the Service.
The corresponding obligations arising in the context of Article 13 are assessed in Parts 2 and 3 of this
Decision and the assessments and views expressed in those sections will help WhatsApp to
understand what is required of it by Article 14, such that it might consider how to reformulate its
approach to the delivery of the prescribed information to non-user data subjects.
165. Accordingly, I remain of the view that WhatsApp has failed to comply with its obligations pursuant to
Article 14. As set out above, WhatsApp has failed to furnish the information required to enable me
to understand why it considers Article 14(5)(b) to apply. Accordingly, I make no finding as to whether
or not WhatsApp is entitled to rely on the Article 14(5)b) exemption (although I acknowledge, by
reference to the consequences of a finding that WhatsApp might not be so entitled – as considered
briefly below – that the circumstances of the processing are such that Article 14(5)(b) may well be
applicable). My view, in thisregard, is that, even if I wereto find that WhatsApp is notentitled to rely
on the Article 14(5)(b) exemption, it would not be appropriate, by reference to the manner in which
WhatsApp currently processes non-user data, to require it to provide the Article 14 information to
each non-user data subject individually. The practical impact of such an outcome would be a
requirement for WhatsApp to subject non-user data to further processing operations, solely for the
purpose of providing the information prescribed by Article 14 to each individual non-user data
subject. Such a consequence would not respect the purpose limitation principle set out in Article
5(1)(b) and would not, in my view, serve the interests of the data subjects concerned.
166. As already observed, the unique and individual impact of the processing upon each individual non-
user crystallises at the point in time when that non-user becomes a user of the Service. Accordingly,
it is particularly important that WhatsApp clearly informs the non-user, as part of the sign-up process
and prior to the conclusion of any contract between WhatsApp and the individual concerned, that (i)
if his/her mobile phone number has been included in the address book of any of WhatsApp’s existing
91The Preliminary Draft Submissions, footnote 51 (as referenced in paragraph 5.1)
58 users, and (ii) if any of those existing users activated the Contact Feature (“the Activating Users”),
WhatsAppwillhaveprocessedthatmobilephonenumberforthepurposeofquicklyandconveniently
updating those Activating Users’ contacts lists on the Service as and when any of their non-user
contacts join the Service; and that (iii) the practical consequence of this is that, if the individual joins
the Service, his/her contact details will automatically appear in the WhatsApp contact lists of the
Activating Users.
167. When considering its options, in terms of the formulation and delivery of the Article 14 information
to non-user data subjects by way of a public notice, WhatsApp should give careful consideration to
the location and placement of such a public notice so as to ensure that it is discovered and accessed
by as wide an audience of non-users as possible. As noted above, a non-user is unlikely to have a
reason to visit WhatsApp’s website of his/her own volition such that he/she might discover the
information which he/she is entitled to receive. Further, my view is that the non-user transparency
information must be presented separately (by way of a separate notice, or a separate section within
the existing Privacy Policy, or otherwise) to the user-facing transparency information so as to ensure
that it is as easy as possible for non-users to discover and access the information that relates
specifically to them. The information to be provided to non-users in compliance with Article 14
should, for the avoidance of doubt, detail the circumstances in which any non-user personal data is
shared with any of the Facebook Companies, regardless of whether any such company is acting as a
(joint) controller or a processor. In accordance with the direction of the Board , the information to
be provided should further inform non-users about the retention of Lossy Hash values, in the Non-
User List on WhatsApp’s servers, in conjunction with the details of the derivative user(s).
Proportionality
168. As already noted, WhatsApp has submitted that:
“the application ofthe proportionalityprinciple … leads tothe conclusionthatthe processingof the
unhashed mobile phone numbers by WhatsApp does not amount to the processing of personal
data. The simple pointisthatthe acutelytransientnature of the processing, coupledwith the facts
that (a) the only data that is processed is the number and (b) the processing is undertaken merely
as a precursor to a hashing process resulting in the irreversible anonymization of the number and
designed to enable user-to-user connectivity (as opposed to the identification of non-users), leads
to a result whereby it would not be proportionate to treat the processing as amounting to the
processing of personal data. This is particularly the case given the lack of any meaningful privacy
consequences for non-users .”3
169. I noted my view, above, that I should not seek to restrict the interpretation of “personal data” but,
rather, to consider proportionality in the context of the application of the rules set out in the GDPR
to those data. I further note that I have already explained why I do not agree with WhatsApp’s
submission concerning the “lack of any meaningful privacy consequences for non-users.”
Accordingly, I must now consider the question of whether the above assessment, concerning the
application of the rules set out in Article 14 to the circumstances in which WhatsApp processes non-
user data, is consistent with the principle of proportionality.
92The Article 65 Decision, paragraph 268
93The Preliminary Draft Submissions, paragraph 3.11
59170. I firstly note, in this regard, that the principle of proportionality primarily operates to regulate the
exercise of powers by the European Union. Pursuant to this principle, the action of the EU and any
institutions / state organs within the EU, applying EU law, must be limited to what is necessary to
achieve the objectives of the Treaties. In other words, the content and form of the action must be in
keeping with the aim pursued. The European Commission reflected the principle in its proposal of
the new data protection framework (that would become the GDPR), as follows:
“The principle of proportionality requires that any intervention is targeted and does not go beyond
what is necessary to achieve the objectives. This principle has guided the preparation of this
proposal from the identification and evaluation of alternative policy options to the drafting of the
legislative proposal .”
171. Further, when interpreting and applying EU law, the European Commission must not rely on an
interpretation which would conflict with fundamental rights or with the other general principles of
EU law, such as the principle of proportionality. In this regard, it is important to remember that the
GDPR seeks to ensure the effective protection of the fundamental right to protection of one’s
personal data, as established by, and enshrined in, Article 8 of the Charter and Article 16 TFEU and
Article 8 of the ECHR. The GDPR seeks to achieve this objective by way of:
a. A set of core principles directed to ensuring that any processing of personal data is lawful, fair
and transparent inrelation to the data subject (andwhich are practically implemented by way
of specific duties and obligations directed primarily to the data controller);
b. Arobustrangeofrightsforthedatasubject,designedtoempowerthedatasubjecttoexercise
control over his/her personal data and to hold the data controller accountable for compliance
with the core principles; and
c. The empowerment of supervisory authorities with a range of functions and powers, designed
to enable those supervisory authorities to monitor and enforce compliance with the
requirements of the framework.
172. In effect, the GDPR envisages a more active role for the data subject than ever before, with
corresponding enhancements to the rights and entitlements that existed under the previous EU data
protection framework. The effectiveness of those enhanced rights and entitlements, however, is
entirely dependent on the data subject’s state of knowledge. This was recognised by the CJEU in
Bara , when the Court observed that:
“… the requirement to inform the data subjects about the processing of their personal data is all
the more important since it affects the exercise by the data subjects of their right of access to, and
right to rectify, the data being processed … and their rightto object to the processing of those data
…”
173. It is noteworthy, in this regard, that the GDPR addresses the right to be informed by way of two
separate provisions: Article 13, which governs the obligation to provide information in situations
94European Commission proposal (COM (2012) 11 final 2012/0011 (COD), published 25 January 2012
95Smaranda Bara and Others v Președintele Casei Naționale de Asigurări de Sănătate, Casa Naţională de Asigurări de
Sănătate, Agenţia Naţională de Administrare Fiscală (ANAF) (Case C-201/14, judgment delivered by the CJEU on 1 October
2015) (“Bara”)
60 where the information undergoing processing has been obtained directly from the data subject
concerned, and Article 14, which governs the obligation to provide information in situations where
the information undergoing processing has been obtained from a source other than the data subject.
The fact that the legislator dedicated two separate provisions to the requirement for data controllers
to provide information to data subjects is, in my view, very significant in that it indicates the
importance of the right to be informed, in the context of the GDPR as a whole.
174. It is further noteworthy that the right to receive information is incorporated into other of the data
subjectrights,suchastherightofaccesstopersonaldata. Insuchacase,Articles15(1)and(2)require
the data controller to provide certain information to the data subject, as part of its response to the
data subject concerned. It is therefore clear that the right to be informed is not only one of the core
data subject rights, it is the bedrock upon which the other rights sit. It is only when the data subject
has been provided with the information that he/she is entitled to receive, pursuant to Article 13/14,
that he/she can understand (i) which of his/her personal data are being processed, (ii) for what
processing operation(s), (iii) for what purpose(s), and (iv) in reliance on which legal basis. When the
data subject has been provided with all of this information, he/she is afforded a sufficient state of
knowledge such that he/she can meaningfully:
a. exercise choice as to whether or not he/she might wish to exercise any of his/her data subject
rights and, if so, which one(s);
b. assess whether or not he/she satisfies any conditionality associated with the entitlement to
exercise a particular right;
c. assess whether or not he/she is entitled to have a particular right enforced by the data
controller concerned; and
d. assess whether or not he/she has a ground of complaint such as to be able to meaningfully
assess whether or not he/she wishes to exercise his/her right to lodge a complaint with a
supervisory authority.
175. I acknowledge that, in the context of the particular manner of processing of non-user data by
WhatsApp, the rights that might be exercised by the non-user data subject concerned are limited.
They are not, however, non-existent. While, for example, the non-user will not be able to be granted
access to his/her personal data, WhatsApp could nonetheless provide him/her with the information
prescribed by Articles 15(1) and (2). Further, the non-user can exercise his/her right to lodge a
complaint with a supervisory authority. Further, there is a particular significance, of the right to
receive information, for those non-users who might be considering joining the Service. The
consequences of the processing, for that particular type of non-user arise when they enter into a
contract with WhatsApp and become a user of the Service. The significance, of the right to receive
information, in this particular context, is that it ensures that the non-user concerned is on notice of
the consequences of the processing such that he/she can factor it into his/her decision as to whether
or not he/she wishes to enter into a contract with WhatsApp to become a user. In this way, the
information ensures that the non-user can make an informed choice as to whether or not he/she
wishes to join the Service. It further ensures that the non-user is best positioned, if he/she decides
to become a user, to provide informed consent to the processing of his/her personal data pursuant
to any of the Service’s voluntary features (such as the possible personalization of his/her user profile
61 to include a photograph). When all of these consequences are considered, it is clear that the right to
receive information, even in the context of the limited processing envisaged by the Contact Feature,
is inextricably connected with the right to exercise control over one’s personal data.
176. Considering, then, the burden that the finding set out above might place on WhatsApp, I note that
the non-user data undergoing processing is very limited, as are the processing operations that are
applied to the data concerned. Accordingly, I do not consider that the preparation of the required
information will be particularly burdensome for WhatsApp. My view is that the role and utility of the
right to be informed, as considered above, outweighs the limited burden that would be placed on
WhatsApp, as regards the formulation of the required information. In relation to the burden that
would result from the requirement for WhatsApp to deliver that information to the data subjects
concerned, I note that WhatsApp could, if it wished, deliver the required information by way of its
existing policies and procedures. I note, in this regard, that WhatsApp could, as part of its existing
onboarding procedure through the app, inform any non-user, who is considering joining the Service,
of the consequences of the processing of non-user mobile phone numbers pursuant to the Contact
Feature. Further, I note that WhatsApp’s user-facing transparency information is already publicly
available and, in the circumstances, the inclusion of the corresponding information required for non-
usersshould notbe a particularly burdensome or oneroustask (and certainly notsoburdensome that
it would outweigh the data subjects’ right to receive this information).
Finding: The extent to which WhatsApp complies with its obligations to non-users pursuant to
Article 14 of the GDPR
177. Accordingly, for the reasons set out above, I find that WhatsApp has failed to comply with its
obligation to provide non-users with the information prescribed by Article 14. For the avoidance of
doubt, nothing in the above assessment should be interpreted as being an endorsement that the
processing of non-user data, by WhatsApp, is conducted in reliance upon an appropriate legal basis.
As already identified, the purpose of the within inquiry is to examine the extent to which WhatsApp
complies with its transparency obligations pursuant to the GDPR and, in the circumstances, the
assessment of the legal basis being relied upon to support any processing operation is outside of the
scope of this inquiry.
Part 2: Transparency in the Context of Users
Introduction
178. Under this heading, I will consider the extent to which WhatsApp complies with its obligations under
Articles 13 and 12(1) of the GDPR, in the context of its processing of personal data relating to users
of the Service. The issues that I will consider under this heading correspond to the matters covered
by Conclusions 3 – 13 (inclusive) of the Final Report.
Relevant Provisions
179. Article13oftheGDPRconcernstransparency wherethepersonaldatainquestion“arecollectedfrom
thedatasubject”. Insuchacase,Article13requiresthedatasubjecttobeprovidedwiththefollowing
information:
(a) the identity and the contact details of the controller and, where applicable, of the controller’s
representative;
62 (b) the contact details of the data protection officer, where applicable;
(c) the purposes of the processing for which the personal data are intended as well as the legal
basis for the processing;
(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by
the controller or by a third party;
(e) the recipients or categories of recipients of the personal data, if any;
(f) where applicable, the fact that the controller intends to transfer personal data to a third
country or international organisation and the existence or absence of an adequacy decision
by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second
subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the
means by which to obtain a copy of them or where they have been made available;
(g) the period forwhichthepersonal data willbestored,orifthatisnotpossible, thecriteriaused
to determine that period;
(h) the existence of the right to request from the controller access to and rectification or erasure
of personal data or restriction of processing concerning the data subject or to object to
processing as well as the right to data portability;
(i) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the
existence of the right to withdraw consent at any time, without affecting the lawfulness of
processing based on consent before its withdrawal;
(j) the right to lodge a complaint with a supervisory authority;
(k) whether the provision of personal data is a statutory or contractual requirement, or a
requirement necessary to enter into a contract, as well as whether the data subject is obliged
to provide the personal data and of the possible consequences of failure to provide such data;
(l) the existence of automated decision-making, including profiling, referred to in Article 22(1)
and (4) and, at least in those cases, meaningful information about the logic involved, as well
as the significance and the envisaged consequences of such processing for the data subject.
180. Article 12(1) complements this by requiring that:
“The controller shall take appropriate measures to provide any information referred to in Articles
13 and14 and anycommunication under Articles15 to 22 and 34 relating to processingto the data
subject in a concise, transparent, intelligible and easily accessible form, using clear and plain
language, in particular for any information addressed specifically to a child. … .”
181. Thus, while Article 13 addresses the information that must be communicated to the data subject,
Article 12 addresses the way in which this information must be communicated.
63Review of the Materials being relied upon by WhatsApp
182. In its Response to Investigator’s Questions, WhatsApp advised that it provides users with the
information prescribed by Article 13 of the GDPR “via its Privacy Policy … and related pages (which
are presented to users when they register to use the Service and are accessible at all times to users
thereafter).”
183. WhatsApp provided the Investigator with a copy of the privacy policy (the policy in question bearing
a “lastmodified” date of24April2018) (“the Privacy Policy”) and “related pages” byway of Appendix
2 to its Response to Investigator’s Questions. Appendix 2 was just over 16 pages in length (in the
format furnished) and the content is set out by reference to the following main headings:
a. WhatsApp Privacy Policy
b. Information We Collect
c. How We Use Information
d. Information You And We Share
e. How We Work With Other Facebook Companies
f. Assignment, Change Of Control, And Transfer
g. How The General Data Protection Regulation Applies To Our European Region Users
h. Managing And Deleting Your Information
i. Law And Protection
j. Our Global Operations
k. Updates To Our Policy
l. Contact Information
m. How We Process Your Information
n. WhatsApp Inc., The EU-US Privacy Shield And The Swiss-US Privacy Shield
o. Intellectual Property Policy: Your Copyrights And Trademarks
p. Cookies
184. For the sake of completeness, I note that WhatsApp expressly referenced a further document in its
Response to Investigator’s Questions. In response to Question 4, WhatsApp confirmed that it
“identifies the purposes of processing personal data and the legal bases for such processing in the
Privacy Policy and the ‘How We Process Your Information’ notice … ” [emphasis added]. WhatsApp
provided the Investigator with a copy of this (undated) notice (“the Legal Basis Notice”) by way of
Appendix 4 to its Response to Investigator’s Questions. This document, in the format furnished, was
4.5 pages in length.
Temporal Scope of this Assessment
185. For the avoidance of doubt, the assessments recorded in Parts 2 and 3 of this Decision reflect an
assessment of the material relied upon by WhatsApp, as available to the public at the date of
commencement of the within inquiry (10 December 2018). I have not had regard to any
amendments that might have been made to the material provided in the intervening time, save
insofar as those amendments have rendered it unnecessary for me to issue a previously proposed
direction to WhatsApp, as regards the remedial action required to address an identified issue that is
not directly the subject of any finding (of infringement or otherwise).
How the User accesses and interacts with the Materials provided
64186. Adoptingthe approach taken by the Investigator, I will firstly consider the contentsof Appendix 2 and
the Legal Basis Notice, both in the format furnished and in the online environment, so as to enable
me to consider them from the perspective of the user.
Location and Accessibility of the Privacy Policy and the Legal Basis Notice: App Users
187. App users can access the Privacy Policy via the in-app “settings” options. Within the “settings”
options, the Privacy Policy isclearly identified under the “Help” option. Within the “Help” option, the
Privacy Policy is again clearly identified under the “Terms and Privacy Policy” option. Once selected,
this brings the user to the “WhatsApp Legal Info” page on WhatsApp’s website . 96
188. The ”WhatsApp Legal Info” page provides app users with the following shortcut options:
a. Key Updates [the linked notice is undated]
b. Terms of Service [the linked document is identified as “Last modified: April 24, 2018”]
c. Privacy Policy [the linked document is identified as “Last modified: April 24, 2018”]
d. How We Process Your Information [the linked notice is undated]
e. Privacy Shield [the linked notice is undated]
f. IP Policy [the linked notice is undated]
g. Cookies [the linked notice is undated]
189. The policies and notices listed above are presented in the form of a continuous scroll with one
policy/notice running into the next, in the order set out above. For ease of reference, I will refer to
this suite of documents as “the Page”.
190. Asobserved by the Investigator, the shortcutoptionsare set outatthe top of the Page with the result
that, when the reader scrolls down through the various polices/notices, the shortcut options are no
longer visible. I note WhatsApp’s submission, in this regard, that the reader can return to the top of
the document by tapping “WhatsApp Legal Info” (which remains at the top of the page throughout).
I agree, however, with the Investigator’sview thatthisfunctionality isnotimmediately obvioustothe
user and, accordingly, I included a proposed direction, in the Preliminary Draft, requiring WhatsApp
to take the action required to ensure that it is clear that the user can return to the top of the Page at
any timebytapping“WhatsAppLegalInfo”. InotethatWhatsApphassincetakenthe actionrequired
to address the substance of my concerns, in this regard, and, accordingly, the proposed direction is
no longer required.
Location and Accessibility of the Privacy Policy and the Legal Basis Notice: Web Users
191. Web users can access the Privacy Policy by selecting “Privacy” from the list of options set out at the
very end of WhatsApp’s landing page . The linked page contains a link to the Privacy Policy in the
section entitled “Data transparency”, located towards the end of the page. This link brings the user
directly to the top of the Privacy Policy, as it is located within the scroll of policies and notices on the
Page.
192. Like app users, web users are provided with a series of shortcut options, as follows:
a. Key Updates [the linked notice is undated]
96www.whatsapp.com
97www.whatsapp.com
65 b. Terms of Service [the linked document is identified as “Last modified: April 24, 2018”]
c. Privacy Policy [the linked document is identified as “Last modified: April 24, 2018”]
d. How We Process Your Information [the linked notice is undated]
e. Privacy Shield [the linked notice is undated]
f. IP Policy [the linked notice is undated]
g. Cookies [the linked notice is undated]
193. Unlike app users, however, these shortcut options are located on the right of the Page and remain
available to the user as he/she scrolls down the Page. In addition, web users are provided with a
series of further shortcut options, in the form of an expanding list that appears when the user clicks
on the Privacy Policy shortcut. The expanding list also appears automatically once the user reaches
the Privacy Policy on the Page (i.e. the expanding list is presented to the user once he/she accesses
the Privacy Policy, regardless of whether or not he/she has actively clicked on the Privacy Policy
shortcut). The expanding list of additional shortcuts facilitate immediate access to the following
specific sections of the Privacy Policy:
a. Information We Collect
b. How We Use Information
c. Information You And We Share
d. How We Work With Other Facebook Companies
e. Assignment, Change of Control, And Transfer
f. How The General Data Protection Regulation Applies To Our European Region Users
g. Managing And Deleting Your Information
h. Law And Protection
i. Our Global Operations
j. Updates To Our Policy
k. Contact Information
194. As set out above, the Privacy Policy and Legal Basis Notice are two of a number of policy
documents/notices available under the general heading of “WhatsApp Legal Info”. The policy
documentsarenotpresentedtothereaderasseparatedocuments;theyaresetout,oneimmediately
followingthe other,inanunbrokenscrollonthe Page. AsI willdetailfurther below,the PrivacyPolicy
and Legal Basis Notice incorporate reference (by way of a range of different hyperlinks embedded in
the text of those documents) to most of the other documents/notices set out on the Page. For this
reason, it was relevant for me to also consider the Privacy Policy and Legal Basis Notice from the
perspective of their presentation to the user, as part of the Page, as well as the ways in which they
interact with each other on the Page.
Presentation of, and Interaction between, the Privacy Policy and the Legal Basis Notice on the Page
195. I note that the Page, when copied into Word document format, runs to approximately 23 pages in
length. The various documents and notices that make up the Page, their order of presentation and
approximate length (when copied into Word document format, as before), are as follows:
a. Key Updates (approximately 1 page in length - 4% of total Page length)
b. Terms of Service (approximately 9 pages in length - 39% of total Page length)
c. Privacy Policy (approximately 7 pages in length - 30% of total Page length)
d. How We Process Your Information (approximately 3 pages long - 13% of total Page length)
e. Privacy Shield (approximately 1 page in length - 4% of total Page length)
66 f. Intellectual Property Policy (approximately 1.5 pages in length - 7% of total Page length)
g. Cookies Policy (approximately 0.5 page in length - 2% of total Page length)
196. In terms of the interaction between the Privacy Policy and Legal Basis Notice, I firstly note that there
is no reference whatsoever to the Legal Basis Notice within the Privacy Policy itself. This is surprising,
given the significance of the information that the Legal Basis Notice purports to provide to the user.
Further, the Privacy Policy only contains a single link to the Legal Basis Notice. This, too, is surprising
in circumstances where the Privacy Policy appears to contain multiple links, spread throughout the
document, toalmostevery other cross-referenced document/text. While thatsingle link iscontained
in the “Our Legal Bases For Processing Information” sub-section of the section entitled “How The
General Data Protection Regulation Applies To Our European Region Users”, the link is embedded in
in the text “Learn More”. This is unfortunate given that this section contains a total of five links, the
first three of which (embedded in the words “collect”, “use” and “share”) link the user back to earlier
sections of the Privacy Policy, while the fourth one (embedded in the word “Terms”) links the user to
the Terms of Service with the last one being the “Learn More” link. There is nothing in this
arrangement that would suggest, to the user, that the “Learn More” link will contain new and
important information about WhatsApp’s processing activities that he/she is entitled to receive.
197. In addition to this, I note that there is no reference whatsoever to the Legal Basis Notice at any point
of the userengagementflow, regardless of whether the user engages with thatflow asan app or web
user. Consequently, a user wishing to access the prescribed information is provided directions by
reference to the term “privacy policy” only; he/she has no way of knowing about the existence of the
Legal Basis Notice, let alone that it contains some of the core information that he/she is entitled to
receive pursuant to Article 13.
198. Turning, finally, to the format in which the Privacy Policy and Legal Basis Notice are presented to the
user, I note that they are, respectively, the second and third documents in an overall scroll that
comprises sevendifferentpolicies/notices acrossarangeof matters. Notwithstanding the availability
of shortcut links, the Page, once accessed by the user, contains a significant amount of text (as
documented above).
199. Considering this arrangement in the context of the obligations arising, Article 13 requires the data
controller to “provide” the prescribed information to the data subject. Article 12(1) supports this by
requiring the data controller to take “appropriate measures” to “provide” the information in a
“concise, transparent, intelligible and easily accessible form, using clear and plain language, in
particular for any information addressed specifically to a child”.
200. In effect, Article 12(1) is directed to ensuring, insofar as possible, that the data subject receives the
information that is “provided” by the data controller. It does this by reference to the potential
barriers that could operate to prevent the information from being received by the data subject. The
requirement, for example, for the data controller to use “clear and plain language” when “providing”
the information helps toensure that the data subject is not prevented from receivingthe information
because he/she could not understand complicated or technical jargon. Similarly, the requirement for
the data controller to “provide” the information in a “concise” manner helps to ensure that the data
subject is not prevented from receiving the information as a result of information fatigue caused by
the incorporation of the information into a long and rambling piece of text.
67201. Considering the format in which the Privacy Policy and Legal Basis Notice is presented to the user in
light of the above, it is clear that, once a user reaches the Page, he/she is presented with a significant
amount of text; this will be immediately apparent to the user, from the scroll bar running down the
side of the Page. While the Privacy Policy and Legal Basis Notice only account for approximately 43%
of the total text length, the user has no way of knowing this or of knowing, at first instance,
whereabouts on the Page these are located. The use of this format to deliver the information
prescribed by Article 13 of the GDPR risks dissuading the user from reading the Privacy Policy and
Legal Basis Notice on the basis of a perception, on the part of the user, that he/she may be required
toreview a considerable length of text. In thisway, the formatof presentation riskscreatinga barrier
between the prescribed information and the data subject.
202. Accordingly, and with a view to ensuring, insofar as possible, that users receive the information that
WhatsApp is required to provide, I included proposed directions, in the Preliminary Draft, requiring
WhatsApp to take action such that:
a. the Legal Basis Notice is incorporated into (such that it forms part of) the Privacy Policy; and
b. the Privacy Policy (with incorporated LegalBasisNotice) isseparatedfromthe remainder ofthe
policies/notices that make up the Page and presented on a page of its own.
203. I note, however, that WhatsApp has since taken the action required to address the substance of my
concerns, in this regard, and, accordingly, the proposed directions are no longer required.
204. For the avoidance of doubt, I note that the Investigator, by way of Conclusion 3, expressed the view
that “the format of the Online Documents in one continuous scrolling document is not in line with the
accessibility requirement contained within Article 12.1 of the GDPR, as this scrolling [renders] specific
informationmoredifficulttofind.” Asdetailedfurtherbelow,Iwillapproachtherequiredassessment
byreferencetotheindividualcategoriesofinformationthatareprescribedbyArticle13. Accordingly,
I do not intend to propose any finding by reference to Conclusion 3 of the Final Report.
Methodology for Part 2: Assessment and Questions for Determination
205. Having established how WhatsApp provides information to its users, I must now consider the extent
to which the measures implemented achieve compliance with the requirements of Article 13, read in
conjunction with Article 12(1).
206. As set out above, Article 13 prescribes the information that must be provided to the data subject
while Article 12(1) sets out the way in which this information should be provided. Thus, in order to
achieve compliance with Article 13:
a. The data controller must provide the required information; and
b. Provide it in a manner that is “concise, transparent, intelligible and easily accessible form, using
clear and plain language, in particular for any information addressed specifically to a child.”
207. Inother words, compliancewith Article13 requires both of the above elements tobesatisfied ineach
case.
68208. Further, while the Investigator made findings by reference to WhatsApp’s use of layering, I propose
to approach the assessment strictly by reference to the requirements of Articles 12(1) and 13. Once
the information has been provided (and) in a manner that complies with the requirements of Article
12(1), it matters not whether a data controller has achieved the objective by the use of layering or
otherwise.
209. Finally, in terms of the limits of this assessment, my function is to assess the extent to which
WhatsApp complies with its transparency obligations pursuant to Articles 12(1) and 13. This
assessment does not permitor require me to inquire into, or otherwise, challenge the veracity of any
information provided by WhatsApp to its users or to consider, for example, the appropriateness of
any legal basis being relied upon to ground a particular processing operation.
210. Accordingly,thequestionstobedetermined,byreferencetoeachcategoryofinformationprescribed
by Articles 13(1) and 13(2), are:
a. What information has been provided by WhatsApp? And
b. How has that information been provided?
Approach to submissions furnished by WhatsApp at the Decision-Making Stage
211. WhatsApp furnished extensive submissions in response to the Preliminary Draft. Broadly speaking,
those submissions can be divided into two categories:
a. submissions directed to a specific aspect of Article 13 or a specific aspect of my assessment;
and
b. submissions concerning global matters, such that they are directed to an approach that I have
taken generally or, otherwise, that have been directed toa number of the individualArticle 13
assessments set out below (“Submissions of General Application”).
212. In relation to the first category of submissions, I have recorded how I have taken account of the
particular submissions made in the corresponding Article 13 assessment. In relation to the
Submissions of General Application, however, I have, as a procedural economy and with a view to
avoiding unnecessary duplication, recorded how I have taken these into account in this particular
section of the Decision only. Thus, where, as part of its response to any of the individual assessments
recorded in Parts 2 or 3 of this Decision, WhatsApp has included reference to any aspect of the
Submissions of General Application, the views set out below can be taken to be the manner in which
I have taken those submissions into account in the particular context.
Assessment of WhatsApp’s Submissions of General Application
213. The Submissions of General Application can be grouped into four headings, as follows:
a. Submissions concerning WhatsApp’s willingness to amend its Privacy Policy and related
material;
b. Submissions concerning Legal Certainty;
69 c. Submissions concerning Inconsistency; and
d. Submissions concerning WhatsApp’s pre-GDPR engagement with the Commission.
214. The manner in which I have taken these four categories of submission into account, for the purpose
of this Decision, is as follows:
Submissions concerning WhatsApp’s willingness to amend its Privacy Policy and related material
215. While WhatsApp maintains that it has complied with its obligations under the GDPR, ithas confirmed
that it is prepared to make, on a voluntary basis, amendments to its approach to transparency. It
submitted, in this regard, that:
“While [WhatsApp] strongly maintains that it has complied with its obligations under the GDPR,
WhatsApp has carefully reflected on the Commission’s proposed findings, directions, views and
obiter dicta comments in the [Preliminary Draft] and accepts that it can do more to improve the
accessibility, quality and clarity of certain information it provides to users. WhatsApp intends to (i)
take action to implement all of the Commission’s proposed directions, and work is already
underway to give effect to the directions requiring technical changes; and (ii) address most of the
Commission’s proposed findings and views by way of changes to the Privacy Policy and other user
facing information. This workstream has already commenced as previously communicated to the
Commission by WhatsApp. Parts C and D of [these Preliminary Draft Submissions] set out further
details of the changes WhatsApp intends to make and the letter accompanying [these Preliminary
Draft Submissions] addresses the timeframe in which these changes might be made, subject to the
98
Commission’s views .”
216. WhatsApp identified the changes that it proposes to make, in this regard, throughout the Preliminary
99
Draft Submissions . Those changes include the implementation of the directions proposed in the
Preliminary Draft, the improvement of the “educational information” that it provides to users in
relation to the Contact Feature and the making of a range of other changes in response to the
individual findings of infringement proposed by the Preliminary Draft.
217. WhatsApp stated that it hoped these commitments might help to “convey how seriously it takes its
transparency obligations and the level of thought, consideration and work that went into preparing
100
the Privacy Policy and user facing information ”, such that I might reconsider my position on the
findings proposed in the Preliminary Draft. While I acknowledge WhatsApp’s willingness to amend
its Privacy Policy and related material, this is not a matter that is relevant to the question of whether
or notaninfringementof theGDPR hasoccurred/isoccurring inthe contextofthewithin inquiry. The
assessments recorded in this Decision are based on the material relied upon by WhatsApp to achieve
compliance with its transparency obligations as at the date of commencement of the within inquiry.
This material forms the factual framework against which I have carried out my assessment. In the
circumstances, I am unable to take account of any expressed willingness to change, on the part of
WhatsApp, when determining, for the purpose of the within inquiry, whether or not an infringement
98The Preliminary Draft Submissions, paragraph 1.2
99
See, in particular, paragraph 2.6(B), paragraph 2.6(D), paragraph 4.3, paragraph 6.2, paragraph 6.3, paragraph 6.7,
paragraph 7.9, paragraph 7.11, paragraph 7.20, paragraph 7.21, paragraph 7.25, paragraph 8.4, paragraph 8.5, paragraph
9.5, paragraph 10.2, paragraph 11.3, paragraph 12.1, paragraph 14.4(B) and paragraph 14.10 of the Preliminary Draft
Submissions
100The Preliminary Draft Submissions, paragraph 2.6(C)
70 of the GDPR has occurred/is occurring. I confirm, however, that I will take account of this aspect of
matters in Part 5 of this Decision, as regards the question of the exercise of corrective powers, if any,
that might be taken pursuant to any (concluded) finding of infringement which I might make.
Submissions concerning Legal Certainty
218. WhatsApp has submitted, in this regard, that:
“The principle of legal certainty dictates that organisations regulated by EU law are entitled to
know and understand the standards to which they must adhere. In particular, WhatsApp
considers that controllers should be able to have reference to the interpretations and
standards set out in guidance issued or adopted by the [EDPB], such as the Transparency
Guidelines,whendecidingonanapproachtocompliance. Inthisregard,WhatsAppnotesthat
its approach aligns with the approaches adopted by industry peers which reinforces
WhatsApp’s view that industry norms – based on good faith efforts to comply with GDPR – do
not reflect the standards that the Commission is seeking to impose in the [Preliminary Draft].
Holding controllers to an alternative and even higher standard of compliance seems contrary
to the function of the EDPB to promote and achieve through guidance a common and
consistent application of the GDPR across the EU and results in a lack of legal certainty for
101
controllers as to the nature and extent of their obligations .”
219. WhatsApp has identified that these submissions have particular application in the context of my
assessmentsoftheobligationsarisingpursuanttoArticle13(1)(c) 102andArticle13(1)(f) 10. WhatsApp
further submits, in this regard, that:
“TheCommissionitselfhasnotproducedspecificguidancedetailingitsexpectationsregarding
compliance with the transparency requirements contained in the GDPR. Consequently this is
the first time that WhatsApp has the benefit of the Commission’s interpretation of many of
104
these transparency requirements .”
220. Having considered the above submissions, I firstly note that Articles 13 and 14 of the GDPR identify
the particular information that data controllers must provide to data subjects. The language of these
provisions is not technical or complex; each category of information is described in simple and clear
terms. I further note that these provisions do not afford any discretion to the data controller, in
relation to the prescribed information; unless the data controller is in a position to avail of one of the
very limited exemptions provided, it must provide all of the information specified to the data subject.
Article 12(1), as I have already observed, complements Articles 13 and 14 by identifying the way in
which the specified information must be provided to the data subjects concerned. Article 12(1)
affords the data controller discretion, in terms of the formulation and method of delivery of the
specified information. This is a very limited discretion, however, given the express requirement for
the information tobe provided ina“concise,transparent, intelligible andeasily accessible form, using
clear and plain language, in particular for any information addressed specifically to a child.”
101The Preliminary Draft Submissions, paragraphs 2.1 and 2.3
102The Preliminary Draft Submissions, paragraphs 2.2, 6.6 and 6.18
103The Preliminary Draft Submissions, paragraph 9.4
104The Preliminary Draft Submissions, paragraph 2.2
71221. The Article 29 Working Party sought to provide support to the data controller in the context of the
transparency obligation. The resulting Transparency Guidelines 105is a lengthy and comprehensive
document that explores transparency from the perspectives of its utility and function, in the context
of the GDPR. In this way, the data controller is enabled to understand the significance of the
information that it has been tasked with providing such that it can ensure that it correctly formulates
its approach to transparency. It is important to remember, in this regard, that there is no “one size
fits all” approach to transparency; each data controller must formulate its approach to transparency
by reference to its own particular data processing operations and the type of data subject concerned.
In these circumstances, there is nothing further that the Commission could provide, by way of
additional guidance, that has not already been covered by the Transparency Guidelines (or, indeed,
by the GDPR itself).
222. As regards the suggestion that the approach I have taken in this Decision represents an “alternative”
or “higher” standard of compliance, I fundamentally disagree with this. The GDPR requires the
provision of certain, specified information to data subjects. In the context of any assessment of
compliance, the data controller has either provided this information or it has not; there is no middle
ground or room for the application of different standards. As regards the two particular aspects of
my assessment – the approaches to Articles 13(1)(c) and 13(1)(f) – cited by WhatsApp in support of
its submissions, I note that the approaches outlined in the Preliminary Draft match those outlined in
the Transparency Guidelines, as follows:
a. Under the heading “(c)lear and plain language”, the Transparency Guidelines state that “(t)he
information should be concrete and definitive; it should not be phrased in abstract or
ambivalenttermsofleaveroomfordifferentinterpretations. Inparticularthepurposesof,and
106
the legal basis for, processing the personal data should be clear” [emphasis added].
Thereafter follows a list of three “poor practice examples” and three “good practice
examples”. The explanations accompanying the “good practice examples” make it clear that,
when providing information concerning the purpose of processing, the data controller must
dosobyidentifyingthe“type(s)ofdata”thatwillbesoprocessed. Theyfurtherclearlyidentify
that the information being provided should be linked to the “type(s) of data” undergoing
processing. Accordingly, there is no difference whatsoever between the approach to Article
13(1)(c) outlined in the Preliminary Draft (i.e. the Proposed Approach) and the approach
outlined by the Article 29 Working Party in the Transparency Guidelines.
b. In relation to Article 13(1)(f), the Transparency Guidelines specifically state 107that “the
information provided on transfers should be as meaningful as possible to data subjects; this
will generally mean that the third countries be named.” It stands to reason that, in order for
the information to be meaningful, the categories of data undergoing transfer must be
providedtothedatasubjectsothathe/shecancheckthatthetransfermechanismbeingrelied
upon permits the transfer of the category of data concerned.
105Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”)
106Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”), page 9
107Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”), page 38
72223. Accordingly, Idonotagreewith any suggestion thata data controllerisunabletoknow orunderstand
the standards to which it must adhere, in the context of the transparency obligations. Neither do I
agree that the absence of Commission guidance has left WhatsApp at a disadvantage, in terms of its
ability to understand what is required of it pursuant to the transparency provisions. Further, I do not
agree that the approaches outlined in the Preliminary Draft represent a higher (or alternative)
standard of compliance to that required by the GDPR and/or the Transparency Guidelines.
224. Finally, I note WhatsApp’s submission that its approach “aligns with the approaches adopted by
industry peers which reinforces WhatsApp’s views that industry norms – based on good faith efforts
to comply with GDPR – do not reflect the standards that the Commission is seeking to impose in the
[Preliminary Draft]108”. If I were to take this submission into account, such that it might persuade me
to reverse any proposed finding of non-compliance, it would be tantamount to saying that the
standards of compliance required by the GDPR may be determined by the members of particular
sectors of industry, rather than by the legislator. Such an approach is fundamentally incompatible
with the GDPR; moreover, it would create a situation whereby individual data subjects would be
afforded different standards of transparency depending on the particular industries with which they
engage. For these reasons, I do not accept that this is a factor that I can take into account for the
purposes of the assessments recorded in Parts 2 or 3 of this Decision.
Submissions concerning Inconsistency
225. WhatsApp has submitted, in this regard, that:
“WhatsAppisconcernedthatthemanner inwhichtheCommissionhaschosentointerpretthe
GDPR and the Transparency Guidelines … results in requirements that are inconsistent or are
very challenging to implement in practice. By way of example as regards inconsistency, in
respect of Article 13(1)(c) GDPR and WhatsApp’s reliance on legitimate interests, the
Commission, on the one hand, note that WhatsApp should adopt a “concise approach”, and
“user[s] should not have to work hard to access the prescribed information”. However, on the
other hand, in WhatsApp’s view, the Commission’s Proposed Approach in the Draft Decision
would necessarily lead to information fatigue, and could actually make it harder and
considerably more time consuming for users to understand the processing WhatsApp is
carrying out. By way of further example, in respect of what WhatsApp considers to be the
impractical nature of the Commission’s interpretation, the Commission’s requirement that
WhatsApp identify the specific adequacy decision relied on in respect of each category of data
could result in WhatsApp needing to continually update its Privacy Policy .”109
226. I do not share WhatsApp’s concerns, in this regard. As is evident from the assessments that follow,
my view is that the Privacy Policy and related material frequently demonstrate an over-supply of very
high level, generalised information at the expense of a more concise and meaningful delivery of the
essential information. Further, while WhatsApp has chosen to provide its transparency information
bywayofpiecesoftext,thereareotheroptionsavailable,suchasthepossibleincorporationoftables,
which might enable WhatsApp to provide the information required in a clear and concise manner,
particularly in the case of an information requirement comprising a number of linked elements. The
importance of concision cannot be overstated, in this regard. For the avoidance of doubt, however,
108The Preliminary Draft Submissions, paragraph 2.3
109
The Preliminary Draft Submissions, paragraph 2.5. See also paragraphs 6.9 and 6.14.
73 I am not saying that WhatsApp is not entitled to provide additional information to its users, above
and beyond that required by Articles 13 and 14. WhatsApp is free to provide whatever additional
information it wishes, providing that it has firstly complied with its statutory obligations and,
secondly, that the additional information does not have the effect of creating information fatigue or
otherwise diluting the effective delivery of the statutorily required information.
227. Asregardsthe suggestion thata requirementfor WhatsApptoidentify the specific adequacy decision
relied on in respect of each category of data could result in WhatsApp needing to continually update
its Privacy Policy, I question how this might be the case. The categories of personal data being
processed by WhatsApp are not extensive and, further, there are a limited number of adequacy
decisions in existence. In any event, I do not agree that the burden that might be placed upon a data
controller, in the context of a requirement for periodic updates to be made to its privacy policy,
outweighs the right of the data subject to receive meaningful transparency information. The
transparency obligation is an ongoing one, rather than one which can be complied with on a once-off
basis, as with all controller obligations under the GDPR and inherent in this is the requirement that
controllers continually monitor and review their practices to ensure continuing compliance with the
GDPR. Ifitisthecasethatadatacontrolleranticipatesthatitmighthavetoupdateitsprivacymaterial
from time to time, then it ought to take this into account when determining how it will formulate and
deliver the prescribed information so as to make life as easy as possible for itself.
Submissions concerning WhatsApp’s pre-GDPR engagement with the Commission
228. WhatsApp, by way of the Preliminary Draft Submissions, has also sought to partially defend its
position, in a limited number of respects, by reference to its pre-GDPR engagement with the
Commission. I note, for example, that, in relation to my comments concerning the placement of the
Facebook FAQ and thefactthatitisa stand-alone document(inthe contextofPart3of this Decision),
WhatsApp has submitted that:
“The Facebook FAQ (as a stand-alone document) was first drafted on the basis of extensive
consultation with the Commission. During that consultation the Commission did not take issue
with the Facebook FAQ being provided as a stand-alone document. Nor has the Commission
subsequently objected to maintaining the Facebook FAQ as a standalone document (on the
understanding it is to be read in conjunction with the Privacy Policy which should refer to the
110
Facebook FAQ). … .”
229. It further submitted, inrelation to my comments concerning the use of links to articles on Facebook’s
website, that:
“There is no requirement in the GDPR that prevents companies from referring individuals to
information available from other sources and the Commission did not raise an issue with this
111
approach previously .
230. It is acknowledged that WhatsApp engaged in extensive consultation with the Commission’s
ConsultationUnitinconnectionwiththepreparationoftheFacebookFAQ. Itisfurtheracknowledged
that the Commission’s Consultation Unit has engaged (and continues to engage) with WhatsApp in
relation to various matters, including transparency. I wish to make it very clear that, in the context
110The Preliminary Draft Submissions, paragraph 14.4(B)
111The Preliminary Draft Submissions, paragraph 14.10
74 of any such engagement, it is not the Commission’s responsibility to carry out a detailed review of
any material discussed or presented; neither is it appropriate for any data controller to expect the
Commission to undertake any, or even partial, responsibility for ensuring that it is compliant with its
obligations pursuant to the GDPR. As WhatsApp is aware, the function of the Commission’s
Consultation Unit is not to approve, or forensically examine, policy documents for a data controller
or processor. Rather, it envisages a process of high level engagement with data controllers and
processors in which the output, on the part of the Commission’s Consultation Unit, is limited to the
raising of questions or making of observations on the data protection aspects of the processing in
issue. This approach reflects the accountability principle set out in Article 5(2) of the GDPR, which
places the primary responsibility for compliance with the GDPR on the data controller or
processor concerned.
231. For the sake of completeness, I note that WhatsApp has previously recognised that:
“During this period of [pre-GDPR] engagement, the DPC made it clear that it was not providing
conclusive guidance on WhatsApp’s proposed updates, and instead was providing an indication of
issues which WhatsApp may have wished to consider while preparing its updates. We therefore
acknowledge and understand that the feedback provided did not amount to approval of the
approach WhatsApp was proposing 112.”
232. In the circumstances, it is apparent that WhatsApp was clearly informed, at the relevant time, of the
limited function and scope of any engagement with the Commission’s consultation function. I
therefore find it surprising that WhatsApp, having previously, in the course of this inquiry, openly
acknowledged the limitations and true nature of the engagement with the Commission, would
subsequently seek to recast that engagement and place reliance at the door of the Commission for
decisions around transparency which are squarely the responsibility of WhatsApp
233. Having addressed the Submissions of General Application raised by WhatsApp, I will now proceed
with my assessment of the extent to which WhatsApp has complied with the obligations arising by
reference to the individual categories of information prescribed by Article 13. To the extent that
WhatsApp might have included reference to any of the above matters of general application as part
of itssubmissionsinresponse toany individualcategoryassessmentset outbelow, the abovereflects
the manner in which I have taken those Submissions of General Application into account in the
context of the particular category of information under assessment.
Assessment: Article 13(1)(a) – the identity and contact details of the controller
Required Information and WhatsApp’s Response to Investigator’s Questions
234. Article 13(1)(a) requires a data controller to provide the data subject with “the identity and the
contact details of the controller … ”.
235. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 4, that:
112
The Inquiry Submissions, paragraph 2.3
75 “The Privacy Policy identifies WhatsApp Ireland as the controller for users of the Service in the EU.
Users can contact [WhatsApp] via a link provided in the Privacy Policy or alternatively using the
details as provided in the ‘Contact Information’ section of the Privacy Policy.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
236. The Investigator’s views, in relation to the extent to which WhatsApp has complied with Article
13(1)(a), are set out by reference to Proposed Finding 4 of the Draft Report.
237. The Investigator proposed a finding that WhatsApp failed to clearly identify the data controller for
the Service on the basisof inconsistencies between the language used inthe Termsof Service and the
language used in the Privacy Policy. Such inconsistencies, in the view of the Investigator, rendered
the information provided “unclear and unintelligible”, contrary to Article 12(1).
238. WhatsApp disagreed with the Investigator’s assessment. It submitted 113 that the proposed finding
ignored “the clear and unequivocal language in the Privacy Policy” and the fact that the Privacy Policy
is the “primary information and transparency document in respect of WhatsApp’s data processing”.
239. The Investigator, however, was not swayed by WhatsApp’s submissions and confirmed, by way of
Conclusion 4, her view that the information provided by WhatsApp, in this regard, was “unclear and
therefore contrary to Article 12(1) of the GDPR.”
Assessment of Decision-Maker: What information has been provided?
Re: the requirement to provide the identity of the controller
240. The second paragraph of the Privacy Policy states that:
“If you live in a country in the European Economic Area (which includes the European Union), and
any other included country or territory (collectively referred to as the European Region), your
Services are provided by WhatsApp Ireland Limited (“WhatsApp Ireland”), which is also the data
controller responsible for your information when you use our Services.”
Re: the requirement to provide the contact details of the controller
241. The “Contact Information” section of the Privacy Policy includes the following information:
“If You Are In The European Region
…
If you have questions about our Privacy Policy, please contact us or write us here:
WhatsApp Ireland Limited
Attn: Privacy Policy
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland”
113
The Inquiry Submissions, paragraphs 6.1 and 6.2
76Assessment of Decision-Maker: How has the information been provided?
Re: the requirement to provide the identity of the controller
242. As set out above, the required information is set out at the beginning of the Privacy Policy.
243. I note that the Investigator expressed the view that the differences in the entities referenced, as
between the Privacy Policy and the Terms of Service, gave rise to a risk of confusion in relation to the
identity of the data controller for the Service. In this regard, and for the sake of completeness, I note
thatthe “Key Updates” section (located attheverytop ofthe Page) containsthe followingstatement:
“WhatsApp Ireland. WhatsApp Ireland Limited provides our Services and is responsible for your
information when you use WhatsApp.”
244. Further, the “Terms of Service” states that:
“Our Services
If you live in a country in the European Economic Area (which includes the European Union), and
any other included country or territory (collectively referred to as the "European Region"),
WhatsApp Ireland Limited provides the services described below to you; if you live in any other
country except those in the European Region, it is WhatsApp Inc. (collectively, "WhatsApp," "our,"
"we," or "us") that provides the services described below to you (collectively, "Services"): …”
Re: the requirement to provide the contact details of the controller
245. The contact details of the controller are clearly set out where they can be easily located (within the
“Contact Information” section of the Privacy Policy).
Finding: Article 13(1)(a) – the identity and contact details of the controller
Re: the requirement to provide the identity of the controller
246. I do not share the Investigator’s view that there is potential for confusion when identifying the data
controller for theService. The Privacy Policy,assubmitted by WhatsApp,isclearly theprimary source
of information, for transparency purposes, and this document clearly identifies “WhatsApp Ireland
Limited” as the relevant data controller. The position, as set out in the Terms of Service, is consistent
with the information set out in the Privacy Policy.
247. Otherwise, the required information has been provided, in a clear way, at the outset of the Privacy
Policy.
Re: the requirement to provide the contact details of the controller
248. Thisinformationhasbeenprovided,inaclearway,andinalocationthatmightbeexpectedtocontain
this information.
249. Accordingly, I find that WhatsApp has complied, in full, with its obligations pursuant to Article
13(1)(a).
77Assessment: Article 13(1)(b) – the contact details of the data protection officer, where applicable
Required Information and WhatsApp’s Response to Investigator’s Questions
250. Article 13(1)(b) requires a data controller to provide the data subject with “the contact details of the
data protection officer, where applicable”.
251. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 4, that:
“[WhatsApp] provides the contact details of its Data Protection Officer (DPO-
inquiries@support.whatsapp.com) via a link in the ‘Contact Information’ section of the Privacy
Policy.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
252. While the Investigator did not propose or confirm any particular finding or conclusion, under this
heading, she confirmed, in the Draft Report and Final Report, that she was satisfied that WhatsApp
had complied with its obligations pursuant to Article 13(1)(b).
Assessment of Decision-Maker: What information has been provided?
253. The “Contact Information” section of the Privacy Policy includes the following information:
“If You Are In The European Region
The Data Protection Officer for WhatsApp Ireland can be contacted here.*”
Assessment of Decision-Maker: How has the information been provided?
254. The information has been included in the “Contact Information” section of the Privacy Policy. Once
the link provided (as identified by an asterisk, above) is selected, it automatically generates an email,
in a new window, addressed to DPO-inquiries@support.whatsapp.com. “WhatsApp Support – DPO”
is auto populated into the subject line and the following text appears in the body of the email:
“Please edit this part to include the information below. Then, hit send. Thanks for contacting
WhatsApp.
* Your full name:
* Your country of residence:
* The phone number you used to create your WhatsApp account:
* A detailed explanation of the issue you want to report to the DPO:”
Finding: Article 13(1)(b) – the contact details of the data protection officer, where applicable
255. I note thatthe required information hasbeen clearly setout, and hasbeen made available tothe user
in a location in which this information might be expected to be found.
256. Accordingly,Iagreewiththe Investigator’sconclusionandfindthatWhatsApp hascomplied,infull,
with its obligations pursuant to Article 13(1)(b).
78Assessment: Article 13(1)(c) – the purposes of the processing for which the personal data are
intended as well as the legal basis for the processing
Required Information and WhatsApp’s Response to Investigator’s Questions
257. Article 13(1)(c) requires a data controller to provide the data subject with “the purposes of the
processing for which the personal data are intended as well as the legal basis for the processing.”
258. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 4, that:
“[WhatsApp] identifies the purposes of processing personal data and the legal bases for such
processing in the Privacy Policy and the ‘How We Process Your Information’ notice …”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
259. The Investigator set out her views on the extent to which WhatsApp complied with its obligations
under this heading by reference to Proposed Findings 5, 6, 7 and 9.
260. By reference to Proposed Finding 5, the Investigator expressed the view that the information
provided in the “Our Legal Bases for Processing Information” section of the Privacy Policy was
insufficient to demonstrate WhatsApp’s compliance with Article 13(1)(c) “as a first layer of
information”. In addition, the Investigator expressed the view that:
a. The information provided by the data controller, pursuant to Article 13(1)(c), “should link the
processing activity and the legal basis relied on by the data controller”. The Investigator was of
the view that this approach was consistent with the wording of Article 13(1)(c) and the views of
the Working Party, as set out in the Transparency Guidelines.
b. The Investigator was further of the view that the information should be provided by reference to
a processing“operation” or“setof operations”, inaccordance with the definition of “processing”
set out in Article 4(2) and the provisions of Recital 60.
261. WhatsApp disagreed with the Investigator’s views, in this regard. It submitted that the GDPR does
not require the precise legal bases being relied upon to be set out in the first layer of information114.
WhatsApp further submitted 115that the GDPR “does not require the separate disclosure of the legal
basis for each and every processing operation.”
262. The Investigator was unconvinced by WhatsApp’s submissions and confirmed, firstly, that she
remained of the view that references to “processing” should be understood as being references to a
processing “operation” or “set of operations”. By reference to that approach, the Investigator
confirmed her view (by way of Conclusion 5) that the information provided under the sub-heading
“OurLegalBasesforProcessingInformation”wasinsufficienttodemonstrateWhatsApp’scompliance
with Article 13(1)(c) of the GPDR, as a first layer of information.
114The Inquiry Submissions, paragraph 7.3
115The Inquiry Submissions, paragraph 7.7
79263. By reference to Proposed Finding 6, the Investigator set out her concerns in relation to the
information that was provided to the user in relation to processing grounded on the contractual
necessity basis (Article 6(1)(b)). She proposed a finding that “the disjointed manner in which the
information is provided to data subjects regarding legal bases for processing of personal data, and
the lack of clarity regarding the link between the purposes of processing and what the processing
entails, is not in line with the requirements of Articles 12(1) and 13(1)(c) of the GDPR.” The
Investigator expressed the view, in this regard that:
“requiring a data subject to access four different locations from a second layer of information
within a Privacy Policy, in order for that data subject to access all the requisite information to fully
understandthepurposesoftheprocessingoftheirpersonaldata,isnotinlinewiththerequirement
set out in Article 12(1) of the GDPR for the information to be clear and intelligible.”
264. WhatsApp disagreed with the Investigator’s views, in this regard. It submitted 116that:
“Despite the assertions to the contrary in paragraph 162 of the Draft Report, users need only
consult the “OurServices” section of the Terms of Service to understand the service provided under
the contract. In reaching the view that users have to review the Terms of Service in their entirety,
the [Investigator] has ignored the explicit statement in the “How We Process Your Information”
notice that “We describe thecontractual services for which this data processing is necessary in Our
Services section of the Terms” (emphasis added).”
265. WhatsApp further submitted 117 that “the “core data uses necessary to provide [the WhatsApp]
contractual services” are specifically identified and listed in four bullet points in the contractual
necessity section of the “How We Process Your Information” notice” and that “(t)hese four bullet
points summarise in a clear and concise manner the processing that is necessary for the performance
of the contract …”.
266. The Investigator was unconvinced by WhatsApp’s submissions, in this regard. She remained of the
view that information concerning the purposes of processing and the legal basis for that processing
should be linked in order for the provisions of Article 13(1)(c) to be satisfied. The Investigator
concluded (by way of Conclusion 6) that the “disjointed manner in which the information is provided
todata subjectsregardinglegalbases for processingof personal data, and the lack ofclarity regarding
the link between the purposes of processing and what that processing entails, is not in line with the
requirements of Articles 12(1) and 13(1)(c) of the GDPR.”
267. While the Investigator considered the section of the Legal Basis Notice that provided information
concerning reliance on consent as a legal basis, she did not propose or confirm any particular finding
or conclusion on this issue. She confirmed, however, that she was satisfied that the relevant section
of the Legal Basis Notice was “sufficiently clear to comply with Article 13(1)(c) of the GDPR, albeit at
the second layer of information, without the clear overview of the purposes of the processing, which
[the Investigator believed] necessary at the first layer”.
268. By reference to Proposed Finding 7, the Investigator set out her views in relation to the information
that had been provided in relation to processing grounded on the legal obligations basis (Article
116The Inquiry Submissions, paragraph 8.4
117The Inquiry Submissions, paragraphs 8.5 and 8.6
80 6(1)(c)). The Investigator proposed a finding, under this heading, that WhatsApp failed to satisfy the
requirements of Articles 12(1) and 13(1)(c) on the basis that:
a. The overview provided in the legal obligation section of the Legal Basis Notice, and the further
information set out in the “Law And Protection” section of the Privacy Policy, did not provide the
data subject with sufficient information about the extent to which WhatsApp relies upon this
basis to ground the processing of personal data;
b. Further, the “broad and non-specific language utilised” in the “Law And Protection” section of
the Privacy Policy did not provide clarity on the purposes for which any data are processed.
269. WhatsApp disagreed with the Investigator’s views, submitting 118that:
“… itismade clearto users that where law requires WhatsApp to process data ina certain way (for
example, in response to a search warrant from An GardaSíochána), it relies on the legal obligation
legal basis. Applying the correct legal standard, WhatsApp has both set out the purpose of
processing (when the law requires it) and legal basis (compliance with a legal obligation), in this
first sentence, as required by Article 13(1)(c).”
270. WhatsApp further submitted 119that:
“The “Law and Protection” section of the Privacy Policy … intentionally (and appropriately)
describes processing which is broader than processing permitted on the basis of a legal obligation.
Forexample,the“How We ProcessYourInformation”notice alsomakesclearthatWhatsApp relies
onlegitimateintereststo“shareinformationwithothersincludinglawenforcementandtorespond
to legal requests” and this section of the fly-out also links to the “Law and Protection” part of the
Privacy Policy. At no point does the “Law and Protection” section of the Privacy Policy purport to
claim that WhatsApp only relies on a legal obligation to process personal data for these law and
protection purposes.
Finally, the Draft Report ignores the fact that, in light of the sensitive and often complicated
processing that occurs in this area on the one hand, and the variety of legal reasons giving rise to
a need to process personal data on the other, it is impossible to provide a full and fully nuanced
descriptive account to users in respect of such processing without overloading them with
information. For example, itwould not be possible to provide further specificity in this section with
regard to the multitude of circumstances in which WhatsApp will be required to assist law
enforcement.”
271. The Investigator was unconvinced by WhatsApp’s submissions, in this regard. She remained of the
view that, as a result of the “broad and non-specific language utilised, the information provided in
the “Law and Protection” section of the Privacy Policy leaves the user uncertain as to the
circumstancesinwhichWhatsAppwill rely upon thislegalbasisfor processinghis/herpersonal data”.
The Investigator confirmed her view, by way of Conclusion 7, thatWhatsAppwas“notcompliantwith
the requirements of Articles 12 and 13(1)(c) in relation to the information that it sets out pertaining
to its legal basis for processing of personal data of compliance with a legal obligation.”
118The Inquiry Submissions, paragraph 9.1
119The Inquiry Submissions, paragraphs 9.2 and 9.3
81272. By reference to Proposed Finding 9, the Investigator set out her views in relation to the information
that had been provided concerning WhatsApp’s reliance on the legitimate interests ground. The
Investigator expressed the view, in this regard, that the Article 13(1)(d) requirement to identify the
legitimate interests being pursued was:
“a cumulative requirement, which results in Articles 13(1)(c) and 13(1)(d) operating together to
place upon the data controller a requirement to set out the purposes of the processing in relation
to the legitimate interests legal basis, along with the legitimate interests being pursued in carrying
out the processing operations.”
273. The Investigator formed the view that the Legal Basis Notice “[conflated] the purposes of the
processing of personal data with the legitimate interests relied upon to process personal data,
without setting out any specific information in relation to the processing operation(s) or set of
operations involved.”
274. Accordingly, the Investigator proposed a finding that WhatsApp failed to fully comply with its
obligationtoprovideinformationinrelationtothelegitimateinterestslegalbasis,pursuanttoArticles
13(1)(c) and 13(1)(d) of the GDPR.
120
275. WhatsApp disagreed with the Investigator’s views. It submitted that:
“In assessing the adequacy of the information provided, the Draft Report also fails to take into
account that the description of the purpose of the processing will often, in and of itself, necessarily
identify the nature of the legitimate interest in issue. The proposed finding is also based on a
mischaracterisation of the obligation on a controller under Article 13(1)(c) – i.e. there is no need to
specify “processing operations” ….”
276. The Investigator was unconvinced by WhatsApp’s submissions and confirmed her view, by way of
Conclusion 9, that WhatsApp failed to fully comply with its obligation to provide information in
relation to the legitimate interests legal basis, pursuant to Articles 13(1)(c) and 13(1)(d) of the GDPR.
Preliminary Issue: What information must be provided pursuant to Article 13(1)(c)?
277. As set out above, there was substantial disagreement, as between WhatsApp and the Investigator, in
relation to what information is required to be provided by Article 13(1)(c). In the Investigator’s view,
this provision requires a data controller to set out:
a. “A description of the purposes of processing;
b. A description of the operation, or set of operations, underlying that purpose, undertaken by the
data controller; and
c. The legal basis relied upon by the data controller in order to carry out that processing operation,
or set of operations.”
278. The Investigator was of the view that “this information must be provided in such a manner so that the
link between the operation (or set of operations), its purpose and the legal basis is clear.”
120The Inquiry Submissions, paragraph 11.1
82279. WhatsApp disagreed with this and submitted that the Investigator sought to impose obligations on
WhatsApp that go “above and beyond those prescribed by law”. WhatsApp made this submission in
relation to a number of the Investigator’s proposed findings, including the proposed requirement for
WhatsApp to:
“(B) link its legal bases for processing to specific processing operations, in addition to
linking them to purposes for processing (which WhatsApp does), even though the
GDPR only provides for the latter 121… .
122
280. WhatsApp expanded upon this submission by asserting that Article 13(1)(c):
“doesnotrequiretheseparatedisclosureofthelegalbasisforeachandeveryprocessingoperation.
Indeed, while the term “processing operation” appears in a number of places in the GDPR, it is
noticeably absent from the transparency obligations in Articles 12 through 14. Therefore, it is not
understood why the Draft Report would purport to read such a requirement into Articles 13.1(c)
and/or 13.1(d), especially given the prescriptive nature of Article 13. In addition, such a
requirement is notably absent from the Transparency Guidelines which refer consistently to legal
basis in the context of processing purposes, not processing operations. …”
281. It thus appears that, while WhatsApp and the Investigator agree that Article 13(1)(c) requires a data
controller to link the legal bases relied upon to the purposes of the processing concerned, they did
not agree that, when providing this information, the controller must do so by reference to a specified
“processing operation” or “set of operations”.
Processing v Processing Operation
282. Article 4(2) provides that “(f)or the purposes of [the GDPR]”:
“’processing’ means any operation or set of operations which is performed on personal data or on
sets of personal data, whether or not by automated means, such as collection, recording,
organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure
by transmission, dissemination or otherwise making available, alignment or combination,
restriction, erasure or destruction.” [emphasis added]
283. Analysing the relevant elements of the above definition, I note that:
a. “For the purposes of the GDPR” means that, each time the term “processing” is referenced in the
GDPR, it should be understood to mean “processing”, as defined by Article 4(2); and
b. “Processing”, by reference to Article 4(2), means “any operation or set of operations”. While the
GDPR does not contain a specific definition for an “operation”, Article 4(2) identifies how this
should be assessed, by reference to the list of examples that follow the words “such as”. This list
makesitclear thatany action carried outon personal data, includingitscollection, isa processing
“operation”.
121The Inquiry Submissions, paragraph 1.6(B)
122The Inquiry Submissions, paragraph 7.7
83284. I further note that this approach is consistent with Recital 60 (which acts as an aid to interpretation
of Articles 12, 13 and 14), which provides that:
“The principles of fair and transparent processing require that the data subject be informed of the
existence of the processing operation and its purposes. …” [emphasis added]
285. This approach is also reflected in the Article 29 Working Party’s Transparency Guidelines 123, which
observe that:
“Transparency is intrinsically linked to fairness and the new principle of accountability under the
GDPR. It also follows from Article 5.2 that the controller must always be able to demonstrate that
personal data are processed in a transparent manner in relation to the data subject. Connected to
this, the accountability principle requires transparency of processing operations in order that data
controllers are able to demonstrate compliance with their obligations under the GDPR.” [emphasis
added]
286. AsregardsWhatsApp’ssubmissionthattheabsenceofspecificreferencetoprocessing“operation(s)”
in Article 13 means that the obligation to provide information to data subjects does not necessitate
an approach whereby the prescribed information is be provided by reference to individual processing
operation(s), I am not persuaded by this argument. As set out above, Article 4 clearly identifies that
the definitions set out in that article are “(f)or the purposes of” the GDPR. There is no limitation on
the application of the prescribed definitions, either within Article 4 or in the context of individual
provisions of the GDPR. That being the case, it seems to me that an argument premised on a
suggestion that the definition of “processing” should only be applied to those provisions that
incorporate specific reference, within its own text, to a processing “operation(s)”, is unsustainable.
Analysis of Article 13(1)(c)
287. Applying the above to the provisions of Article 13, I note that Article 13(1)(c) requires the following:
“Wherepersonaldata…arecollectedfromthe datasubject, thecontrollershall…provide the data
subject with all of the following information:
…
(c) the purposes of the [processing operation] for which the personal data are intended
as well as the legal basis for the [processing operation]” [emphasis added]
288. While WhatsApp and the Investigator were agreed that Article 13(1)(c) requires a data controller to
provide information in relation to the purpose(s) of the processing in conjunction with the
corresponding legal basis for processing, it strikes me that the language highlighted in bold, above,
suggests that the data controller should also provide this information in such a way that enables the
data subject to understand which personal data are/will be processed, for what processing operation
andbyreferencetowhichlegalbasis. Inordertoestablishwhetherornotthisisthecorrectapproach,
it is important to consider the role and function of Article 13 in the context of the GDPR as a whole.
289. Turning firstly to the core data protection principles, I note that Article 5(1) provides that:
123Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”)
84 “Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject
(‘lawfulness, fairness and transparency’);
(b) collected for specified, explicit and legitimate purposes and not further processed in a
manner that is incompatible with those purposes … (‘purpose limitation’);
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which
they are processed (‘data minimisation’);
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to
ensure that personal data that are inaccurate, having regard to the purposes for which they
are processed, are erased or rectified without delay (‘accuracy’);
(e) kept in a form which permits identification of data subjects for nolonger than is necessary for
the purposes for which the personal data are processed … (‘storage limitation’);
(f) processed in a manner that ensures appropriate security of the personal data, including
protection against unauthorised or unlawful processing … (‘integrity and confidentiality’).”
[emphasis added]
290. It can be observed, from the above, that there is a heavy focus, across the core principles, on the
purpose(s) of the processing. It is further clear that, even though Article 5 describes six different
principles, those principles are interconnected such that they operate, in combination, to underpin
the data protection framework.
291. Considering, specifically, the purpose limitation principle, I note that this principle identifies the
obligationsarisingby reference totheterms“collection”and “further”processing. Thisisverysimilar
to the language of Article 13(1)(c) which contains separate references to “collection” and “the
purposes of the processing for which the personal data are intended”, i.e. it is couched in terms of
“collection”and“further”processing. Forthisreason,itisusefultoexaminefurthertherequirements
and function of the purpose limitation principle enshrined in Article 5(1)(b) of the GDPR.
The Article 29 Working Party’s Opinion on Purpose Limitation
292. The Article 29 Working Party considered the purpose limitation principle in its “Opinion 3/2013 on
124
purpose limitation” (“Opinion 3/2013”). As before, the Article 29 Working Party considered this
issue in the context of the Directive however that consideration has equal application to the
interpretation of the same principle in the context of the GDPR (given that the relevant text, in both
the Directive and the GDPR, is materially identical). The Working Party observed that:
“When setting out the requirement of compatibility, the Directive does not specifically refer to
processing for the ‘originally specified purposes’ and processing for ‘purposes defined
subsequently’. Rather, it differentiates between the very first processing operation, which is
124Article 29 Working Party, Opinion 3/2013 on purpose limitation, adopted 2 April 2013 (00569/13/EN WP 203) (“Opinion
3/2013”)
85 collection, and all other subsequent processing operations (including for instance the very first
typical processing operation following collection – the storage of data).
In other words: any processing following collection, whether for the purposes initially specified or
for any additional purposes, must be considered ‘further processing’ and must thus meet the
requirement of compatibility.”
293. The Working Party considered that the concept of purpose limitation comprises two main building
blocks: ‘purpose specification’ and ‘compatible use’. Considering the first of these building blocks,
purpose specification, the Working Party noted as follows:
“Article 6(1)(b) of the Directive requires that personal data should only be collected for ‘specified,
explicit and legitimate’ purposes. Data are collected for certain aims; these aims are the ‘raison
d’être’ of the processing operations. As a prerequisite for other data quality requirements,
purpose specification will determine the relevant data to be collected, retention periods, and all
other key aspects of how personal data will be processed for the chosen purpose/s.” [emphasis
added]
294. In relation to the significance of the purpose limitation principle and its relationship to other key
elements of the data protection framework, the Working Party observed that:
“Thereisastrongconnectionbetweentransparencyandpurposespecification. Whenthespecified
purpose is visible and shared with stakeholders such as data protection authorities and data
subjects, safeguards can be fully effective. Transparency ensures predictability and enables user
control.”
295. Also:
“In terms of accountability, specification of the purpose in writing and production of adequate
documentation will help to demonstrate that the controller has complied with the requirement of
Article 6(1)(b). It would allow data subjects to exercise their rights more effectively – for example,
it would provide proof of the original purpose and allow comparison with subsequent processing
purposes.”
296. In terms of the benefits for the data subject, the Working Party observed that:
“In many situations, the requirement also allows data subjects to make informed choices – for
example, to deal with a company that uses personal data for a limited set of purposes rather than
with a company that uses personal data for a wider range of purposes.”
297. Further:
“It should be kept in mind that processing of personal data has an impact on individuals’
fundamentalrights intermsof privacy and data protection. This impacton the rights of individuals
must necessarily be accompanied by a limitation of the use that can be made of the data, and
therefore by a limitation of purpose. An erosion of the purpose limitation principle would
consequently result in the erosion of all related data protection principles.” [emphasis added]
298. It is clear, from the above, that the purpose limitation principle has an important role to play, both in
relation to the empowerment of the data subject but also in relation to underpinning and supporting
the objectives of the data protection framework, as a whole.
86299. It therefore seems to me that, when considering what information must be provided in relation to
the “purposes” of any processing operation (such as by way of Article 13(1)(c)), I must do so by
considering how the quality of information provided may potentially impact the effective operation
of the other data protection principles. This is particularly the case where the wording of Article
13(1)(c) maps the approach of Article 5(1)(b), i.e. by describing the obligation arising by reference to
“collection” and ‘further’ processing.
300. Given that the data controller identifies the categories of personal data that will need to be collected
by the application of the purpose specification element of the purpose limitation principle, it seems
to me that the provision of the Article 13(1)(c) information in conjunction with the
category/categories of personal data being processed is essential if the data subject is to be
empowered to hold the data controller accountable for compliance with the Article 5(1)(b) purpose
limitation principle. The Article 29 Working Party reflects this approach in the Transparency
Guidelines 12, as follows:
“Transparency, when adhered to by data controllers, empowers data subjects to hold data
controllers and processors accountable and to exercise control over their personal data by, for
example, providing or withdrawing informed consent and actioning their data subject rights. The
concept of transparency in the GDPR is user-centric rather than legalistic and is realised by way of
specific practical requirements on data controllers and processors in a number of articles.”
Conclusion – Preliminary Issue: What information must be provided pursuant to Article 13(1)(c)?
301. By way of the Preliminary Draft, I set out my view that, in order to achieve compliance with the
provisions of Article 13(1)(c), a data controller must provide the following information, and in the
following way (“the Proposed Approach”):
a. the purpose(s) of the specified processing operation/set of processing operations for which the
(specified category/specified categories of) personal data are intended; and
b. the legal basis being relied upon to support the processing operation/set of operations.
302. The information should be provided in such a way that there is a clear link from:
a. a specified category/specified categories of personal data, to
b. the purpose(s) of the specified processing operation/set of operations, and to
c. the legal basis being relied upon to support that processing operation/set of operations.
303. The provision of the information in this manner is, in my view, consistent with language of Article
13(1)(c) and all of theelementsthatfeed into, and flowfrom, the principle of transparency, including:
a. the definition of “processing” set out in Article 4(2);
125Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”)
87 b. the Article 13(1)(c) requirement for a data controller to provide information in relation to “the
purposes of the processing for which the personal data are intended” [emphasis added];
c. the role of the purpose limitation principle and the fact that the assessment required by this
principle will determine what personal data will be collected for the particular purpose(s);
d. the fact that Article 5(1)(a) clearly envisages a user-centric approach, i.e. “(p)ersonal data shall
be … processed lawfully, fairly and in a transparency manner in relation to the data subject”
[emphasis added];
e. the role of transparency in the context of accountability; and
f. the requirement, set out in Article 5(2), for the controller to “be responsible for, and be able to
demonstrate compliance with” all of the principles set out in Article 5(1), including the
transparency and purpose limitation principles.
Proportionality and the Proposed Approach
304. InsofarasWhatsApphassubmittedthattheapproachproposedbytheInvestigator,andincorporated
intotheProposedApproachabove,isinconsistentwiththeEUlawprincipleofproportionality,Ifirstly
note that this principle primarily operates to regulate the exercise of powers by the European Union.
The principle 126is enshrined in Article 5 of the Treaty on European Union, as follows:
“the content and form of Union action shall not exceed what is necessary to achieve the objectives
of the Treaties.”
305. Pursuant to this rule, the action of the European Union (and any institutions / state organs within the
EU, applying EU law) must be limited to what is necessary to achieve the objectives of the Treaties,
i.e. the content and form of the action must be in keeping with the aim pursued. The European
Commission confirmed that it took account of the principle when preparing its proposal in favour of
127
the new data protection framework (that would become the GDPR) :
“The principle of proportionalityrequiresthatanyintervention istargeted and does notgobeyond
what is necessary to achieve the objectives. This principle has guided the preparation of this
proposal from the identification and evaluation of alternative policy options to the drafting of the
legislative proposal.”
306. As I have referred to earlier in this Decision, when interpreting and applying EU law, the Commission
must not rely on an interpretation which would be in conflict with fundamental rights or with the
other general principles of EU law, such as the principle of proportionality. In this regard, I note that
the GDPR seeks to ensure the effective protection of the fundamental right to protection of personal
data as established by, and enshrined in, Article 8 of the Charter and Article 16 TFEU and Article 8 of
the ECHR. The GDPR seeks to achieve this objective by way of:
126Article 52 of the Charter of Fundamental Rights of the EU also emphasises the requirement of proportionality, in
relation to the application of rules concerning Charter protected rights.
127European Commission proposal (COM (2012) 11 final 2012/0011 (COD), published 25 January 2012
88 a. a set of core principles directed to ensuring that any processing of personal data is lawful, fair
and transparent in relation to the data subject (and which are practically implemented by way of
specific duties and obligations directed primarily to the data controller);
b. a robust range of rights for the data subject, designed to empower the data subject to exercise
control over his/her personal data and to hold the data controller accountable for compliance
with the core principles; and
c. the empowerment of supervisory authorities with a range of functions and powers, designed to
enable those supervisory authorities to enforce compliance with the requirements of the
framework.
307. As discussed briefly above, the GDPR envisages a more active role for the data subject than ever
before, with corresponding enhancements to the rights and entitlements that existed under the
previous framework. The effectiveness of those enhanced rights and entitlements, however, is
entirely dependent on the data subject’s state of knowledge. This fact was recognised by the CJEU in
Bara128, when the Court observed that:
“… the requirement to inform the data subjects about the processing of their personal data is all
the more important since it affects the exercise by the data subjects of their right of access to, and
right to rectify, the data being processed … and their rightto object to the processing of those data
…”
308. The Proposed Approach represents, in my view, the minimum information required to give
meaningful effect to the rights of the data subject. This approach respects the likelihood that:
a. a data controller will usually collect different categories of personal data from an individual data
subject at different times, in different ways and for different purposes and a data subject may
not always be aware thathis/her personal data isbeing collected (because, for example, the data
concerns the way in which a data subject interacts with a particular product or service and the
data is collected by technology operating automatically as a component part of that product or
service);
b. a data controller will always need to carry out more than one processing operation in order to
achieve the stated purpose of a processing operation; and
c. a data controller might collect a particular category of data for a number of different purposes,
each supported by a different legal basis.
309. Further, the Proposed Approach is, in my view, the only approach that will ensure, in each and every
case, that a data subject has been provided with meaningful information such that he/she knows (i)
which of his/her personal data are being processed, (ii) for what processing operation(s), (iii) for what
purpose(s),and(iv) inrelianceonwhichlegalbasis. Itisonlywhenthedatasubjecthasbeenprovided
with all of this information, that he/she is afforded a sufficient state of knowledge such that he/she
can meaningfully:
128Smaranda Bara and Others v Președintele Casei Naționale de Asigurări de Sănătate, Casa Naţională de Asigurări de
Sănătate, Agenţia Naţională de Administrare Fiscală (ANAF) (Case C-201/14, judgment delivered by the CJEU on 1 October
2015) (“Bara”)
89 a. exercise choice as to whether or not he/she might wish to exercise any of his/her data subject
rights and, if so, which one(s);
b. assess whether or not he/she satisfies any conditionality associated with the entitlement to
exercise a particular right;
c. assess whether or not he/she is entitled to have a particular right enforced by the data controller
concerned; and
d. assesswhether or nothe/she hasa ground of complaintsuch astobe able tomeaningfully assess
whether or not he/she wishes to exercise his/her right to lodge a complaint with a supervisory
authority.
310. Intermsofassessingthecorrespondingburdenonthedatacontroller,Ifirstlynotethatarequirement
for a data controller to provide the prescribed Article 13(1)(c) information in the manner required by
the Proposed Approach does not require the controller to do anything that it is not already required
to do. I note, in this regard:
a. The general principle of transparency set out in Article 5(1)(a) and detailed further in Articles 13
and 14;
b. Therequirement,setoutinArticle5(1)(b),forthedatacontrollertocarryoutapurposelimitation
assessment in order to determine, inter alia, the personal data that will need to be collected to
satisfy the stated purpose(s); and
c. The requirement, pursuant to Article 5(2), for the data controller to be able to demonstrate
compliance with all of the core principles.
311. Taking account of all of the above, it is my view that the Proposed Approach:
a. Requires the provision of the minimum information necessary to achieve the objectives of the
GDPR; and
b. In doing so, does not place any additional obligation on the data controller.
312. Accordingly, the Preliminary Draft recorded my satisfaction that the Proposed Approach is consistent
with the principle of proportionality.
WhatsApp’s Submissions in response to the Proposed Conclusion – Preliminary Issue:
313. WhatsApp, by way of the Preliminary Draft Submissions, sought to challenge the Proposed Approach
on a number of different grounds. WhatsApp firstly submitted that the Proposed Approach failed to
“respect the clear choices made by the drafters of the GDPR 129”. It submitted, in this regard, that
Article 13(1)(c) does not require the “categories of data” to be specified:
“It isignificant that Article 13 GDPR is itself an extremely detailed and prescriptive provision.
It is to be inferred in the circumstances that, had the legislators intended controllers to specify
129The Preliminary Draft Submissions, paragraph 6.5
90 the “categories of data” itwas processing in the context of specific processing operations they
would have made express provision for this. The fact that they have not done so reinforces
against the imposition of this kind of granular obligation .”30
314. It further submitted that:
“… it is clear from the fact that the concept is referred to in Article 14(1)(d) GDPR, that the
legislators made a deliberate choice not to include this concept in Article 13(1)(c) GDPR.
Moreover, if the Proposed Approach was correct there would be no need for Article 14(1)(d),
as Article 14 GDPR would in any event have to be approached on the basis that categories of
data needed to be identified. As such, the Proposed Approach appears to conflict with the
statutory interpretation principle expressio unis est exclusion alterius [sic], it cannot be
reconciled with the legislative intent of the drafters of the GDPR or the Transparency
Guidelines including in particular the Annex to the Transparency Guidelines relating to
131
“Information that must be provided to a data subject under Article 13 or Article 14 ” …”
315. Having considered the above submissions, I note that the first fundamental difference between
Article13andArticle14isthatArticle13isexpresslystatedtoapplyincircumstanceswhere“personal
data arecollectedfromthe data subject”. Article14,on the otherhand,only applies in circumstances
where personal data have been obtained from a source(s) other than the data subject. The second
fundamental difference is that the information prescribed by Article 13 must be provided to the data
subject “at the time when personal data are obtained”. The information prescribed by Article 14,
however, can only be provided after the personal data has been collected.
316. These fundamental differences give rise to three variations, as between the information required to
be provided pursuant to Article 13 and the information required to be provided pursuant to Article
14, as follows:
a. Firstly, Article 13(2)(e) requires the controller to inform the data subject as to “whether the
provision of personal data is a statutory or contractual requirement, or a requirement
necessary to enter into a contract, as well aswhether thedata subject is obliged to provide the
personal data and of the possible consequences of failure to provide such data.” Article 14, on
the other hand, contains no such requirement. The rationale for this difference is clear: when
this information is provided prior to the collection of personal data, the data subject is
empowered to exercise control over his/her personal data because he/she is not placed in a
position where he/she gives his/her personal data to the controller on a mistaken
understanding as to the necessity for its collection and/or the potential consequences of
failure to provide the data. The provision of such information would have no purpose if
provided to the data subject after the personal data has been collected, hence its omission
from Article 14.
b. In relation to the second and third variations, Article 14(1)(d) requires the data subject to be
provided with information as to the “categories of personal data concerned” while Article
14(2)(f) requires the provision of information as to the source “from which the personal data
130The Preliminary Draft Submissions, paragraph 6.11
131
The Preliminary Draft Submissions, paragraph 6.12
91 originate”. These requirements are notably absent from Article 13. In my view, the rationale
for these omissions is clear, by reference to the exemption to the obligation to provide
information set out in Article 13(4) and Article 14(5)(a). These exemptions provide that the
controller’s obligation to provide the specified information “shall not apply where and insofar
as the data subject already has the information”. In a case where the personal data has been
collected from the data subject, there is no need to provide information as to the “categories
of personal data concerned” or the source “from which the personal data originate” because
the data subject already has this information; it is the data subject himself/herself that has
provided the personal data to the controller and, in having done so, he/she already knows the
“categories of personal data concerned” and the source. The data subject will not have this
knowledge, however, if the data has been collected in the circumstances envisaged by Article
14. In my view, it is not the case that these two categories of information are only required to
be provided pursuant to Article 14. Rather, both Article 13 and 14 envisage that this
information will be provided but the circumstances in which Article 13 applies are such that
the relevantinformation willalready beknowntothe data subjectconcerned. Inother words,
Article 13 assumes that the data subject will already know the “categories of personal data
concerned” and the source of the data.
317. Returning to the submissions made by WhatsApp under this particular heading, it is not the case that
the Proposed Approach relies on an interpretation whereby the origin of the requirement to provide
information detailing the particular categories of data isArticle 13(1)(c) itself. Rather,my view is that
Article 13 presumes that the data subject concerned already knows the “categories of personal data
concerned” such that the purpose of Article 13(1)(c) is to inform the data subject about how
that/those data will be processed by the controller and in reliance in which legal basis. To put it
another way, my view is that Article 13 presumes that, aside from the information covered by Article
13(2)(e) (which, as noted above, serves no purpose once the personal data has been collected by the
controller), a data subject should be no less informed if he/she is covered by Article 13 than he/she
would be if he/she were to be covered by Article 14 (and vice versa). The analysis supporting the
Proposed Approach, as already discussed, reflects this.
318. For the sake of completeness, I have also considered the position from the perspective advanced by
WhatsApp, namely a position whereby Article 13 does not require the data subject to be informed as
to the categories of personal data that the controller intends to be processed. It is unclear to me why
a data subject would only be entitled to this information if the controller has acquired his/her
personal data from another source. It is further difficult to understand how such a difference in
treatment, between two categories of data subject, could be consistent with the GDPR, particularly
where the difference in treatment concerns a core data subject right.
319. WhatsApp’s Preliminary Draft Submissions secondly suggested that the Proposed Approach “cannot
be reconciled with the wider requirements embodied in Article 12 GDPR. 13” I have already
considered these submissions as part of my assessment of WhatsApp’s Submissions of General
Application, at paragraphs 213 - 233, above.
132The Preliminary Draft Submissions, paragraphs 6.5, 6.9, 6.13 and 6.14
92320. WhatsApp thirdly submitted that the Proposed Approach “results in an approach that cannot be
reconciled with the proportionality principle that governs the interpretation of this provision 133.” It
submitted, in this regard, that:
“The highly prescriptive notification provisions expressly embodied in Article 13 impose onerous
burdens on controllers and, consistent with the proportionality principle, it is not possible to apply
Article 13(1)(c) GDPR in the manner suggested by the Commission without arriving at a
disproportionate result going beyond what is necessary to achieve the GDPR’s objectives.
Consequently, to the extent that Article 13(1)(c) GDPR is open to interpretation, it should be
construed narrowly rather than the broad interpretation adopted by the Commission 13.”
321. As is evidentfrom the analysis of the Proposed Approach set out above, my assessment already takes
account of the requirement for proportionality.
322. WhatsApp fourthly submitted that the rationale underpinning the Proposed Approach, namely the
need to ensure that meaningful information is provided to empower data subjects to assess or
exercise their rights and grounds for complaint, “appears not to take into account the fact that
WhatsAppdoesprovideinformationonthecategoriesofdataitcollectsandprocessestodatasubjects
in the “Information We Collect” section of the Privacy Policy. 13”
323. WhatsApp is correct that, when formulating and assessing the Proposed Approach, I did not take
account of the extent of information that WhatsApp provides to data subjects. This is because, when
consideringtheissue,itwasappropriateformetodosointheabstractsoastoidentifytheapplicable
requirements, against which I could assess the extent to which WhatsApp has complied with same.
That assessment of compliance is set out below.
324. HavingconsideredthevarioussubmissionsmadebyWhatsApp,inrelationtotheProposedApproach,
I maintain my view that the Proposed Approach correctly reflects the requirements of Article
13(1)(c). That being the case, I will now proceed to assess the extent to which WhatsApp complies
with its obligations pursuant to Article 13(1)(c).
Assessment: Application of the Proposed Approach to Article 13(1)(c)
325. As set out above, the information required to be provided by Article 13(1)(c), by reference to the
Proposed Approach, is as follows:
a. The purpose(s) of the specified processing operation/set of operations for which the specified
category/categories of personal data are intended; and
b. The legal basis being relied on to support the identified processing operation/set of operations.
326. As set out in its Response to Investigator’s Questions, WhatsApp asserts that it provides the required
information by way of the Privacy Policy and Legal Basis Notice. Turning firstly to the Privacy Policy, I
note that the following information is provided under the heading“How The GeneralData Protection
Regulation Applies To Our European Region Users”:
133The Preliminary Draft Submissions, paragraph 6.5
134The Preliminary Draft Submissions, paragraph 6.17
135The Preliminary Draft Submissions, paragraph 6.15
93 “We collect, use, and share the information we have as described above:
as necessary to fulfill our Terms;
consistent with your consent, which you can revoke at any time;
as necessary to comply with our legal obligations;
occasionally to protect your vital interests, or those of others;
as necessary in the public interest; and
as necessary for our (or others') legitimate interests, including our interests in providing an
innovative, relevant, safe, and profitable service to our users and partners, unless those
interests are overridden by your interests or fundamental rights and freedoms that require
protection of personal data. Learn More”
327. Once the link embedded in the text “Learn More” is selected, the user is brought to the Legal Basis
Notice where further information is provided in relation to the identified legal bases.
328. For ease ofreview, Iwill proceedwith my assessment of the extenttowhichWhatsApp complieswith
its obligations pursuant to Article 13(1)(c) by reference to the individual legal bases identified by
WhatsAppinthe Privacy Policy(andelaborated uponinthe LegalBasisNotice). Iwillset outmyviews
under the heading “assessment” at the end of every section however, for the avoidance of doubt, I
will only make a single finding in relation to the extent to which WhatsApp complies with its
obligations under Article 13(1)(c), read in conjunction with Article 12(1).
Identified Legal Basis 1: Contractual Necessity
What information has been provided?
329. In this section, I will examine whether there has been compliance with Article 13(1)(c), insofar as
WhatsApp refers to reliance on the legal basis set out in Article 6(1)(b) (referred to as “contractual
necessity”). The Legal Basis Notice provides, in this regard, that:
“For all people who have legal capacity to enter into an enforceable contract, we process data as
necessary to perform our contracts with you (the Terms of Service, the "Terms"). We describe the
contractual services for which this data processing is necessary in Our Services section of the
Terms and in the additional informational resources accessible from our Terms. The core data
uses necessary to provide our contractual services are:
To provide, improve, customize, and support our Services as described in "Our Services";
To promote safety and security;
To transfer, transmit, store, or process your data outside the EEA, including to within the
United States and other countries; and
To communicate with you, for example, on Service-related issues.
These uses are explained in more detail in our Privacy Policy, under How We Use Information and
Our Global Operations. We'll use the data we have to provide these services; if you choose not to
provide certain data, the quality of your experience using WhatsApp may be impacted.”
330. As is clear from the above, the user is invited to receive more information by reference to the links
embedded in the following text:
94a. “Terms of Service” – this links the user to the top of the Terms of Service, on the Page. As set out
above, this is a relatively lengthy document (that contains further links to other documents,
including the Privacy Policy itself).
b. “Our Service” – this links the user to the section entitled “Our Service” within the Terms of
Service. The information available here is as follows:
“Privacy And Security Principles. Since we started WhatsApp, we've built our Services with
strong privacy and security principles in mind.
Connecting You With Other People. We provide ways for you to communicate with other
WhatsApp users including through messages, voice and video calls, sending images and
video, showing your status, and sharing your location with others when you choose. We
may provide a convenient platform that enables you to send and receive money to or from
other users across our platform. WhatsApp works with partners, service providers, and
affiliated companies to helpus provide ways for you to connect with their services. We use
the information we receive from them to help operate, provide, and improve our Services.
Ways To Improve Our Services. We analyze how you make use of WhatsApp, in order to
improve all aspects of our Services described here, including helping businesses who use
WhatsApp measure the effectiveness and distribution of their services and messages.
WhatsApp uses the information it has and also works with partners, service providers, and
affiliated companies to do this.
Communicating With Businesses. We provide ways for you and third parties, like
businesses, to communicate with each other using WhatsApp, such as through order,
transaction, and appointment information, delivery and shipping notifications, product
and service updates, and marketing. Messages you may receive containing marketing
could include an offer for something that might interest you. We do not want you to have
a spammy experience; as with all of your messages, you can manage these
communications, and we will honor the choices you make.
Safety And Security. We work to protect the safety and security of WhatsApp by
appropriately dealing with abusive people and activity and violations of our Terms. We
prohibit misuse of our Services, harmful conduct towards others, and violations of our
Termsandpolicies,andaddresssituationswherewemaybeabletohelpsupportorprotect
our community. We develop automated systems to improve our ability to detect and
remove abusive people and activity that may harm our community and the safety and
security of our Services. If we learn of people or activity like this, we will take appropriate
action by removing such people or activity or contacting law enforcement. We share
information with other affiliated companies when we learn of misuse or harmful conduct
by someone using our Services.
Enabling Global Access To Our Services. To operate our global Service, we need to store
and distribute content and information in data centers and systems around the world,
including outside your country of residence. This infrastructure may be owned or operated
by our service providers or affiliated companies.
Affiliated Companies. We are part of the Facebook Companies. As part of the Facebook
Companies, WhatsApp receives information from, and shares information with, the
Facebook Companies as described in WhatsApp's Privacy Policy. We use the information
wereceivefromthemtohelpoperate,provide,andimproveourServices.Learnmoreabout
the Facebook Companies and their terms and polices here.”
As evident from the above, three further hyperlinks have been embedded in certain text, within
the “Affiliated Companies” bullet point, as follows: “Facebook Companies”, “Privacy Policy” and
“here”. These links operate to link the user to the following additional information:
95 I. The “Facebook Companies” link brings the user to an “article” on the Facebook
Companies (hosted on Facebook’s website). This “article” contains a number of further
linkstoadditionalinformation,availableinotherlinked“articles”onFacebook’swebsite;
II. The “Privacy Policy” link brings the user back to the top of the Privacy Policy itself; and
III. The “here” link brings the user to the “article” on the Facebook Companies (hosted, as
before, on Facebook’s website).
c. “How We Use Information” – this links the user back to the “How We Use Information” section
of the Privacy Policy. This section contains the following information:
“How We Use Information
We use the information we have (subject to choices you make) to operate, provide, improve,
understand, customize, support, and market our Services. Here's how:
Our Services. We use the information we have to operate and provide our Services,
including providing customer support, and improving, fixing, and customizing our
Services. We understand how people use our Services and analyze and use the
information we haveto evaluate and improveour Services, research, develop, and test
new services and features, and conduct troubleshooting activities. We also use your
information to respond to you when you contact us.
Safety And Security. We verify accounts and activity, and promote safety and security
on and off our Services, such as by investigating suspicious activity or violations of our
Terms, and to ensure our Services are being used legally.
Communications About Our Services And The Facebook Companies. We use the
information we haveto communicate with youaboutour Services and features and let
you know about our terms and policies and other important updates. We may provide
you marketing for our Services and those of the Facebook Companies. Please see How
You Exercise Your Rights for more information.
NoThird-PartyBannerAds.Westilldonotallowthird-partybanneradsonWhatsApp.
We have no intention to introduce them, but if we ever do, we will update this policy.
Commercial Messaging. We will allow you and third parties, like businesses, to
communicate with each other using WhatsApp, such as through order, transaction,
and appointment information, delivery and shipping notifications, product and service
updates, and marketing. For example, you may receive flight status information for
upcoming travel, a receipt for something you purchased, or a notification when a
delivery will be made. Messages you may receive containing marketing could include
an offer for something thatmight interest you. We donot want you to have a spammy
experience; as with all of your messages, you can manage these communications, and
we will honor the choices you make.
Measurement, Analytics, And Other Business Services. We help businesses who use
WhatsApp measure the effectiveness and distribution of their services and messages,
and understand how people interact with them on our Services.”
As before, users are invited to receive further information by way of the links identified above.
The“HowYouExerciseYourRights”sectionmaybediscountedforthepurposeofthisassessment
(given that it pertains to the exercise of the data subject rights, rather than the legal basis being
relied upon for processing). The “Facebook Companies” link brings the user to the Facebook
Companies “article” on Facebook’s website, as before.
96 d. “OurGlobalOperations”–thislinkstheusertothe“OurGlobalOperations”sectionofthePrivacy
Policy. That section provides the following information:
“Our Global Operations
WhatsApp Ireland shares information globally, both internallywithin the FacebookCompanies,
and externally with our partners and with those you communicate around the world in
accordance with this Privacy Policy. Information controlled by WhatsApp Ireland will be
transferred or transmitted to, or stored and processed, in the United States or other countries
outside of where you live for the purposes as described in this Privacy Policy. These data
transfers are necessary to provide the Services set forth in our Terms and globally to operate
andprovideourServicestoyou.WeutilizestandardcontractclausesapprovedbytheEuropean
Commission, and may rely on the European Commission's adequacy decisions about certain
countries, as applicable, for data transfers from the European Economic Area to the United
States and other countries.
WhatsApp Inc. shares information globally, both internally within the Facebook Companies,
and externally with businesses, service providers, and partners and with those you
communicate with around the world. Your information may, for example, be transferred or
transmittedto,orstoredand processedintheUnitedStatesorothercountriesoutsideofwhere
you live for the purposes as described in this Privacy Policy.”
As evident from the above, this section invites the user to learn more by way of three embedded
hyperlinks. Theonlylinkrelevant,forthepurposeofthewithinassessment,isthelink to“Terms”
– this brings the user to the top of the Terms of Service. (The other links bring the user to
information pertaining to standard contractual clauses and adequacy decisions located on the
websites of Facebook and the European Commission).
How has the information been provided?
331. As set out above, the information, which WhatsApp asserts is provided by way of compliance with
Article 13(1)(c), is provided by way of a summary in the Legal Basis Notice with links to various other
documentsand texts. The approach taken issomewhatdisjointed inthat the “summary” of the “core
data uses” has been set out in very vague terms. If the user wishes to learn more, he/she must tackle
the Terms of Service and also review the “Our Global Operations” section of the Privacy Policy by way
of the links provided. When all of the available information has been accessed, it becomes apparent
that the texts provided are variations of each other. This approach lacks clarity and concision and
makes it difficult for the user to access meaningful information as to the processing operations that
will be grounded on the basis of contractual necessity. By way of example, it is unclear why the
“summary” of the “core data uses” could not have been prepared by reference to the contents of the
“Our Services” section of the Terms of Service, with more detailed information being made available
by way of a link (if a layered approach is WhatsApp’s preferred approach to the delivery of the
required information).
Assessment of Decision-Maker
332. Asalludedtoabove,theinformationprovidedbyWhatsApp,underthisheading,givesrisetoconcern,
from the perspective of the quality of information that has been provided as well as the way in which
it has been provided.
Quality of information provided
97333. Addressing, firstly, the quality of the information provided, it seems to me that insufficient detail has
been provided in relation to the processing operations that will be grounded upon the contractual
necessitybasis. Thelanguageuseddoesnotenabletheusertounderstandwhatwayhis/herpersonal
data will be processed for each purpose. By way of example, the statement “(t)o promote safety and
security”doesnotprovideanyindicationastowhatprocessingoperationswillbeappliedtotheuser’s
personal data(i.e.specifically howitwill beusedandinwhatcontext) tomeetthis objective. Further,
it does not enable a sufficient understanding as to what objectives are being pursued when personal
data is processed for the general purpose of “[the promotion of] safety and security”. Such an
approach deprives the user of meaningful information and further risks causing significant confusion
as to what legal basis will be relied upon to ground a specific processing operation. Further, it is not
possible to clearly identify the categories of personal data that will be processed for those processing
operations that will be grounded upon contractual necessity.
The way in which information has been provided
334. Article 12(1) requires information to be provided in a “concise, transparent, intelligible and easily
accessible form, using clear and plain language, in particular for any information addressed
specifically to a child.” The information, however, that has been provided by WhatsApp, above, has
been furnished in a piecemeal fashion that requires the user to link in and out of various different
sections of the Privacy Policy as well as the Terms of Service.
335. While WhatsApp suggested, in the Inquiry Submissions, that the user only needs to access the “Our
Services” section of the Terms of Service (and not the entirety of the Terms of Service), the language
used in the Legal Basis Notice suggests otherwise:
“We describe the contractual services for which this data processing is necessary in Our Services
section of the Terms and in the additional informational resources accessible from our Terms.”
[emphasis added]
336. Further, even if the user actively seeks out the additional information that is available by way of the
various links, he/she is presented with variations of information previously furnished. By way of
example, there is significant overlap between the information set out in the “How We Use
Information” Section (a link to which is embedded on the “Our Legal Bases For Processing
Information” sub-section of the Privacy Policy) and the contents of the “Our Services” section of the
Terms of Service. Similarly, the summary of “core uses” set out in the Contractual Necessity section
of the Legal Basis Notice contains a sub-set of the information provided in the “Our Services” section
of the Terms of Service. The way in which the information has been spread out and included in
similarly worded (linked) tranches of text means that any new elements available within a linked text
could easily be overlooked by the user due to the simultaneous overlap and discrepancies between
various portions of text dealing with same / similar issues in different locations. To be clear, it is not
the case that the user is presented with more detailed information once he/she avails of the links
provided; the information made available by way of embedded links is similar in content to the
information thatisavailableboth inthe primarytextandother linkedtexts –whichcreates significant
risk of confusion and opacity.
337. In short, the way in which the relevant information has been presented requires the user to work
hard to actively engage with the original text as well as seek out the additional texts made available
by way of the various links. This is unnecessary and could easily be alleviated by the adoption of a
98 more concise approach to the delivery of the relevant information. There does not appear to be any
particular complexity to the information being delivered; the difficulties arise from the absence of a
consideredapproach. Thesimplefactofthematteristhatthereisnosinglecompositetextorlayered
route available to the user such as would allow the user to quickly and easily understand the full
extent of processing operations that will take place on her/her personal data on the basis of
contractual necessity. Each additional layer presents the user with both similar information to that
already provided as well as new elements that are not easy to detect because the language used is
similar to the information that has been provided before. The user should not have to work hard to
access the prescribed information; nor should he/she be left wondering if he/she has exhausted all
availablesourcesofinformationandnorshouldhe/shehavetotrytoreconcilediscrepanciesbetween
the various pieces of information set out in different locations.
WhatsApp’s Response to Assessment of Decision-Maker
338. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above
assessment,submittingfirstlythat“(a)speoplewouldexpect,tounderstandtheservicesofferedunder
the contract users need only consult the “Our Services” section of the Terms of Service 136.” Further,
“WhatsAppstatesinsummaryfashionforwhatpurposesitreliesoncontractualnecessityin[thebullet
points provided] which, in themselves, serve to discharge WhatsApp’s Article 13(1)(c) GDPR
137
obligations in relation to contractual necessity .”
339. WhatsApp further emphasised that:
“from the perspective and experience of the user, they are (1) required to agree to the Terms of
ServicebeforeusingtheService,whichisclearlyexplainedinthe“OurServices”sectionoftheTerms
of Service; and (2) directed to the Privacy Policy and the Legal Basis Notice, which equally clearly
set out the “core data uses” and other helpful information. Having been provided with this clear
and comprehensive information and a link to the Terms of Service, the user is then informed that
additional informational resources are available. This additional information does not undermine
138
the information provided at (1) and (2). ”
340. It further submitted that the Preliminary Draft did not take account of:
“the benefit to users of more generally providing a range of easily accessible tools, settings and
measures to better understand the Services and how a data subject’s information will be used […
and …] the ease with which the user can navigate from the Privacy Policy to the linked Legal Basis
Notice and to the Terms of Service (and back), and the various other links and tools available to the
user at all times when using the service; nor does it take into account that these additional
resources are supplemental to the information which is required to be provided under Article
13(1)(c) GDPR. These resources are not considered by WhatsApp as assisting it to discharge its
Article 13(1)(c) GDPR obligations and nor should the Commission regard them as part of
WhatsApp’s compliance with this requirement. The information required by Article 13(1)(c) GDPR
is provided in the Privacy Policy and Legal Basis Notice …”
136The Preliminary Draft Submissions, paragraph 7.4
137The Preliminary Draft Submissions, paragraph 7.5
138The Preliminary Draft Submissions, paragraph 7.7
99341. WhatsApp also submitted that the proposed finding “conflicts with suggestions given by the
Commission as part of its pre-GDPR engagement with WhatsApp, as evidenced in an email dated 11
April 2018, in which the Commission confirmed that the use of “technological design” and “hyperlinks
139
to specific portions of the Terms/Privacy Policy” in the Legal Basis Notice was recommended .”
342. It is clear that WhatsApp and I fundamentally disagree as to my assessment of the information
provided by WhatsApp to users under this heading. I have already set out above the reasons why I
consider the information provided to be insufficient, in terms of quality and the manner of delivery.
My assessment, in this regard, already takes account of the matters raised by WhatsApp in the
Preliminary Draft Submissions and my concerns remain, notwithstanding WhatsApp’s perspective on
matters. Further,IdonotagreewithWhatsApp’ssubmissionconcerning“thebenefittousersofmore
generally providing a range of easily accessible tools, settings and measures” or “the ease with which
the user can navigate from the Privacy Policy to the linked Legal Basis Notice and to the Terms of
Service (and back) …”. Such matters are only beneficial to the user if the user has been provided with
theinformationthathe/sheisentitledtoreceive(whichIdonotconsidertobethecasehere). Finally,
my assessment of WhatsApp’s submissions concerning its pre-GDPR engagement with the
Commission’sConsultation UnithasalreadybeenconsideredaspartofmyassessmentofWhatsApp’s
Submissions of General Application, above.
Identified Legal Basis 2: Consent
What information has been provided?
343. In this section, I examine whether there has been compliance with Article 13(1)(c), insofar as
WhatsApp refers to reliance on the legal basis set out in Article 6(1)(a) (consent). With regard to
WhatsApp’s reliance on consent, the Legal Basis Notice provides that:
“The other legal bases we rely on in certain instances when processing your data are:
…
Your Consent
Forcollectingandusinginformationyouallowustoreceivethroughthedevice-basedsettingswhen
you enable them (such as access to your GPS location, camera, or photos), so we can provide the
features and services described when you enable the settings.”
How has the information been provided?
344. The information set out above has been provided in a clear and concise manner.
Assessment of Decision-Maker
345. While the manner in which the information has been made available to the user is clear and concise,
the quality of the information provided is insufficient in that it fails to identify the processing
operations that will be grounded upon the user’s consent. It further fails to identify the categories of
data that will be processed for the processing operations that will be grounded upon the user’s
consent. I note, in this regard, that the information provided specifically references the “collection”
and “use” of information that the user “allows” WhatsApp to receive through the device-based
settings, such as access to the user’s GPS location, camera or photos.
139
The Preliminary Draft Submissions, paragraph 7.4
100346. Inthe “Information We Collect” section of the Privacy Policy (a link towhichisembedded on the “Our
Legal Bases For Processing Information” sub-section of the Privacy Policy), however, the user is
informed as follows:
“Location Information. We collect device location information if you use our location
features, like when you choose to share your location with your contacts, view locations
nearby or those others have shared with you, and the like, and for diagnostics and
troubleshooting purposes such as if you are having trouble with our app's location features.
We use various technologies to determine location, including IP, GPS, Bluetooth signals, and
information about nearby Wi-Fi access points, beacons, and cell towers.” [emphasis added]
347. While it is perfectly obvious that WhatsApp will use device location information if the user decides to
enable his/her device-based settings so as to avail of WhatsApp’s location features, it is not clear,
from the above, whether WhatsApp will carry out any further processing operations and, if so, what
particular processing operations, on the user’s location data (as suggested by the use of the word
“collect” in the text quoted above).
WhatsApp’s Response to Assessment of Decision-Maker
348. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above
assessment, submitting that: “(t)he exact processing depends on the feature that is used by the user
and WhatsApp provides further information in this regard, including at the time the user makes the
choice. … Additionally, the categories of location data that are collected are identified in the Location
Information section of the … Privacy Policy 14.” WhatsApp further provided the consent user flows
for location data, by way of an appendix to the Preliminary Draft Submissions. WhatsApp submitted,
in this regard, that the user flows inform the user as to the purpose of the processing. The user flows
submitted contain the following text:
User Flow 1:
“To send a nearby place or your location, allow WhatsApp access to your location.
[Options provided:] NOT NOW [or] CONTINUE”
User Flow 2:
“Allow WhatsApp to access this device’s location?
[Options provided:] Deny [or] Allow
349. As before, it is clear that WhatsApp and I fundamentally disagree as to my assessment of the
information provided by WhatsApp to users under this heading. I have already set out above the
reasons why I consider the information provided to be insufficient, in terms of the quality of
information provided. My concerns remain, in this regard, notwithstanding WhatsApp’s perspective
on matters. I acknowledge, for example, WhatsApp’s submission that the exact processing, in any
case, will depend on the feature that is selected by the user. However, neither the submissions nor
the sample user flows provided demonstrate that the required further information, in relation to the
processing that will take place, is actually provided to the user, either at the time the user makes the
choice to activate a particular feature or otherwise.
140The Preliminary Draft Submissions, paragraph 7.10
101Identified Legal Basis 3: Legitimate Interests
What information has been provided?
350. In this section, I examine whether there has been compliance with Article 13(1)(c), insofar as
WhatsApp refers to reliance on the legal basis set out in Article 6(1)(f) (legitimate interests). In this
regard, the Legal Basis Notice provides the following information:
“The other legal bases we rely on in certain instances when processing your data are:
…
Our legitimate interests or the legitimate interests of a third party, where not outweighed by
your interests or fundamental rights and freedoms ("legitimate interests"):
For people under the age of majority (under 18, in most EU countries) who have a limited ability
to enter into an enforceable contract only, we may be unable to process personal data on the
grounds of contractual necessity. Nevertheless, when such a person uses our Services, it is in our
legitimate interests:
To provide, improve, customize, and support our Services as described in Our Services;
To promote safety and security; and
To communicate with you, for example, on Service-related issues.
The legitimate interests we rely on for this processing are:
To create, provide, support, and maintain innovative Services and features that enable
people under the age of majority to express themselves, communicate, discover, and
engage with information and businesses relevant to their interests, build community, and
utilize tools and features that promote their well-being;
To secure our platform and network, verify accounts and activity, combat harmful
conduct, detect and prevent spam and other bad experiences, and keep our Services and
all of the Facebook Company Products free of harmful or inappropriate content, and
investigate suspicious activity or violations of our terms or policies and to protect the
safety of people under the age of majority, including to prevent exploitation or other
harms to which such individuals may be particularly vulnerable.
For all people, including those under the age of majority:
For providing measurement, analytics, and other business services where we are
processing data as a controller. The legitimate interests we rely on for this processing
are:
o To provide accurate and reliable reporting to businesses and other partners, to
ensure accurate pricing and statistics on performance, and to demonstrate the
value our partners realise using our Services; and
o In the interests of businesses and other partners to help them understand their
customers and improve their businesses, validate our pricing models, and
evaluate the effectiveness and distribution of their services and messages, and
understand how people interact with them on our Services.
For providing marketing communications to you. The legitimate interests we rely on for
this processing are:
o To promote Facebook Company Products and issue direct marketing.
102 To share information with others including law enforcement and to respond to legal
requests. See our Privacy Policy under Law and Protection for more information. The
legitimate interests we rely on for this processing are:
o To prevent and address fraud, unauthorised use of the Facebook Company
Products, violations of our terms and policies, or other harmful or illegal activity;
to protect ourselves (including our rights, property or Products), our users or
others, including as part of investigations or regulatory inquiries; or to prevent
death or imminent bodily harm.
To share information with the Facebook Companies to promote safety and security. See
our Privacy Policy under "How We Work with Other Facebook Companies" for more
information. The legitimate interests we rely on for this processing are:
o To secure systems and fight spam, threats, abuse, or infringement activities and
promote safety and security across the Facebook Company Products.”
351. The text contains a number of embedded links which, when selected, bring the user to the following
text/information:
a. The “Our Services” section of the Terms of Service (which has further links to the “Facebook
Companies” and the “Privacy Policy”);
b. An “article”, hosted on Facebook’s website, entitled “Facebook Company Products” (containing
further links to other relevant/related “articles”, on Facebook’s website);
c. The “Law And Protection” section of the Privacy Policy;
d. The“HowWeWorkWith Other Facebook Companies” section of the Privacy Policy,with a further
link to a Frequently Asked Question (“FAQ”) on this topic (“the Facebook FAQ 14”);
e. An “article”, hosted on Facebook’s website, entitled “Facebook Companies” (containing further
links to other relevant/related “articles”, on Facebook’s website).
How has the information been provided?
352. The information has been provided largely by way of the relevant section of the Legal Basis Notice
with links to a number of other documents and texts. As before, the approach taken is somewhat
disjointed (albeit to a lesser degree than the contractual necessity section). As before, it is unclear
why the summary of core data uses referenced under the section that addresses those users under
the age of majority could not have been prepared by reference to the contents of the “Our Services”
section of the Terms of Service, with more detailed information being made available by way of a link
(if a layered approach is WhatsApp’s preferred approach to the delivery of the required information).
Assessment of Decision-Maker
353. As before, the information provided under this heading gives risk to concern, from the perspective
of the quality of information that has been provided as well as the way in which it has been provided.
Quality of information provided
141Available at https://faq.whatsapp.com/general/26000112/?eea=1 (the “Facebook FAQ”)
103354. It seems to me that insufficient detail has been provided in relation to the processing operations that
will be grounded upon the legitimate interests basis. Further, it is not possible to identify what
categories of personal data will be processed for those processing operations that will be grounded
upon this legal basis.
The way in which information has been provided
355. The information has been furnished in a piecemeal fashion that requires the user to link in and out of
various different sections of the Privacy Policy as well as the Terms of Service and a comprehensive
142
FAQ entitled “How we work with the Facebook Companies” (available by way of a link from the
linked “How We Work With Other Facebook Companies” section of the Privacy Policy). As before,
this results in a situation whereby, even if the user actively seeks out the additional information that
is available by way of the various links, he/she is presented with variations of information previously
furnished. The way in which the information has been spread out and included in similarly worded
tranches of text means that any new elements available within a linked text could easily be
overlooked by the user due to the simultaneous overlap and discrepancies between various portions
of text dealing with the same / similar issues in different locations. This is unnecessary and could
easily be alleviated by adopting a concise approach to the delivery of the relevant information.
356. As before, there is no single composite text or layered route available to the user such as would allow
the user to quickly and easily understand the full extent of processing operations that will be
conductedonher/herpersonaldatainrelianceonthelegitimateinterestslegalbasis. Eachadditional
layerpresentsthe user withsimilar information tothatalreadyprovided aswell asnew elementsthat
are not easy to detect. The user should not have to work hard to access the prescribed information;
nor should he/she be left wondering if they have exhausted all available sources of information and
nor should he/she have to try to reconcile discrepancies between the various pieces of information
given in different locations.
357. I also note, in this regard, that the Terms of Service appears to contradict the information set out in
the Legal Basis Notice, in relation to reliance on the legitimate interests basis for processing the
personal data of users who have not attained the age of majority. The Legal Basis Notices states, in
this regard, that the legitimate interests basis will ground processing operations in cases where the
user concerned has a limited ability to enter into an enforceable contract. The Terms of Service,
however, provides, in the “About Our Services” section, that:
“Age. If you live in a country in the European Region, you must be at least 16 years old to use our
Services or such greater age required in your country to register for or use our Services. … . In
addition to being of the minimum required age to use our Services under applicable law, if you are
not old enough to have authority to agree to our Terms in your country, your parent or guardian
must agree to our Terms on your behalf.” [emphasis added]
358. Thus, while the information provided suggests that inability to enter into a contract might mean that
WhatsApp will not be able to rely on the contract legal basis for any consequent processing of
personal data, the Terms of Service clearly require a contract to be entered into, if necessary, by a
parent or guardian acting on behalf of the user concerned. This appears to be somewhat of a
contradiction in terms.
142Available at https://faq.whatsapp.com/general/26000112/?eea=1 (the “Facebook FAQ”)
104359. Further, the bullet point summary of processing operations set out under this legitimate interests
heading includes three of the four operations listed under the contractual necessity heading. If it is
thecasethatthelegitimateinterestsbasiswillformthebasisforprocessinginthecaseofthoseunder
the age of majority, it is unclear why reference to “the transmission, storage and processing of data
outside of the EEA” has been omitted from this summary list.
360. I further note that a number of the objectives set out in the general body of the legitimate interests
section have already been included in the contractual necessity section. Similarly, by incorporating a
link tothe “LawAndProtection” section, thisindicates thatthe legitimate interestsbasiswill form the
basis for any processing set out in this text, including for the purpose of “[responding] pursuant to
applicable law or regulations, to legal process, or to government requests”. The same issue arises in
relationtotheincorporationofalinktothe“HowWeWorkWithOtherFacebookCompanies”section
of the Privacy Policy. I note, in this regard, that such processing has also been included under the
contractual necessity heading. Thisstate of affairsleaves the user unable toidentify whichlegalbasis
is being relied upon when processing his/her personal data for any required processing activities.
WhatsApp’s Response to Assessment of Decision-Maker
361. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above
assessment, submitting that the provision of additional information through links “does not
undermine the information made available in the Legal Basis Notice but rather helps the user better
understand the Service and how a data subject’s information will be used. A reduction of information
or removing convenient hyperlinks to relevant information would have the effect of reducing overall
143
user understanding and control of the Service, to the detriment of users ”.
362. In relation to my observation that “a number of the objectives set out in the general body of the
legitimate interests section have already been included in the contractual necessity section … This
state of affairsleaves the user unable to identifywhich legalbasis isbeing relied upon…”, WhatsApp’s
position is that it “has designed the Legal Basis Notice in this manner, as depending on the
circumstances,morethanonelegalbasisforprocessingmaybeapplicabletoprocessingpursuing
the same objective. … WhatsApp is being transparent about the fact that it relies on different
144
legalbasesindifferentcircumstances,anddoesnotconsiderthisshouldbeapointofcriticism .”
363. As before, it is clear that WhatsApp and I fundamentally disagree as to my assessment of the
information provided by WhatsApp under this heading. I have already set out, above, the reasons
why I consider the information provided tobe insufficient, in terms of quality and manner of delivery.
That assessment already takes account of the matters raised by WhatsApp in the Preliminary Draft
Submissions and my concerns remain, in this regard, notwithstanding WhatsApp’s perspective on
matters. I remain particularly concerned about the position whereby the data subject is unable to
identify, from the information provided, which legal basis is being relied upon to support what
particular processing operation.
143The Preliminary Draft Submissions, paragraph 7.14
144The Preliminary Draft Submissions, paragraph 7.16
105Identified Legal Basis 4: Compliance with a Legal Obligation
What information has been provided?
364. In this section, I examine whether there has been compliance with Article 13(1)(c), insofar as
WhatsApp refers to reliance on the legal basis set out in Article 6(1)(c) (compliance with a legal
obligation). In this regard, the Legal Basis Notice provides the following information under this
heading:
“The other legal bases we rely on in certain instances when processing your data are:
…
For processing data when the law requires it, including, for example, if there is a valid legal request
for certain data. See our Privacy Policy under Law and Protection for more information.”
365. The “Law And Protection” section of the Privacy Policy further provides as follows:
“Law And Protection
We collect, use, preserve, and share your information if we have a good-faith belief that it is
reasonably necessary to: (a) respond pursuant to applicable law or regulations, to legal process, or
to government requests; (b) enforce our Terms and any other applicable terms and policies,
including for investigations of potential violations; (c) detect, investigate, prevent, and address
fraud and other illegal activity, security, or technical issues; or (d) protect the rights, property, and
safety of our users, WhatsApp, the Facebook Companies, or others, including to prevent death or
imminent bodily harm.”
How has the information been provided?
366. The information has been provided by way of a short statement in the body of the Legal Basis Notice
with a link to a short text in the “Law And Protection” section of the Privacy Policy, as referred to
above.
Assessment of Decision-Maker
Quality of information provided
367. I note that the “Law And Protection” section has already been incorporated, by way of a link, into the
legitimate interests section. In these circumstances, its incorporation into the “legal obligations”
section is a source of potential confusion for the user. I further note that, while the “Law And
Protection” section identifiessome processingoperations(“collect”, “preserve”and “share”), itisnot
clear what processing operations might be covered by the umbrella term “use”. Further, and while I
acknowledge that the processing that might be necessitated in the circumstances covered by this
heading is largely dependent on the occurrence of certain events, the user should be provided with
some indication as to what categories of personal data might be processed under this heading.
368. I note, in this regard, that there is information available elsewhere on the WhatsApp website that
might assist the user to understand how and why his/her personal data might be processed under
this heading. There are links within the Privacy Policy (embedded in text such as “end-to-end
145
encrypted”) that links the user to WhatsApp’s “End-to-end encryption” FAQ . There are a series of
145
Available at https://faq.whatsapp.com/en/general/28030015
106 further links within that document, including one that links to an “Information for Law Enforcement
Authorities” FAQ 146. While I note that this document does not appear to be directed to EEA users
(given that it only references WhatsApp, Inc., rather than WhatsApp), it provides useful information
about the circumstances in which WhatsApp might have to share information with law enforcement
authorities. Given the requirement for the data controller to provide “meaningful” information to
the data subject, I recommend that consideration is given to a more direct incorporation of this
document (with appropriate references to WhatsApp) or, at the very least, the incorporation of
similar information, into the Privacy Policy (insofar as the information proffered in that document
might be applicable).
369. I am further of the view that, where WhatsApp intends to ground a processing operation on this legal
basis, it should also identify the “European Union law or Member State law” giving rise to the
obligation for WhatsApp to process data.
The way in which information has been provided
370. The requirements of Article 12(1) are clear in that any prescribed information must be provided in a
“concise, transparent, intelligible and easily accessible form, using clear and plain language …”. The
information that has been provided by WhatsApp, however, is somewhat opaque and does not
enable the user to understand the circumstances in which his/her personal data will be processed
under this heading.
WhatsApp’s Response to Assessment of Decision-Maker
371. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above
assessment, submitting that “(t)he reality is that the processing described in the “Lawand Protection”
section may be based on legal obligation or legitimate interest depending on the circumstances at
hand 14”.
372. Further, “(i)n light of the sensitive and often complex processing that occurs for law enforcement
purposes, the description of the processing (considered together, i.e. “collect, use, preserve and
share”) in combination with therest of the section gives usersa clearpictureof the ways inwhich
their data may be “used”. While “use” is a broad term, when read together with the rest of the
section, WhatsApp considers it is sufficiently clear .”48
373. Again, it is clear that WhatsApp and I fundamentally disagree as to my assessment of the
information provided by WhatsApp to users under this heading. I have already set out above
reasons why I consider the information provided to be insufficient, in terms of quality and the
manner of delivery. My concerns remain, in this regard, notwithstanding WhatsApp’s
perspective on matters.
374. While my view, as set out in paragraph 369 above, that information should be provided in relation to
anyunderlyinglegalobligationsetoutinEUorMemberStatelaw,wasnotincludedinthePreliminary
Draft, inthe contextof my assessmentof Article 13(1)(c) concerningWhatsApp’sreliance on the legal
obligation legal basis, it was however included in the context of my assessment of the information
146Available at https://faq.whatsapp.com/en/general/26000050
147The Preliminary Draft Submissions, paragraph 7.17
148The Preliminary Draft Submissions, paragraph 7.18
107 provided under the heading “Identified Legal Basis 6: Tasks carried out in the public interest”. Given
thatArticle6(3)istheoriginforthisrequirement,inbothcases,IamappraisedofWhatsApp’sposition
on the issue by virtue of thesubmissions thatitfurnished inresponse tomy assessmentof “Identified
Legal Basis 6: Tasks carried out in the public interest”. In the circumstances, my response to those
submissions, as set out in paragraphs 394 – 398, below, applies equally here.
375. WhatsApp, by way of its Article 65 Submissions, expressed the view that my conclusion, as regards
the requirement for a data controller to identify the European Union law or Member State law giving
rise to the relevant obligation is “flawed in substance” on the basis, inter alia, that49:
a. “The legislature specifically prescribed that such information be provided in Article 13(1)(d)
GDPR, and the fact that it did not choose to do the same with respect to Article 13(1)(c) is
significant.”
b. “There are also straightforward reasons to justify drawing a distinction between these
provisions. For example, it is feasible for controllers when preparing a privacy policy to
identify the legitimate interests they are pursuing to process data under Article 6(1)(f) GDPR,
in a way which would not be the case if controllers were required to exhaustively identify in
their privacy policy all legal obligations that may justify them processing data pursuant to
Articles 6(1)(c) and/or 6(1)(e) GDPR. This is because a controller decides (and so can readily
identify) the legitimate interests it wishes to rely on pursuant to Article 6(1)(f) GDPR;however
a controller does not decide which legal obligations it is subject to and which may be relevant
to Articles 6(1)(c) and/or 6(1)(e) GDPR given this is the responsibility of law makers, both at
EU level and national level.”
c. “The Commission’s approach would be infeasible for controllers. For example, in Ireland,
various regulatory bodies have a wide range of powers to request information from entities
such as[WhatsApp], and these powerschange atthe discretion of the Irish legislature. Ontop
of this, a multitude of regulatory bodies fromacrossother EUMember States alsohave a wide
range of powers to request information – again at the discretion of their legislatures – which
they might consider would also apply to entities such as [WhatsApp]. It is not feasible as a
matter of practice for a controller to identify all such laws in existence when preparing a
privacy policy. Indeed it may be the case that the controller only becomes aware of a
particular legal obligation at the time when such powersare exercised, once it is put on notice
and after it has had the opportunity to consider their applicability on the facts of a specific
request. The approach prescribed by the Commission therefore risks imposing obligations on
controllers which would be impossible to comply with.”
d. A similar issue arises with respect to Irish criminal laws, where laws which may give rise to a
requirement to produce information to law enforcement are spread across numerous pieces
of primary and secondary legislation. As one illustration of this, the Law Reform Commission
reported that as of 2015, more than 300 separate legislative provisions … provide for powers
to issue search warrants. It simply cannot have been the legislative intention to exhaustively
list all such legal obligations that a controller is subject to in order to comply with its
obligations under Article 13(1)(c) GDPR.”
149The Article 65 Submissions, paragraphs 53.1 to 53.7
108 e. Even if controllers were able to identify all such relevant legal obligations in advance, the long
list of names of statutory provisions that would then need to be provided to data subjects
would serve only to overwhelm them with detailed – and, for most practical purposes, useless
– information.” WhatsApp has further submitted, in this regard, that, in the event that I
consider “such information regarding laws” to be required by Article 13(1)(c), I should
conclude that it would be “more beneficial for data subjects if controllers were to, at most,
describe the categories or types of laws engaged, and explain how these categories or types
of laws could result in the processing of their data”. WhatsApp considers that this is the “only
way in which such information could feasibly be provided by controllers and be meaningful
for a data subject.”
376. InotethatIhavealreadyaddressedthematterscoveredbythesubmissionssummarisedatparagraph
375(a),above,aspartofthesame assessmentcarriedoutfor thepurpose oftheinformation required
to be provided where a data controller intends to processpersonal data on the basis of Article 6(1)(e)
(tasks carried out in the public interest). I remain of the views set out in paragraphs 394 to 398,
below.
377. As regards the submissions set out at paragraph 375(b), above, I disagree that the fact that a
controller does not decide which legal obligations it is subject to is a relevant consideration. If a data
controller processespersonal data inpursuitofcompliancewith alegalobligation, then thecontroller
is in a position to “readily identify” and inform the data subjects concerned about the processing and
the reason for the processing. To be clear, it is not the case, as appears to be suggested by
WhatsApp’s submissions, that a data controller is required to “exhaustively identify … all legal
obligations that may justify them processing data pursuant to Articles 6(1)(c) and/or 6(1)(e) GDPR”
[emphasis added]. A controller either processes personal data pursuant to a requirement set out in
EUorMemberStatelaworitdoesnot;ifitdoes,thenallthatisrequiredisforthecontrollertoinform
the data subjects concerned about that processing along with the underlying legal requirement.
378. I further do not agree that such a requirement would be “infeasible” for controllers, as suggested. If
it is the case that a controller becomes subject to a new legal requirement to process personal data,
then all that is required is for the data controller to update its privacy policy to reflect that. It is
important to remember, in this regard, that the transparency obligation is an ongoing one and not
one which can be complied with on a once-off basis. As with all of the obligations that are imposed
on data controllers, the GDPR requires controllers to continually monitor and review their practices
to ensure ongoing compliance with the obligations arising. This is particularly the case for the
transparency obligation, which is not only one of the core data subject rights but also one of the fair
processingprinciplesenshrinedinArticle5oftheGDPR. WhileInoteWhatsApp’sreferencetoa2015
report from the Law Reform Commission, identifying more than 300 separate legislative provisions
providing for powers to issue search warrants, it is unlikely to be the case that WhatsApp is subject
to a requirement to process personal data pursuant to each one of those provisions.
379. As regards the suggestion that a requirement to provide information as to the underlying legal
obligation would result in the data subject being overwhelmed with “details – and, for most practical
purposes, useless – information”, I firstly disagree that such information is appropriately classified as
“useless”. Theinformationenables the data subjecttounderstand why his/her personaldata isbeing
processed, thereby enabling him/her to (i) hold the relevant controller accountable and (ii) exercise
109 his/her data subject rights, if he/she wishes to do so. I secondly disagree that a requirement to
provide such information will result in the data subject being overwhelmed with “details”. As noted
above, all a controller is required to do is identify any legislative provisions pursuant to which it
(actually, rather than potentially) processes personal data. Once this information is provided in a
clear and concise manner (as required by Article 12), it is difficult to see how this would operate to
overwhelm a data subject. Accordingly, I do not agree that it would be necessary or appropriate for
me to conclude that it would be more beneficial for data subjects if controllers were to “at most,
describe the categories or types of law engaged, and explain how these categories or types of laws
could result in the processing of their data”, as suggested by WhatsApp.
Identified Legal Basis 5: The vital interests of the data subject or those of another person
What information has been provided?
380. In this section, I examine whether there has been compliance with Article 13(1)(c) insofar as
WhatsApp refers to reliance on the legal basis set out in Article 6(1)(d) (vital interests of the data
subject or another person). In this regard, the Legal Basis Notice provides the following information
under this heading:
“The other legal bases we rely on in certain instances when processing your data are:
…
The vital interests we rely on for this processing include protection of your life or physical integrity
or that of others, and we rely on it to combat harmfulconduct and promote safety and security, for
example, when we are investigating reports of harmful conduct or when someone needs help.”
How has the information been provided?
381. The information has been provided by way of the above statement.
Assessment of Decision-Maker
382. I note that the text quoted above suggests that the vital interests basis will be used to ground
processing in the context of combatting “harmful conduct” and to “promote safety and security, for
example, when we are investigating reports of harmful conduct”. Given that these objectives have
already been referenced in the contractual necessity and legitimate interests sections, the expected
processing operation(s) should be set out with greater granularity so that the user can identify which
‘safety and security’ objectives will be grounded on vital interests, as distinct from other similar
objectives for which another legal basis is relied on. Further, the user should be provided with some
indication of whatcategories ofhis/herpersonal datamightneedtobe processedunderthisheading.
Again, I appreciate that the processing that might be necessitated under this heading is entirely
dependent on the occurrence of particular events however WhatsApp should be able to, at the very
least, provide the user with some examples of the type of data that has been processed by reference
to the vital interests legal basis in the past.
WhatsApp’s Response to Assessment of Decision-Maker
383. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above
assessment, submitting that it does not consider that:
110 “more granularity is required to comply with Article 13(1)(c) GDPR in this regard. In particular,
WhatsApp is of the view that the user is already provided with adequate information so that the
user can identify which “safety and security” objectives will be grounded on vital interests … as it is
evident that this will be engaged in circumstances where a life or physical integrity is at risk.”
Nonetheless, WhatsApp intends to provide the user with some examples of the type of data that
150
has been processed by reference to past processing, as suggested by the Commission. ”
384. As before, it is clear that WhatsApp and I fundamentally disagree as to my assessment of the
information provided by WhatsApp to users under this heading. I have already set out above the
reasons why I consider the information provided to be insufficient, in terms of the quality of the
information that has been provided. My concerns remain, in this regard, notwithstanding
WhatsApp’s perspective on matters however I acknowledge that WhatsApp intends to provide the
user with examples, as suggested.
Identified Legal Basis 6: Tasks carried out in the public interest
What information has been provided?
385. In this section, I examine whether there has been compliance with Article 13(1)(c), insofar as
WhatsApp refers to reliance on the legal basis set out in Article 6(1)(e) (tasks carried out in the public
interest). Inthisregard, theLegal BasisNotice providesthe followinginformation under thisheading:
“The other legal bases we rely on in certain instances when processing your data are:
…
For undertaking research and to promote safety and security, as described in more detail in our
Privacy Policy under How We Use Information, where this is necessary in the public interest as laid
down by European Union law or Member State law to which we are subject.”
How has the information been provided?
386. The information has been provided by way of the statement set out above with a link that, when
selected, brings the user back to the “How We Use Information” section of the Privacy Policy. While
thatsection containstwo further embedded links, the one relevanttothisassessmentbringsthe user
to an “article” hosted on the Facebook website entitled “the Facebook Companies” (which contains
further links to further relevant information).
Assessment of Decision-Maker
Quality of information provided
387. I am unable to identify at any level, based on the information that has been provided in relation to
this legal basis, what sort of processing operation will be grounded on this legal basis and what
categoriesofpersonaldatawillbeprocessedunderthisheading. WhereWhatsAppintendstoground
a processing operation on this legal basis, it should also identify the “European Union law or Member
State law” giving rise to the obligation for WhatsApp to process data.
388. I further note that “the promotion of safety and security” has been included under the contractual
necessity heading, the legitimate interests heading and the vital interests heading. If this is not an
150
The Preliminary Draft Submissions, paragraph 7.21
111 error, WhatsApp must identify, with sufficient granularity, the relevant processing operation(s) that
will be carried out, under each heading, for the purpose of the promotion of safety and security.
The way in which information has been provided
389. Further, it is unfortunate that the way in which the information has been provided is somewhat
circular in that:
a. The user is linked to the Legal Basis Notice by the “Our Legal Basis For Processing Information”
section of the Privacy Policy. The top of that section includes a link back to the “How We Use
Information” section of the Privacy Policy.
b. Thus, the inclusion of a link back to the “How We Use Information” section of the Privacy Policy
does notprovidetheuserwith anynewormoredetailedinformation butmerelybringsthe user
in a circle back to the original starting point.
390. WhatsAppisperfectlyentitledtoincorporatelayeringintoitsapproachtothedeliveryofinformation.
In order for this to be effective, however, it must be done in a considered way such that the
information beingprovided, acrossthe variouslayers, still meetsthe requirementsof Article 12(1) for
informationtobeprovidedina“concise,transparent,intelligibleandeasilyaccessibleform”. Bringing
the user on a pointless circuitous route, as detailed above, does not achieve this.
WhatsApp’s Response to Assessment of Decision-Maker
391. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above
assessment, submitting firstly that:
“WhatsApp does not consider a requirement can be construed under Article 13(1)(c) GDPR to
exhaustively list in a privacy policy-type document all the EU or Member State laws potentially
engaged when a controller might rely on Article 6(1)(e) as a legal basis to process personal data.
We would question whether it is even possible to identify in advance every such applicable law.
Additionally, if this were the case, when new laws are enacted at EU or Member State level that
might impose a duty on WhatsApp to carry out tasks in the public interest, WhatsApp would have
to update its Privacy Policy each time. This would be impractical to implement, particularly where
an applicable situation develops at pace (which could very well be the case in circumstances of
public interest). This would be confusing for users, would be likely to create information fatigue,
and would not be proportionate to WhatsApp’s obligations under the GDPR 15.”
392. It further submitted that “… for the same reasons, WhatsApp does not consider there can be a
requirement to specify with granularity the processing operations that will take place under “the
promotion of safety and security” heading .” 152
393. As before, it is clear that WhatsApp and I fundamentally disagree as to my assessment of the
informationprovidedby WhatsApp to usersunderthisheading. Ihave alreadyset out abovethe
reasons why I consider the information provided to be insufficient, in terms of quality and the
151The Preliminary Draft Submissions, paragraph 7.22
152The Preliminary Draft Submissions, paragraph 7.24
112 manner of delivery. My concerns remain, in this regard, notwithstanding WhatsApp’s
perspective on matters.
394. In relation to WhatsApp’s submission that Article 13(1)(c) does not require the identification of
the underlyingEUorMember State law, Inote that itis firstly clear, from Article6(3) (andRecital
45), that, in order for a controller to be able to process personal data in reliance upon Article
6(1)(e),thebasisfortheprocessingmustbelaiddownbyEUorMemberStatelaw. Theexistence
of such legal underpinning is therefore a component part of reliance upon Article 6(1)(e).
395. Article 13(1)(c) requires the provision of information concerning the “legal basis for the
processing”. It is clear, from Article 6(3), that the underlying EU or Member State law forms the
basis of processing carriedout in reliance on Article 6(1)(e). That being thecase,myview is that,
where a controller intends to process personal data in reliance on Article 6(1)(e), Article 13(1)(c)
requires the controller to inform the data subject not only of its intended reliance on Article
6(1)(e),butalsooftheEUorMemberStatelawthatformstheunderlyingbasisfortheprocessing
concerned.
396. I note that such an approach is consistent with the purpose of the transparency obligation, as
considered as part of the assessment that led to the formulation of the Proposed Approach,
above. I note, in particular, the role of transparency in helping the data subject to hold the data
controller accountable.
397. I further note that Article 13 already indicates that this is the correct approach, by reference to the
requirement, set out in Article 13(1)(d), for the controller to identify the legitimate interests being
pursued ina case where theprocessingisgrounded upon Article 6(1)(f). Theexistence of a legitimate
interest plays a similar role, in the context of Article 6(1)(f), as that played by the underlying EU or
Member State law, in the context of Article 6(1)(e). That being the case, it would not make sense for
Article 13 to require the identification of the legitimate interest being pursued, in the case of
processing grounded upon Article 6(1)(f), but not the underlying EU or Member State law that forms
the basis for processing grounded upon Article 6(1)(e).
398. Finally, and insofar asitmightbe suggested thatthe above approach isinconsistentwith the principle
of expressio unius est exclusio alterius (on the basis that the express inclusion of the requirement to
provide information about the legitimate interest being pursued suggests that the legislator did not
intend for Article 13 to contain a similar requirement as regards the provision of information
concerning any underlying legal requirement enshrined in EU or Member State law), I note that it is
not possible to rely on Article 6(1)(c) or (e) in the abstract; both are subject to compliance with the
provisions of Article 6(3). This is not the case with Article 6(1)(f), which is self-contained and not
subject to any additional and specific conditionality within Article 6 itself. This means that, in the
context of Article 13, it was not necessary for the legislator to specifically require the provision of
information as to the underlying EU or Member State law where the applicable legal basis is Article
6(1)(c)or6(1)(e);thisrequirementhasalreadybeen incorporatedintotheseprovisionsbyArticle6(3).
The absence of such a corresponding provision in the context of Article 6(1)(f) meant that it was
necessary for the legislator to specifically incorporate a requirement for information to be provided
about the underlying legitimate interest where, pursuant to Article 13(1)(c), the data controller has
confirmed its intention to rely on Article 6(1)(f) to ground its processing.
113Finding: Article 13(1)(c) – The purposes of the processing for which the personal data are intended
as well as the legal basis for the processing
399. For thereasons set out inthe assessment sections above, I findthat WhatsApphas failed to comply
with its obligations pursuant to Article 13(1)(c) and Article 12(1).
Article 13(1)(d) – where applicable, the Legitimate Interests being pursued
Required Information and WhatsApp’s Response to Investigator’s Questions
400. Article 13(1)(d) requires a data controller, “where the processing is based on [the legitimate interests
ground]” to provide information to the data subject in relation to “the legitimate interests being
pursued by the controller or by a third party”.
401. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 4, that:
“[WhatsApp] identifies legitimate interests pursued in the ‘How We Process Your Information’
notice.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
402. The Investigator set out her views in relation to the extent to which WhatsApp complies with its
obligation under this heading by reference to Proposed Findings 8 and 9.
403. By reference to Proposed Finding 8, the Investigator considered the information that had been
provided under this heading, where that information was “addressed specifically to a child”. The
Investigator expressed the view, in this regard, that the language used “in relation to the legitimate
interests pursued when processing the personal data of people under the age of majority is
unchanged from the vocabulary, tone and style of the information utilised throughout the “How We
Process Your Information” Notice.” Accordingly, the Investigator proposed a finding that the
language of the information provided under Article 13(1)(d) was “not inline with the requirements of
clarity for people under the age of majority, in contravention of Article 12(1) of the GDPR”.
153
404. WhatsApp disagreed with the Investigator’s views. It submitted that:
“… the Draft Report refers to “children” throughout but does not acknowledge that the WhatsApp
Terms of Service require users in the European Region to be at least 16 years old to use the service.
This is an important consideration as what information can be understood by a 16 year old is likely
very different from that which can be understood by a 13 year old, and the [Investigator] appears
to have taken no account of this.”
405. The Investigator countered that “in the absence of such a distinction in the GDPR or in the
Transparency Guidelines, the guidelines regarding communication with a child remain applicable in
respectof communicationsaddressed specifically topersonsaged 16 or17yearsold.” She confirmed
her view, by way of Conclusion 8, that “the language of the information provided under Article
153
The Inquiry Submissions, paragraph 10.2
114 13(1)(d) of the GDPR is not in line with the requirements of clarity for people under the age of
majority, in contravention of Article 12(1) of the GDPR.”
406. By reference to Proposed Finding 9, the Investigator expressed the view that the Article 13(1)(d)
requirement to identify the legitimate interests being pursued was:
“a cumulative requirement, which results in Articles 13(1)(c) and 13(1)(d) operating together to
place upon the data controller a requirement to set out the purposes of the processing in relation
to the legitimate interests legal basis, along with the legitimate interests being pursued in carrying
out the processing operations.”
407. The Investigator formed the view that the Legal Basis Notice “[conflated] the purposes of the
processing of personal data with the legitimate interests relied upon to process personal data,
without setting out any specific information in relation to the processing operation(s) or set of
operations involved.”
408. Accordingly, the Investigator proposed a finding that WhatsApp failed to fully comply with its
obligationtoprovideinformationinrelationtothelegitimateinterestslegalbasis,pursuanttoArticles
13(1)(c) and 13(1)(d) of the GDPR.
409. WhatsApp disagreed with the Investigator’s views. It submitted 154 that:
“In assessing the adequacy of the information provided, the Draft Report also fails to take into
account that the description of the purpose of the processing will often, in and of itself, necessarily
identify the nature of the legitimate interest in issue. The proposed finding is also based on a
mischaracterisation of the obligation on a controller under Article 13(1)(c) – i.e. there is no need to
specify “processing operations” … .”
410. The Investigator was unconvinced by WhatsApp’s submissions and confirmed her view, by way of
Conclusion 9, that WhatsApp failed to fully comply with its obligation to provide information in
relation to the legitimate interests legal basis, pursuant to Articles 13(1)(c) and 13(1)(d) of the GDPR.
Assessment of Decision-Maker: What information has been provided?
411. The information provided has been detailed above (in the “legitimate interests” section of the Article
13(1)(c) assessment) and can be found in the Legal Basis Notice.
Assessment of Decision-Maker: How has the information been provided?
412. The information has been provided by way of a series of bullet points, under identified objectives
(that need to be detailed with greater specificity, as discussed under the Article 13(1)(c) assessment,
above). In this way, the user can clearly identify which legitimate interests are being pursued under
eachidentified objective. The information itself hasbeenprovided ina meaningful manner,such that
the user is enabled to understand the legitimate interests being pursued. While I note that the
Investigator expressed concern about the lack of clarity concerning whether the legitimate interests
being pursued were those of WhatsApp or a third party, I do not share those concerns in
circumstances where the information provided includes indications as to the “owner” of the
legitimate interests such as:
154The Inquiry Submissions, paragraph 11.1
115420. WhatsApp rejected this proposed finding. It submitted 173that:
“Under the “Information You and We Share” section of the Privacy Policy, WhatsApp separately
identifies “thirdpartyservice providers” asa categoryof recipients. WhatsApp details, inclearand
plain language and in a concise manner, the types of processing activities that these service
providers undertake for WhatsApp as well as giving assurances as to the contractual obligations
on those providers. Examples ensure that users can understand how these companies provide
services to and on behalf of WhatsApp, whilst avoiding technical or complex terms like data
processor or data processing agreement.
421. TheInvestigatorwasunconvincedbyWhatsApp’ssubmissions,inthisregard,andconfirmedherview,
by way of Conclusion 10, that the information provided by WhatsApp failed to satisfy the
requirements of Articles 13(1)(e) and 12(1) of the GDPR.
Assessment of Decision-Maker: What information has been provided?
422. The sections of the Privacy Policy identified by WhatsApp contain the following relevant information:
“Information You And We Share
… we share your information to help us operate, provide, improve, understand, customize,
support, and market our Services.
…
Businesses On WhatsApp. We help businesses who use WhatsApp measure the
effectiveness and distribution of their services and messages, and understand how people
interact with them on our Services.
Third-Party Service Providers. We work with third-party service providers and the
Facebook Companies to help us operate, provide, improve, understand, customize,
support, and market our Services. ….
… . “
423. Also:
“How We Work With Other Facebook Companies
We are part of the Facebook Companies. As part of the Facebook Companies, WhatsApp receives
information from, and shares information with, the Facebook Companies. ….
Learn More about how WhatsApp works with the Facebook Companies.”
424. And, finally:
“Assignment, Change of Control, And Transfer
All of our rights and obligations under our Privacy Policy are freely assignable by us to any of our
affiliates, in connection with a merger, acquisition, restructuring, or sale of assets, or by operation
of law or otherwise, and we may transfer your information to any of our affiliates, successor
entities, or new owner.”
173The Inquiry Submissions, paragraph 12.2
120Assessment of Decision-Maker: How has the information been provided?
425. The information described above has been provided in three different sections of the Privacy Policy.
The links embedded in the text quoted above relate to the following additional text/information:
a. The link embedded the “Facebook Companies” text, aslisted above, linksthe user toanarticle
entitled “The Facebook Companies” on Facebook’s website. That contains further links to
three other “articles” on Facebook’s website (each linking back to the others).
b. The link embedded in the “Learn More” text, at the end of the ”How We Work With Other
Facebook Companies” section, links the user to a FAQ located elsewhere on the WhatsApp
174
website entitled “How we work with the Facebook Companies” (that FAQ contains further
embedded links and some of the text that can be accessed by these links contain further links
to further information).
Finding: Article 13(1)(e) – the Recipients or Categories of Recipient
Quality of information provided
426. The obligation arising, under this heading, is to provide information to the data subject in relation to
the recipientsor categories of recipientof the data. TheArticle 29 WorkingParty expressed the view,
in the Transparency Guidelines 17, that the information required to be provided under this heading is
as follows:
“The actual (named) recipients of the personal data, or the categories of recipients, must be
provided. In accordance with the principle of fairness, controllers must provide information on the
recipients that is most meaningful for data subjects. In practice, this will generally be the named
recipients, so that data subjects know exactly who has their personal data. If controllers opt to
provide the categories of recipients, the information should be as specific as possible by
indicating the type of recipient (i.e. by reference to the activities it carries out), the industry,
sector and sub-sector and the location of the recipients.” [emphasis added]
427. I agree with the view expressed by the Working Party that the information provided (where it has
been provided by reference to categories of recipient) should be as specific as possible so as to
provide the data subject with meaningful information under this heading. Accordingly, I consider
that, in order to achieve compliance with this requirement, WhatsApp must provide the following
information to users, and in a way that enables the user to quickly and easily locate and identify:
a. The categories of third-party service providers that will receive his/her personal data as
part of the provision of any required services to WhatsApp, including a brief description
of the services in question in a manner that enables the user to understand why his/her
personal data is being transferred and why/for what purpose(s) it is being transferred;
and
b. Thecategoriesofthird-partythatwillreceivehis/herpersonaldataaspartoftheprovision
of services, by WhatsApp, to the parties concerned, including a brief description of the
174Available at https://faq.whatsapp.com/general/26000112/?eea=1 (the “Facebook FAQ”)
175Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”)
121 servicesinquestioninamannerthatenablestheusertounderstandwhyhis/herpersonal
data is being transferred and why/for what purpose(s) it is being transferred.
428. Further, I am of the view that the information should be provided such that the user should be able
to identify what categories of his/her personal data will be received by the identified categories of
recipient. As discussed in the “Preliminary Issue” section of the Article 13(1)(c) assessment, the
quality of information that is provided to a data subject directly impacts on the effectiveness of that
data subject’s rights. Unless the user can identify what categories of his/her personal data are
transferred to any identified recipients and why it is being transferred, the user is deprived of the
information required to firstly understand the true consequences of the transfer for the data subject,
176
as emphasised by the Transparency Guidelines , and, secondly, assess whether or not he/she might
wish to consider exercising one or more of his/her rights.
429. With the exception of the Facebook FAQ, the information provided in relation to the categories of
recipient does not enable the user to understand what categories of personal data will be sent to
which category of recipient, nor to understand in a meaningful way why such transfers are being
carried out and, therefore, the consequences for the data subject. The information furnished, in
relation to the categories of recipient is insufficiently detailed so as to be meaningful to the user. For
the avoidance of doubt, I will address the quality of information provided by the Facebook FAQ, in
relation to the Facebook Companies, under Part 3 of this Decision.
M anner in which information has been provided
430. Asbefore,Iconsiderthattherearedeficienciesinthemannerinwhichinformationhasbeenprovided
under this heading. Again, the data subject is required to pursue further information by way of links
to further texts, which themselves contain further links to additional texts. The information to be
provided, under this heading, is not complex and neither is the information that WhatsApp has
available toprovide, under thisheading. Itseemsto me thatelementsof thisinformation are already
scattered throughout the Terms of Service, Privacy Policy, Legal Basis Notice and linked
articles/documents/FAQs. In the circumstances, it should be a straightforward task to collate this
information and present it to the data subject in a clear and concise format.
431. Finally, I note that the “Assignment, Change of Control and Transfer” clause appears to have been
included both in the Privacy Policy and Terms of Service. It seems to me that, from the perspective
of the function of the Privacy Policy, thisclause serves nofunction and ismore appropriately included
in the Terms of Service. If this clause is to remain in the Privacy Policy, I consider that it should be
tempered by the addition of a statement to confirm that the data subject will be notified of any such
changes in advance (as confirmed by the “Updates To Our Policy” clause). Otherwise, and to be
absolutely clear, the clause itself, as currently drafted, does not, in my view, communicate
information of the quality required by Article 13(1)(e).
432. For the reasons set out above, the Preliminary Draft included a proposed finding that WhatsApp has
failed to comply with its obligations pursuant to Article 13(1)(e) and Article 12(1).
WhatsApp’s Response to Proposed Finding and Assessment of Decision-Maker
176Transparency Guidelines, paragraph 10
122433. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above
assessment, submitting that:
“for the same reasons as set out above in relation to Article 13(1)(c) GDPR, WhatsApp disagrees
with the Commission’s analysis that granular information should be provided to users identifying
the categories of personal data which will be received by the identified categories of recipients.
This requirement departs from the clear language of the GDPR and is supplemental to the
information points outlined by the Transparency Guidelines on Article 13(1)(e) 177.”
434. It is clear that WhatsApp and I fundamentally disagree as to my assessment of the information
provided by WhatsApp to users under this heading. I have already set above the reasons why I
consider the information provided to be insufficient, in terms of quality and the manner of
delivery. My concerns remain, in this regard, notwithstanding WhatsApp’s perspective on
178
matters. I acknowledge, however, that WhatsApp has decided to relocate the “Assignment,
Change of Control and Transfer” section to the Terms of Service, in light of the views I expressed
in the Preliminary Draft. Accordingly, for the reasons already set out above, I find that
WhatsApp has failed to comply with its obligations pursuant to Article 13(1)(e) and Article
12(1).
Assessment: Article 13(1)(f) – Transfers of personal data to a third country
Required Information and WhatsApp’s Response to Investigator’s Questions
435. Article 13(1)(f) requires the data controller, “where applicable”, to inform the data subject “that the
controller intends to transfer personal data to a recipient in a third country or international
organisation and the existence or absence of an adequacy decision by the [European]Commission, or
in the case of transfers referred to in Article 46 or 47, or the second paragraph of Article 49(1),
reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where
they have been made available.”
436. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 4, that:
“[WhatsApp] identifies the fact that it intends to transfer personal data to a third country or
international organisation in the ‘Our Global Operations’ section of the Privacy Policy.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
437. The Investigator considered the extent to which WhatsApp complied with its obligations under this
heading by reference to Proposed Finding 11. She expressed the view that the information provided
was not sufficiently clear to satisfy the requirements of Article 12(1) of the GDPR. Further, the use of
conditional language (“may”), in the context of possible reliance on adequacy decisions, was, in the
Investigator’sview, contrarytothe requirementfora data controller toprovide clearand transparent
information to data subjects.
177The Preliminary Draft Submissions, paragraph 8.3
178
The Preliminary Draft Submissions, paragraph 8.5
123438. Further, theInvestigator wasconcernedthatthe inclusion of a link thatbringsthe user toinformation
hosted on Facebook’s website risked confusing the data subject as to the identity of the data
controller with regard to third country transfers.
439. Accordingly, the Investigator proposed a finding that the information provided, under this heading,
did not provide the minimum level of information required by Article 13(1)(f). Further, the
informationthathadbeenprovidedwasinsufficientlycleartosatisfytherequirementsofArticle12(1)
of the GDPR.
440. WhatsApp rejected this proposed finding. It submitted 179that:
“On a proper analysis, the drafting of [the “Our Global Operations”] section of WhatsApp’s Privacy
Policy represents quite a meticulous implementation of the detailed requirements of this part of
Article 13(1)”.
441. WhatsApp further submitted 180that:
“The Draft Report takes the view that WhatsApp must be explicit in respect of each recipient and
each country to which it transfers personal data. Not only is this not required by the GDPR … it is
also impractical and would require a controller operating a service such as WhatsApp to
continuously update its privacy notice in the (likely frequent) event it engaged a new service
provider based in a differentjurisdiction outside the EEA. There is simply no statutory basis for this
interpretation of the GDPR and, in any event, such an approach would result in excessive and
confusing information for users. … Moreover, the fact that WhatsApp relies on safeguards to
transfer personaldata of itsEU usersinstead of relying entirely on derogations, and communicates
this to its users, provides a significant level of protection. The further level of specificity described
in the Draft Report is simply not a legal requirement.”
442. The Investigator was not swayed by WhatsApp’s submissions, in this regard, and confirmed her view,
by way of Conclusion 11, that WhatsApp failed to discharge its obligations pursuant to Article 13(1)(f)
in circumstances where it failed to provide the minimum level of information required.
Assessment of Decision-Maker: What information has been provided?
443. The “Our Global Operations” section of the Privacy Policy includes the following information:
“Our Global Operations
… Information controlled by WhatsApp Ireland will be transferred or transmitted to, or stored and
processed, in the United States or other countries outside of where you live for the purposes as
described in this Privacy Policy. … We utilize standard contract clauses approved by the European
Commission, and may rely on the European Commission's adequacy decisions about certain
countries, as applicable, for data transfers from the European Economic Area to the United States
and other countries.
….”
179The Inquiry Submissions, paragraph 13.2
180The Inquiry Submissions, paragraph 13.3
124Assessment of Decision-Maker: How has the information been provided?
444. The information has been provided in the Privacy Policy, as outlined above. The text contains two
embedded links, as follows:
a. The“standardcontractclauses”linkbringstheuserdirectlytoan“article”hostedonFacebook’s
website, entitled “What is a standard contract clause?”. There is a further link within that
“article” that links the user to the relevant landing page (providing information on standard
contractual clauses generally) on the European Commission’s website;
b. The “adequacy decisions” link brings the user directly to the relevant landing page (providing
information on adequacy decisions generally) on the European Commission’s website.
Finding: Article 13(1)(f) – Transfers of personal data to a third country
445. Identifying, firstly, the information required to be provided under this heading, Article 13(1)(f)
specifies the following information:
a. Where applicable, the fact that the controller intends to transfer personal data to a third country
… and
b. The existence or absence of an adequacy decision … , or
c. … reference to the appropriate or suitable safeguards and the means by which to obtain a copy
of them or where they have been made available.
446. Considering,firstly,theinformationrequiredtobeprovidedbyArticle13(1)(f),Inotetherequirement
for the controller toinformthe data subjectasto“theexistence or absence”of anadequacy decision.
This language goes beyond a requirement for the data controller to identify “if” or “whether” an
adequacy decision exists in relation to the proposed country of transfer and instead requires a
controller to provide definitive information such that the data subject is informed either (i) that the
transfer is subject to an adequacy decision; or (ii) that the transfer is not subject to an adequacy
decision.
447. WhatsApp,however,hassimplyadvisedthatit“may”relyonadequacydecisions,“ifapplicable”. This
does not appear to be sufficient for the purpose of Article 13(1)(f). Neither is it sufficiently
transparent for the purpose of Article 12(1) as to whether adequacy decisions are relied on.
448. Considering what additional information might be required to be provided, I note that, in the case of
a transfer which is not the subject of an adequacy decision, the data controller must provide
“referencetotheappropriateorsuitablesafeguardsandthemeansbywhichtoobtainacopyofthem
or where they have been made available.” This information requirement is quite specific; in effect it
enables the data subject to access, if he/she so wishes, detailed information about the safeguards
being used to protect his/her personal data. That being the case, it would not make sense if the data
subject were notentitled to access information of similar quality in a case where his/her data is being
transferred in reliance on an adequacy decision.
449. On the basis of the above, itseems to me that, while Article 13(1)(f) does not expressly require a data
controllertoidentifythecountryoftransfer,thisinformationshouldbeprovidedifitenablesthedata
125 subjecttoreceivetransparentandmeaningfulinformationastothosetransferstakingplacepursuant
to an adequacy decision. If a controller does not want to provide this specific information, it must
find another way to enable the data subject to access information in relation to the (specific)
adequacydecisionsupportingthetransfersuchthathe/sheisenabledtoaccessinformationofsimilar
quality to that which he/she is entitled to receive if the transfer is supported by other safeguards.
450. I note, in this regard, that the Working Party, in the Transparency Guidelines 181, expressed the view
that Article 13(1)(f) requires the provision of information as to:
“The relevant GDPR article permitting the transfer and the corresponding mechanism (e.g.
adequacy decision under Article 45 / binding corporate rules under Article 47 / standard data
protection clauses under Article 46.2 / derogations and safeguards under Article 49 etc.) should be
specified. Information on where and how the relevant document may be accessed or obtained
should also be provided e.g. by providing a link to the mechanism used. In accordance with the
principles of fairness, the information provided on transfers to third countries should be as
meaningful as possible to data subjects; this will generally mean that the third countries be
named.” [emphasis added]
451. As discussed in the “Preliminary Issue” section of the Article 13(1)(c) assessment, the quality of
information that is provided to a data subject directly impacts on the effectiveness of that data
subject’s rights. Accordingly, I am of the view that, inorder to comply with Articles13(1)(f) and 12(1),
the data controller mustprovide the required information in such a way thatenablesthe data subject
to identify the categories of personal data that will be transferred. This knowledge is particularly
significant in circumstances where the conditions attaching to the transfer (as recorded in the
adequacy decision or other suitable safeguard) may specify the categories of personal data that may
be transferred inreliance onthe decision/safeguard inquestion. Without confirmation of the precise
categories of data being transferred, the data subject is deprived of the information he/she needs to
consider whether or not he/she might wish to exercise his/her rights.
452. The information provided by WhatsApp, under this heading, does not appear to satisfy the
requirements of Articles 13(1)(f) and 12(1) in circumstances where it does not:
a. provide the required information by reference to specified categories of data;
b. definitely identify whether or not an adequacy decision exists to support the transfer of a
specified category of data such as to satisfy the requirement for transparency given the
residual lack of clarity about whether (and, if so, what) adequacy decisions are relied on;
c. enable the data subject to access more information, in a meaningful way, about the adequacy
decision(s) being relied on such as to satisfy the requirement for transparency given the
residual lack of clarity about whether (and, if so, what) adequacy decisions are relied on. I
note, in thisregard, that a link has simply been provided to the relevantpage on the European
Commission’s website. While this is better than nothing, a user is unable to identify which
adequacy decision is being relied upon, such that he/she can access further information.
181Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”)
126453. To be clear, it is not sufficient to simply provide a link to a generic European Commission webpage.
The Transparency Guidelines make it clear that the data subject should be able to access (or obtain
access,ifaccessisnotdirectlyprovided)totheparticulardocumentbeingreliedupon,i.e.inthiscase,
the specific set of standard contractual clauses or specific adequacy decision.
454. For the sake of completeness (and as already observed elsewhere in this Decision), I am further not
in favour of the existing position whereby the data subject is invited to access further information
about standard contractual clauses on Facebook’s website. This is particularly the case where the
information provided is so minimal that there is no (apparent) reason why it could not be provided
on WhatsApp’s website.
455. For the reasons set out above, the Preliminary Draft proposed a finding that WhatsApp has failed to
comply with its obligations under Article 13(1)(f) and Article 12(1).
WhatsApp’s Response to Proposed Finding and Assessment of Decision-Maker
456. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above
assessment, submitting firstly that my view that controllers must provide information on the
categories of personal data which will be transferred is “without support in the text of the GDPR
itself8”. It secondly noted that the Preliminary Draft “is the first time detailed interpretative
guidance has been given on the implementation of [Article] 13(1)(f) by the Commission, and in
particular how to implement the obligation in respect of providing additional information to data
subjects183.” WhatsApp further noted “two key points”, as follows:
“First, the mechanism relied on by WhatsApp depends on the country to which data will be
transferred so, in the context of a service available inmost parts of the world, WhatsApp considers
that language such as “many” [sic] and “as applicable” [sic] is appropriate. Second, WhatsApp
enables data subjects to access more information about adequacy decisions (and standard
contractualclauses)byprovidingalinktotheEuropeanCommissionwebsite. Italso,inaccordance
with Article13(1)(f)GDPR,enables usersto access acopyof thestandardcontractualclauses relied
184
on .”
457. As before, it is clear that WhatsApp and I fundamentally disagree as to my assessment of the
information provided by WhatsApp to users under this heading. I have already set out above the
reasonswhyIconsidertheinformationprovidedtobeinsufficient,intermsofqualityandthemanner
of delivery. That assessment already explains my position on the matters raised by WhatsApp in the
Preliminary Draft Submissions. My concerns remain, in this regard, notwithstanding WhatsApp’s
perspective on matters. My assessment of WhatsApp’s submission that this is the first time that
“detailed interpretive guidance” has been provided in relation to the interpretation of Article 13(1)(f)
is recorded as part of my assessment of WhatsApp’s Submissions of General Application, above.
Accordingly, I find that WhatsApp has failed to comply with its obligations under Article 13(1)(f)
and Article 12(1).
182The Preliminary Draft Submissions, paragraph 9.3
183The Preliminary Draft Submissions, paragraph 9.4
184The Preliminary Draft Submissions, paragraph 9.5
127Assessment: Article 13(2)(a) – Retention Criteria/Retention Periods
Required Information and WhatsApp’s Response to Investigator’s Questions
458. Article 13(2)(a) requires the data controller to provide the data subject with information in relation
to “the period for which the personal data will be stored, or if that is not possible, the criteria used to
determine that period.”
459. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 6, that:
“[WhatsApp] explains the period for which personal data will be stored and how this is determined
in the ‘Managing and Deleting Your Information’ section of the Privacy Policy.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
460. The Investigator considered the extent to which WhatsApp complies with its obligations under this
heading by reference to Proposed Finding 12. She expressed the view that the information provided
by WhatsApp, in this regard, was “generic”. Further, the language used was “wide-ranging” in that
there was no indication as to the circumstances that might constitute “operational retention needs”.
461. Accordingly, the Investigator proposed a finding that WhatsApp failed to comply with the
requirements of Article 13(2)(a).
462. WhatsApp rejected this proposed finding. It submitted 185 that this information was “clearly”
explained to users in the Privacy Policy. Further, it submitted 186that:
“Where possible, WhatsApp also provides users with additional contextual information on
retention. For example the “Deleting your account” FAQ also sets out the process which follows
deletion of an account, in that it “may take up to 90 days to delete data stored in backup systems”
and that “personal information shared with the other Facebook Companies will also be deleted”.
The reality for WhatsApp (and the vast majority of online companies of any significant size) is that
it is not in a position to inform a data subject at the time their personal data is collected of the
specific time period for which it will be stored, in a way that would accord with the principles of
Article12(1)GDPR(i.e.ensuring the notice isconcise,transparent, intelligible andinclear andplain
language). This is because there are too many variables to do this at scale in a concise and
accessible way via a privacy policy. This is precisely why Article 13(2)(a) GDPR does not require
controllers to provide specific retention periods to data subjects where it is not possible to do so.”
463. The Investigator was unconvinced by WhatsApp’s submissions and noted that she had not suggested
that precise retention periods were required for all personal data. She confirmed, by way of
Conclusion 12, that she remained of the view that WhatsApp failed to comply with its obligations
pursuant to Article 13(2)(a) in circumstances where it failed to furnish sufficient detail in relation to
the retention periods, or the criteria used to determine such retention periods, in operation in
relation to the personal data it processes.
185The Inquiry Submissions, paragraph 14.1
186The Inquiry Submissions, paragraphs 14.2 and 14.3
128Assessment of Decision-Maker: What information has been provided?
464. The identified section of the Privacy Policy provides as follows:
“Managing And Deleting Your Information
We store information until it is no longer necessary to provide our services, or until your account is
deleted, whichever comes first. This is a case-by-case determination that depends on things like
the nature of the information, why it is collected and processed, and relevant legal or operational
retention needs.
If you would like to manage, change, limit, or delete your information, we allow you to do that
through the following tools:
…
Deleting Your WhatsApp Account. You may delete your WhatsApp account at any time
(including if you want to revoke your consent to our use of your information) using our in-
app delete my account feature. When you delete your WhatsApp account, your
undelivered messages are deleted from our servers as well as any of your other
information we no longer need to operate and provide our Services. Be mindful that if you
only delete our Services from your device without using our in-app delete my account
feature, your information may be stored with us for a longer period. Please remember that
when you delete your account, it does not affect the information other users have relating
to you, such as their copy of the messages you sent them.”
465. I note, however, that further information has been provided in the “How to Delete Your Account”
FAQ 187. While this assessment has been carried out by reference to the Privacy Policy and any linked
texts/documents/notices, WhatsApp, as part of its Inquiry Submissions, made specific reference this
FAQ in support of its approach under this heading. Accordingly, I have reviewed this document as
part of my assessment. I note that this document states:
“How to delete your account
You can delete your account from within WhatsApp. Deleting your account is an irreversible
process, which we cannot reverse even if you perform it by accident.
…
Deleting your account will:
Delete your account info and profile photo.
Delete you from all WhatsApp groups.
Delete your WhatsApp message history on your phone and your iCloud backup.
If you delete your account:
You can't regain access to your account.
It may take up to 90 days from the beginning of the deletion process to delete your
WhatsApp information. Copies of your information may also remain after the 90 days
in the backup storage that we use to recover in the event of a disaster, software error,
or other data loss event. Your information isn't available to you on WhatsApp during
this time.
It doesn't affect the information other users have relating to you, such as their copy of
the messages you sent them.
Copies of some materials such as log records may remain in our database but are
disassociated from personal identifiers.
187Available at https://faq.whatsapp.com/en/general/28030012/ (the “”How to Delete Your Account” FAQ”)
129 We may also keep your information for things like legal issues, terms violations, or
harm prevention efforts.
Please refer to the Law and Protection section of our Privacy Policy for more
information.
Your personal information shared with other Facebook Companies will also be
deleted.”
466. The “Law And Protection” section of the Privacy Policy (accessible via the link in the “How to Delete
Your Account” FAQ) provides that:
“Law And Protection
We collect, use, preserve, and share your information if we have a good-faith belief that it is
reasonably necessary to: (a) respond pursuant to applicable law or regulations, to legal process,
or to government requests; (b) enforce our Terms and any other applicable terms and policies,
including for investigations of potential violations; (c) detect, investigate, prevent, and address
fraud and other illegal activity, security, or technical issues; or (d) protect the rights, property, and
safety of our users, WhatsApp, the Facebook Companies, or others, including to prevent death or
imminent bodily harm.” [emphasis added]
Assessment of Decision-Maker: How has the information been provided?
467. The information has been provided primarily by the “Managing And Deleting Your Information”
sectionofthePrivacyPolicy. Whiletheinformationprovidedbythistextissimpleanduncomplicated,
it does not contain any reference to the possible preservation of data in the circumstances described
in the “Law And Protection” section. Neither does it reference the retention of “information” or
188
“materials”, as described in the “How to Delete Your Account” FAQ .
Finding: Article 13(2)(a) – Retention Criteria/Retention Periods
189
468. The Working Party, in its Transparency Guidelines , expressed the view that:
“[The requirement to provide information as to the period of retention] is linked to the data
minimisation requirement in Article 5.1(c) and storage limitation requirement in Article 5.1(e).
The storage period (or criteria to determine it) may be dictated by factors such as statutory
requirements or industry guidelines but should be phrased in a way that allows the data subject to
assess, on the basis of his or her own situation, what the retention period will be for specific data/
purposes. It is not sufficient for the data controller to generically state that personal data will be
kept as long as necessary for the legitimate purposes of the processing. Where relevant, the
different storage periods should be stipulated for different categories of personal data and/or
different processing purposes, including where appropriate, archiving periods.”
469. I agree with the views expressed above and note that, again, what is required by Article 13(2)(a) is
“meaningful” information. The information provided by WhatsApp, under this heading, is minimal.
Whileadatasubjectwouldexpecthis/herpersonaldatatobeprocessedduringthetimewhilehe/she
is using the Services, he/she might not expect any processing to continue once he/she has deleted
188Available at https://faq.whatsapp.com/en/general/28030012/ (the “”How to Delete Your Account” FAQ”)
189Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”)
130 his/her account. This is particularly the case where the “Managing and Deleting Your Information”
section informs the user that WhatsApp stores information “until it is no longer necessary to provide
our Services or until your account is deleted, whichever comes first” [emphasis added]. This is
somewhat misleading in that it gives the impression that, if the user deletes his/her account,
WhatsApp will no longer process his/her data.
470. Further, in relation to the variables that will determine the processing of data where the user has not
deleted his/her account, WhatsApp has simply indicated that the period of post-deletion retention
would be a case-by-case determination that depends on things like:
a. The nature of the information;
b. Why the information was collected and processed; and
c. Relevant legal or operational retention needs.
471. This information does not assist the data subject to understand the basis for any retention of data
because the significance of each criterion hasnotbeen clarified. WhatsAppshould beable toprovide
practical examples of the how each of the above criteria impact on the period of retention so as to
demonstrate accountability for compliance with the storage limitation principle.
472. Further,Inotetheadditionalinformationthathasbeenprovidedinthe“HowtoDeleteYourAccount”
FAQ 19. This clearly suggests that, notwithstanding the fact that a user may have deleted his/her
account:
a. Copies of the user’s information may remain in WhatsApp’s backup storage (but will not be
available to the user during this time).
b. Copies of some materials such as log records may remain in WhatsApp’s database but are
disassociated from personal identifiers.
c. The user’s information may be retained “for things like legal issues, terms violations, or harm
prevention efforts” and for the purposes identified in the “Law And Protection” section of the
Privacy Policy.
473. The above is most concerning given that the user is led to believe, by the clear statement, in the
“Managing And Deleting Your Information” that WhatsApp “allows” a user to delete his/her
information by way of the “in-app delete my account feature”. Leaving aside the lack of clarity as to
how WhatsApp will determine that it is necessary to “preserve” a user’s information for any of the
purposes set out in the “Law And Protection” section and the possibility that some data will be
retained on back-up servers, the “How to Delete Your Account” FAQ 191suggests that log records (and
possibly other such records) will be retained in WhatsApp’s database. No information has been
provided in relation to how such records “are dissociated from personal identifiers”. It is further
concerning that this information has not been incorporated into the Privacy Policy (by way of link or
otherwise), thus leaving it to chance as to whether a user will discover it. I note, in this regard, that
the only reason I have this information is because WhatsApp included it by way of a footnote in its
190Available at https://faq.whatsapp.com/en/general/28030012/ (the “”How to Delete Your Account” FAQ”)
191Available at https://faq.whatsapp.com/en/general/28030012/ (the “”How to Delete Your Account” FAQ”)
131 Inquiry Submissions 192; had it not been drawn to my attention, I would not have known of its
existence.
474. Accordingly, I proposed a finding, in the Preliminary Draft, that WhatsApp has failed to comply with
its obligations pursuant to Article 13(2)(a) in circumstances where:
a. No meaningful information has been provided in relation to the criteria that will be used to
determine if, and for how long, a user’s personal data will be retained following the deletion of
his/her account;
b. Keyinformationconcerningthefactthatcertaininformation(“materialssuchaslogrecords”)will
be retained, even after deletion, has not been incorporated into the Privacy Policy; and
c. Key information to explain how such retained records (i.e. those “materials such as log records”)
are “disassociated from personal identifiers” has not been incorporated into the Privacy Policy.
WhatsApp’s Response to Proposed Finding and Assessment of Decision-Maker
475. WhatsApp, by way of the Preliminary Draft Submissions, maintained its position that, as far as it is
concerned, it provides the information required by Article 13(2)(a). However, it further confirmed
that, having reflected carefully on the Commission’s views, it intends to make changes to the
information that it provides to users under this heading 19.
476. In the absence of any substantive submissions from WhatsApp under this heading, my views remain
as set out above. Accordingly, I find that WhatsApp has failed to comply with its obligations under
Article 13(2)(a).
Assessment: Article 13(2)(b) – the existence of the data subject rights
Required Information and WhatsApp’s Response to Investigator’s Questions
477. Article13(2)(b)requires thedata controller toinformthedata subjectasto“the existence oftheright
to request from the controller access to and rectification or erasure of personal data or restriction of
processing concerning the data subject or to object to processing as well as the right to data
portability”.
478. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 6, that:
“[WhatsApp] explains the rights specified in Article 13(2)(b) in the Privacy Policy, under the section
entitled ‘How You Exercise Your Rights’.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
479. While the Investigator did not propose or confirm any particular finding or conclusion under this
heading, she confirmed, in the Draft Report and Final Report, that she was satisfied that WhatsApp
192The Inquiry Submissions, paragraph 17.2 (and footnote number 77)
193The Preliminary Draft Submissions, paragraph 10.2
132 had complied with its obligations pursuant to Article 13(2)(b) in circumstances where clear
information had been provided that could be easily understood and followed.
Assessment of Decision-Maker: What information has been provided?
480. The “How You Exercise Your Rights” section of the Privacy Policy provides the following information:
“… you have the right to access, rectify, port, and erase your information, as well as the right to
restrict and object to certain processing of your information. This includes the right to object to our
processing ofyour informationfor directmarketing and the rightto objecttoour processingof your
information where we are performing a task in the public interest or pursuing our legitimate
interestsorthoseofathirdparty.…Ifweprocessyourinformationbasedonourlegitimateinterests
or those of a third party, or in the public interest, you can object to this processing, and we will
ceaseprocessingyourinformation, unlesstheprocessingis basedoncompelling legitimate grounds
or is needed for legal reasons. … Where we use your information for direct marketing for our own
Services, you can always object and opt out of future marketing messages using the unsubscribe
link in such communications, or by using our in-app "Block" feature.”
Assessment of Decision-Maker: How has the information been provided?
481. The information has been provided in an appropriately named section of the Privacy Policy, as
outlined above.
Finding: Article 13(2)(b) – the existence of the data subject rights
482. The information provided above is easy to locate and has been presented in a clear and concise
manner. I further note that WhatsApp has specifically referenced the rights that may be exercised
under therelevantsectionsof the Legal BasisNotice andhasprovided information astohow the data
subject may go about exercising those rights. This represents a very thorough and comprehensive
approach to this particular information requirement. Accordingly, I find that WhatsApp has
complied, in full, with its obligation to provide information pursuant to Article 13(2)(b).
Assessment: Article 13(2)(c) – the existence of the right to withdraw consent
Required Information and WhatsApp’s Response to Investigator’s Questions
483. Article 13(2)(c) requires the data controller, in a case where the processing is based on the data
subject’s consent or explicit consent, to inform the data subject of “the existence of the right to
withdraw consent at any time, without affecting the lawfulness of processing based on consent
before its withdrawal.”
484. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 6, that:
“[WhatsApp] explains its approach to consent in the Privacy Policy and in the ‘How We Process
Your Information’ notice.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
485. While the Investigator did not propose or confirm any particular finding or conclusion under this
heading, she confirmed her view, in the Draft Report and Final Report, that the information provided
133 by WhatsApp, in this regard, was sufficiently clear to achieve compliance with the requirements of
Article 13(2)(c).
Assessment of Decision-Maker: What information has been provided?
486. The relevant information provided, in the Privacy Policy, is as follows:
“Managing And Deleting Your Information
…
Deleting Your WhatsApp Account. You may delete your WhatsApp account at any time
(including if you want to revoke your consent to our use of your information) using our in-app
delete my account feature.”
487. In the section entitled “HowThe General Data Protection Regulation Applies To Our EuropeanRegion
Users”, the use of consent as a legal basis for processing as identified as follows:
“We collect, use, and share the information we have as described above:
…
consistent with your consent, which you can revoke at any time”
488. The Legal Basis Notice further provides, in the “Your Consent” section, that:
“When we process data you provide to us based on your consent, you have the right to withdraw
your consent at any time and to port that data you provide to us, under the GDPR. To exercise your
rights, visit your device-based settings, your in app-based settings like your in-app location control,
and the How You Exercise Your Rights section of the Privacy Policy.”
Assessment of Decision-Maker: How has the information been provided?
489. As set out above, the relevant information has been provided in the Privacy Policy and Legal Basis
Notice.
Finding: Article 13(2)(c) – the existence of the right to withdraw consent
490. While the statement in the “Your Consent” section of the Legal Basis Notice clearly references the
right to withdraw consent, it does not include the full extent of information required by Article
13(2)(c) in that the qualifier “without affecting the lawfulness of processing based on consent before
itswithdrawal” hasbeenomitted. Thisqualifier isimportantinthatitfirstly helpstomanage the data
subject’s expectations and secondly helps to ensure that the data subject is adequately informed
about the consequences of exercising this right.
491. Further, I note that:
a. The “How You Exercise Your Rights” section does not include reference to the right to withdraw
consent to processing or how a data subject might go about exercising this right. Given the title
of this section, I am of the view that this is where the data subject is most likely to go to search
for information about his/her rights. In the circumstances, reference to the right to withdraw
consent should be included here.
134 b. The statement included in the “Managing and Deleting Your Information” section, as identified
above, risks creating the impression that, in order to withdraw consent to consent-based
processing, the data subject will have to delete his/her account (as opposed to simply adjusting
his/her device-based settings).
492. The issues outlined above again arise as a result of a piecemeal approach to the provision of the
required information. Theeffectivenessorotherwise of thisapproach isentirelydependentonwhich
section the data subject visits first and whether or not he/she decides to look for further information
in other locations. The information that is required to be given, under this heading, is not complex
and, while WhatsApp has taken steps towards compliance, those steps are, in my view, rendered
ineffective as a result of the scattering of slightly different information on the subject in three
different areas of the Privacy Policy. As before, the issue here is the lack of a concise approach to the
provision of the prescribed information.
493. For the reasonsset outabove, I proposeda finding, inthePreliminary Draft, thatWhatsApphasfailed
to comply with its obligations pursuant to Article 13(2)(c) and Article 12(1).
WhatsApp’s Response to Proposed Finding and Assessment of Decision-Maker
494. By way of the Preliminary Draft Submissions, WhatsApp confirmed its disagreement with the above
assessment, submitting that:
a. “As a preliminary comment WhatsApp did not provide its views on compliance with Article
13(2)(c) GDPR in the Inquiry Submissions as the investigator found the information provided
was sufficiently clear19.”
b. While WhatsApp would address the minor omission of the qualifying text, “it is important to
note that … the first column to the Annex to the Transparency Guidelines does not indicate this
qualifier should be included and WhatsApp had followed this guidance when endeavouring to
195
comply with this provision .”
495. Having considered the above submissions, I firstly acknowledge that WhatsApp did not provide its
views on compliance, under this heading, at the inquiry stage. I do not consider that WhatsApp has
been disadvantaged or prejudiced in any way by this, however, given that it had the opportunity to
put forward its case in response to the Investigator’s initial questions and, again, in response to the
Preliminary Draft. In relation to the absence of the qualifying wording from the Annex to the
Transparency Guidelines, I note that the column in question is entitled “Required Information Type”
[emphasis added] and that the contents of this column do not reflect, in each case, the precise
wording of Article 13. I note, in any event, that the Transparency Guidelines do not take precedence
over the clear language of Article 13(2)(c).
496. As before, it is clear that WhatsApp and I remain in disagreement as to my assessment of the
information provided by WhatsApp to users under this heading. I have already set out above the
reasons why I consider the information provided to be insufficient, in terms of quality and the
manner of delivery. My concerns remain, in this regard, notwithstanding WhatsApp’s
194The Preliminary Draft Submissions, paragraph 11.2
195The Preliminary Draft Submissions, paragraph 11.4
135 perspective on matters. I note, however, that WhatsApp will take account of my views , as 196
regards the appropriate location for this particular information. Accordingly, for the reasons
already set out above, I find that WhatsApp has failed to comply with its obligations pursuant to
Article 13(2)(c) and Article 12(1).
Assessment: Article 13(2)(d) – the right to lodge a complaint with a supervisory authority
Required Information and WhatsApp’s Response to Investigator’s Questions
497. Article 13(2)(d) requires the data controller to inform the data subject as to his/her right to “lodge a
complaint with a supervisory authority”.
498. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 6, that:
“[WhatsApp] provides this information in the ‘Contact Information’ section of the Privacy Policy.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
499. The Investigator confirmed that she was satisfied that WhatsApp had complied with its obligations
pursuant to Article 13(2)(d).
Assessment of Decision-Maker: What information has been provided?
500. The “Contact Information” of the Privacy Policy provides that:
“You have the right to lodge a complaint with WhatsApp Ireland's lead supervisory authority, the
Irish Data Protection Commissioner, or your local supervisory authority.”
Assessment of Decision-Maker: How has the information been provided?
501. As set out above the relevant information has been included in the “Contact Information” section of
the Privacy Policy. The language used is clear and concise.
Finding: Article 13(2)(d) – the right to lodge a complaint with a supervisory authority
502. While the information provided is clear and unequivocal, it has been presented in the “Contact
Information” section of the Privacy Policy. The information required to be given, pursuant to Article
13(2)(d) is “the right to lodge a complaint with a supervisory authority”. In the circumstances, it
seems to me that it should be included, or at least cross-referenced, in the “How You Exercise Your
Rights” section, given that this is likely the place where a data subject will first go to learn about
his/her rights and how to access same.
503. In recognition of the fact that the required information has been delivered in such a clear and concise
manner, I find that WhatsApp has broadly complied with the obligation arising pursuant to Article
13(2)(d), subject to the direction that WhatsApp include reference to the existence of this right
under the“How YouExercise Your Rights”section soastoensure that thedatasubject is presented
196
The Preliminary Draft Submissions, paragraph 11.3
136 with the required information in a place where he/she might expect to find it. For the sake of
completeness, thecorrecttitle of the Irish supervisoryauthority isthe“Data Protection Commission”.
197
504. I note that WhatsApp, by way of the Preliminary Draft Submissions, has confirmed its intention to
implement the change outlined above.
Article 13(2)(e) – whether the provision of personal data is a statutory or contractual requirement,
or a requirement necessary to enter into a contract, as well as whether the data subject is obliged
to provide the personal data and of the possible consequences of failure to provide such data
Required Information and WhatsApp’s Response to Investigator’s Questions
505. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 6, that:
“[WhatsApp] identifies this information in the Privacy Policy and the ‘How We Process Your
Information’ notice.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
506. The Investigator did not propose or confirm any finding or conclusion under this heading.
Assessment of Decision-Maker: What information has been provided?
507. The Privacy Policy, in the “Information We Collect” section states that:
“WhatsApp must receive or collect some information to operate, provide, improve, understand,
customize, support, and market our Services … . The types of information we receive and collect
depend on how you use our Services.”
508. The use of the word “must” denotes a mandatory requirement. In contrast, the use of the word
“may”, as used more generally within the “Information We Collect” section, indicates that the
provisionoftherelevantinformationisnotcompulsory. Theword“may”hasbeenused,forexample,
in the context of the user’s email address and other account information “such as a profile picture
and about information”.
509. Under the “Your Account Information” sub-heading, “may” is not used in conjunction with the
provision of access to the phone numbers in the user’s mobile address book. Under the “Your
Connection” sub-heading, however, the word “may” is used in reference to the Contact Feature –
“we may help you identify your contacts who also use WhatsApp” [emphasis added].
510. Under the heading “Automatically Collected Information”, the word “may” is used in the context of
location information collected “if” the user has chosen to share location with his/her contacts, etc.
pursuant to WhatsApp’s “location features”.
511. The Legal Basis Notice (within the contractual necessity section) provides that:
197
The Preliminary Draft Submissions, paragraph 12.1
137 “We'll use the data we have to provide these services; if you choose not to provide certain data, the
quality of your experience using WhatsApp may be impacted.”
512. For the sake of completeness, the Terms of Service, in the “About Our Services” section, provides
that:
“Registration. You must register for our Services using accurate information, provide your current
mobile phone number, and, if you change it, update your mobile phone number using our in-app
change number feature. … .
Address Book. You provide us, all in accordance with applicable laws, the phone numbers of
WhatsApp users and your other contacts in your mobile address book on a regular basis, including
for both the users of our Services and your other contacts.”
Assessment of Decision-Maker: How has it been provided?
513. Asset outabove,the information providedhasbeenincluded invarioussectionsof the PrivacyPolicy,
Legal Basis Notice and Terms of Service. The language used, however, does not clearly identify the
data that must be provided or the consequences of failure to provide that data.
Finding: Article 13(2)(e) - whether the provision of personal data is a statutory or contractual
requirement, or a requirement necessary to enter into a contract, as well as whether the data
subject is obliged to provide the personal data and of the possible consequences of failure to
provide such data
514. Article 13(2)(e) requires the provision of the following information:
a. Whether the provision of personal data is a statutory or contractual requirement,
b. Or a requirement necessary to enter into a contract,
c. As well as whether the data subject is obliged to provide the personal data
d. And of the possible consequences of failure to provide such data
515. It stands to reason that WhatsApp needs to process a certain, minimum amount of personal data in
order to provide the Service. The extent of the minimum required, however, is not clear from any of
thetextoutlinedabove. Further,the(possible)consequencesoffailuretoprovidedataarenotclearly
set out for the data subject. The only reference to such consequences is set out in the Legal Basis
Notice, within the contractual necessity section, as follows:
“… if you choose not to provide certain data, the quality of your experience using WhatsApp may
be impacted.”
516. This is further confusing in circumstances where processing is either necessary for the purpose of
administering a contract or it is not.
517. Inthecircumstancessetoutabove,theCompositeDraftcontainedarecommendationthatWhatsApp
consider its position in relation to the extent to which it has incorporated the information prescribed
by Article 13(2)(e) into its Privacy Policy (and Legal Basis Notice). I proposed no finding under this
heading in circumstances where the extent to which WhatsApp complies with the requirements of
Article 13(2)(e) does not appear to have been pursued by the Investigator (notwithstanding that it is
covered by the scope of the within Inquiry, as set out in the Notice of Commencement). Thus, the
138Introduction
525. Under this heading, I will consider the extent to which WhatsApp complies with its transparency
obligations by reference to WhatsApp’s relationship with the Facebook Companies and any sharing
of user data in the context of that relationship (for completeness, it should be noted that the issue of
transparency obligations arising in the context of the sharing of non-user data by WhatsApp with any
of the Facebook Companies has already been dealt with in Part 1). The issues that I will consider
under this heading correspond to the matters covered by Conclusion 15 of the Final Report.
The Inquiry Stage
526. In its Response to Investigator’s Questions, WhatsApp provided the following information:
“16. Please outline WhatsApp’s compliance with Articles 13 and 14 GDPR in relation to the
information provided to data subjects regarding how WhatsApp works with other Facebook
companies, as outlined in its Terms of Service and Privacy Policy, including WhatsApp’s online FAQ
resource. In answering this question, please make reference to the requirements set out in Article
12 GDPR, with particular regard to any differences thatmay be present between these documents,
in the language used to describe its current or potential future arrangements.
Please see [WhatsApp’s] response to question 4 describing the information provided to users in
compliance with Article 13 regarding how [WhatsApp] works with other Facebook companies,
including in particular the “How We Work With Other Facebook Companies” section. In addition,
further information is available to users who click on the “Learn more” link which brings users to a
dedicated section of [WhatsApp’s] FAQ titled “How we work with the Facebook Companies”
(attached hereto as Appendix 3). [WhatsApp] demonstrated how it complies with Article 12(1) in
relation to the communication of this information in our response to question 5.
With respect to [WhatsApp’s] compliance with Article 14 and corresponding Article 12(1)
obligations, please see the responses to questions 9 and 10.
[WhatsApp] ensures that the information referred to in the preceding two paragraphs describes
how itprocesses personaldata of its users, includinginthe contextof workingwith other Facebook
companies.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s
Conclusion
527. By reference to Proposed Finding 15, the Investigator proposed a finding that WhatsApp’s approach
to transparency, under this heading, did not comply with the requirements set out in Articles 12(1),
13(1)(e) and 13(1)(f) of the GDPR. She formed this view on the basis that:
a. In order for a data subject to understand the manner in which his/her personal data, which is
processed by WhatsApp, interacts with other Facebook Companies, the data subject must
navigate a number of linked but separate documents on both the WhatsApp and Facebook
websites.
b. The language used in some of the text provided is conditional, e.g. “we may share …” [emphasis
added]. Further the text failed to sufficiently clarify what information may be shared between
the companies.
142 c. The text failed to identify the category of data subject that was covered by the term “you”. This
left it unclear as to whether the sharing of data occurred in the context of users, or non-users or
both.
d. Further, the diversion of the data subject to the Facebook website risked creating confusion in
relation to the entity/entities covered by the term “we”. In other words, the data subject could
interpret the term “we” as meaning WhatsApp, Facebook or any and all of the Facebook
Companies.
528. WhatsApp rejected the Investigator’s proposed finding and submitted 210that:
“The Draft Report seeks to give the impression that information on the relationship between
WhatsApp and the Facebook Companies is opaque and difficult to discern from the Online
Documents. The opposite is in fact the case. The Draft Report fails to mention that the fact
WhatsApp may share information with other Facebook Companies is explained in the “Key
Updates” summary page at the very top of the Online Documents. It also fails to mention that
WhatsApp provides a suite of FAQs addressing a range of different issues relevant to WhatsApp’s
relationship with other Facebook Companies (depending on what a particular user is interested in
understanding), all of which are designed to maximize transparency around WhatsApp’s
processing activities. Only one of these FAQs is referred to in the Draft Report – described as the
“WhatsApp Website FAQ document”.”
529. WhatsApp further submitted that the Draft Report failed to have due regard to the clear statements
that had been included in various pieces of text “as to what Facebook cannot do with WhatsApp user
data”.
530. The Investigator was unconvinced by WhatsApp’s submissions and confirmed her view, by way of
Conclusion 15, that WhatsApp was not compliant with the transparency requirements, as specifically
set out in Articles 12(1), 13(1)(e) and 13(1)(f) of the GDPR in the context of the information provided,
explaining how it works with the Facebook Companies.
The Decision-Making Stage
531. The issue for assessment is the extent to which WhatsApp complies with its transparency obligations,
by providing meaningful information in relation to how it works with other Facebook companies.
532. In its Response to Investigator’s Questions, WhatsApp indicated that it provides information to users
in relation to how it works with other Facebook Companies by way of the Privacy Policy and related
pages (including the Legal Basis Notice), with particular reference to the “How We Work With Other
Facebook Companies” section of the Privacy Policy and the linked FAQ entitled “How we work with
211
theFacebookCompanies ”(“theFacebookFAQ”). WhatsAppfurnishedacopyoftheFacebookFAQ
by way of Appendix 3 to its Response to Investigator’s Questions.
210The Inquiry Submissions, paragraph 17.2
211Available at https://faq.whatsapp.com/general/26000112/?eea=1 (the “Facebook FAQ”)
143533. For the sake of completeness, I included, in my assessment, any additional sources of information
identified by WhatsApp in its Inquiry Submissions. Those additional sources are as follows:
212
a. The “I have Questions” FAQ ; and
b. The “How to Delete Your Account” FAQ 213
Preliminary Issue: The Status of the “I have Questions” FAQ
534. Further to my review of the “I have Questions” FAQ, I observed that this was the only text that
expressly referenced the possible sharing of personal data with “Facebook and the Facebook family”
for objectives including the possible delivery of “better friend suggestions and more relevant ads on
Facebook”. This directly contradicted the clear statement (that has been included in three separate
places) in the Facebook FAQ that:
“Facebook does not use your WhatsApp account information to improve your Facebook product
experiences or provide you more relevant Facebook ad experiences on Facebook.”
535. I was very concerned about the suggestion that Facebook might use personal data in the manner
outlined in the “I have Questions” FAQ and, accordingly, I directed WhatsApp to specifically respond
to the following questions, as part of any responding submissions:
a. Whether or not Facebook and/or the “Facebook family”uses data provided to it by WhatsApp
to improve Facebook product experiences, by way of “better friend suggestions and more
relevant ads on Facebook” or otherwise; and
b. If not, why the information referenced above has been included and made available in the “I
have Questions” FAQ.
WhatsApp’s Response to Questions Posed and Outcome of Preliminary Issue
536. By way of the Preliminary Draft Submissions, WhatsApp answered the above questions as follows:
a. In response to the first question, WhatsApp confirmed that it “has had technical controls in
place since 2016 to support its ongoing commitment to the [Commission] that Facebook (or
any company in the Facebook family) will not use European Region WhatsApp users’ data
provided to it by WhatsApp to improve Facebook product experiences, by way of better friend
suggestions and more relevant ads on Facebook or otherwise”. WhatsApp further confirmed
that “as previously committed to the [Commission], in the event that WhatsApp makes a
decision to share such data with Facebook for these purposes in the future, it will only do so
after prior discussion with [the Commission] 214.”
b. In response to the second question, WhatsApp explained that the “I have Questions” FAQ was
referenced in error in the Inquiry Submissions. WhatsApp clarified that this FAQ “was never
intendedtoapplytousersintheEuropeanRegionundertheGDPRandwasdeprecatedglobally
212Previously available at https://faq.whatsapp.com/en/general/28030012/ (the “”I have Questions” FAQ”)
213Available at https://faq.whatsapp.com/en/general/28030012/ (the “”How to Delete Your Account” FAQ”)
214The Preliminary Draft Submissions, paragraph 13.2
144 in April 2018.” The link was “reactivated in October 2018 as it was embedded in a historic
blogpost mentioned in a media interview”. It would have only been available, however, to
individualswhohadadirectlink,suchasfromthehistoricblogpost. WhatsAppconfirmedthat
the FAQ could not be viewed when browsing the WhatsApp website, nor could it be located
via the search function on the website. Otherwise, the FAQ was not linked to any other user-
facing content. WhatsApp confirmed that the FAQ was archived in May 2020 and is no longer
215
accessible via the respective link .
537. WhatsAppprovidedfurtherassurance of the position by advisingthat“the FacebookCompanies have
recently introduced further measures via its enhanced group wide privacy program which encompass
monitoring and verifying data uses and practices. As part of these further measures, a range of data
processing activities across the Facebook Companies are being reviewed, which will include the
controls around the processing of European Region WhatsApp users’ data by Facebook, to further
ensure commitments such as those [set out above] remain accurate 21.”
538. As regards the confirmation / explanation provided by WhatsApp, above, I note that the “I have
Questions FAQ” was referenced in error in the Inquiry Submissions and that this document was not,
at the relevant time, generally available. Accordingly, I have removed any further reference to the “I
have Questions” FAQ from the record of assessment set out below.
Approach to Assessment
539. Given that the focus of this assessment is the extent to which information has been provided in
relation to how WhatsApp works with other Facebook Companies, I consider that the required
information is likely to be captured by the requirement to provide specific information under Articles
13(1)(c), 13(1)(d) and 13(1)(e), as follows:
a. Article 13(1)(c): the purposes of the processing for which the personal data are intended as well
as the legal basis for the processing. As part of my assessment under this heading, I will also
consider the extent to which the personal data that will be shared with the Facebook Companies
has been identified to the user.
b. Article 13(1)(d): where the processing is based on point (f) of Article 6(1), the legitimate interests
pursued by the controller or by a third party.
c. Article 13(1)(e): the recipients or categories of recipients of the personal data, if any.
540. For the avoidance of doubt, I considered the extent to which WhatsApp complies with its
transparency obligations, generally, in Part 2 of this Decision. The focus of the assessment for the
purpose of this Part 3, however, is the extent to which WhatsApp complies with its transparency
obligations in the specific context of explaining its relationship with the Facebook Companies (and
any consequent sharing of data).
541. Further, while I will carry outseparate assessmentsof the information thathasbeen provided further
to each of Articles 13(1)(c), 13(1)(d) and 13(1)(e), I will conclude my overall assessment with a single
215The Preliminary Draft Submissions, paragraphs 13.4 and 13.5
216The Preliminary Draft Submissions, paragraph 13.3
14511. Third-Party Service Providers. We work with third-party service “Information We
providers and the Facebook Companies to help us operate, provide, Collect” section
improve, understand, customize, support, and market our Services. of Privacy Policy
For example, we work with companies to distribute our apps, provide
our infrastructure, delivery, and other systems, supply location, map,
and places information, process payments, help us understand how
people use our Services, market our Services, help you connect with
businesses using our Services, conduct surveys and research for us,
and help with customer service. These companies may provide us
information about you in certain circumstances; for example, app
stores may provide us reports to help us diagnose and fix service
issues.
12. We may provide you marketing for our Services and those of the “How We Use
Facebook Companies. Please see How You Exercise Your Rights for Information”
more information. section of Privacy
Policy
13. Third-Party Service Providers. We work with third-party service “Information You
providers and the Facebook Companies to help us operate, provide, And We Share”
improve, understand, customize, support, and market our Services. section of Privacy
When we share information with third-party service providers and Policy
the Facebook Companies in this capacity, we require them to use
your information on our behalf in accordance with our instructions
and terms.
14. We may use the information we receive from them, and they may “How We Work
use the information we share with them, to help operate, provide, With Other
improve, understand, customize, support, and market our Services Facebook
and their offerings. This includes helping improve infrastructure and Companies”
delivery systems, understanding how our Services or theirs are used, section of Privacy
helping us provide a way for you to connect with businesses, and Policy
securing systems.
We also share information to fight spam, threats, abuse, or
infringement activities and promote safety and security across the
Facebook Company Products.
…
Learn More about how WhatsApp works with the Facebook
Companies.
15. We may collect, use, preserve, and share your information if we have “Law And
a good-faith belief that it is reasonably necessary to: … (d) protect thProtection”
rights, property, and safety of our users, WhatsApp, the Facebook section of Privacy
Companies, or others … Policy
16. Information controlled by WhatsApp Ireland will be transferred or “Our Global
transmitted to, or stored and processed, in the United States or other Operations”
countries outside of where you live for the purposes as described in section of Privacy
this Privacy Policy. These data transfers are necessary to provide the Policy
Services set forth in our Terms and globally to operate and provide
our Services to you. …
14817. To receive services that will help WhatsApp improve and develop our The Facebook
business. FAQ
o We share information with the Facebook Companies (and trusted
third parties) as service providers. Service providers help
companies like WhatsApp by providing infrastructure,
technologies, systems, tools, information, and expertise to help
us provide and improve the WhatsApp service for our users.
o This enables us, for example, to analyze and understand how our
Services are being used, and how it compares to usage across the
Facebook Companies. By sharing information with the Facebook
Companies, such as the phone number you verified when you
signed up for WhatsApp and the last time your account was used,
we may be able to work out whether or not a particular
WhatsApp account belongs to someone who also uses another
service in the Facebook Companies. This allows us to more
accurately report information about our Services and to improve
our Services. So, for example, we can then understand how
people use WhatsApp services compared to their use of other
apps or services in the Facebook Companies, which in turn helps
WhatsApp to explore potential features or product
improvements. We can also count how many unique users
WhatsApp has, for example, by establishing which of our users
do not use any other Facebook apps and how many unique users
there are across the Facebook Companies. This will help
WhatsApp more completely report the activity on our service,
including to investors and regulators.
o It also helps WhatsApp as we explore ways to build a sustainable
business. For example, as we announced in 2016, we're exploring
ways for people and businesses to communicate using
WhatsApp, and this could include working with the Facebook
Companies to help people find businesses they're interested in
and communicate with via WhatsApp. In this way, Facebook
could enable users to communicate via WhatsApp with
businesses they find on Facebook.
o When WhatsApp shares information with them in these ways,
the Facebook Companies act as service providers, in order to help
WhatsApp and our family of companies. When we receive
services from the Facebook Companies, the information we share
with them is used to help WhatsApp in accordance with our
instructions.
18. To keep WhatsApp and other Facebook family services safe and The Facebook
secure. FAQ
o We share information with the Facebook Companies, and vice
versa, to help fight spam and abuse on our Services, help keep
them secure, and promote safety and security on and off our
Services. So if, for example, any member of the Facebook
149 Onavo (http://www.onavo.com/privacy policy).
Facebook Technologies, LLC and Facebook Technologies Ireland
Limited (https://www.oculus.com/legal/privacy-policy/).
WhatsApp Inc. and WhatsApp Ireland Limited
(http://www.whatsapp.com/legal/#Privacy).
CrowdTangle (https://www.crowdtangle.com/privacy).
…
Related Articles
The Facebook Company Products [see text below]
How can I switch back to Classic Facebook?
Can I search for specific videos on the Facebook Watch TV app?
How do I get to the Facebook mobile site (m.facebook.com)?
What are the Facebook Products? [see text below]
2. The Facebook Company Products “The Facebook
Company
The Facebook Company Products are, together, the Facebook
1 Products” (article
Products and other products provided by the Facebook Companies on Facebook’s
that are subject to a separate, stand-alone terms of service and website)
privacy policy, including the WhatsApp, Oculus, and CrowdTangle
websites, products, or apps.
3. 1What are the Facebook Products? “What are the
Facebook
The Facebook Products include Facebook (including the Facebook Company
mobile app and in-app browser), Messenger, Instagram (including Products” (article
apps like Direct and Boomerang), Portal-branded devices, Bonfire,
on Facebook’s
Facebook Mentions, Spark AR Studio, Audience Network, NPE Team website)
apps and any other features, apps, technologies, software, products,
or services offered by Facebook Inc. or Facebook Ireland Limited
under our Data Policy. The Facebook Products also include Facebook
Business Tools , which are tools used by website owners and
publishers, app developers, business partners (including advertisers)
and their customers to support business services and exchange
information with Facebook, such as social plugins (like the "Like" or
"Share" button) and our SDKs and APIs.
Facebook Products does not include some Facebook-offered
products or services that have their own separate privacy policies
and terms of service – such as Workplace, Free Basics, and
Messenger Kids.
4. 2The Facebook Business Tools “Facebook
Business Tools”
The Facebook Business Tools are technologies offered by Facebook (article on
Inc. and Facebook Ireland Limited that help website owners and
152 publishers, app developers, and business partners, including Facebook’s
advertisers and others, integrate with Facebook, understand and website)
measure their products and services, and better reach and serve
people who use or might be interested in their products and services.
These Tools include APIs and SDKs, the Facebook Pixel, Facebook
social plugins, such as the Like and Share buttons, Facebook Login
and Account Kit, and other Platform integrations, as well as other
plugins, code, specifications, documentation, technology and
services.
5. Facebook Cookie Banner Facebook’s
To help personalize content, tailor and measure ads, and provide a Cookie Banner
(presented once
safer experience, we use cookies. By clicking or navigating the site, the user accesses
you agree to allow our collection of information on and off Facebook the website via
through cookies. Learn more, including about available controls:
the links
Cookies Policy. provided)
How has that information been provided?
548. As is evident from the above, the information has been provided in various locations, as follows:
a. Introduction section at top of the Page
b. “Our Services” section of the Terms of Service
c. Introduction section at top of Privacy Policy
d. “How We Work With Other Facebook Companies” section of Privacy Policy
e. “Our Global Operations” section of Privacy Policy
f. “Information We Collect” section of Privacy Policy
g. The Facebook FAQ
h. “How We Use Information” section of Privacy Policy
i. “Information You And We Share” section of Privacy Policy
j. “Law And Protection” section of Privacy Policy
k. Legal Basis Notice (Legitimate Interests Section)
l. The “How to Delete Your Account” FAQ
549. In addition to the above, the user is invited to find out more information by way of links to two
different “articles” hosted on Facebook’s website. Once the user accesses that website, he/she is
immediatelypresentedwithacookiebanner. Withthelinkedarticles,therearefurtherlinksprovided
to other “articles”. In total, the user is presented with information in five different locations on
Facebook’s website, as follows (noting that the cookie banner is only relevant to the information
provided concerning the personal data, if any, that will be processed as a result of the user having
visited Facebook’s website):
a. Cookie banner
b. “The Facebook Companies”
c. “The Facebook Company Products”
d. “What are the Facebook Company Products”
e. “Facebook Business Tools”
153Assessment of Decision-Maker
Article 13(1)(c): the purposes of the processing for which the personal data are intended as well as
the legal basis for the processing
550. As already addressed in Part 2 of this Decision, I consider that Article 13(1)(c) requires the data
controller to provide information to the data subject such that the data subject can identify what
categories of personal data are processed for a particular processing operation (or set of operations)
and by reference to which legal basis.
551. Considering, firstly, theextenttowhichthe user isinformed astothe categoriesof personal data that
will be shared with the Facebook Companies, this information is only meaningfully addressed in the
Facebook FAQ. While the relevant part of the Facebook FAQ states that WhatsApp “currently shares
limited categories of information with the Facebook Companies”, the information described appears
to comprise a substantial part of the information detailed in the “Information We Collect” section of
the Privacy Policy.
552. I further note that the Privacy Policy only provides a single link to the Facebook FAQ, within the “How
We Work With Other Facebook Companies” section. While this is a logical place for the link, it is
unclear why it has not also been included in the “Information You And We Share” section of the
Privacy Policy. I note, in this regard, that numerous sections of the Privacy Policy have been
(repeatedly) cross-referenced to each other via links in different sections of the Privacy Policy. Given
the importance of the information contained in the Facebook FAQ, it is unclear, firstly, why it is in a
stand-alonedocumentand,secondly,whythereisonlyasinglelinktoitinthePrivacyPolicy. Ifurther
note that the link in question is embedded in “Learn more” text with the result that it does not stand
out to a user wishing to access it again outside of the “How We Work With Other Facebook
Companies” section of the Privacy Policy.
553. Turning, then, to the information provided concerning the purposes of the processing for which the
personal data are intended as well as the legal basis for the processing, I firstly note that there are
generalised references, throughout the entire Page, as to the reasons why WhatsApp needs to share
information with the Facebook Companies. By way of example, there are repeated references to
keeping WhatsApp and the Facebook Companies “safe and secure”. It is unclear, however, what sort
of processing operations will be carried out to this end, or even what “keeping WhatsApp and the
Facebook Companies safe and secure” might entail. This type of generalised information is of little
benefit to the user. In terms of any less generalised information that has been provided in relation
to the purpose of any sharing, this information is described and located as follows:
a. Top of the Page and also in the Facebook FAQ:
a. To receive services like infrastructure, technology, and systems that help us provide
and improve WhatsApp and
b. To keep WhatsApp and the Facebook Companies safe and secure
b. Top of the Page:
a. Provide you fast and reliable messaging and calls around the world
b. Understand how our services and features are performing
c. Ensure safety and security across WhatsApp and the Facebook Company Products by
removing spam accounts and combatting abusive activity
154 d. Connect your WhatsApp experience with Facebook Company Products
e. Enable you to communicate with businesses on WhatsApp
c. “How We Work With Other Facebook Companies” section of Privacy Policy
a. To help operate, provide, improve, understand, customize, support, and market our
Services and their offerings
b. [including] helping improve infrastructure and delivery systems
c. Understanding how our Services or theirs are used
d. Helping us provide a way for you to connect with businesses
e. Securing systems
f. Fight spam, threats, abuse or infringement activities and promote safety and security
across the Facebook Company Products
d. The Facebook FAQ
a. Services received from the Facebook Companies (and trusted third parties) include
i. infrastructure, technologies, systems, tools, information, and expertise to help
us provide and improve the WhatsApp service for our users.
1. This enables WhatsApp to
a. analyse and understand how our Services are being used
i. so as to more accurately report information about
our Services and to improve our Services.
ii. And understand how people use WhatsApp services
compared to other apps or services in the Facebook
Companies, which helps us to explore potential
features or product improvements
b. explore ways to build a sustainable business
a. To keep WhatsApp and other Facebook family services safe and secure
ii. By helping to fight spam and abuse on our Services
iii. Help keep our Services [safe and] secure
554. Asisevidentfromtheabove,verylittlerelevantinformation,inrelationtothereasonswhyWhatsApp
shares information with the Facebook Companies, is to be found inthe Privacy Policy itself. The most
meaningful information is to be found in the Facebook FAQ. Again, it is unclear why this document is
not linked more frequently throughout the Privacy Policy, as an alternative to the meaningless and
generalised information that has been included in the Privacy Policy.
555. In relation to the information provided as to the legal bases relied upon when sharing personal data
with the Facebook Companies, the issues identified in Part 2 of this Decision apply here. It is
impossible to identify what legal basis is relied upon by WhatsApp when it is sharing personal data
with the Facebook Companies for the various purposes identified.
WhatsApp’s Response
556. BywayofthePreliminaryDraftSubmissions,WhatsAppfirstlyrestateditsdisagreementwithmyview
thatArticle13(1)(c)requiresa controllertoprovide information tothe data subjectsuch thatthe data
subject can identify what categories of personal data are processed for a particular processing
155 operation (or set of operations) and by reference to which legal basis217. I acknowledge WhatsApp’s
position, in this regard, and have already taken account of WhatsApp’s substantive submissions on
this particular issue in Part 2 of this Decision.
557. WhatsAppfurthermadethepreliminarycommentthatitdidnotprovideitsviewsoncompliancewith
Article 13(1)(c) in the context of working with the Facebook Companies in the Inquiry Submissions as
the Investigator did not propose a finding under this heading 218. While I acknowledge WhatsApp’s
position, in this regard, I donot consider that WhatsApp has been disadvantaged or prejudiced in any
way by this in circumstances where it has already been provided with the opportunity to be heard, at
the Preliminary Draft stage, on the Proposed Approach by reference to Part 2 of this Decision.
558. In relation to my comments concerning the placement of the Facebook FAQ and the fact that it is a
stand-alone document, WhatsApp submitted that:
“The Facebook FAQ (as a stand-alone document) was first drafted on the basis of extensive
consultation with the Commission. During that consultation the Commission did not take issue
with the Facebook FAQ being provided as a stand-alone document. Nor has the Commission
subsequently objected to maintaining the Facebook FAQ as a standalone document (on the
understanding it is to be read in conjunction with the Privacy Policy which should refer to the
Facebook FAQ). While WhatsApp disagrees that there isany transparency deficiency in this regard
and certainly does not consider that this matter comprises an Articles [sic] 12 or 13 contravention,
WhatsApp is givingfurther thought to the structure of this information and how bestto ensure this
information is prominently featured and accessible to users219.”
559. I have previously recorded my assessment of WhatsApp’s submissions concerning its pre-GDPR
engagement with the Commission’s Consultation Unit as part of my assessment of WhatsApp’s
Submissions of General Application, at paragraphs 228 to 232, above.
560. In relation to my observations concerning the extent of information provided about the legal
basis being relied upon for processing, WhatsApp contended that:
“Asaninitialpoint,WhatsAppwouldliketoclarifythatitdoesnotrequireadistinctlegalbasis
to share data with Facebook Companies when they are acting as its processor. With respect
to sharing data with Facebook Companies on a controller-to-controller basis … WhatsApp has
committedtonotshareanyEuropeanRegionWhatsAppuserdataforthepurposeofFacebook
usingthisdatatoimprovetheirproductsandadvertisementswithoutprior discussionwiththe
Commission. With respect to controller-to-controller sharing for safety and security,
WhatsApp has previously explained to the Commission that: “… following the GDPR Update
WhatsApp intended to commence the sharing of its EU users’ data with Facebook on a
controller-to-controller basis for safety and security purposes only. We made this clear to our
users in the User Engagement Flow and our Privacy Policy as well as explaining to users the
legal bases on which we will rely for this sharing … Whilst we plan to commence this sharing
in the foreseeable future, we can confirm that WhatsApp will only do so following further
217The Preliminary Draft Submissions, paragraph 14.2
218The Preliminary Draft Submissions, paragraph 14.3
219The Preliminary Draft Submissions, paragraph 14.4(B)
156 engagement and consultation with your Office”. This notwithstanding, were WhatsApp to
share European Region WhatsApp users’ personal data with other Facebook Companies as
controllers for this purpose, information on the legal basis that would be relied upon for this
sharing is provided in the final bulleted paragraph of the general legitimate interests section
of the Legal Basis Notice (“To share information with the Facebook Companies to promote
safety and security”). Given the unequivocal nature of this language about reliance on
legitimate interests for this sharing with Facebook Companies, WhatsApp is of the view that
220
there is no contravention of Article 13(1)(c) GDPR .”
561. WhatsApp is, of course, correct that it does not require a distinct legal basis to share personal
data with the Facebook Companies when they are acting as its processor. However, the Privacy
Policy and related materials do not enable the reader to understand which transfers are taking
place on a controller-to-processor basis and which are taking place on a controller-to-controller
basis. As regards the latter, I note that WhatsApp’s submissions indicate that no such transfers
take place for the purpose of safety and security or for the purpose of enabling Facebook to
improve its products and advertisements. It remains unclear, however, whether any personal
data is being shared with the Facebook Companies on a controller-to-controller basis for any
other purpose(s). Further, the inclusion of a specific legal basis to support the sharing of
information “with the Facebook Companies to promote safety and security” in the Legal Basis
Notice is misleading if it is the case that no such transfers are actually taking place. I note, in this
regard, that there are numerous references to the sharing of personal data with the Facebook
Companies in connection with “safety and security” throughout the Privacy Notice and related
pages. The inclusion of a specific legal basis to support transfers matching this description
misleads users by suggesting that such transfers take place on a controller-to-controller basis.
This impression is also conveyed by the text used within the “How is my WhatsApp information
used by the Facebook Companies?” section of the Facebook FAQ. I note, in this regard, that
under the heading “(t)o keep WhatsApp and other Facebook family services safe and secure”,
the example provided and the absence of confirmation that the relevant data is shared with the
Facebook Companies as service providers, in contrast to the preceding heading, strongly
suggests,tothereader,thatthetransfersdescribedaretakingplaceonacontroller-to-controller
basis rather than on a controller-to-processor basis. I also note the express confirmation
provided, in the Facebook FAQ, that WhatsApp does not share data with the Facebook
Companies for the purpose of enabling Facebook to improve its products and advertisements.
The absence of a similar confirmation, in relation to the sharing of data for safety and security
purposes, only exacerbates the confusion caused by the misleading language used elsewhere.
562. As regards WhatsApp’s having provided a legal basis for controller-to-controller processing that
is not actually taking place, I note that Article 13(1)(c) requires the provision of information in
relationtothe“purposeoftheprocessingforwhichthepersonaldata areintendedaswellasthe
legal basis for the processing”. The use of the words “are intended” reflects the fact that, at the
point of collection, the data controller intends to process the data for the purposes outlined to
the data subject. There may be cases where, for reasons unforeseen, the data controller is
unable, or no longer wishes, to proceed with the processing once the data has been collected.
220The Preliminary Draft Submissions, paragraph 14.4(C)
157 In such a case, it would not be fair to find that a controller breached Article 13(1)(c) simply
because of a change in circumstances after the initial collection of the personal data concerned.
Nevertheless, I note that considerable time has elapsed since the formulation of the relevant
parts of the Privacy Policy and related pages (including the Facebook FAQ) and the letter dated
8 June 2018 to the Commission, advising of WhatsApp’s plan to “commence this sharing in the
foreseeable future”. As set out above, I consider that the inclusion of reference to a legal basis
to support controller-to-controller transfers of personal data to the Facebook Companies is
misleading.
221
563. For the sake of completeness, I do not agree with WhatsApp’s assertion that, “were it to
commence” the sharing of personal data with the Facebook Companies for safety and security
purposes, that the language used in final bulleted paragraph of the general legitimate interests
section of the Legal Basis Notice satisfies the requirements of Article 13(1)(c). I have already
addressed the information that must be provided, in this regard, in the corresponding section of
Part 2 of this Decision. I note, in this regard, that the information provided does not identify the
processing operations that will take place under this heading or the categories of personal data
that will be so processed.
Article 13(1)(d): where the processing is based on point (f) of Article 6(1), the legitimate interests
pursued by the controller or by a third party
564. As set out in my assessment, in Part2 of the PreliminaryDraft, of the information provided under this
heading, my preliminary view was that WhatsApp has provided clear and transparent information to
users in relation to the legitimate interests being pursued. Considering this aspect of matters
specifically from the point of view of the extent towhich it is transparent that the legitimate interests
of the Facebook Companies might form part of the legalbasis for processing in respect of the sharing
with them of personal data by WhatsApp, I note that the relevant sections of the Legal Basis Notice
include reference to the Facebook Companies as follows:
565. Under the section addressed to people under the age of majority:
“The legitimate interests we rely on for this processing are:
• To … keep our Services and all of the Facebook Company Products free of harmful or
inappropriate content …”
566. Under the section addressed to all users, including those under the age of majority:
“For providing marketing communications to you. The legitimate interests we rely on for this
processing are:
• To promote Facebook Company Products and issue direct marketing.”
“To share information with others including law enforcement and to respond to legal requests.
See our Privacy Policy under Law and Protection for more information. The legitimate interests
we rely on for this processing are:
221The Preliminary Draft Submissions, paragraph 14.4(C)
158 • To prevent and address fraud, unauthorised use of the Facebook Company Products …”
“To share information with the Facebook Companies to promote safety and security. See our
Privacy Policy under “How We Work with Other Facebook Companies” for more information. The
legitimate interests we rely on for this processing are:
• To secure systems and fight spam, threats, abuse, or infringement activities and promote
safety and security across the Facebook Company Products.”
567. I expressed the view, in the Composite Draft, that the information provided above is broadly
representative of the information I would expect to see, by reference to the processing described in
the Facebook FAQ.
Article 13(1)(e): the recipients or categories of recipients of the personal data, if any
568. As set out above, this information is provided mainly by way of links to “articles” on the Facebook
website. However, thisapproach effectively forces the data subjecttoaccepta certain level of cookie
processing by Facebook if he/she wishes to access information on the identities of the “Facebook
Companies”. In other words, by seeking to vindicate his/her right to transparency, the data subject
is subjected to processing of his/her personal data through the use of cookies. This runs counter to
the nature of transparency as a freestanding right; a data subject is entitled to transparency
information without any conditionality. Further, and in any event, the information available on the
Facebook website is minimal so it is unclear why it has been split into three/four separate articles
(which are linked to each other, in various ways) on that website. The information could easily be
consolidated into a single piece of text and hosted on WhatsApp’s website.
569. While the Facebook FAQ touches upon the identities of the Facebook Companies (as discussed
below), I note that the user is only invited to access the Facebook FAQ document in the “How We
Work With Other Facebook Companies” section of the Privacy Policy. If the user, when looking for
information in relation to the recipients/categories of recipient, only reviews the “Information You
And We Share” section of the Privacy Policy (which would not be an unreasonable course of action,
given the title of this section), he/she is deprived of the additional information which is solely set out
in the Facebook FAQ.
570. My views, in relation to the information that must be provided to a data subject, for the purpose of
Article 13(1)(e), are already set out in the corresponding section of Part 2 of this Decision. Assessing
this requirement specifically from the perspective of transparency in the context of the sharing of
data between WhatsApp and the Facebook Companies, I note as follows:
571. Each time the term “Facebook Companies” is referenced in the Page, it contains an embedded
hyperlink that, when selected, brings the user to an “article” entitled “the Facebook Companies”, on
Facebook’s website. That “article” provides that:
“The Facebook Companies
In addition to the services offered by Facebook Inc. and Facebook Ireland Ltd, Facebook owns and
operates each of the companies listed below, in accordance with their respective terms of service
and privacy policies. We may share information about you within our family of companies to
159 facilitate, support and integrate their activities and improve our services. For more information on
theFacebookCompanies’privacypracticesandhowtheytreatindividuals’information,pleasevisit
the following links:
Facebook Payments Inc. (https://www.facebook.com/payments terms/privacy) and
Facebook Payments International Limited
(https://www.facebook.com/payments terms/EU privacy).
Onavo (http://www.onavo.com/privacy policy).
Facebook Technologies, LLC and Facebook Technologies Ireland Limited
(https://www.oculus.com/legal/privacy-policy/).
WhatsApp Inc. and WhatsApp Ireland Limited (http://www.whatsapp.com/legal/#Privacy).
CrowdTangle (https://www.crowdtangle.com/privacy).
…
Related Articles
The Facebook Company Products
How can I switch back to Classic Facebook?
Can I search for specific videos on the Facebook Watch TV app?
How do I get to the Facebook mobile site (m.facebook.com)?
What are the Facebook Products?”
572. Each time the “Facebook Company Products” is referenced in the Page, it contains an embedded
hyperlink that, when selected, brings the user to an “article” entitled “the Facebook Company
Products”, on Facebook’s website. That “article” provides that:
“The Facebook Company Products
The Facebook Company Products are, together, the Facebook Products and other products
provided by the Facebook Companies that are subject to a separate, stand-alone terms of service
andprivacypolicy,includingtheWhatsApp,Oculus,andCrowdTanglewebsites,products,orapps.”
573. The term “Facebook Products”, above, contains an embedded link that brings the user to another
“article” on Facebook’s website, entitled “Facebook Products”. That “article” provides:
“What are the Facebook Products?
The FacebookProductsinclude Facebook(includingthe Facebook mobile appand in-appbrowser),
Messenger,Instagram(includingappslikeDirectandBoomerang),Portal-brandeddevices,Bonfire,
Facebook Mentions, Spark AR Studio, Audience Network, NPE Team apps and any other features,
apps, technologies, software, products, or services offered by Facebook Inc. or Facebook Ireland
LimitedunderourDataPolicy.TheFacebookProductsalsoincludeFacebookBusinessTools ,which 2
are tools used by website owners and publishers, app developers, business partners (including
advertisers) and their customers to support business services and exchange information with
Facebook, such as social plugins (like the "Like" or "Share" button) and our SDKs and APIs.
Facebook Products does not include some Facebook-offered products or services that have their
own separate privacy policies and terms of service – such as Workplace, Free Basics, and
Messenger Kids.”
574. The term “Facebook Business Tools”, above, contains a link to a further “article”, as follows:
“The Facebook Business Tools
The Facebook Business Tools are technologies offered by Facebook Inc. and Facebook Ireland
Limited that help website owners and publishers, app developers, and business partners,
160 including advertisers and others, integrate with Facebook, understand and measure their
products and services, and better reach and serve people who use or might be interested in their
products and services. These Tools include APIs and SDKs, the Facebook Pixel, Facebook social
plugins, such as the Like and Share buttons, Facebook Login and Account Kit, and other Platform
integrations, as well as other plugins, code, specifications, documentation, technology and
services.”
575. The Facebook FAQ defines the “Facebook Companies” as follows:
“What are the Facebook Companies?
WhatsApp is one of the Facebook Companies. The Facebook Companies include, among others,
Facebook, Oculus, and WhatsApp and together offer the Facebook Company Products.”
576. I note that the definition provided by the Facebook FAQ, above, indicates that Oculus is one of the
Facebook Companies. The corresponding definition on Facebook’s website, however, does not
include Oculus in the “Facebook Companies” article but rather in the “Facebook Company Products”
article. Oculus is included in the above text in the Facebook FAQ, alongside WhatsApp and
CrowdTangle, both of which were previously defined as being “Facebook Companies”, by reference
to the “article” on Facebook’s website.
577. Havingreviewed the information provided on numerous occasions, I cannotidentify,with any degree
of certainty, the extent of the entities that are covered by the definition of “Facebook Companies”
such as to be able to identify all of the possible recipients of user data.
578. I note, in this regard, that Exhibit 21.1 of the Form 10-K filed with the US Securities and Exchange
Commission for the fiscal year ended December 31, 2018 (which is attached to the Directors’ Report
and Financial Statements filed with the Irish Companies Registrations Office on behalf of Facebook
Ireland Limited for the financial year ended 31 December 2018) comprises a list of thirty separate
corporate entities. WhatsApp is not included on that list so, presumably, the list is just a fraction of
the total corporate entities making up the Facebook “family”, once the subsidiaries of the listed
companies are taken into account. Thirty companies alone (without any further entities which may
not have been included in this list) is a very significant number of potential recipients of a user’s
personal data yet the user is provided with no meaningful information as to which Facebook entities
will receive his/her data and for what purpose.
579. In the circumstances set out above, it is incumbent on WhatsApp to address the question of what,
exactly, “Facebook Companies” means for the purposes of Article 13(1)(e). If WhatsApp wishes to
address the question by reference to its current approach, the user must be able to clearly and easily
identifythefullextentoftheentitiesthatarecoveredbytheterm“FacebookCompanies”. Thatterm,
once defined for the purposes of Article 13(1)(e) should only contain the names of those “Facebook
Companies” that actually receive user data from WhatsApp. Further, it should be possible for the
user to access this information on WhatsApp’s website and in a single, composite text (rather than a
series of interlinked and overlapping “articles”).
WhatsApp’s Response
580. WhatsApp, by way of the Preliminary Draft Submissions, expressed its disagreement with the views I
expressed under this heading, submitting firstly that “ the Facebook FAQ was first drafted on the
basisofextensiveconsultationwiththeCommissionandduringthatconsultationtheCommission
161 did not raise concerns about the identity of the Facebook Companies or the linking to Facebook
222
resources to provide additional information .”
581. WhatsApp further submitted, in this regard, that:
“There is no requirement in the GDPR that prevents companies from referring individuals to
information available from other sources and the Commission did not raise an issue with this
approach previously .223
582. My assessment of WhatsApp’s submissions concerning its pre-GDPR engagement with the
Commission’s Consultation Unit has already been recorded as part of my assessment of
WhatsApp’s Submissions of General Application, at paragraphs 228 to 232, above. As regards
WhatsApp’s submission that there is no requirement in the GDPR that prevents companies from
referringindividualstoinformationavailablefromothersources/providedbyentitiesotherthan
the controller, my view is that it is unfair to deliver the statutorily required transparency
information to a data subject in a way that unnecessarily forces that data subject to accept the
further collection and processing of his/her personal data by a third party. The information that
WhatsApp is required to provide, in this regard, is information that is uniquely known to
WhatsApp and its processors and which could easily be provided by WhatsApp. This is different
to a case where, for example, a data controller might wish to include a link to the relevant part
of the European Commission’s website so that the data subject can learn more about the
particular mechanism being relied upon to support the transfer of his/her personal data outside
of the EEA. The further information available on the European Commission’s website, in this
regard, is not information that it uniquely known to the data controller given that it had no part
to play in the implementation of the relevant transfer mechanism(s).
583. WhatsApp further submitted, under this heading, that:
“WhatsApp wishes to clarify that the “Facebook Companies” information on the Facebook
website includes “Facebook Technologies, LLC and Facebook Technologies Ireland Limited
(https://www.oculus.com/legal/privacy-policy/) which provides the Oculus product and is
sometimes referred to as ‘Oculus’ (as in the Facebook FAQ) because it provides the Oculus
product. The website address included after this company name clearly refers to Oculus and
WhatsApp submits that it is clear that the Facebook Companies comprise of the companies
listed in the “Facebook Companies” information on the Facebook website which gives more
detailed information, expanding on the colloquial names of the companies listed in the
Facebook FAQ .”224
584. WhileIacceptWhatsApp’sclarificationoftheposition,Iremainoftheviewthattheidentification
of the “Facebook Companies”, as set out in the Privacy Policy and related material, is unclear. I
note, in this regard, that:
222
223The Preliminary Draft Submissions, paragraph 14.7
The Preliminary Draft Submissions, paragraph 14.10
224The Preliminary Draft Submissions, paragraph 14.8
162 a. TheFacebookFAQidentifiestheFacebookCompaniesbytheuseofopen-endedlanguage
– “include, among others, Facebook, Oculus, and WhatsApp” [emphasis added].
b. The linked “article” provides that “(i)n addition to the services offered by Facebook Inc.
andFacebookIrelandLtd,Facebookownsandoperateseachofthecompanieslistedbelow
….” Thecorrespondinglistcompriseseight specifiedcompanies. Inote,however,thislist
is “in addition to the services offered by Facebook Inc. and Facebook Ireland Ltd.” The use
of the language “in addition to” is, again, open-ended, in that it suggests the existence of
something in addition to the identified list of eight companies. No clarification, however,
is provided as to the significance of this statement or what is meant by “the services
offered”, in this context.
c. The “article” further confirms that “(w)e may share information about you within our
family ofcompanies”. It isunclear, however,whatismeantby“ourfamily ofcompanies”.
It could mean the subsequent list of eight specified companies. Alternatively, it could
meantheeightspecifiedcompaniestogetherwithFacebookInc.andFacebookIrelandLtd
oritmightmeantheeightspecifiedcompaniestogetherwithFacebookInc.andFacebook
Ireland Ltd plus “the services offered”.
d. The fact that Oculus is identified as being a Facebook Company Product and not a
Facebook Company only exacerbates the uncertainty of the position.
585. The resultof the above is the creation of doubt, in themind of the reader, as to the extent ofthe
entities that comprise the “Facebook Companies” for the purpose of the Facebook FAQ. Such
doubt is unnecessary and could easily be eliminated by removing the open-ended language
identified above and clarifying the matters which have been referred to above.
586. WhatsApp finally submitted that:
Without prejudice to WhatsApp’s position that the manner in which the information is
provided in full compliance with Article 13(1)(e) GDPR, WhatsApp will make this information
available on the WhatsAppwebsitewhenmaking thesuite of changes to itsPrivacy Policy and
225
user facing information .”
587. I acknowledgeWhatsApp’scommitment to making therelevant information available on its own
website. My assessment of WhatsApp’s Submissions of General Application, in Part 2 of this
Decision, includes an assessment of any submissions made concerning WhatsApp’s willingness
to incorporate changes, on a voluntary basis, to its privacy material.
Finding: Assessment of compliance with the requirements of Articles 13(1)(c), 13(1)(d) and 13(1)(e)
588. As set out above, the information that has been provided, regarding WhatsApp’s relationship with
theFacebookCompaniesandthedatasharingthatoccursinthecontextofthatrelationship,isspread
out across a wide range of texts and a significant amount of the information provided is so high level
as to be meaningless. While the Facebook FAQ is a comprehensive and informative document, it is
22The Preliminary Draft Submissions, paragraph 14.10
163 only linked to the Privacy Policy in one place (via the “Learn More” link at the end of the end of the
“How We Work With Other Facebook Companies” section). While WhatsApp has referenced
“numerousother FAQs” available on itswebsite, inthisregard, itisunfair toexpectthe user tosearch
WhatsApp’s website, after having failed to find sufficient information in the Privacy Policy itself.
589. In relation to the inclusion of text concerning, or suggesting, the existence of controller-to-controller
sharing of personal data with the Facebook Companies for safety and security purposes, this text is
misleading by reference to the confirmation provided in the Preliminary Draft Submissions that no
such processinghasever taken place. If the commencementof such processingisnotimminent, such
text should be removed from the Legal Basis Notice and Facebook FAQ so as to avoid misleading the
user. If, however, WhatsApp intends to imminently proceed with the commencement of such
processing, my view is that the Facebook FAQ and Legal Basis Notice do not sufficiently inform the
data subject as to the legal basis that will be relied upon for any such processing. My views, in this
regard, are already set out as part of my assessment of the extent to which WhatsApp provides the
information prescribed by Article 13(1)(c). Those views apply equally here.
590. Further, it is unsatisfactory that the user has to access information as to the identity of the Facebook
Companies on Facebook’s website and for the information to be broken up over three or four
different “articles” that each link back to one another in a circular fashion. There is no reason why
this information could not be hosted, in a concise piece of text, on WhatsApp’s website. As set out
above, the information currently being provided is unnecessarily confusing and ill-defined. As set out
in Part 2 of this Decision, it is a matter for a data controller to determine how best to provide the
required information to data subjects. In this case, there is an over-supply of very high level,
generalised information at the sacrifice of a more concise and meaningful delivery of the essential
information. Wherelinksandlayeringareused,theyshouldbeusedinaconsideredwaythatensures
the concise and meaningful delivery of the required information. In this case, however, it is a matter
of luck, rather than logic, as to whether or not the user will access the information provided in the
Facebook FAQ. If the user has engaged with the other, less meaningful (and, in one place,
contradictory) information en route, this may undermine the user’s ability to receive the information
set out in the Facebook FAQ.
591. Accordingly, for the reasons set out in the composite analysis, above, I find that WhatsApp has
failed to comply with its transparency obligations pursuant to Articles 13(1)(c), 13(1)(e) and 12(1)
in relation to how WhatsApp works with the Facebook Companies. I further direct that, unless
WhatsApp has a concrete plan in place, that includes a definitive and imminent
commencement date, to commence the sharing of personal data on a controller-to-controller
basis with the Facebook Companies for safety and security purposes, the misleading elements
of the Legal Basis Notice and Facebook FAQ should be deleted to reflect the true position.
592. For the avoidance of doubt, the Composite Draft proposed a finding that WhatsApp had broadly
complied with its obligations under Article 13(1)(d) for the purpose of this Part 3. Given that the
rationale was premised partly upon the original assessment of the extent to which WhatsApp had
achieved compliance with Article 13(1)(d), as recorded in Part 2 of the Preliminary Draft, I must now
amend my proposed finding, under this heading, in order to take account of the counter view of the
Board (as recorded in the Article 65 Decision 226), on the extent to which WhatsApp has achieved
226
The Article 65 Decision, paragraph 66
164Introduction
596. Having recorded my views and findings as to whether or not an infringement of the GDPR has
occurred/is occurring, I must now consider whether or not the findings of infringement merit the
exercise of any of the corrective powers set out in Article 58(2) and, if so, which one(s).
Approach to submissions furnished by WhatsApp in response to the Supplemental Draft
597. WhatsApp has furnished extensive submissions in response to the Supplemental Draft. Broadly
speaking, those submissions can be divided into two categories:
a. submissions directed to a specific aspect of the manner in which I assessed or proposed to
apply, in the Supplemental Draft, the provisions of Article 58(2) and/or Article 83; and
b. submissions concerning recurring themes, such that they are directed to an approach that I
took, on apreliminary basis,inthe SupplementalDraftgenerallyor,otherwise,thathavebeen
directed to a number of the individual aspects of my preliminary assessment and/or proposed
application of Articles 58(2) and/or Article 83 (“Submissions on Recurring Themes”).
598. In relation to the first category of submissions, I have recorded how I have taken account of the
particular submissions made in the corresponding assessment of this Part 5. In relation to the
Submissions on Recurring Themes, however, I have, as a procedural economy and with a view to
avoiding unnecessary duplication, recorded my views on the particular subject-matter arising in this
section of the Decision only. Thus, where, as part of its response to my assessment of any individual
aspect of Article 58(2) and/or Article 83, WhatsApp has indicated reliance on any matter covered by
the Submissions on Recurring Themes, the views set out below should be understood as being my
views on the relevant subject-matter.
WhatsApp’s Submissions on Recurring Themes
599. The Submissions on Recurring Themes can be grouped into six categories, as follows:
a. Submissions that:
i. assert that the provisional views expressed by the Commission represent new and
subjective interpretations of the transparency provisions; and/or
ii. assertthatthe approach proposed by the Commission representsanalternative or higher
standard of compliance, of which WhatsApp has not had prior notice; and/or
iii. concern WhatsApp’s reliance on the Transparency Guidelines; and/or
iv. concern the flexibility afforded to data controllers, in terms of how they might achieve
compliance with the transparency provisions.
b. Submissions concerning:
i. the nuanced nature of a transparency assessment; and/or
ii. the significance of the differing views as between the Investigator and Decision-Maker.
c. Submissions concerning:
170 i. the binary approach of the Commission, as regards the preliminary assessment of the
extent of information provided to users and non-users pursuant to Articles 13 and 14;
and/or
ii. the characterisation of the proposed infringements.
d. Submissions in relation to:
i. WhatsApp’s careful and good faith efforts to achieve compliance with the transparency
provisions; and/or
ii. WhatsApp’sviewthatitsapproachisalignedwiththeapproachadoptedbymanyindustry
peers; and/or
iii. WhatsApp’s pre-GDPR engagement with the Commission.
e. Submissions concerning WhatsApp’s willingness to amend its Privacy Policy and related
materials, on a voluntary basis;
f. Submissions that:
i. the Commission has not demonstrated how WhatsApp’s approach to transparency has in
fact had any negative impact on data subject rights; and/or
ii. the Commission’s concerns that the alleged infringements have impacted on data
subjects’ rights is theoretical and not supported as a matter of fact; and/or
iii. the Commission’s analysis of the damage allegedly suffered by data subjects is based on
assertions rather than evidence; and/or
iv. no evidence has been provided to indicate that WhatsApp’s approach to providing
transparency has undermined the effective exercise of the data subject rights.
600. For the purpose of this Decision, I have considered the above submissions as follows:
Submissions that the preliminary views expressed by the Commission represent new and subjective
interpretations of the transparency provisions and/or that the approach proposed by the Commission
represents analternative orhigher standardof compliance ofwhich WhatsApp has nothad anyprior notice
and/or concerning the flexibility afforded to data controllers, in terms of how they might achieve
compliance with the transparency provisions (“the New and Subjective Views Submissions”)
601. WhatsApp has submitted, in this regard 26, that:
“Most of the Commission’s proposed findings of infringement turn on new and subjective
interpretationsof Articles12and 13GDPR. These interpretationsgobeyond the letter of – and any
guidance published to date in relation to – Articles 12 and 13 GDPR. As evidence of this, WhatsApp
is not aware of any controller that could be considered to comply with the Commission’s
expectationsinthis regard. WhatsApp submits thatitcannotbe the case thatunprecedented fines
shouldbeimposedonacontrollerinrespectoffindingsofinfringementarisingfromtheapplication
of standards which it was not aware of in advance, in the first case where such standards are
articulated263.”
262The submissions falling under this particular heading are set out in paragraph 1.3, paragraph 1.5, paragraph 3.4(B)(2),
paragraph 5.13, paragraph 5.14, paragraph 5.19, paragraph 5.20, paragraph 6.4(C) and (D) and paragraph 10.2 of the
Supplemental Draft Submissions
263The Supplemental Draft Submissions, paragraph 1.3, paragraph 3.4(B)(2)
171602. WhatsApp further submits that:
“The Commission’s position in the Preliminary Draft in fact goes beyond simply providing the
information listed in Article 13 GDPR: … For example, complying with the Commission’s “Proposed
Approach” requires more than simply providing information listed in Article 13(1)(c) GDPR.
Ultimately, there is no clear consensus on what amounts to an appropriate approach to
transparency … In these circumstances, WhatsApp submits that it cannot be held to have acted
negligently … The Commission’s standards go beyond that required by Article 13 26.”
603. WhatsApp has also submitted, in this regard, that it:
“… should not be penalised for the duration of the alleged infringements in circumstances where it
proactivelysoughtto make changes assoonasitwasina position to understand the Commission’s
265
views .”
604. In relation to the flexibility afforded to the data controller, WhatsApp has submitted that:
“Articles 12 to 14 GDPR collectively, by their very nature, also afford latitude to controllers in
relation to how they achieve compliance, as underlined by the [Transparency Guidelines] which
explicitly recognises that there are “nuances and many variables which may arise in the context of
the transparency obligations of a specific sector, industry or regulated area”. This is an important
point to bear in mind where the proposed findings of infringement … arise from the Commission
and WhatsApp adopting different good faith interpretations of how to comply in practice with the
broad transparency obligations set out in the GDPR – an issue which is not black and white, but
dependent onsubjective judgment and evaluation of what is appropriate in specific circumstances.
… the Commission … should also adopt an approach which takes account of the flexibility afforded
to controllers in discharging their transparency obligations as envisaged by the GDPR and by the
266
EDPB .”
605. I note that I have already assessed the substance of this particular category of submissions in the
context of my assessment of WhatsApp’s Submissions of General Application set out at paragraph
218 to 224 in Part 2 of this Decision (by reference to the category of “Submissions concerning Legal
Certainty”). The views so expressed apply equally here. By way of summary of my position: I do not
agree that the views expressed in Parts 2 or 3 of this Decision represent a new or subjective approach
and neither do I accept that they represent an alternative or higher standard of compliance. I am, in
fact, satisfied that my views accord with the views expressed by the Article 29 Working Party in the
Transparency Guidelines, as endorsed and adopted by the EDPB on 25 May 2018.
606. I note, inanyevent, thatthere are clearinconsistencies, asbetween thecontentsof the Transparency
Guidelines and the approach taken by WhatsApp. By way of example, the Transparency Guidelines
provide that:
264The Supplemental Draft Submissions, paragraph 6.4(D)
265The Supplemental Draft Submissions, paragraph 5.20
266The Supplemental Draft Submissions, paragraph 1.5
172 “The information should be concrete and definitive; it should not be phrased in abstract or
ambivalent terms or leave room for different interpretations. In particular the purposes of, and
legal basis for, processing the personal data should be clear 267.”
607. They further provide that:
“Language qualifiers such as “may”, “might”, “some”, “often” and “possible” should also be
268
avoided .”
608. Had WhatsApp followed these directions (which, I note, were supplemented and further explained
by way of examples in the corresponding sections of the Transparency Guidelines), it would have
avoided the confusion thathasresultedfromthemannerinwhichitformulated itsLegalBasisNotice.
AsidentifiedinParts2and3ofthisDecision,thisisasignificantcauseforconcern,giventhecomplete
lack of clarity as to the legal basis being relied on for any of the general processing initiatives
identified. Further, WhatsApp would have avoided the ambiguity that results from the use of
language qualifiers, as noted in Parts 2 and 3 of this Decision.
609. In the circumstances, I am unable to attribute weight, as a mitigating factor for the purpose of my
assessment as to the application of corrective powers within this Part 5, to the matters raised under
thisparticular headingof submission. Asset outabove, I disagree thatmy views representa different
standard of compliance than that already required by the Transparency Guidelines. If, however, I am
(wholly or partially) incorrect in this assessment (and, for the record, I do not consider that I am), I
note that, despite its submission 269 that it relied on the Transparency Guidelines when preparing the
Privacy Policy and related material, there are clear inconsistencies between the contents of
WhatsApp’s user-facing information and the Transparency Guidelines.
Submissions concerning the nuanced nature of a transparency assessment and/or the significance of the
differing views, as between the Investigator and Decision-Maker (the “Nuanced Nature of Assessment
Submissions”)
610. WhatsApp has submitted, in this regard, that:
“The subjective and nuanced nature of assessing transparency – which is what renders the
Commission’s binary approach inappropriate – is also underlined by the fact that differing views
have been reached even within the Commission throughout this Inquiry. … If transparency was
simple and straightforward as the Commission asserts in the Supplemental Draft then … these
material differences of opinion even within the Commission would not have arisen 270.”
611. For the reasons explained above, I do not agree that the assessment of transparency is a “subjective
and nuanced” matter. While WhatsApp has sought to rely on the statement, in the Transparency
Guidelines, that there are “nuances and many variables which may arise in the context of the
267Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”), pages 8/9
268
Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”), page 9
269The Preliminary Draft Submissions, paragraph 2.1
270The Supplemental Draft Submissions, paragraph 5.2 (see also paragraphs 5.3 and 5.13)
173 271
transparency obligations of a specific sector, industry or regulated area ”, this statement is simply a
reflection of the fact that there is no “one size fits all” approach to transparency. In fact, I consider
that WhatsApp has taken this statement from the Transparency Guidelines out of context, as its
objective is to explain how the Transparency Guidelines are generally applicable to all controllers,
irrespective of sector, industry or regulated area and to explain why the guidelines did not
specifically focus on, or consider, the particular application of the transparency principle in any
particular sector, industry or regulated area . Articles 13 and 14 require the provision of specified
information so as to enable the data subject to understand how and why his/her personal data will
be processed in the context of the particular processing that will be carried out by the data controller
concerned. The Transparency Guidelines aim to provide support to data controllers, in terms of
explaining how they might individually tailor the transparency requirements to the unique
circumstances of their processing operations. This is clear from the introduction to the Transparency
Guidelines:
“… these guidelines are intended to enable controllers to understand, at a high level, [the Working
Party’s] interpretation of what the transparency obligations entail in practice and to indicate the
approach which [the Working Party] considers controllers should take to being transparent while
embedding fairness and accountability into their transparency measures 272”.
612. While there will undoubtedly be “nuances” and variables, in terms of the information required to be
provided, from data controller to data controller, these “nuances” and variables are the consequence
of the difference in processing operations being carried out, from data controller to data controller.
This does not mean, however, that there are “nuances” and variables in relation to the manner of
assessment of the information provided, as considered further below, in the context of the Binary
Approach Submissions. The Transparency Guidelines make it absolutely clear that the principles
enunciated must be applied across the board, while acknowledging that particular measures (which
still adhere to those principles) may be necessitated, depending on context.
613. In relation to WhatsApp’s submissions concerning the significance of any “material difference of
opinion” as between the Investigator and myself, I firstly note that there are only three such material
differences, as follows:
a. The Investigator was of the view that the information provided by WhatsApp did not satisfy
the requirements of Article 13(1)(a). She formed this view on the basis of the inconsistencies,
as between the Privacy Policy and the Terms of Service, in the language used to identify what
is meant by the term “we”. I reached a different conclusion, by reference to WhatsApp’s
submission that the Privacy Policy is the “primary information and transparency document in
273
respect of WhatsApp’s data processing ”. I concluded, above, that the Privacy Policy clearly
identified WhatsApp as being the relevant data controller. As regards the significance of this
differenceofopinion,asbetweentheInvestigatorandmyself,therearetwoobservationsthat
I would make, in this regard:
271
Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”), paragraph 1
272Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”), paragraph 1
273The Inquiry Submissions, paragraphs 6.1 and 6.2
174 i. Firstly, WhatsApp created the circumstances in which it was possible for there to be a
difference of opinion by using “we” in the Privacy Policy to denote WhatsApp Ireland
Limited and the same term – “we” – in the Terms of Service to collectively refer to
WhatsApp Ireland Limited and WhatsApp, Inc. This could have been avoided by a more
careful approach to the defined term.
ii. Secondly, our difference of opinion reflected a differencein our respective approaches to
the inquiry, rather than a difference in our approach to the assessment of Article 13(1)(a)
itself. As already reflected in the corresponding assessment in Part 2, I focused my
assessment, for the purpose of Article 13(1)(a), on the Privacy Policy because this was
identified, by WhatsApp, as being the relevant primary source of the prescribed
information under assessment.
b. The second difference of opinion arose in relation to our respective assessments of Article
13(2)(c). This provision requires the data controller to inform the data subject about “the
existence” of the right to withdraw consent. The Investigator was satisfied that WhatsApp
had doneso. Ireached adifferentfinding,on thebasisthat, firstly,WhatsAppfailedtoinclude
the full extent of the text required by Article 13(2)(c). More importantly, however, I noted
that the existence of this right was not referenced in the “How You Exercise Your Rights”
section of the Privacy Policy. This section, as the title suggests, is the primary source of
information on the data subject rights, in the context of WhatsApp’s Privacy Policy. In the
circumstances, Iexpressedthe preliminaryview,whichIhavemaintainedinthis Decision, that
this section is where the data subject is most likely to visit, if he/she wishes to learn about
his/her rights. Accordingly, it is incumbent on WhatsApp to include reference to the right to
withdraw consent in this particular location. Otherwise, it is a matter of chance as to whether
or not the data subject receives the information prescribed by Article 13(2)(c). Again, I note
this difference in opinion, as between the Investigator and myself, is more reflective of a
difference in our respective approaches to the inquiry rather than a difference in approach to
the assessment of Article 13(2)(c) itself. The Investigator, in this regard, adopted a thematic /
functional approachtoassessment. Iadopted amoreformulaic approachwherebyI assessed,
inaholisticmanner,theinformationthathadbeenprovidedpursuanttoeachoftheindividual
categories of information prescribed by Article 13.
c. The third difference of opinion arose in relation to our respective assessments of Article
13(1)(d). That difference of opinion, however, is limited to our views concerning the question
of whether or not the information provided indicated the “owner” of the legitimate interests
being pursued. In all other respects, the Investigator and I were aligned in our views. As
already observed, the Investigator and I adopted different approaches to the inquiry. The
consequence of this is apparent within our respective conclusions on the extent to which
WhatsApp has complied with its obligations pursuant to Article 13(1)(d). The Investigator’s
Proposed Finding 9 reflected an infringement of “a cumulative requirement, which results in
Articles 13(1)(c) and 13(1)(d) operating together …”. My proposed finding, however, was
based purely on an assessment of Article 13(1)(d), although I clearly noted, as part of my
assessment 27, the impact of the shortcomings previously identified, pursuant to my Article
13(1)(c) assessment, on the quality of information provided in pursuance of Article 13(1)(d).
274The Preliminary Draft, paragraph 265
175 This remains the case, notwithstanding the determination of the Board on the objections
raised by the German (Federal), Polish and Italian SAs concerning the Article 13(1)(d)
assessment (as addressed in Part 2, above).
614. I note that the only other differences, between the Investigator and myself, are the result of a
divergence in approach to the inquiry itself, rather than adivergence in approach to the transparency
assessment. Unlike the Investigator, I did not propose individual findings on the manner in which the
material ispresented, for example, inrelation tothe useof layeringor the suitabilityof language used
where the recipient is likely to be under the age of majority. This is because I adopted a holistic
approach to the transparency assessment whereby the only question for determination was whether
or not the prescribed information had been provided. In having taken this approach, I assessed the
qualityofinformationprovided,byreferencetoanyparticularcategory,atthesametimeasassessing
the manner in which that information had been provided. I note that, even with this adjusted
approach to the inquiry, my views, in relation to the transparency deficiencies arising from the
manner in which the information had been presented, are entirely consistent with those of the
Investigator.
615. Inthe circumstancessetoutabove,I donotacceptthatthe limiteddifferencesinopinion, asbetween
the Investigator and myself, are suggestive of anything other than a thorough and robust inquiry
process in which WhatsApp has been afforded the benefit of a second and independent review of
matters by the Decision-Maker. Accordingly, I am unable to attribute weight, as a mitigating factor
for the purpose of this Part 5, to the matters raised under this heading.
Submissions concerning the binary approach of the Commission, as regards the preliminary assessment of
the extent of information provided to users and non-users pursuant to Articles 13 and 14 and/or the
characterisation of the proposed infringements (the “Binary Approach Submissions”)
616. WhatsApp has submitted 27, in this regard, that:
“The Commission’s binary approach of finding either full compliance or complete non-compliance
with each provision – resulting in the creation of a “55%” compliance figure – is based on its
subjective views, not on any established precedent or published guidance, and does not take
adequate account of the fact that the relevant information has, WhatsApp submits, been provided
for each specific Article 13 category. Adopting the Commission’s methodology as set out in the
Supplemental Draft, WhatsApp would achieve the same 55% compliance level if it had provided no
information at all in relation to the five categories concerned. … an examination of WhatsApp’s
transparency information against the requirements of Article 13 GDPR in fact shows that the
essenceof theGDPR requirements isadhered to. Whileitmaybethat, inits view,suchinformation
does not reach the new standards for compliance set by the Commission … it is certainly not the
case that WhatsApp has provided no relevant information whatsoever 276.”
617. WhatsApp further submits that:
275The submissions falling under this particular heading are set out in paragraph 5.1, paragraph 5.3, paragraph 5.13,
paragraph 5.15, paragraph 5.30, paragraph 5.31, paragraph 8.2, paragraph 16.6(A), paragraph 5.4 and paragraph 5.6 of the
Supplemental Draft Submissions
276The Supplemental Draft Submissions, paragraphs 5.1 and 5.13
176 “… the flaws in the binary approach … are particularly evident in circumstances where it is clear
that: … (ii) … the Commission has not identified any provision of Article 13 GDPR where WhatsApp
has failed to provide at least some information. The Commission has instead reached a more
nuanced finding: namely that, in its opinion, WhatsApp should have provided more granular
information in addition to what it currently provides, included more examples, or presented the
information in a different manner. These alleged infringements do not support the Commission’s
approach of applying the Article 83(2) Factors as if WhatsApp had done nothing at all in relation
277
to compliance with the relevant provisions. … ”
618. Is important to recall that the assessment with which we are, here, concerned is the obligation to
provide information. I have not, by way of my assessment, sought to apply any particular standard
of compliance: my view is that there could only ever be one applicable standard or test and that is
thesimplequestionofwhetherornottherequiredinformationhasbeenprovided. Asreflectedupon
in Parts 2 and 3 of this Decision, effective communication simply requires the data controller to set
out, for the data subject, the information described inArticles 13 and/or14 and to doso in a way that
makes it possible for the data subject to receive and understand that information. My focus,
throughout my assessment, has been on the simple question of whether the Privacy Policy and
related materials enabled me to receive the information that a data subject is entitled to receive,
pursuant to Articles 13 and 14.
619. WhatsApp has sought to characterise my findings being “nuanced”, such that they are findings that
WhatsAppoughttohave provided“more granular information” or moreexamples or,otherwise,that
WhatsApp ought to have presented the information “in a different manner”. I strongly disagree with
this characterisation. To ensure that my assessments, views and proposed findings are understood
in their proper context, and to ensure that there is no doubt as to the seriousness of the issues
identified, I have summarised, below, the difficulties that I encountered when carrying out my
assessment of the Privacy Policy and related materials. It is important to recall, in this regard, that,
as a member of the Commission, I am experienced in data protection matters and so the review of
transparency material ought to be a relatively simple exercise in circumstances where I know what I
amlookingfor and can identify itquickly, when itispresented. A data subjectmay nothave the same
level of understanding of data protection matters; indeed, there is likely to be significant variation in
this state of knowledge, as between one data subject and the next. The transparency obligation has
particular significance for those data subjects who might not have a developed state of awareness of
data protection matters. Thus, while, during the course of my assessment, I actively located and
reviewed, in a comprehensive manner, all of the information that had been provided by WhatsApp in
relation to each individual category of prescribed information, it is unlikely that an individual data
subject would adopt such a complete approach. This is why it is so important that a data controller
not only provides the prescribed information but provides it in such a way that it is easy for the data
subjecttoreceive it. If either of these elementsismissing, itcreates a situation whereby itisa matter
of chance as to whether or not the data subject will achieve the state of knowledge that Articles 12 –
14 of the GDPR intend for him/her to have.
620. My experience of interacting with, and navigating, the Privacy Policy and related materials was one
whereby:
277The Supplemental Draft Submissions, paragraph 5.3
177 a. therewasanabundanceoftextthat,ultimately,communicatedverylittleotherthanageneral
and high level summary of the relevantposition. While WhatsApphasasserted,inthisregard,
that there is no aspect of Article 13 in relation to which no information has been provided, I
respectfully observe that it does not necessarily follow that the provision of text results in the
actual communication of the required information;
b. there was an over-supply of linked material that, for the most part, presented a variation of
the generalised information that had previously been presented at the first layer. Insofar as
that linked material might have provided additional prescribed information, it was difficult to
clearly identify the information of significance given that it was mixed in with generalised
information that was similar to that which had been provided at the first layer. In some
instances, the path provided by the links was actually circular;
c. the language used to describe the purpose of any processing was so high level that it is more
appropriately described as information that identifies general processing initiatives, e.g. “to
promote safety and security”. Such an approach communicates nothing, in terms of enabling
the data subject to understand how his/her personal data will be processed and the specific
objectives sought to be achieved by that processing;
d. information was frequently presented in a piecemeal fashion, whereby information on a
particular topic, for example, the period for which the personal data will be stored, has been
scattered across different sections and documents. In some instances, the information
provided in one location contradicted that provided in another location;
e. certain key information has been set out in an entirely separate notice with only a single link
from the body of the Privacy Policy. This was the case, for example, with the Facebook FAQ.
This was surprising, given the liberal approach to the incorporation of hyperlinks that was
evident elsewhere in the Privacy Policy;
f. thelanguageused,incertainrespects,wasunnecessarilyambiguous,e.g.theinformationthat
had been provided in pursuance of compliance with Article 13(1)(f).
621. As a result of the above, the assessment of the material provided took a significant period of time to
document and complete. It was a needlessly frustrating exercise that required the extensive and
repeated search of the Privacy Policy and related material to try and piece together the full extent of
the information that had been provided in relation to any individual category of Article 13. The most
frustrating aspect of all was the manner in which WhatsApp formulated its Legal Basis Notice; this
document made it impossible for me to understand which legal basis might be relied on for any
particular act of processing, as required by Article 13(1)(c). This was because, for the most part,
WhatsApp indicated potential reliance on multiple legal bases to ground a generally identified
processing initiative. WhatsApp, in its Preliminary Draft Submissions, suggested that, in having
adopted such an approach, it was “being transparent about the fact that it relies on different legal
278
bases in different circumstances, and does not consider this should be a point of criticism .” It is
surprising to me that WhatsApp considers this patent ambiguity to represent transparency,
278The Preliminary Draft Submissions, paragraph 7.6
178 particularly given the clear direction and examples set out on pages 8 and 9 of the Transparency
Guidelines (as referenced above) on this very issue.
622. I have recorded, in Parts 2 and 3 of the Decision, all of the information that has been provided, by
reference to each individual category of information prescribed by Article 13. It is self-evident, from
those records, that there is a significant information deficit. The position is exacerbated by the
inaccessibility of the information itself; in other words, the level of effort required to access, review
and exhaust all possible avenues of information. This aspect of matters is also clearly demonstrated
by the assessments recorded in Parts 2 and 3 of this Decision.
623. The fundamentalpoint of the matter is that, despite my best efforts, I did notreceive the information
that WhatsApp purported to have provided – even by reference to its own interpretations of Article
13. I note, for example, that, even if I am incorrect inmy formulation of the Proposed Approach (and,
fortherecord,Idonotconsiderthistobethecase),WhatsApphasnotevenprovidedtheinformation
thatitbelievesArticle13(1)(c)toprescribe. WhatsApp’sposition,inthisregard,isthatArticle13(1)(c)
requires the provision of information such that there is a link between the purpose of the processing
and the supporting legal basis. While WhatsApp’s position 279is that it has provided this information,
this is clearly not the case. As summarised above (and recorded in detail as part of the corresponding
assessment in Part 2 of this Decision), it is impossible to tell which legal basis will support any general
processing initiative because the information provided is vague, contradictory and ambiguous. It is
therefore entirely incorrect to characterise the findings proposed in the Preliminary Draft, as
“nuanced”, such that they might be said to represent findings that WhatsApp should have provided
more granular information “in addition to what it currently provides”. The findings of infringement,
asset outinthisDecision, representa position whereby the prescribedinformation, in eachcase save
for Article 13(2)(c) (which will be considered further, below), has simply not been provided.
624. Againstthebackgroundoftheabove,IfurthernotethatArticles13and14donotpermittheprovision
of “some” of the prescribed information. Rather they require all of the prescribed information to be
provided. Therefore, a failure to provide all of the required information will constitute an
infringement of the relevant sub-article requirement. I have already considered, in Parts 1, 2, 3 and
4 of thisDecision, thesignificantrole andfunction thattransparency playsinthe contextof theGDPR,
as a whole. In these circumstances, I do not agree that it is inappropriate for me to apply a so-called
“binary” approach to the outcome of my assessment. The simple fact of the matter is that an
incomplete approach to the provision of information undermines one of the data subject’s most
fundamental data protection rights. The position is no different if the information provided is
ambiguous. The infringements found in Parts 2 and 3 of this Decision represent, in all but one
instance, serious information deficits, as follows:
a. Article 13(1)(c) – as set out above, the information provided by WhatsApp left me unable to
discern which legal basis it would rely on when processing personal data for a particular
purpose. WhatsApp indicated potential reliance on all of the legal bases set out in Article 6(1)
and,inmanycases,suggestedthatitcouldrelyondifferentlegalbasestosupportanidentified
general processing initiative. The information provided simply does not enable the reader,
upon any objective review of the material, to receive the information prescribed by Article
13(1)(c). I further note, in this regard, that WhatsApp has included a legal basis to ground the
279The Inquiry Submissions, paragraph 1.6(B)
179 sharing of personal data with Facebook, in respect of processing that, I now understand, does
not actually take place. As already observed, the purpose of Article 13 is to enable the data
subject to learn how his/her personal data will be processed in the context of the particular
processing that will be carried out by the data controller concerned. WhatsApp’s approach to
Article 13(1)(c) does not satisfy this objective.
b. Article 13(1)(d) – as set out in the Article 65 Decision, the Board determined that WhatsApp
failed to provide the prescribed information in circumstances where the Legal Basis Notice
does not specify “the provided information with regard to the corresponding processing
operation such as information about what categories of personal data are being processed for
which processing pursued under basis (sic) of each legitimate interest respectively 28.” The
281
Boardfurthernoted ,inthisregard,thattheTransparencyGuidelines“statethatthespecific
interest in question to be identified for the benefit of the data subject”. It further noted 282
“the similarities between the examples of non-transparent (“poor practice”) information put
forward in the Transparency Guidelines and the Legal Basis (N)otice … which includes for
example: “For providing measurement, analytics, and other business services where we are
processingdata asa controller[…];“The legitimate interestswerely onforthisprocessingare:
[…] Inthe interests of businesses and other partnersto help them understand their customers
and improve their businesses, validate our pricing models, and evaluate the effectiveness and
distribution of their services and messages, and understand how people interact with them
on our Services”.” In the circumstances, it is clear that the Board considered that WhatsApp’s
approachtotheArticle13(1)(d)informationrequirementtobeinadequateandnotinlinewith
the requirements and guidance set out in the Transparency Guidelines.
c. Article 13(1)(e) – as before, the information provided under this heading was generalised and
vague. It suggested that personal data would be shared with service providers and with third
parties as part of the delivery of WhatsApp’s services. In relation to the former category of
recipient, I have already recorded the number of links and texts that must be negotiated in
order to access all of the information provided. At the end of this exercise, the use of
qualifying language (as already considered in the corresponding assessment in Part 3) leaves
the reader questioning what, exactly, is meant by the “Facebook Companies”. As regards the
potential sharing of personal data with third parties as part of the delivery of WhatsApp’s
service, it is left to the reader to guess as to what this might mean in reality. Again, this was
an issue that was specifically considered in the Transparency Guidelines 283. The clear
directions provided, in this regard, are not reflected in WhatsApp’s Privacy Policy and related
material.
d. Article 13(1)(f) – the information provided under this heading is such that the reader is
informed that relevant transfers will take place but, beyond that, it is not possible to discern
anything further about the particular circumstances of the transfers. Again, as an approach,
this is completely inadequate. It remains to be seen how WhatsApp considered its approach,
280
281The Article 65 Decision, paragraph 59
The Article 65 Decision, paragraph 52
282The Article 65 Decision, paragraph 62
283Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”), page 37
180 in this regard, to represent the “meaningful” delivery of information, as required by the
Transparency Guidelines 284.
e. Article 13(2)(a) – as before, this requirement was specifically considered by the Transparency
285
Guidelines . Despitetheguidanceprovided,theinformationprovidedbyWhatsAppisvague
and misleading (as clearly explained in the relevant aspect of Part 2). It is unfair to give the
reader the clear impression that he/she has the power to determine the retention period for
his/her personal data buttoundermine thatposition inother areasof the material with vague
information as to the possible retention of personal data in insufficiently explained
circumstances.
f. Article 13(2)(c) – I have made a finding, in this regard, that, while WhatsApp has taken steps
towards compliance with this provision, those steps were rendered ineffective as a result of
the scattering of slightly different information on the subject in three different areas of the
Privacy Policy. I noted, in this regard, that the section of the Privacy Policy most likely to be
consulted by the data subject, if he/she wishes to learn about his/her data subject rights (the
section entitled “How You Exercise Your Rights”) does not include any reference to the right
to withdraw consent to processing. In these circumstances, the effectiveness of WhatsApp’s
approach is entirely dependent on which section the data subject visits first and whether or
not he/she decides to look for further information in other locations. I observed, in this
regard, that, if the data subject located the information in the “Managing and Deleting Your
Information” section, he/she would be given to believe that, if he/she wished to withdraw
his/her consent to any consent-based processing, he/she would have to delete his/her
account (as opposed to simply adjusting his/her device-based settings).
g. Article 13(2)(e) – my assessment under this heading records that it is not clear, from the
information provided by WhatsApp, what minimum information must be processed in order
to provide the Service. Further, the (possible) consequences of failure to provide data are not
clearly set out for the data subject. Indeed, I noted that the only text provided, in this regard,
is confusing.
625. Considering, then, the question of whether or not it is appropriate for me to adopt a so-called binary
approach to quantify the extent of non-compliance found in the context of this particular inquiry, I
note that Article 13(2)(c) requires the data controller to inform the data subject of “the existence” of
the right to withdraw consent. While I remain of the view that the placement of this information is
such that it might or might not be discovered by the data subject, I acknowledge that WhatsApp’s
submissionshave some meritinthisparticular context,given thattheexistence ofthisparticularright
has been identified in the Privacy Policy and, accordingly, I will take this into account within my
assessment of gravity for the purpose of Article 83(2)(a).
284Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”), page 38
285Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on 11
April 2018 (17/EN WP260 rev.01) (“the Transparency Guidelines”), pages 38 and 39
181626. Otherwise, I am satisfied that it is appropriate for me to consider that there has been a total failure
to provide the information prescribed by Articles 13(1)(c), 13(1)(d) 286, 13(1)(e), 13(1)(f), 13(2)(a) and
13(2)(e). As regards WhatsApp’s submission that “the logic of the Commission’s reasoning is that
WhatsApp is equally culpable for providing [the text assessed to be insufficient] as it would have been
if it had provided no information whatsoever on the relevant topic”, I agree that this is a correct
reflection of theposition. My viewisthattheinformation provided infurtherance ofArticles13(1)(c),
13(1)(e), 13(1)(f), 13(2)(a) and 13(2)(e) is of such limited utility to the data subject that I am unable to
agree with WhatsApp’s suggestion that “the essence of the GDPR requirement is adhered to”. The
Board made an equivalent determination 28, in relation to the finding of infringement of Article
13(1)(d). To be clear, however, the adoption of such an approach does not create a situation, as
WhatsApp appears to suggest, whereby, for the purpose of this Part 5, WhatsApp is in the same
position as a data controller that might have made no effort whatsoever to provide the prescribed
information. While WhatsApp’s efforts did not produce the intended result (i.e. full compliance), I
will(asconsideredfurther,below)takeaccountoftheeffortsmade,inthisregard,withintherelevant
aspect of the Article 83(2) assessment.
627. As regards my proposed finding that WhatsApp has failed to provide any information to non-users, I
288
note that WhatsApp has submitted that it “already makes information publicly available on the
very limited way in which it engages with non-user data”. The information provided by WhatsApp, in
thisregard,hasbeenincludedinthe“InformationWeCollect”sectionofthePrivacyPolicy,asfollows:
“You provide us, all in accordance with applicable laws, the phone numbers in your mobile address
book on a regular basis, including those of both the users of our Services and your other contacts.”
628. I do not consider that this statement merits credit, as regards any potential offset against the
information that has not been provided to non-users pursuant to Article 14. In terms of the
information communicated by the statement, it tells the user that WhatsApp will collect the phone
numbers of everyone in his/her mobile address book on a regular basis and that this may include the
phone numbers of non-users. It does not contain the required information as to the processing
operations that will be carried out on the numbers, the purpose of the processing of non-user
numbers or the period for which it will be retained. Most significantly, it does not enable the non-
user to understand the way in which he/she will be individually and uniquely affected by the
286The Board, at paragraph 59 of the Article 65 Decision, found that “in the Legal Basis Notice [WhatsApp] has not specified
the provided information with regard to the corresponding processing operation such as information about what categories
of personal data are being processed for which processing pursued under basis (sic) of each legitimate interest respectively.
The Legal Basis Notice does not contain such specific information in relation to the processing operation(s) or set of
operationsinvolved.” TheBoard further found, at paragraphs61, 63and64 of the Article65Decisionthat“severalpassages
from the Legal Basis Notice … do not meet the necessary threshold of clarity and intelligibility that is required by Article
13(1)(d)GDPRinthiscase”andthat“itisunclearwhatismeantby“otherbusinessservices”,as[WhatsApp]doesnotdisclose
this information or provide a relation to the specific legitimate interest. The [Board] also notes that it is unclear which
businesses or partners [WhatsApp] refers to” and, further, that “descriptions of the legitimate interest as the basis of a
processing like “[t]o create, provide, support, and maintain innovative Services and features […]” do not meet the required
threshold of clarity required by Article 13(1)(d) GDPR, as they do not inform the data subjects about what data is used for
what “Services” under the basis of Article 6(1)(f) GDPR, especially regarding data subjects under the age of majority.” In
paragraph 65, the Board determined that the same applies in respect of the stated interest to “[share] information with the
Facebook Companies to promote safety and security”. The Board made it clear that it considered the information provided
by WhatsApp, under this heading, to be inadequate to such a degree that it hampered the ability of the data subject to
exercise his/her data subject rights. Accordingly, partial credit cannot be given, in respect of any information that has been
provided in furtherance of Article 13(1)(d).
287The Article 65 Decision, paragraph 66
288The Preliminary Draft Submissions, paragraph 5.1
182 processing in the event that he/she decides to join the Service. In the circumstances, I am satisfied
that it is appropriate for me to carry out the Article 83(2) assessment by reference to a position
whereby there has been a total failure to provide the required information to non-users.
629. For the avoidance of doubt, and insofar as I have identified, by way of any previously proposed
directions or obiter dicta comments, any other issues that, while requiring improvement, fall outside
of the findings of infringement, I have not taken account of any such previously proposed directions
or obiter dicta comments (or the underlying assessments) in any assessment carried out for the
purpose of this Part 5.
Submissions in relation to WhatsApp’s careful and good faith efforts to achieve compliance with the
transparencyprovisionsand/orWhatsApp’spositionthatitsapproachisalignedwiththeapproachadopted
by many industry peers and/or WhatsApp’s pre-GDPR engagement with the Commission (the “Careful and
Good Faith Efforts Submissions”)
Alignment with Industry Peers / Industry Practice
630. WhatsApp has submitted 289, in this regard, that:
“WhatsApp has always considered, and continues to consider, that it satisfies the transparency
requirements set out in the GDPR. Indeed, its approach is aligned with the approach adopted by
many industry peers 290.”
631. I note that I have already set out my views on the possible significance of alignment with industry
peers as part of my assessment of WhatsApp’s Submissions of General Application in Part 2 of this
Decision (by reference to the category of “Submissions concerning Legal Certainty”). The views so
expressed apply equally here.
632. As set out above, my view is that the transparency requirements are clearly set out in the GDPR and
additional guidance/direction is available by way of the Transparency Guidelines. While it is
undoubtedly the case thatthe style andlanguage ofcommunicatinginformation cannotbe optimised
for every individual person and the privacy notice is, by its nature, a somewhat “blunt” instrument,
nonetheless,itisclearthatArticles12–14oftheGDPRrequirecertainbasicsthatarebeyonddebate.
Accordingly, while an industry-wide failure (if this is, in fact, the case) to achieve compliance with the
transparency requirements is a poor reflection on that industry, it is not, however, evidence of a
position whereby data controllers in this particular sector are unable to identify what is required of
them, in terms of transparency. Further, an (alleged) failure to achieve compliance with the
transparency obligations, on the part of WhatsApp’s industry peers, is not something that could
absolve WhatsApp of its own individual responsibility as a data controller given, in particular, the
accountability obligation set out in Article 5(2). Accordingly, I am unable to attribute weight, as a
mitigating factor for the purpose of this Part 5, to such submissions.
WhatsApp’s pre-GDPR engagement with the Commission
289The submissions falling under this particular heading are set out in paragraph 1.3, paragraph 2.1, paragraph 5.12 and
paragraph 6.4(E) of the Supplemental Draft Submissions
290The Supplemental Draft Submissions, paragraph 2.1
183 291
633. WhatsApp’s submissions , in this regard, include the following:
“WhatsApp also considers that the Commission should take account of the fact that it was
consulted extensively during the process of developing WhatsApp’s Privacy Policy and related
documents in 2018, and so was made aware of the approach WhatsApp was planning to take in
292
respectoftransparencyfrompriortotherelevantuser-facinginformationevenbeinglaunched .”
634. I note that I have already assessed the substance of this particular category of submissions as part of
my assessment of WhatsApp’s Submissions of General Application in Part 2 of this Decision (by
reference to the category of “Submissions concerning WhatsApp’s pre-GDPR engagement with the
Commission”). The views so expressed apply equally here. In summary, my view is that it is not
appropriate for WhatsApp to seek to make the Commission (even partially) responsible for its
compliance with the GDPR. Accordingly, I am unable to attribute weight, as a mitigating factor for
the purpose of this Part 5, to such submissions.
Careful and Good Faith Efforts
635. WhatsApp has submitted 293, in this regard, that:
“Any administrative fine would be inappropriate, unnecessary and disproportionate in the
circumstances where a reprimand has been issued given: …
3. WhatsApp’s careful and good faith efforts to achieve compliance – in this respect, WhatsApp
submits that the Commission’s findings in the Supplemental Draft that WhatsApp has “made
efforts towards achieving compliance” and that there is a “genuinely held belief, on WhatsApp’s
part” that “its approach to transparency complies, in full, with the GDPR” are important; … 294”
636. I wish to make it clear, by way of response to this particular submission, that no such findings were
made by me, either in the Supplemental Draft or otherwise. I recognised, at paragraph 45(d) of the
Supplemental Draft, that WhatsApp “has made efforts towards achieving compliance”. I noted, in
the same sentence, that those efforts fell significantly short of what is required by Articles 12 and 13.
637. In relation to WhatsApp’s “genuinely held belief”, I recognised this as part of my assessment in the
SupplementalDraft of the Article 83(2)(c) criterion, whichrequires consideration of “any action taken
by the controller or processor to mitigate the damage suffered by data subjects”. I noted, in this
regard, that it would be unfair to criticize WhatsApp for failing to take action to mitigate any damage
suffered in circumstances where its position was that no infringement had occurred and, accordingly,
no damage had been suffered by data subjects. It was important for me to recognise, at the same
time, that WhatsApp is perfectly entitled to maintain such a position, which I accepted as being
genuinely held in the absence of any indication to the contrary.
291The submissions falling under this particular heading are set out in paragraph 5.18(A), paragraph 6.4(B), paragraph 10.1
and paragraph 12.1
292The Supplemental Draft Submissions, paragraph 12.1
293
The submissions falling under this particular heading are set out in paragraph 1.6, paragraph 3.4(B)(3), paragraph 5.3,
paragraph 5.5, paragraphs 6.4(A) and (B), paragraph 7.1, paragraph 8.4 and paragraph 16.6(B) of the Supplemental Draft
Submissions
294The Supplemental Draft Submissions, paragraph 3.4(B)(3)
184638. As is clear from the above, the statements in question were made in particular contexts and it is
incorrect to suggest that they have meaning beyond those particular contexts.
639. Otherwise, the substance of WhatsApp’s submissions, under this heading, are that:
“The Commission … has also failed to take account of WhatsApp’s significant efforts to achieve
compliance with its transparency obligations and the information it provides to users 295.”
640. WhatsApp clarifies, in this regard, that:
“For example, WhatsApp’s pre-GDPR efforts, details of which have previously been communicated
to the Commission in the context of this Inquiry … [including] the extensive engagement with the
Commission on the GDPR update … WhatsApp’s research on transparency (where it conducted
independent user-testing of its proposed new user facing information) and the extensive resources
that WhatsApp invested in updating its user facing information (which incorporated expert input
from Engineering, Product, Policy, Design, Marketing, Communications and User Research
departments, in addition to Legal teams) 296.”
641. It further submits that:
“There is no requirement in the GDPR for controllers to engage experts, or carry out research to
assess the best approach to provide the information required by Article 13 GDPR, or proactively
engage with the Commission in advance of launch. In carrying out this work, WhatsApp considers
it exceeded whatcouldreasonably be expected of it inorder to seek to meetits GDPR transparency
297
requirements .”
642. I note, in this regard, that Articles 12 – 14 require the data controller to provide the prescribed
information. This is the required standard of compliance; not the making of efforts (substantial or
otherwise) towards achieving compliance. While I recognise that WhatsApp made efforts towards
compliance, the weightthatmightbe attributed to such efforts, asa mitigatingfactor for the purpose
of this Part 5, is somewhat limited in circumstances where (i) those efforts did not produce the
intended result, and (ii) the level of non-compliance, as assessed, is significant. I will take account,
insofar as possible, of the efforts made within the relevant aspect of the Article 83(2) assessment.
Submissions concerning WhatsApp’s willingness to amend its Privacy Policy and related materials, on a
voluntary basis (the “Willingness to Change Submissions”)
643. WhatsApp has submitted 298, in this regard, that:
“… in light of the interpretations … that the Commission has now articulated, WhatsApp has
volunteered … to adaptits transparencydocuments to meetthe Commission’sstated expectations,
and in fact began planning changes as part of its ongoing consideration of how best to provide
transparency in June 2019, when it learned of the preliminary findings of the Inquiry team.
295The Supplemental Draft Submissions, paragraph 5.5
296
297The Supplemental Draft Submissions, footnote 22 (as referenced in paragraph 5.5)
The Supplemental Draft Submissions, paragraph 6.4(B)
298The submissions falling under this particular heading are set out in paragraph 1.7, paragraph 3.4(A), paragraph 3.4(B)(4),
paragraphs 5.18(B), (C) and (D), paragraph 7.2 and paragraph 10.1
185 WhatsApp’s prompt expression of its willingness to comply with the Commission’s newly
articulated interpretations of the GDPR transparency requirements further underlines that it is
inappropriate, unnecessary and disproportionate for the Commission to take any corrective action
(and particularly action of the nature envisaged in the Supplemental Draft) to ensure
299
compliance .”
644. It has further submitted that:
“WhatsApp has already volunteered to change the information it provides in order to address the
Commission’s concerns, after starting to consider such changes as soon as it learned of the Inquiry
team’s views on transparency and subsequently proposing the detailed changes set out in its
Preliminary Draft Submissions (i.e., prior to receiving the Supplemental Draft) 300”.
645. I have already set out the reasons why I do not accept that my assessments and views represent
“newly articulated interpretations” of the GDPR transparency requirements. As regards WhatsApp’s
willingness to amend its approach to the delivery of the prescribed information, I note firstly that,
despite WhatsApp’s position that it began considering its position in June 2019, it has only just (as of
December2020) beguntoimplementthose changes (for the avoidance of doubt, I make nocomment
as to the sufficiency or otherwise of any such changes). While I acknowledge that the making of such
changes might entail a certain lead-in time, I note that almost eighteen months has passed since the
time WhatsApp started considering its position.
646. While I welcome WhatsApp’s willingness to amend its position, on a voluntary basis, I do not agree
that such willingness renders the exercise of corrective powers (including the possible imposition of
an order to bring processing operations into compliance) inappropriate, unnecessary and/or
disproportionate in the circumstances of this particular inquiry. Firstly, the inquiry is based on the
state of information available at the commencement of the inquiry and a number of infringements of
the transparency provisions are found to have occurred, in that context. A willingness to remedy the
cause of the infringements does not preclude corrective action. Secondly, WhatsApp has maintained
its position, throughout the inquiry, that, as far as it is concerned, it has fully complied with its
obligations pursuant to the GDPR. WhatsApp is perfectly entitled to maintain this position, however,
when coupled with WhatsApp’s expressed disagreement with certain of the approaches that I have
proposed, it creates certain limitations, in terms of the weight that I might attribute to WhatsApp’s
willingness to change, in the context of the choices that I must make for the purpose of Article 58(2).
647. Against the background of the above, I will take account, as appropriate, of WhatsApp’s willingness
to change its user-facing material, on a voluntary basis, as part of the relevant assessment(s) for the
purpose of this Part 5.
Submissions that the Commission has not demonstrated how WhatsApp’s approach to transparency has in
facthad anynegative impactondata subjectrights and/or thatthe Commission’sconcerns thatthe alleged
infringements have impacted on data subjects’ rights is theoretical and not supported as a matter of fact
and/or that the Commission’s analysis of the damage allegedly suffered by data subjects is based on
assertions rather than evidence / no evidence has been provided to indicate that WhatsApp’s approach to
299The Supplemental Draft Submissions, paragraph 1.7
300The Supplemental Draft Submissions, paragraph 3.4(B)(4)
186providing transparency has undermined the effective exercise of the data subject rights (the “Theoretical
Risk Submissions”)
301
648. WhatsApp firstly submits , in this regard, that the Commission has not demonstrated how its
approach to transparency has in fact had any negative impact on data subject rights. With specific
302
reference to the position of users, it submits that:
a. The issues identified by Parts 2 and 3 of this Decision do not impact on users’ ability to make
a fully informed decision, based on the information WhatsApp currently provides as to
whether they wish to use the Service and for WhatsApp to process their personal data; and
b. No examples have been provided of how data subjects “may be deprived” of the information
they need to exercise their data subject rights, as suggested in the Supplemental Draft.
649. It is clear that, as regards the first limb of WhatsApp’s submissions, above, WhatsApp and I
fundamentally disagree as to the quality and quantity of the information that has been provided by
way of the Privacy Policy and related materials. I have already set out, in detail, the reasons why I
consider theinformation providedtouserstobeinsufficient. Thedeficienciesidentified aresuch that
the user, in my view, cannot make informed decisions in relation to whether or not they wish to
continue using the Service (including the Contact Feature) and for WhatsApp to continue processing
their personal data, in that context.
650. The second limb of WhatsApp’s submissions, above, is directed to challenging my view that the
information deficiencies identified in Parts 2 and 3 of this Decision are such that data subjects “may
be deprived” of the information they need to exercise their data subject rights. I note, in this regard,
that WhatsApp’s own Legal Basis Notice expressly recognises the link between the data subject’s
knowledgeastothelegalbasisbeingrelieduponandthecorrespondingrightsthatmightbeexercised
by the data subject. Therelevant statement, whichis setout at the very top of the Legal BasisNotice,
provides that:
“You have particular rights available to you depending on which legal basis we use …” [emphasis
added]
651. As recorded in Parts 2 and 3 of this Decision, I have proposed findings that WhatsApp has failed to
comply with its obligations pursuant to Article 13(1)(c). One of the issues arising, in this regard, is
that the information, as presented, does not enable the data subject to understand which legal basis
will be relied upon by WhatsApp when it processes his/her personal data for a particular purpose. All
the data subject knows, from the information presented in the Legal Basis Notice, is that WhatsApp
might rely on different legal bases to ground the same general processing activity, depending on the
circumstances. This leaves the data subject unable to identify if, for example, he/she is entitled to
invoke his/herrighttoobject tothe processingof his/herpersonal data. Thisrightisonly enforceable
if the processing is grounded upon Article 6(1)(e) or Article 6(1)(f) (and the controller does not have
compelling legitimate grounds for the processing which override the interests, rights and freedoms
of the data subject or for the establishment, exercise or defence of legal claims). The information
provided by WhatsApp, by way of the Legal Basis Notice, does not, however, enable the data subject
301The Supplemental Draft Submissions, paragraph 5.4
302The Supplemental Draft Submissions, paragraphs 5.4 and 5.6 (see also paragraphs 5.28 and 5.32)
187 to identify if any processing operation is grounded upon Articles 6(1)(e) or 6(1)(f) and, accordingly,
he/she is unable to identify if he/she is entitled to exercise his/her right to object to processing.
652. Further, if that data subject decides, regardless, to try and invoke the right to object but his/her
requestis refused on the basis that the processing is notgrounded upon Articles6(1)(e) or6(1)(f), the
data subject has no way of checking this because he/she has never been informed, as part of the
collection of the personal data in question, the legal basis that would be relied upon to ground its
processing. In this way, the data subject is unable to hold the data controller accountable. Further,
the data subject is unable to identify whether or not he/she might have a valid basis for complaint,
so as to be able to make an informed decision as to whether he/she might wish to pursue the matter
further by lodging a complaint with a supervisory authority.
653. It is therefore clear that the issues identified in Parts 2 and 3 of this Decision are such that the data
subjects concerned may be deprived of the information they need to exercise their data subject
rights. While I note WhatsApp’s submission that users do seek to exercise data subject rights, 303this
does not remedy the issue demonstrated in the example set out above.
304
654. In relation to the position of non-users, WhatsApp submits that:
a. Even if it were to concede that it has obligations under Article 14, it would be impossible for it
to do any more than it currently does to respect non-users’ data subject rights. By way of
example,WhatsAppexplainsthatitcannotcomplywithdatasubjectrightsrequestsasaresult
of the privacy protective technical measures it has implemented to protect the mobile phone
numbers of non-users. Accordingly, WhatsApp submits that the concern expressed, that the
(proposed) infringement (as it was when set out in the Preliminary Draft) of Article 14 has
impacted on non-users’ data subject rights, is “theoretical and not supported as a matter of
fact”; and
b. To the extent that my concerns arise from an alleged inability, on the part of WhatsApp users
to make informed decisions, this is also unfounded. WhatsApp’s view, in this regard, is that
the statement provided in the “Information We Collect” section of the Privacy Policy enables
the user to make an informed decision as to whether or not they wish to use the Contact
Feature and allow WhatsApp to access non-user contact information in their mobile address
book.
655. In respect of the first limb of WhatsApp’s submissions, above, I acknowledge that the circumstances
of the processing of non-user data are such that the range of data subject rights that might be
exercised by a non-user data subject are limited. They are not, however, non-existent. I firstly note,
in this regard, that the right of access enshrined in Article 15 requires the data controller to provide
access to the personal data and also furnish a range of specified information to the data subject
concerned. By WhatsApp’s own account 30, it responds to data access requests from non-users by
explaining “the manner in which non-user data is handled”. If, in doing so, WhatsApp provides the
information prescribed by Articles 15(1) and (2), then, ostensibly, it is complying with its obligations
to the non-user data subject concerned pursuant to Article 15.
303The Supplemental Draft Submissions, paragraphs 5.31 and 5.32
304The Supplemental Draft Submissions, paragraphs 5.8, 5.9 and 5.10 (see also paragraphs 5.28, 5.33 and 5.34)
305The Supplemental Draft Submissions, paragraph 5.34
188656. I further note that, if WhatsApp were to make the information that it provides to individual non-user
data subjects publicly available, this would enable non-users to understand the way in which their
personal data have been/might be processed by WhatsApp, in the event that their phone number is
contained in the address book of a user who has activated the Contact Feature. This, in turn, would
avoid a situation whereby a concerned non-user, seeking to find out more, has no option but to
exercise one of his/her data subject rights.
657. The most significant loss of control that results from the proposed Article 14 infringement, however,
is in the case of a non-user who is considering joining the Service. If that non-user’s mobile phone
has been processed by WhatsApp pursuant to the Contact Feature, he/she will appear in the
derivativeusers’contactlistsassoonashe/shejoinstheService. Thenon-userhasnowayofknowing
this in advance and is thereby deprived of the ability to (i) make an informed decision about
potentially joining the Service; and (ii) exercise control over his/her personal data.
658. As regards the second limb of WhatsApp’s submissions, above, my response is the same as that
provided at paragraph 651 to 653, above.
659. Finally, I note WhatsApp’s submission 306 that I have not explained how Articles 11 and 12(2) of the
GDPR impact on my analysis. The short answer to this is that these provisions have no application in
circumstances where I have already found that the mobile phone number of a non-user constitutes
the personal data of the non-user concerned because he/she can be said to be “identifiable”.
660. By way of the Article 65 Submissions, WhatsApp further submitted, under this heading, that:
a. No evidence has been put forward to support claims of any harm or risk to users or non-users
arising from the infringements alleged to have occurred, nor has any evidence been provided
thatanydatasubjectswouldhaveacteddifferentlyiftheyhadbeenprovidedwithinformation
in the manner prescribed in the Composite Draft. WhatsApp submits, in this regard, that “(i)f
anything the lack of any concrete and identifiable harm in this case supports [WhatsApp’s]
position that the fine at its [then proposed] level is unwarranted and disproportionate.” 307
b. In relation to non-users specifically, WhatsApp considers the concerns about risk and harm
raised by the Commission (and CSAs) to be “unwarranted and based on unsupported
speculation” 30. InWhatsApp’sview,“(t)he“harm”described isessentiallyarestatementthat
an infringement has occurred – namely, that it is not made clear to a non-user that they may
appear in other users’ WhatsApp contact lists after the non-user becomes a user. No further
step has been taken to articulate the consequence of the information not being provided 30.”
c. WhatsAppfurthersubmitsthatthereis“asignificantdiscrepancybetweentheprocessingthat
gives rise to the alleged infringement of Article 14 GDPR, and the processing which is relied
upon as leading to the alleged harm to non-users. Such a discrepancy arises in this case
because … (t)he Composite Draft concludes that [WhatsApp] has infringed Article 14 GDPR
306
307The Supplemental Draft Submissions, paragraph 5.33
The Article 65 Submissions, paragraph 39.14
308The Article 65 Submissions, paragraph 39.18
309The Article 65 Submissions, paragraph 39.18(B)
189 with respect to a processing operation conducted in relation to one dataset for one purpose
(i.e. non-users’ phone numbers accessed through the [Contact Feature] and processed to
create the lossy hash … ), but is then relying on an entirely different processing operation
conducted in relation to a different dataset in order to find that harm was caused (i.e. use of
a new user’s phone number provided after they sign up to the Service in order to generate a
notification hash, which is then used to update the contact lists of existing users). As a result,
the true position is that the alleged harm relied on in the Composite Draft cannot in fact be
attributed tothe processing underlyingthe findingof alleged infringementof Article 14 GDPR.
In fact, Article 14 GDPR is not even relevant to the processing operation relied upon as giving
rise to the alleged harm, given the data in question (i.e. the new user’s phone number) has
been collected directly from the data subject once they … have signed up to use WhatsApp
and is therefore subject to Article 13 GDPR considerations, in respect of which [WhatsApp]
complies. Given the alleged harm does not in fact arise from the alleged infringement, it
310
should not be taken into account when assessing any fine .”
d. In addition, any harm to non-users “of the nature alleged would, in any event, be extremely
limited for two reasons 311:
i. Firstly, a non-user (once they become a user) will only ever appear in an existing
WhatsAppuser’scontactlistif the existinguser already hasthe non-user’sphone number
stored as a contact on their device. The assumption must be that this is generally the
result of the non-user previously having shared their phone number with the existing
WhatsApp user, in the expectation that they would be contacted by that person. …
ii. Secondly, according to the Composite Draft, the “harm” to non-users only “crystallises at
the point in time when that non-user becomes a user of the Service”. However,
importantly, at that point in time the non-user … has already been provided with
[WhatsApp’s] Terms of Service and Privacy Policy … .”
e. WhatsApp also submits 312that the Commission’s assessment of the extent of any “harm” to
non-users does not take into account “the fact that [WhatsApp] would be entitled to rely on
the following factors, both of which demonstrate the limitations on any harm that can
plausibly be said to have been caused to non-users in this case:
i. Article 14(5)(b) GDPR which, on the facts of this case, means that [WhatsApp] would not
be obliged to provide information to non-users directly … and instead could only be
required to “take appropriate measures to protect the data subject’s rights and freedoms
and legitimate interests” (which it does) ... [and]
ii. Article 11 GDPR which, on the facts of this case, limits [WhatsApp’s] obligations to non-
users under Articles 15 to 20 GDPR. This is relevant to the question of harm given the
Commission has relied on failings in transparency as having inhibited data subject’s (sic)
ability to exercise their rights under these provisions in its harm assessment. Article 11
GDPR is applicable in this case because … [WhatsApp] only processes such non-users’
310The Article 65 Submissions, paragraph 39.18(C)
311The Article 65 Submissions, paragraph 39.19
312The Article 65 Submissions, paragraph 39.20
190 phone numbers for a matter of seconds prior to the [application of the cryptographic
hashing process], during which period [WhatsApp] has no mechanism to re-access those
unhashed numbers in other ways or to reverse the effects of the process. As such, if this
information constitutes personal data of non-users in the manner concluded in the
Composite Draft, it must constitute personal data processed for purposes which “do not
or do no longer require the identification of a data subject by the controller” (per Article
11(1) GDPR).”
661. In response to the above submissions, I firstly note that there is no requirement for me to
demonstrate“evidence”ofdamageto datasubjectsaspartofmyassessmentoftheArticle83(2)
criteria. Were it otherwise, data protection authorities would only be able to carry out a full
assessment of the Article 83(2) criteria in complaint-based inquiries which would permit the
interrogation of individual data subjects for the purpose of adducing “evidence” of damage
suffered as a result of a given infringement. As a statutory regulator carrying out functions
pursuant to the GDPR and the 2018 Act, the Commission is well placed and uniquely qualified to
assess the damage caused by a given infringement for the data subjects concerned. In this case,
Ihave(repeatedlyandmost recentlyinparagraphs655 to657above)outlinedtheconsequences
forthedatasubject,bothuserandnon-user,oftheinfringementsofthetransparencyprovisions.
To be clear about the position, while the risks to the rights and freedoms of the non-user data
subject, other than at the point of signing up to use the Service, are somewhat limited, they are
not insignificant.
313
662. Further, WhatsApp is incorrect when it suggests that the Composite Draft provides that the
“harm” to non-users “only” crystallises “at the point in time when that non-user becomes a user
314
of the Service”. The relevant part of the Decision records that “the unique and individual
impactoftheprocessinguponeachindividualnon-usercrystallisesatthepointintimewhenthat
non-user becomes a user of the Service.” It is at that point that the purpose of the processing of
the individual’s mobile phone number (when the individual was a non-user), namely, the ‘quick
315
and convenient’ updatingof usercontact lists , isachieved. Thisformedpartofmyassessment
in circumstanceswhereWhatsApp submitted 316thatthepurposeoftheContactFeaturewas not
to identify non-users. To be clear about the position, the relevant statement was not an
assessment of the damage caused to non-users by the processing. That assessment is recorded
withinthisPart5(formerlyPart4oftheCompositeDraft),whereIhaveclearlyidentifiedtheloss
of control arising, both for non-users generally as well as those on the point of signing up to
become users of the Service in paragraphs 655 to 657 above.
663. As regards WhatsApp’s submissions concerning the “significant discrepancy between the
processing that gives rise to the alleged infringement of Article 14 GDPR, and the processing
whichisrelieduponasleadingtotheallegedharmtonon-users”,IdonotagreewithWhatsApp’s
position for the following reasons:
313The Article 65 Submissions, paragraph 39.19(B)
314See paragraph 105, above
315The Response to Investigator’s Questions
316
See paragraph 92, above
191 a. As part of my determination that the mobile phone number of a non-user constitutes the
317
personal data of thatnon-user, I set outmy view that, while I accepted thatWhatsAppdoes
not process the mobile phone numbers of non-users for the specific purpose of identifying
those non-users, it is clear that the processing is designed to impact upon an individual non-
user in the event that he/she subsequently decides to become a user of the Service. In this
way, the processing, while not designed to identify the non-user concerned, will, nonetheless,
have individual and unique impact for the non-user concerned if he/she subsequently decides
to become a user. In the circumstances, it is clear that my determination of the matter
involved consideration of the impact of the Contact Feature “in the round” as opposed to the
artificially segregated manner now being suggested by WhatsApp.
b. I note that this approach is consistent with the approach taken by the CJEU in the Facebook
Fan Pages case, in which the CJEU assessed the status of the controllers concerned by
analysing the various processing that took place in the context of a fan page. While the Court
identified the controllersconcerned by reference totheir respective abilitiestodetermine the
means and purposes of certain aspects of the processing taking place in the context of the fan
page, its ultimate determination was that the fan page administrator and Facebook Ireland
were joint controllers for the purpose of the processing that took place in the context of the
fan page. In other words, the status of controllership was not defined by reference to
individual processing operations that were taking place in the context of the fan page, but
rather by reference to the processing that was taking place, in the round, by way of the fan
page. The fact that the CJEU recognised that “those operators may be involved at different
stages of that processing … and to different degrees, so that the level of responsibility of each
of them must be assessed with regard to all the relevantcircumstances of the particular case”
does not change the position that the status of (joint) controller was assigned for the purpose
of the global (rather than individual) processing operations that were taking place by way of
the fan page.
c. For the sake of completeness, I further note that I clarified, at the outset of the Article 83(2)
assessments set out below, that “the processing concerned”, for the purpose of those
assessments, should be understood as meaning all of the processing operations that
WhatsApp carries out on the personal data under its controllership. On the basis of the
foregoing, IdonotacceptthatI amrequiredtoassesstheArticle14infringementbyreference
only to the processing operations that take place prior to the non-user signing up to become
a user of the Service.
664. As regards the submission that is premised on the assumption that the non-user previously shared
their phone number with the relevant user “in the expectation that they would be contacted by that
person”, I do not agree that this is an assumption that I ought to take into account when assessing
the damage to non-users. There are any number of ways in which a user might come to have a non-
user’s mobile phone number in his/her address book, only one of which involves the non-user having
provided the number to the user directly, in the expectation that he/she would be contacted by that
user. It is possible, for example, that the user was given the non-user’s number by a third party.
Further, the assumption does not take account of the context in which the number might have been
provided by the non-user tothe user. It mightwell have been the case, for example, that the number
317See paragraph 92, above
192 was provided for a specific purpose or in the context of a particular relationship which has since
completed/come to an end. In such a case, the non-user might not wish for his/her contact details to
appear in the relevant user’s WhatsApp contact list in the event of his/her signing up to the Service.
665. I have already addressed WhatsApp’s submissions concerning the possible application of the Article
14(5)(b) exemption in Part 1 of this Decision. In relation to WhatsApp’s submissions concerning the
possible application of Article 11, I remain of the view expressed at paragraph 659 above. In any
event, it is important to note that nothing in this Decision requires WhatsApp to “maintain, acquire
or process additional information in order to identify the data subject for the sole purpose of
complying with this Regulation”. Further, Article 11(2) only concerns the application of Articles 15 to
20 of the GDPR. It does not impact on the data subject’s entitlement to receive the information
prescribed by Articles 13 and 14 and neither does it impact on the data subject’s right to object
pursuant to Article 21 or his/her right to lodge a complaint with a supervisory authority. In the
circumstances, I do not agree with WhatsApp’s submission that Article 11, were it to be applicable,
would have any significant impact on my assessment of the damage caused by the processing for the
purpose of this Part 5.
WhatsApp’s Article 65 Submissions
666. WhatsApp, by way of its Article 65 Submissions, advanced a number of arguments that have general
application tothe Article 83(2) assessmentsset outbelow. Asa proceduraleconomy, and with a view
to avoiding unnecessary duplication, I will respond to those submissions within this section only.
Thus, where, as part of its response to any assessment of any individual aspect of Article 83,
WhatsApp has indicated reliance on any matter covered by the Article 65 Submissions, the views set
out below should be understood as being my views on the relevant subject-matter.
667. WhatsApp has firstly expressed concern that “the mitigating factors, in respect of which [WhatsApp]
has made extensive submissions, have not been adequately taken into account 31.” WhatsApp
319
submitted , in this regard, that “(t)he fact that the Commission has failed to attribute appropriate
weight to relevant mitigating factors is demonstrated by the fact that it has not taken into account
mitigations in this process even though it has considered those same mitigations to be relevant in
other [named] inquiries.”
668. As acknowledged by WhatsApp, I have already addressed these concerns by way of letter dated 13
May 2021. That letter explained that the Commission is not required to apply the same approach
acrossall ofitsinquiries. TheCommission’sapproachtothe presence or absenceofrelevantprevious
infringements (for the purpose of the Article 83(2)(e) assessment) differs, depending inter alia on the
contextsof differenttypes ofcontrollersand,inparticular, the scale of the processingatissue. Unlike
the position with the smaller-scale domestic inquiries that WhatsApp has cited as examples, inquiries
into larger internet platforms generally concern data controllers or processors with multi-national
operations and significant resources available to them, including large, in-house, compliance teams.
Such entitles are further likely to be engaged in business activities that are uniquely dependent on
the large-scale processing of personal data. The Commission’s view is that the size and scale of such
entities, the level of dependency on data processing and the extensive resources thatare available to
them necessitate a different approach to the absence of previous relevant infringements. That
318The Article 65 Submissions, paragraphs 39.23 to 39.28
319The Article 65 Submissions, paragraphs 39.24 to 39.27
193 approach has been reflected in the decisions that have been cited by WhatsApp in support of its
submission. I note, in this regard, that WhatsApp’s submissions do not reference the Commission’s
decision in the Twitter (breach notification) inquiry. The Commission’s approach to the Article 83(2)
assessment, as recorded in the Twitter decision, is consistent with that applied to the within inquiry
(and recorded in this Part 5). Against the background of the above, the Commission does not accept
that the matters identified in WhatsApp’s submission represent inconsistency in the Commission’s
approach to determining the quantum of any fine.
669. WhatsApp has further referred to the fact that, in the context of certain previously published
decisions, the Commission, where it identified a mitigating factor, also quantified the value of that
mitigating factor. WhatsApp asked the Commission to adopt the same methodology to the within
inquiry. As set out above, the Commission is not required to apply the same approach to the
assessment and quantification of a proposed fine across all of its inquiries. In the context, however,
of the more granular approach taken in certain of the domestic inquiries for which decisions have
been published, the Commission does not agree that the absence of a similar level of granularity, in
any other inquiry, constitutes a material difference in approach, as between those inquiries. The
reasons why the Commission varies its approach, as between inquiries, are explained above. In the
context of the difference in granularity, it is also important to note that the decisions relied upon by
WhatsApp all concern public bodies. As WhatsApp is undoubtedly aware, Section 141(4) of the 2018
Actrestrictsthefinethatmaybeimposedonapublicbody(thatdoesnotactasanundertakingwithin
the meaningof theCompetition Act,2002)toamaximumof€1,000,000. Thisisalsoafactor, interms
of the Commission’sdecision tovarythe degree of granularity thatitappliestothe finingassessment,
as between different inquiries.
320
670. WhatsApp has further submitted that there has been an “over emphasis” on the number of data
subjects and that this factor has been afforded “more than appropriate weight” by the Commission.
It is important to note, in this regard, that the Board considered, as part of its Article 65 Decision, the
weight that was attributed to this particular factor. It determined 321, in this regard, that:
“the Draft Decision adequately qualifies the infringements as very serious in terms of the affected
number of data subjects and the consequences of the non-compliance in light of the facts of the
case. With regard to the assessment of whether the fine is proportionate, effective and dissuasive
in light of these elements, the [Board] refers to paragraph 405 and following of the present
decision.”
671. TheBoardfurtherinstructed 322theCommissionto“setoutahigherfineamountfortheinfringements
identified”, to take account of the various determinations made by the Board, as summarised in
Section 9.4 of the Article 65 Decision. Section 9.4 includes an instruction requiring the Commission
to ensure that the amount of the fine “shall appropriately reflect the aggravating factors identified in
the [Composite Draft]” (noting that the number of affected data subjects was treated, in the Draft
Decision, as an aggravating factor). The Commission is bound by the Board’s decision and,
accordingly, I am unable to attribute any further weight to WhatsApp’s submissions in relation to the
weight attributed to the number of affected data subjects, as a mitigating factor for the purpose of
320The Article 65 Submissions, paragraph 39.28
321The Article 65 Decision, paragraph 401
322The Article 65 Decision, paragraph 424
194 this Part 5. Otherwise, I am satisfied that I have adequately taken account of any mitigating factors
put forward by WhatsApp as part of the Article 83(2) assessments recorded below.
672. WhatsApp has further made submissions concerning the use of (i) the legal maximums set out in
Articles 83(4) to 83(6) of the GDPR as well as (ii) turnover to calculate the fine. I note, however, that
323
thesemattersarethesubjectofdeterminationsoftheBoard,asrecordedintheArticle65Decision .
Accordingly, the Commission is required to apply the method of calculation determined by the Board
when reassessing the proposed fine, for the purpose of this Decision.
673. In relation to WhatsApp’s submissions 324concerning proportionality, I note that these submissions
325
were taken into account by the Board when it determined that “the turnover of an undertaking is
not exclusively relevant for the determination of the maximum fine amount … but it may also be
considered for the calculation of the fine itself, where appropriate, to ensure the fine is effective,
proportionate and dissuasive in accordance with Article 83(1) GDPR.” That determination was
326
followed by an instruction that the Commission take account of the turnover of the relevant
undertaking when reassessing the fine for the purpose of Section 9.4 of the Article 65 Decision.
674. In relation to WhatsApp’s submissions under the heading “(u)nsupported assumptions as to
deterrence”, I will take account of these submissions, insofar as possible, when reassessing the fine
further to the instruction of the Board, as set out in Section 9.4 of the Article 65 Decision.
675. HavingconsideredWhatsApp’sSubmissionson RecurringThemes andits Article65 Submissions, I will
now assess whether or not my findings, as set out in this Decision, merit the exercise of any of the
corrective powers set out in Article 58(2) and, if so, which one(s).
Starting Point: Article 58(2)
676. To begin, I note that Recital 129, which acts as an aid to the interpretation of Article 58, provides that
“… each measure should be appropriate, necessary and proportionate in view of ensuring compliance
with this Regulation, taking into account the circumstances of each individual case ….” From that
starting point, the relevant corrective powers that are available to me, pursuant to Article 58(2), may
be summarised as follows:
“…
(b) to issue reprimands to a controller or a processor where processing operations have infringed
provisions of this Regulation;
…
(d) to order the controller or processor to bring processing operations into compliance with the
provisions of this Regulation, where appropriate, in a specified manner and within a specified
period;
…
323
324See the summary set out in Section 9.4 of the Article 65 Decision
The Article 65 Submissions, paragraphs 39.35 to 39.36
325The Article 65 Decision, paragraph 412
326The Article 65 Decision, paragraphs 423 and 424
195 (f) to impose a temporary or definitive limitation including a ban on processing;
…
(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures
referred to in this paragraph, depending on the circumstances of each individual case;
(j) to order the suspension of data flows to a recipient in a third country or to an international
organisation.”
677. In the circumstances of the within inquiry, and with particular reference to the findings set out in this
Decision, I consider that the exercise of one or more corrective powers is both appropriate and
necessary for the purpose of ensuring compliance with the GDPR. Of the options available to me, as
set out above, I consider that a reprimand and an order to bring processing operations into
compliance in the terms set out in Appendix C hereto would operate, respectively, to:
a. formally identify and recognise the fact of infringement; and
b. bring about the required remedial action.
678. The exercise of the above corrective powers is, inmy view, proportionate incircumstances where the
proposed measures do not exceed what is required toenforce compliance with the GDPR, taking into
account the findings set out in this Decision. (As will be seen from the below, I have also separately
dealt with the question of whether to impose an administrative fine and I deal with WhatsApp’s
submissions in relation to that issue in that separate analysis).
WhatsApp’s Response and Assessment of Decision-Maker
679. WhatsApp,bywayoftheSupplementalDraftSubmissions,disagreeswiththeabove. Itfirstlysubmits
that I have failed to consider whether any proposed measures are “appropriate, necessary and
proportionate” and that I have failed to apply the principal of proportionality, insofar as I am obliged
to “impose the least onerous measure available … in order to achieve compliance 32.” WhatsApp
further submits, in this regard, that the proposed order to bring processing operations into
compliance is unnecessary because WhatsApp has already volunteered to “promptly make relevant
328
changes to address the Commission’s concerns ”.
680. I have clearly set out, in paragraphs 677 and 678, above, the reasons why I consider that the
imposition of a reprimand and the making of an order tobring processing operationsinto compliance
is both appropriate and necessary in the circumstances of the findings of infringement recorded in
thisDecision. I havealsonoted, inparagraph678,thatI consider these measures to be proportionate
to the circumstances. I have already given extensive consideration, in Parts 1, 2, 3 and 4 of this
Decision, to the significance, utility and function of the transparency obligation in the context of the
GDPR as a whole. WhatsApp, in my view (and the view of the Board), has not discharged its
transparencyobligations. Inthecircumstances,itisanentirelyproportionateresponseformetoseek
to exercise one or more of the corrective powers set out in Article 58(2) of the GDPR.
327The Supplemental Draft Submissions, paragraph 2.2 (see also paragraphs 1.8, 2.3, 2.4 and 3.4)
328The Supplemental Draft Submissions, paragraph 3.4(A)
196 including the conclusion that “the identified additional infringements of Articles 5(1)(a), 13(1)(d),
13(2)(e) and the extended scope of 14 GDPR are to be reflected in the amount of the fine 338 … .”
692. On the basis of the Board’s instruction, I have amended my original Article 83(2) assessment, set out
immediately below, to incorporate reference to, and assessment of, the additional findings of
infringement of Articles 13(1)(d), 13(2)(e), Article 5(1)(a) and the extended scope of the Article 14
infringement that were established by the Article 65 Decision.
693. As regards WhatsApp’s right to be heard in relation to the assessment of the Article 5(1)(a)
infringement (which did not appear in the Composite Draft), WhatsApp was provided with copies of
alloftheobjectionsthatformedthebasisfortheBoard’sArticle65Decisionandwasinvitedtofurnish
submissions in relation to all aspects of same. While WhatsApp furnished submissions in response to
the status and merits of the Article 5(1)(a) objections, it did not substantively address that aspect of
the Italian SA’sobjection that indicated that the proposed administrative fine should be reconsidered
in the event that a finding of infringement of Article 5(1)(a) is recorded in the Commission’s final
decision. While I note that WhatsApp has submitted 339 that a concurrent finding of infringement of
Article 5(1)(a) alongside findings of infringement of Articles 12 – 14 would amount to double
340
punishmentforthesameconduct,thesesubmissionswerealreadytakenintoaccountbytheBoard
in its Article 65 Decision. That being the case, it is not open to the Commission to reach a contrary
assessment to that carried out by the Board.
341
694. In relation to the infringement of Article 13(2)(e), I note that WhatsApp has addressed this in its
Article 65 Submissions on the basis that:
a. “This matter relates to compliance with Article 13 GDPR, which has not been determined to
be the “gravest infringement” in this [inquiry] under Article 83(3) GDPR, and so it is not
determinative to the issue of the final fine amount;
b. … the substantive issue cannot be distinguished from issues arising in respect of compliance
with Article 13(1)(c) GDPR which has been addressed in the Composite Draft already and
subject to a fine;
c. There is no evidence of harm to users and this is an example of a technical infringement at
best, without any real impact on user rights;
d. A further fine is not required in order for there to be an effective or dissuasive effect since
[WhatsApp] has already taken steps … to improve the information provided in the updated
Privacy Policy on this issue; and
e. It would in any event be procedurally unfair to issue an increased fine at this late stage when
the Commission has not addressed the issue in the Composite Draft and afforded [WhatsApp]
a meaningful opportunity to make submissions.”
338
339The Article 65 Decision, paragraphs 423 and 424
The Article 65 Submissions, paragraphs 10.4 and 13.2
340The Article 65 Decision, paragraphs 186 and 187
341The Article 65 Submissions, paragraph 17.9
201695. In relation to the submissions set out at (a), above, the Board has already considered and issued a
determination inrelation tothe interpretation and manner ofapplication of Article83(3) (asdetailed,
further below). Similarly, the Board hasalso determined that: (i) this Decision should record a finding
of infringement of Article 13(2)(e); and (ii) the infringement of Article 13(2)(e) should be taken into
accountwhenre-assessingthe administrative fine. Asalready noted, theCommissionisbound by the
findings that were made the Board, as recorded in the Article 65 Decision.
696. As regards the requirement for me to take account of the additional finding of infringement of Article
13(1)(d) and the expanded scope of the Article 14 infringement, I note that WhatsApp’s submissions
do not address the issue of how such additional/expanded findings should be addressed, in the
context of the administrative fine.
Article 83(2)(a): the nature, gravity and duration of the infringement taking into account the nature
scope or purpose of the processing concerned as well as the number of data subjects affected and
the level of damage suffered by them
Preliminary Considerations
697. I note that Article 83(2)(a) requires consideration of the identified criterion by reference to “the
infringement” as well as “the processing concerned”. Considering, firstly, the meaning of
“infringement”, it is clear from Articles 83(3)-(5), that “infringement” means an infringement of a
provision of the GDPR. Inthe context of the within inquiry, I have found that WhatsApp has infringed
Articles 5, 12, 13 and 14. Thus, “the infringement”, for the purpose of my assessment of the Article
83(2) criteria, should be understood (depending on the context in whichthe term is used) asmeaning
an infringement of Article 5, an infringement of Article 12, an infringement of Article 13 or an
infringement of Article 14 of the GDPR. While each is an individual “infringement” of the relevant
provision, they all concern transparency and, by reason of their common nature and purpose, are
likely to generate the same, or similar, outcomes in the context of some of the Article 83(2)
assessment criteria. Accordingly, and for ease of review, I will assess all four infringements
simultaneously, by reference to the collective term “Infringements”, unless otherwise indicated.
698. It is further important to note that there is a significant degree of overlap, as between the subject-
matter of the Article 12 – 14 infringements and the Article 5 infringement. This is clear from the
rationale supporting the Board’s determination of the existence of the Article 5 infringement (as set
out in paragraphs 195 – 199 of the Article 65 Decision). That being the case, the considerations and
assessments set out below, save where otherwise indicated, should be understood as being
assessments of the individual Article 83(2) criteria in the context of WhatsApp’s approach to
transparency generally (encompassing both the general principle set out in Article 5 and the more
particular obligations arising by reference to Articles 12 – 14).
699. The phrase “the processing concerned” should be understood as meaning all of the processing
operations that WhatsApp carries out on the personal data under its controllership. The within
inquiry was not based on an assessment of the extent to which WhatsApp complies with its
transparency obligations in the context of specific processing operations. Instead, the inquiry
examined the extent of the information WhatsApp provides to data subjects about all of the
processing operations that it carries out on personal data under its controllership.
202700. From this starting point, I will now assess the Article 83(2)(a) criterion in light of the particular
circumstances of the within inquiry. I note, in this regard, that Article 83(2)(a) comprises four
elements, as follows:
The nature, gravity and duration of the infringement
701. In terms of the nature of the Article 12 – 14 infringements, the findings concern infringements of the
datasubjectrights. Assetoutintheanalysisthatsupportedthe“ProposedApproach”forthepurpose
of the Article 13(1)(c) assessment in the Preliminary Draft, my view is that the right concerned – the
right to information – is the cornerstone of the rights of the data subject. Indeed, the provision of
the information concerned goes to the very heart of the fundamental right of the individual to
protection of his/her personal data which stems from the free will and autonomy of the individual to
share his/her personal data in a voluntary situation such as this. If the required information has not
been provided, the data subject has been deprived of the ability to make a fully informed decision as
to whether or not he/she wishes to become a user of the Service. Further, the extentto which a data
controller has complied with its transparency obligations has a direct impact on the effectiveness of
the other data subject rights. If the data subject has not been provided with the prescribed
information, he/she may be deprived of the knowledge he/she needs to consider exercising one of
the other data subject rights. Indeed, he/she may even be deprived of knowing about the very
existence of the data subject rights.
702. In terms of the Article 5 infringement, the Board observed 342that transparency “is an overarching
principle that not only reinforces other principles (i.e. fairness, accountability), but from which many
otherprovisionsoftheGDPRderive.” Itisthereforeclearthatfailuretocomplywiththetransparency
principle has the potential to undermine other fundamental data protection principles, including but
not limited to the principles of fairness and accountability.
703. I further note, in this regard, that Articles 83(4) and (5) are directed to the maximum fine that may be
imposed in a particular case. The maximum fine prescribed by Article 83(5) is twice that prescribed
by Article 83(4). The infringements covered by Article 83(5) include infringements of the data
subject’s rights pursuant to Article 12 to 22 as well as the basic principles for processing pursuant to
Article 5. It is therefore clear that the legislature considered the data subject rights and the basic
principles forprocessingtobe significant, inthe contextof the data protection framework asawhole.
WhatsApp’s Response and Assessment of Decision-Maker
704. BywayofresponsetotheaboveassessmentoftheArticle12–14infringements,WhatsApphasmade
submissions that fall within the categories of the Binary Approach Submissions, the Careful and Good
FaithEffortsSubmissionsandtheTheoreticalRiskSubmissions. Myviews,oneachofthesecategories
of submissions, have been set out within my assessment of the Submissions on Recurring Themes set
out at paragraphs 599 to 665. For the reasons already explained, I am unable to attribute weight, as
a mitigating factor for the purpose of this Part 5, to the matters raised under the Binary Approach
Submissions. While I will take account of the matters covered by the Careful and Good Faith Efforts
Submissions, it is not appropriate for me to do so in the context of my assessment of the nature of
the Infringements. Otherwise, I have addressed the submissions arising under the Theoretical Risk
342The Article 65 Decision, paragraph 192
203 Submissions by providing examples and further reasoning as to the risks arising from the
Infringements.
705. In terms of the gravity of the Infringements, I note that WhatsApp has not addressed its Article 14
obligationstonon-usersatall. Thismeansthatnoneoftheprescribedinformationhasbeenprovided
to non-users of the Service. In the context of users, my provisional findings were such that, in the
Supplemental Draft, I considered WhatsApp to have only provided 55% 343 of the prescribed
informationtousersoftheService. Asnotedabove,theBoarddeterminedtheexistenceofadditional
infringements of Articles 13(1)(d) and 13(2)(e). This means that, in total, WhatsApp has been found
to have only provided 36% 344of the prescribed information to users of the Service. This, in my view,
represents a very significant level of non-compliance, particularly in the case of the Article 14
infringement, taking into account the importance of the right to information, the consequent impact
on the data subjects concerned and the number of data subjects potentially affected (each of which
is considered further, below).
706. Turning to the infringement of Article 5(1)(a), the Board determined 345 that there has been “an
infringement of the transparency principle under Article 5(1)(a), in light of the gravity and the
overarching nature and impact of the infringements, which have a significant negative impact on all
of the processing carried out by [WhatsApp]”. That being the case, it is clear that the Board did not
consider the Article 5 infringement to be insignificant, in terms of gravity.
WhatsApp’s Response and Assessment of Decision-Maker
707. BywayofresponsetotheaboveassessmentoftheArticle12–14infringements,WhatsApphasmade
submissions that fall within the categories of the Binary Approach Submissions, the New and
Subjective Views Submissions, the Nuanced Nature of Assessment Submissions and the Theoretical
Risk Submissions. My views, on eachof these categories of submissions, have been set out within my
assessment of the Submissions on Recurring Themes. For the reasons already explained, I am unable
to attribute weight, as a mitigating factor for the purpose of this Part 5, to the matters raised under
the New and Subjective Views Submissions and the Nuanced Nature of Assessment Submissions.
Further, I have already addressed the submissions arising under the Theoretical Risk Submissions by
providing examples and further reasoning as to the risks arising from the Infringements.
708. As regards the Binary Approach Submissions, I have already acknowledged that WhatsApp’s
submissions have some merit in relation to the proposed finding of infringement of Article 13(2)(c)
only. Accordingly, I will adjust my assessment of the extent to which WhatsApp has achieved with its
obligations pursuant to Article 13 to reflect a position whereby it has provided 41% 346 of the
prescribed information to users of the Service. This assessment gives credit to WhatsApp, as regards
its having provided information concerning the existence of the right to withdraw consent. As noted
343Article 13 sets out twelve categories of information that must be provided to data subjects. The Preliminary Draft
records proposed findings that WhatsApp has complied with its obligations in respect of six of the twelve categories.
Discounting the applicability of one category (Article 13(2)(f)), the figure of 55% represents the extent to which WhatsApp
has achieved compliance with the requirements of Article 13 (i.e. (6/11) x 100).
344This figure reflects the additional findings of infringement of Articles 13(1)(d) and 13(2)(e), as established by the Board
in its Article 65 Decision. Discounting, as before, the applicability of one category (Article 13(2)(f)), the figure of 36%
represents the fact that WhatsApp has been found to have complied with its obligations in respect of four of the eleven
prescribed categories (i.e. (4/11) x 100).
345The Article 65 Decision, paragraph 199
346This reflects an adjustment to the existing formula as follows: (4.5/11) x 100
204 in my assessment, the placement of this information is such that it might or might not be discovered
by the data subject. I have therefore reassessed the extent to which WhatsApp hascomplied with its
Article 13 obligations by reference to the addition of 50% credit for the information that it has
provided further to Article 13(2)(c). As explained, as part of my assessment of the Submissions on
Recurring Themes, I am not prepared to afford similar credit to WhatsApp in respect of the other
proposed findings of infringement in circumstances where I am strongly of the view that the extent
of information provided, in each case, was wholly insufficient.
709. In terms of the duration of the Infringements, the Privacy Policy bears a “last modified” date of 24
April 2018. Accordingly, it seems to me that the Infringements have been occurring since before the
entry into force of the GDPR (and, I note, remain ongoing). For the purpose of this assessment, I will
only take account of any period of infringement occurring from 25 May 2018 onwards.
WhatsApp’s Response and Assessment of Decision-Maker
710. By way of response to the above aspect of assessment, WhatsApp has made submissions (directed to
the assessment of the Article 12 – 14 Infringements) that fall within the categories of the Careful and
Good Faith Efforts Submissions, the Willingness to Change Submissions and (indirectly) the New and
Subjective Views Submissions. My views, on each of these categories of submissions, have been set
out within my assessment of the Submissions on Recurring Themes. For the reasons already
explained, I am unable to attribute weight, as a mitigating factor for the purpose of this Part 5, to the
matters raised as part of my assessment of the duration of the Infringements.
Taking into account the nature, scope or purpose of the processing concerned
711. I note that the processing of personal data by WhatsApp, in the context of both users and non-users,
is not extensive. In the context of users, WhatsApp processes a limited number of categories of
347
personal data , the vast majority of which are expressly furnished by the data subjects concerned.
I further note that WhatsApp does not appear to process special categories of personal data. The
data are processed in connection with the provision of the Service to users.
712. In the context of non-users, WhatsApp appears to only process, as a controller, the mobile phone
numbersof non-users. Asbefore, the data of non-usersisprocessed inconnection with the provision
of the Service to users. I note, in this regard, that the duration of the processing itself is very short,
lasting only a couple of seconds, culminating with the application of a lossy hashing process and the
irretrievable deletion of the original mobile phone number. I note, however, that this (albeit limited)
348
processing takes place “on a regular basis ” while the Contact Feature is activated on any individual
user’s device. While WhatsApp submits that it has no ability to access the mobile phone number
during the processing and further that it has no practical ability to link the non-user’s mobile phone
number to a person (or, otherwise, link the resulting Lossy Hash with a specific phone number of an
individual non-user), the Board has determined 349that the “table of lossy hashes together with the
associated users’ phone numbers as Non-User List constitutes personal data”. Following this
determination, the Board noted 350that: “(t)he only aspect that needs to be assessed is whether, as a
consequence of the conclusion concerning the nature of the non-user data after the application of the
347
See the “Information We Collect” section of the Privacy Policy
348The “Information We Collect” section of the Privacy Policy
349The Article 65 Decision, paragraph 156
350The Article 65 Decision, paragraph 228
205 Lossy Hashing procedure, the infringement of Article 14 GDPR extends to such data, too, and whether
this needs to be reflected in the choice of corrective measures and amount of the administrative fine.”
The Board concluded 351that it “agrees with the CSAs’ objections that the infringement of Article 14
GDPR extendsaswellto the processing of non-users’ data inthe form of Non-User Lists after the Lossy
Hashing procedure was applied, and instructs the [Commission] to amend its [Composite Draft]
accordingly.” Onthebasisofthisinstruction, I havereinstated those aspectsofmyinitial Article83(2)
analysis which were premised on a proposed finding that the mobile phone number of a non-user,
after the application of the lossy hashing process, remains the personal data of the non-user
concerned. Accordingly, I note that, while a limited amount of non-user personal data is processed
by WhatsApp, it nonetheless appears to be stored indefinitely on WhatsApp’s servers.
713. Overall, it appears clear that the nature and scope of the processing is limited. The purpose of the
processing is directed towards achieving connectivity for users. I note, in this regard, that the
processing only serves the interests of users and WhatsApp. I acknowledge the “extensive technical
measures which were designed by WhatsApp to ensure this data … is stored and used in a highly
privacyprotectivemanner 352”. Intermsoftheweightthatmightbeattributedtothisfactor,however,
I note that it does not operate to mitigate against the infringement of the right to be informed,
particularly in relation to the consequences of that processing that only crystallise for the non-user
concerned, after he/she has signed up as a user of the Service.
As well as the number of data subjects affected
714. In terms of the number of data subjects affected, WhatsApp confirmed 353 that, as at 29 April 2020, it
was the controller for approximately data subjects in the EEA and the United Kingdom 354.
715. Placing this figure in context, I note that Eurostat, the statistical office of the European Union 355
356
confirms that , as of 1 January 2020:
a. The population of the “EU-27” was approximately 448 million;
357
b. The population of the UK was approximately 67 million ;
c. The population of Iceland was approximately 364,000;
d. The population of Liechtenstein was approximately 39,000; and
e. The population of Norway was approximately 5 million.
716. By reference to the Eurostat figures, above, it appears that, as at 1 January 2020, the total population
of the EEA (including the UK) was approximately 520 million. While it is not possible, or indeed
necessary, for me to identify the precise number of usersaffected by the Infringements, it is useful to
351The Article 65 Decision, paragraph 229
352
The Supplemental Draft Submissions, paragraph 5.16
353By way of letter dated 1 May 2020 from WhatsApp to the Commission
354The letter dated 1 May 2020 explained, by way of footnote 1 thereto, that: “(t)his figure is based on monthly active
users of the Service in the EEA and the United Kingdom. An “active user” is defined as a user that has opened their
WhatsApp application at least one time within a given period of time, for example, a month. A monthly active user is
defined as a user that has opened their WhatsApp application at least one time in the last 30 days.”
355https://ec.europa.eu/info/departments/eurostat-european-statistics en
356https://ec.europa.eu/eurostat/tgm/table.do?tab=table&init=1&language=en&pcode=tps00001&plugin=1
357This figure has been taken into account, notwithstanding the intervening departure of the UK from the European Union,
in circumstances where, as at the date of commencement of the within inquiry, UK-based data subjects fell within the
affected scope of data subjects concerned by the cross-border processing in question.
206 have some point of reference in order to consider the extent of EEA data subjects that are potentially
affected by the Infringements. The figure provided by WhatsApp ( monthly active users)
equates to approximately of the population of the EEA (including the UK), by reference to the
Eurostat figures, above.
717. In terms of the number of non-users affected by the Article 14 infringement, it is not possible for me
to identify the number of data subjects concerned. This number, however, cannot be discounted as
beingpotentiallyinsignificant. Iobserved,intheSupplementalDraft, that,ifitisthe case thatroughly
of the EEA population are users of the Service, this means that roughly of the population
are non-users of the Service. All that is required for a non-user’s data to be processed by WhatsApp
is for that non-user to have his/her contact details stored in the address book of a user. While it
cannot be assumed that all of the non-users have been included in the address books of users, I note
the comment of the Investigator in the Inquiry Report 358 that, “there appear to be few barriers to
using the [Service] from a socio-economic perspective, aside from the requirement of a user to have a
smart device upon which the App can be downloaded.” On this basis, the number of non-users
affected by the Infringement is likely to be significant.
WhatsApp’s Response and Assessment of Decision-Maker
718. WhatsApp, by way of the Supplemental Draft Submissions, has responded that:
“WhatsApp accepts that there are a large number of users of the Service, and that those users are
likely to have chosen to upload device contact lists containing a large number of non-users’ phone
numbers…However, WhatsApp submits thatthe number of userscanonlybe relevant… if this can
be linked to damage caused to those users … 35”
719. I have already addressed, as part of my assessment of the Theoretical Risk Submissions, the risks
arising from the proposed Infringements and the consequent non-material damage (loss of control
over personal data and the inability to make a fully informed decision) that flow from that.
720. In relation to my assessment of the number of data subjects affected, WhatsApp has submitted,
firstly, that:
“… WhatsApp should clarify that the number of data subjects in the EEA and the UK previously
provided ) is better understood as an upper bound rather than a specific number, as
the figure is based on active phone numbers rather than individual users, and includes WhatsApp
business accounts.
Further, individuals mayhave multiple phonenumbersregistered to the Service. …WhatsApp does
not require users to provide identifying information, such as their real name or email address, to
create an account. As a result, WhatsApp is not in a position to refine this figure to remove any
duplication (i.e. where a number of active phone numbers correspond to the same data subject or
correspond with both a business and personal account) 36.”
358The Inquiry Report, paragraph 170
359The Supplemental Draft Submissions, paragraph 5.25
360The Supplemental Draft Submissions, paragraph 5.26
207721. Further information, in relation to the above submission, has been provided by way of a footnote, as
follows:
“A WhatsApp business account may be operated by a verified business or a private individual user.
Further, a single phone number can be linked to both a personal WhatsApp account and a
WhatsApp business account, which WhatsApp counts as two accounts 361.”
722. I will make two observationsin response to the above submissions. Firstly, I asked WhatsApp, by way
of letter dated 24 April 2020, to confirm:
“whether or not I am correct in my understanding that WhatsApp is the data controller for
approximately 300 million EEA data subjects.”
723. The response received, dated 1 May 2020, advised that:
“As at 29 April 2020, [WhatsApp] is the controller, as defined by Article 4(7) GDPR, for
approximately data subjects in the EEA and the United Kingdom.”
724. Asnotedabove,anaccompanyingfootnoteexplainedthatthisfigureisbasedonmonthlyactiveusers
of the Service in the EEA and the UK. In other words, the figure represents the number of users that
opened their WhatsApp app at least once within the previous 30 days.
725. I acknowledge WhatsApp’s submissions that the calculation of the number of users is not an exact
science. Itisnotnecessary,for the purpose of thewithinassessment, forthe numberof data subjects
tobe calculable asanexactscience. Itissufficientfor metooperate by reference toaclear indication
as to the sizes of the groups of affected data subjects.
726. By way of second observation, I note that the information required to assess this particular aspect of
matters can only be obtained from WhatsApp. This information is uniquely within WhatsApp’s
control andthere isnoothersource fromwhichI mightprocure same. While WhatsApphasprovided
me with a definite figure (albeit an “upper bound”) of , it has not offered any indication of
the extent to which this figure might include the variable factors 362 referenced in the Supplemental
Draft Submissions. Accordingly, I have no option but to proceed with this particular aspect of my
assessment by reference to a figure of users, noting that this represents an indication of
the size of the affected pool of user data subjects, rather than a specific confirmation of the numbers
affected.
727. WhatsApp has further submitted that:
“Additionally,theCommission’sconclusionthat,ifroughly oftherelevantpopulationareusers
of the Service, roughly are non-users of the Service is … overly-simplistic. For example, the
Commission does not give consideration to the various categories of non-users who are unlikely to
be listed as contacts in any user’s address book. Infants, children and many elderly people do not
have mobile phones (and so will not have a mobile phone number) and so are likely to incorrectly
account for a material proportion of the Commission’s estimated number of “non-users” allegedly
361The Supplemental Draft Submissions, footnote 40 (as referenced in paragraph 5.26)
362The Supplemental Draft Submissions, paragraph 5.26
208 affected. Eurostat figures show that of the population ofthe “EU-27” approximately15% are aged
0-14 years and approximately 20% are aged 65 and over. To further illustrate this, research in the
363
UK shows that 12% of 64 – 74 year olds and 25% of 75+ year olds do not use a mobile phone .
The Commission’s estimation does not take factors such as these into account 364.”
728. Asset outabove, itisnotnecessary, for the purpose of the within assessment, for thenumber of data
subjects to be calculable as an exact science. It is sufficient for me to operate by reference to a clear
indication as to the size of the group of data subjects affected. WhatsApp has submitted that the
rough calculation of the percentage of the relevant population that are likely to be non-users (which
derives from the percentage of the population that are likely to be users) does not take account of
the various categories of non-users who are unlikely to be listed as contacts in any user’s address
book. I acknowledge that WhatsApp’s submissions have some merit in this regard, and I have
adjusted my assessment of the approximate numbers of data subjects affected, as follows:
a. Taking the Eurostat figures originally referenced (in paragraph 715, above), the total
population of the EEA (including the UK) is approximately 520 million.
b. WhatsApp submits that 15% of the population are aged 0-14 years and so should be
discounted from the calculation on the basis that they are unlikely to own a mobile phone and
are thereby unlikely to have a mobile phone number that could be processed pursuant to the
Contact Feature.
c. I note, in this regard, that research 365 carried out by the same UK body relied upon by
WhatsAppsuggeststhat45%ofchildrenandyoungadults,betweentheagesof5and15years
of age, own their own smartphones.
d. It follows, therefore, that approximately 55% of children and young adults between the ages
of 5 and15yearsdonotowntheir own smartphone. Accordingly, thereduction tobeapplied,
by reference to this particular category of individuals, is43 million (i.e.55% of15% of the total
EEA population).
e. WhatsApp further submits that 20% of the population are aged 65 years and over and the
percentage of those who do not own a mobile phone, within this age category, varies by
reference to a two sub-divided age ranges. The Eurostat figures are not broken down in such
a way that would enable an assessment by reference to the age categories specified. For this
reason, I have decided to give WhatsApp the maximum benefit possible by assessing this
reduction by reference to the higher of the two non-mobile-phone-owner rates specified (i.e.
the rate of 25% non-ownership, which applies to those aged 75 years and over).
f. Accordingly, the reduction to be applied, by reference to this category of individuals, is 26
million (i.e. 25% of 20% of the total EEA population).
363
Cited Source: Ofcom ‘Adults’ Media Use & Attitudes Report 2020’ available at
https://www.ofcom.org.uk/ data/assets/pdf file/0031/196375/adults-media-use-and-attitudes-2020-report.pdf
364The Supplemental Draft Submissions, paragraph 5.27
365Ofcom “Children and parents: Media use and attitudes report 2019”, available at
https://www.ofcom.org.uk/ data/assets/pdf file/0023/190616/children-media-use-attitudes-2019-report.pdf
209 g. The result of the above is that, of the total population figure of 520 million, approximately 69
million individuals (or 13%) are neither users nor non-users because they are unlikely to own
a mobile phone (and so cannot have a mobile phone number to be processed pursuant to the
Contact Feature). As before, the user figure provided by WhatsApp (of monthly
active users), represents approximately of the total population of the EEA (including the
UK). The corresponding figure, in respect of non-users, however, is reduced to .
The level of damage suffered by them
729. I note that Recital 75 (which acts as an aid to the interpretation of Article 24, the provision that
addresses the responsibility of the controller), describes the “damage” that can result where
processing does not accord with the requirements of the GDPR:
“The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may
result from personal data processing which could lead to physical, material or non-material
damage, in particular: … where data subjects might be deprived of their rights and freedoms or
prevented from exercising control over their personal data …” [emphasis added]
730. As set out above, my provisional findings are such that users have only been provided with 41% of
the information they are entitled to receive. Non-users have not been provided with any of the
information they are entitled to receive. This represents, in my view, a very serious information
deficit and one which, by any assessment of matters, can only equate to a significant (in the case of
users) and total (in the case of non-users) inability to exercise control over personal data. I further
note that, in the case of users, the failure to provide all of the prescribed information undermines the
effectiveness of the data subject rights and, consequently, infringes the rights and freedoms of the
data subjects concerned.
731. The lossof control over personal data islikely, inmy view, tobe particularly objectionable toany non-
user who might have actively decided against using the Service on the basis of privacy concerns. I
note, in this regard, that the European Commission, in its assessment of the (then) proposed
acquisition of WhatsApp by Facebook 36, recorded that:
“… after the announcement of WhatsApp’s acquisition by Facebook and because of privacy
concerns, thousands of users downloaded different messaging platforms, in particular Telegram
which offers increased privacy protection.”
367
732. It further recorded that:
“Privacy concerns also seem to have promoted a high number of German users to switch from
WhatsApp to Threema in the 24 hours following the announcement of Facebook’s acquisition of
WhatsApp 368.”
366European Commission Case No. COMP/M.7217 – Facebook/WhatsApp, dated 3 October 2014 (available at:
https://ec.europa.eu/competition/mergers/cases/decisions/m7217 20141003 20310 3962132 EN.pdf). See, in
367ticular, paragraph 132 and footnote 79 thereof.
Ibid, paragraph 174
368The source of this statement was identified, per footnote 96 of the European Commission’s merger decision, as being
http://techcrunch.com/2014/02/21/bye-bye-whatsapp-germans-switch-to-threema-for-privacy-reasons/ ;
http://www.sueddeutsche.de/digital/seit-facebook-deal-whatsapp-konkurrent-threema-verdoppelt-nutzerzahl-1.1894768
210WhatsApp’s Response and Assessment of Decision-Maker
733. Bywayofresponse totheaboveaspectofassessment(asitwasoriginallyset outinthe Supplemental
Draft), WhatsApp has made submissions that fall within the categories of the Theoretical Risk
Submissions and the Binary Approach Submissions. My views, on each of these categories of
submissions, have been set out within my assessment of the Submissions on Recurring Themes. I
have already taken account of the information that WhatsApp provides in furtherance of Article
13(2)(c) and I have addressed the submissions arising under the Theoretical Risk Submissions, by
providing examples and further reasoning as to the risks arising from the Infringements.
734. WhatsApp has further submitted, in relation to the latter, that:
“Recital 75 GDPR provides that “the risk to the rights and freedoms of natural persons, of varying
likelihood and severity, may result from personal data processing which could lead to physical,
material or non-material damage, in particular … where data subjects might be deprived of their
rights and freedoms or prevented from exercising control over their personal data.” (emphasis
added). WhatsApp submits that the Commission has not adequately considered the varying
likelihoodandseverityofanydamagethatmightpossiblybesuffered. WhatsAppdoesnotconsider
there is a likelihood of a data subject suffering damage, let alone significant damage, in the
circumstances of this case369.”
735. In terms of the likelihood and severity of the identified risks to the rights and freedoms of natural
persons, I have already set out my view that the identified risks are the consequence of WhatsApp’s
failure to provide the prescribed information to users and non-users. In terms of likelihood of the
identified risks resulting, therefore, my view is that the identified risks materialise when WhatsApp
embarksupon the processingof the personal data concerned withouthavingprovided the prescribed
information to the data subjects concerned. In terms of the severity of those risks, I have already set
out my view that the risks are likely to have a more severe impact for non-users, particularly non-
users who might be considering joining the Service, who will not have been provided with any
informationastotheconsequencesofthepossibleprocessingoftheirmobilephonenumbers,further
to the activation of the Contact Feature by any existing user contacts, that will crystallise upon their
joiningthe Service. Inthecase of users, the identified risksare lesssevere however Iamsatisfied that
they areappropriatelyclassified assevere giventhattheyconcernthe infringementofone ofthecore
data subject rights.
Article 83(2)(b): the intentional or negligent character of the infringement
736. In assessing the character of the Infringements, I note that the GDPR does not identify the factors
that need to be present in order for an infringement to be classified as either “intentional” or
“negligent”. The EDPB, in its former composition as the Article 29 Working Party (“the Working
Party”) considered this aspect of matters in its “Guidelines on the application and setting of
administrativefinesforthepurposesofRegulation2016/679 37”(“theFiningGuidelines”),asfollows:
369The Supplemental Draft Submissions, paragraph 5.29
370The Article 29 Working Party’s Guidelines on the application and setting of administrative fines for the purposes of
Regulation 2016/679, adopted 3 October 2017, 17/EN WP 253 (“the Fining Guidelines”)
211 “In general, “intent” includes both knowledge and wilfulness in relation to the characteristics of an
offence, whereas “unintentional” means that there was no intention to cause the infringement
although the controller/processor breached the duty of care which is required in the law.”
737. Considering, firstly, the Article 12 and 13 infringements, I note WhatsApp’s submissions in relation to
the efforts that it had made to achieve compliance with its transparency obligations 371.
738. Considering, secondly, the Article 14 infringement, I note that WhatsApp Inc. was previously the
subject of a joint investigation carried out by the Office of the Privacy Commissioner of Canada
(“OCO”) and the Dutch Data Protection Authority (College bescherming persoonsgegevens) (“the
CBP”) in 2012 (“the 2012 Investigation”). I note, in this regard, that WhatsApp is the wholly-owned
subsidiary of WhatsApp Inc 37. I further note that, while, the 2012 Investigation considered this issue
by reference to Dutch and Canadian national law, the applicable legal principles (certainly in the case
of CBP’s investigation) were materially identical to those arising in the context of the GDPR.
739. The resulting investigation reports 373confirm that the 2012 Investigation included an assessment of
whether or not the processing of non-user data collected by way of the Contact Feature was
supported by an appropriate legal basis. The CBP’s “Report on the definitive findings 374”, in this
regard, concluded that the mobile phone numbers of non-users constituted the personal data of the
non-users concerned. The CBP observed that a mobile phone number “is a personal data item
because it is a direct contact data item that anyone can use to identify a person directly or indirectly
by taking intermediate steps”.
740. It seems to me that, as a result of the findings of the 2012 Investigation, WhatsApp was on notice (via
its parent company) that the Dutch Supervisory Authority considered the mobile phone number of a
non-user to constitute personal data and that WhatsApp, when processing this personal data
pursuant to the Contact Feature, it acted as a data controller.
WhatsApp’s Response and Assessment of Decision-Maker
741. In response to the above point, WhatsApp firstly submits that:
“… the Commission’s position appears to be predicated on the assumption that an infringement
must be either intentional or negligent. WhatsApp submits that this is not the case 37.”
742. There is no doubt but that an infringement may be classified as intentional, negligent or neither
intentional nor negligent. I do not, however, consider that the Infringements could appropriately be
classified as being neither negligent nor intentional in the circumstances of the within inquiry.
Transparency is not only one the core data subject rights, it is also one of the fundamental principles
of processing set out in Article 5. This means that data controllers must pay particular care and
371The Inquiry Submissions, paragraphs 1.3, 2.5, 2.6 and 10.3
372
As confirmed by WhatsApp in its letter dated 1 May 2020 to the Commission. See also page 3 of the Directors’ Report
and Financial Statements most recently filed, on behalf of WhatsApp, with the Companies Registration Office (in respect of
the financial period from 6 July 2017 to 31 December 2018).
373Available at: https://autoriteitpersoonsgegevens.nl/en/news/canadian-and-dutch-data-privacy-guardians-release-
findings-investigation-popular-mobile-app
374
“Dutch Data Protection Authority Investigation into the processing of personal data for the ‘whatsapp’ mobile
application by WhatsApp Inc. Z2011-00987 Report on the definitive findings”, dated January 2013 [Public Version]
375The Supplemental Draft Submissions, paragraph 6.2
212 attention to the requirements of Articles 12 – 14. There is nothing to suggest that the proposed
Infringements were the result of intentional behaviour (by way of act or omission) on the part of
WhatsApp. My view, however, is that the Infringements suggest a degree of carelessness on
WhatsApp’s part. The reasoning for this view is set out as part of my assessment, above, of the New
and Subjective Views Submissions, the Nuanced Nature of Assessment Submissions and the Binary
Approach Submissions.
743. While I recognise, in this regard, that WhatsApp has made efforts towards achieving compliance, it
does not necessarily follow that those efforts preclude the possibility of the Infringements being
classified as negligent. The fundamental obligation arising, pursuant to Articles 12 – 14, is the
provision of information. The extent of non-compliance, as established in Parts 1, 2, 3 and 4 of this
Decision, is such that a significant amount of information has simply not been provided. In these
circumstances, the efforts made by WhatsApp have limited weight, as a mitigating factor for the
purpose of this Part 5 (my views, in this regard, are set out as part of my assessment of the Careful
and Good Faith Efforts Submissions). In the context of the within aspect of assessment, I am not
satisfied that they can be afforded such weight as to reduce the classification of the Infringements
from negligent to neither negligent nor intentional.
744. WhatsApp has further submitted that the Article 12 and 13 Infringements “cannot reasonably be
regarded as negligent (or careless)” by reference to submissions falling with the categories of Careful
and Good Faith Efforts Submissions, the New and Subjective Views Submissions and the Nuanced
Nature of Assessment Submissions. I do not agree with WhatsApp, for the reasons set out within my
assessment of the Submissions on Recurring Themes.
745. Inrelation tothe Article12and14 Infringements, WhatsAppobjectstomy conclusion thatthisaspect
of matters “demonstrates a high degree of negligence as regards WhatsApp’s obligations to non-
users”. It further objects to the inclusion of reference to “materials from the 2012 Investigation”. It
376
submits , in this regard, that:
a. “As a purely procedural matter, this is not appropriate given findings in the 2012 Investigation
were not previously raised as part of the Inquiry process”; and
b. “In any event, the 2012 Investigation occurred eight years ago in relation to a different data
controller (WhatsApp Inc.), pre-dated the GDPR, and was notably before the ruling in Breyer
on which the Commission expressly relies on in this Inquiry.”
377
746. WhatsApp considers , in this regard, that:
“the Commission’s reliance on the 2012 Investigation is misplaced and … should be disregarded
entirely by the Commission … . Given this misplaced reliance on the 2012 Investigation, the
Commission’s provisional finding of negligence in relation to the alleged Article 14 Infringement is
378
without foundation and similarly must be reversed .”
376
377The Supplemental Draft Submissions, paragraph 6.5(A), (B) and (C)
It is further important to note that the Board took account of this submission (in circumstances where WhatsApp
included it in its Article 65 Submissions) when determining the objections raised by the CSAs in relation to the
characterisation of the infringements. See paragraph 381 of the Article 65 Decision, in this regard.
378The Supplemental Draft Submission, paragraph 6.6
213747. While I accept that the significance of the outcome of the 2012 Investigation was not previously put
to WhatsApp prior to it being given the opportunity to respond to same as part of the Supplemental
Draft, this is because it was not relevant to the examination of the extent to which WhatsApp has
379
complied with its obligations pursuant to Articles 12 – 14. As previously explained to WhatsApp,
the role of the investigator is limited to infringement only; he/she is not entitled to consider or make
recommendations concerning the proposed exercise of corrective powers. Given that the 2012
Investigation is only relevant to the considerations arising in this Part 5, it could only have been put
to WhatsApp as part of the Supplemental Draft.
380
748. As regards WhatsApp’s submissions in relation to the relevance of the findings of the 2012
Investigation to the within assessment, I acknowledge that it may well be the case that the hashing
process described in the reports of the 2012 Investigation may be different to that assessed in the
context of the within inquiry. To be clear, however, the significance of the findings of the 2012
Investigation, in this regard, is that WhatsApp was on notice (via its parent company) of the fact that
both the OCO and CBP considered the mobile phone number of an individual to constitute the
personal data of that individual.
749. While I note that the 2012 Investigation occurred eight years ago and predated both the GDPR and
Breyer, it is nonetheless appropriate for me to have regard to it, particularly in relation to the status
of a non-user mobile phone number. I note, in this regard, that the concept of personal data has not
changed, as between the Directive and the GDPR. Further, it is irrelevant that it predated Breyer in
circumstances where the basis for the CBP’s conclusion appears to be materially identical to the one
recorded in Part 1 of this Decision (while I have considered the application of Breyer, as part of the
relevant assessment, this was for the sake of completeness only). I do not agree that the difference
is such that I cannot have regard to the 2012 Investigation. WhatsApp Inc. is WhatsApp’s parent
company and, in these circumstances, WhatsApp ought to have known of the position and of its
significance in the context of the continued operation of the Contact Feature.
750. Finally, and to be absolutely clear about the position, the relevant aspect of the 2012 Investigation is
only significant insofar as it suggests that WhatsApp ought to have known (via its parent company)
that an EU data protection authority, operating within the previous EU data protection framework,
considered the mobile phone number of a non-user to constitute personal data. In terms of the
weight that I have attributed to this, that weight is limited only to my assessment of whether or not
the Infringements might appropriately be classified as negligent. My view, as set out above, is that,
quite aside from the issue of the 2012 Investigation, the extent of non-compliance found suggests a
degree of carelessness (i.e. negligence) on the part of WhatsApp. The impact of the relevant aspect
of the 2012 Investigation on this assessment is that I consider the degree of carelessness (negligence)
arising to be at the higher end of the scale. As already observed, my view is that the inclusion of
transparency as part of (i) the Article 5 data processing principles; and (ii) the data subject rights
necessitates particular care and attention on the part of a data controller. In WhatsApp’s case, it has
fallen particularly short in respect of its obligations to non-users. My view is that it ought to have
known, from the outcome of the 2012 Investigation, that its views, as to the status of non-user
numbers, would likely not be endorsed by a data protection authority. In these circumstances, it is
379By way of the letter dated 19 February 2020 from the Commission to WhatsApp
380The Supplemental Draft Submissions, paragraph 6.5
214 questionable why it did noterr on the side of caution and include more information, in relation tothe
mannerofoperationof theContactFeature,initsPrivacyPolicy. Inote, inthisregard,thatWhatsApp
already provides additional information to non-users, on request (i.e. in response to any non-user
attemptingtoexerciseadatasubjectright. Fortheavoidanceofdoubt,Ihavenotassessedtheextent
of information so provided and, accordingly, nothing in this Decision should be understood as
acceptance of the sufficiency of such additional information that might be provided). Otherwise, I
have not had regard to, nor taken account of, the outcome of the 2012 Investigation as part of my
assessment of any other aspect of the Article 83(2) criteria.
751. For the avoidance of doubt, I also consider the Article 5 infringement to be negligent in character on
the basis that it does not meet the threshold of being intentional in nature (and the extent of non-
compliance with the transparency obligation is such that the infringement cannot be characterised as
anything less than negligent).
Article 83(2)(c): any action taken by the controller or processor to mitigate the damage suffered by
data subjects
752. The purpose of the within inquiry is to determine whether or not WhatsApp’s approach to
transparency satisfies the requirements of the GDPR. WhatsApp’s position is that its approach to
transparency complies, in full, with the GDPR. Notwithstanding my disagreement with this position,
Iacceptthatitrepresentsagenuinelyheldbelief,onWhatsApp’spart. Onthisbasis,itwouldarguably
be unfair to criticize WhatsApp for failing to take action to mitigate the damage suffered as a result
of the Infringements, particularly where WhatsApp’s position is that no infringement has occurred
and, accordingly, no damage has been suffered by data subjects.
WhatsApp’s Response and Assessment of Decision-Maker
381
753. WhatsApp has submitted that I have not provided any evidence that could support a finding that
damage has been suffered by data subjects. I have already addressed, as part of my assessment of
the Theoretical Risk Submissions, the risks arising from the proposed Infringements and the
consequent non-material damage (loss of control over personal data and the inability to make a fully
informed choice) that flows from that.
754. WhatsApp further submits 382that I have not had due regard to the substantial efforts undertaken by
WhatsApp to achieve compliance. I have already considered the substance of these submissions, as
part of my assessment of the Careful and Good Faith Efforts Submissions. I am unable to attribute
weight to such matters, as a mitigating factor for the purpose of this particular aspect of assessment,
in circumstances where this assessment is directed to the action taken to mitigate the damage
suffered (the focus of the Careful and Good Faith Efforts Submissions is on the efforts made by
WhatsApp to achieve compliance, i.e. the efforts made prior to infringement).
755. It further submits 383that I have not considered WhatsApp’s proposed actions to address the issues
raised in the Preliminary Draft Submissions or the fact that WhatsApp volunteered to take such
actions as soon as it became aware of the expectations which the Commission has articulated during
the course of the within inquiry.
381The Supplemental Draft Submissions, paragraph 7.1
382The Supplemental Draft Submissions, paragraph 7.1
383The Supplemental Draft Submissions, paragraph 7.2
215756. I have already explained, aspart of my assessment of the New and Subjective Views Submissions, the
reasons why I do not agree that the views expressed in Parts 2 and 3 of this Decision can properly be
described as ‘newly articulated’. In relation to WhatsApp’s proposed actions to address the issues
raised, I can, and will, later in this Part 5, attribute weight to WhatsApp’s willingness to amend its
Privacy Policy and related material, on a voluntary basis. I further note, in thisregard, that WhatsApp
has taken steps beyond merely volunteering to change, in that it has already amended the relevant
material. In terms of the weight that may be so attributed, it is limited by reference to (i) my view
that there is no reason why WhatsApp could not have properly formulated its Privacy Policy and
related material on the basis of the text of Articles 12 – 14, as supported by the Transparency
Guidelines; and (ii) WhatsApphasonlyjust(asof December2020)beguntoimplementthose changes
(for the avoidance of doubt, I make no comment as to the sufficiency or otherwise of any such
changes).
Article 83(2)(d): the degree of responsibility of the controller or processor taking into account
technical and organisational measures implemented by them pursuant to Articles 25 and 32
757. The Fining Guidelines provides, in this regard, that:
“The question thatthe supervisoryauthoritymustthen answer isto whatextentthe controller “did
what it could be expected to do” given the nature, the purposes or the size of the processing, seen
in light of the obligations imposed on them by the Regulation.”
758. I note that, as regards all four Infringements, while WhatsApp made some effort to communicate the
prescribed information to its users, it made no such effort in the context of non-users on the basis
that it processed non-user data, as a processor, on behalf of its users. I further note that WhatsApp
does notappear tohave made any efforttocommunicate itsposition toitsuserssuch thatthey could
consider their responsibilities as alleged controllers (it is important to note, in this regard, that I have
not made any determination as to whether or not an individual user might properly be classified as a
data controller, in this context). This lack of communication was an unfortunate oversight given that
the users in question signed up for, and used, the Service as consumers, rather than business users,
and are unlikely to have anticipated that WhatsApp considered them to be the data controllers of
non-user data.
WhatsApp’s Response and Assessment of Decision-Maker
384
759. WhatsApp has submitted that any criticism of its failure to inform non-users that it processes non-
userdata,asaprocessorontheirbehalf,suchthattheymightconsidertheirresponsibilitiesasalleged
(or potential) controllers, is inappropriate in circumstances where its users are exempt from the
application of the GDPR “due to the household exemption at Article 2(2)(c) GDPR”. WhatsApp has
submitted, in this regard, that it would be inappropriate for WhatsApp to inform users that they have
any obligations under GDPR when they do not.
760. My view on this is that a determination as to whether or not the “household exemption” can be said
to apply to the processing carried out, by way of any individual user, cannot be made in the absence
of an assessment of the circumstances of processing in the particular case. In note, in this regard,
384The Supplemental Draft Submissions, paragraph 8.1
216 thatthe exemption only applieswherethe processingiscarriedoutbya naturalperson “in thecourse
of a purely personal or household activity”. While I accept that, for the most part, this is indeed likely
to be the case, it cannot be said that it will apply in each and every case. It is possible, for example,
that some individuals might use the Service to communicate with groups in connection with their
work or, otherwise, to help organise events on behalf of a club. By informing users of WhatsApp’s
position (and, again, I emphasise that I am by no means endorsing such a position, that being a
separate matter which does not fall for determination in these circumstances), it ensures that the
users concerned are made aware of the position such that they might consider whether they have
GDPRresponsibilitiesornot. Inthecircumstances,Idisagreethatitisinappropriateformetocriticise
WhatsApp for failing to have made its position clear, in this regard.
761. WhatsApphasfurther submitted thatthe Privacy Policy does provide information tousersabouthow
it processes non-user data. My views, in this regard, are already set out as part of my assessment of
the Binary Approach Submissions. In summary, I am of the view the information provided is wholly
insufficient.
762. WhatsApp further relies on the “extensive technical measures which were designed by WhatsApp to
ensure this data (i.e. non-user contacts uploaded from user’ devices) is stored and used in a highly
privacy protective manner 38”. As set out above, the issue for determination, under this heading, is
the extent to which the controller “did what it could be expected to do”. While it is clear that
WhatsApp has implemented measures to help protect the personal data during the course of
processing (and I have taken this into account as part of my assessment of the Article 82(2)(a)
criterion), such measures do not address its transparency obligations to non-users. In the
circumstances, I am unable to attribute weight to this, as a mitigating factor in this particular context.
763. WhatsApp also submits that account should be taken of “the efforts it undertook to comply with its
transparency obligations” which, it suggests, “exceed what was required of a controller and aligns
with the approaches adopted by industry peers”. My views, on both of these categories of
submissions, have been set out within my assessment of the Submissions on Recurring Themes, set
out at paragraphs 599 to 665, above. For the reasons already explained, I am unable to attribute
weight, as a mitigating factor for the purpose of this Part 5, to any submissions made on the basis of
parity with industry peers or industry standards. I have also set out my views, as part of my
consideration of the Carefuland Good Faith EffortsSubmissions, astothe extentof weightthatmight
be attributed to this particular factor, in the context of this Part 5. I have already taken account of
such matters as part of my assessment of Article 83(2)(c). My view is that it is not appropriate for me
to give weight to that particular factor within this particular aspect of the Article 83(2) assessment.
Article 83(2)(e): any relevant previous infringements by the controller or processor
764. There are no such previous infringements by WhatsApp under the GDPR.
WhatsApp’s Response and Assessment of Decision-Maker
386
765. WhatsApp submits that the fact that it has never infringed the GDPR must be taken into account
as a mitigating factor. I disagree with this suggestion. The Article 83(2) criteria are simply matters
385The Supplemental Draft Submissions, paragraph 8.3
386The Supplemental Draft Submissions, paragraph 9.1
217 that I must consider when deciding whether to impose an administrative fine and, if so, the amount
of thatfine. TheArticle83(2) criteriaarenotbinaryinnature,such that,when assessed inthe context
of the circumstances of infringement, they must be found to be either a mitigating or an aggravating
factor. The position is similar, in this regard, to the position advanced by WhatsApp in response to
my assessment of Article 83(2)(b).
766. Accordingly, it does not follow that the absence of a history of infringement must be taken into
account as a mitigating factor. This is particularly the case where the GDPR has only been in force for
a relatively short period of time. On this basis, my view is that this is neither a mitigating factor nor
an aggravating one for the purpose of the within assessment.
767. By way of the Article 65 Submissions, WhatsApp further sought to rely on (what it considered to be)
an inconsistency in the approach taken by the Commission to this particular criterion in other of the
387
Commission’s inquiries . I have already addressed those submissions at paragraphs 668 and 669,
above.
Article 83(2)(f): the degree of cooperation with the supervisory authority, in order to remedy the
infringement and mitigate the possible adverse effects of the infringement
768. The Fining Guidelines provide, in this regard, that:
“… it would not be appropriate to give additional regard to cooperation that is already required by
law for example, the entity is in any case required to allow the supervisory authority access to
premises for audits/inspection.”
769. While WhatsApp has cooperated fully with the Commission at all stages of the within inquiry, it is
required to do so by law. Further, I note that the cooperation that would be relevant to the
assessment of this criterion is cooperation “in order to remedy the infringement and mitigate the
possible adverse effects of the infringement”. In the circumstances, nothing arises for assessment by
reference to this criterion.
WhatsApp’s Response and Assessment of Decision-Maker
770. WhatsAppfirstly disagreesthatitscooperationduringthe course of inquiryisnotsomethingthatmay
be taken into account under this heading. My position on this is as already outlined. Further, as set
out above, within the Article 83(2)(e) assessment, it is not the case that each individual assessment
of the Article 83(2) criteria must result in a position whereby the output of the assessment must
conclude whether the particular matter applies as a mitigating factor or an aggravating factor.
771. WhatsApp has made further submissions that fall within the categories of the Careful and Good Faith
Efforts Submissions, the Willingness to Change Submissions and the New and Subjective Views
Submissions. My views, on each of these categories of submissions, have been set out within my
assessment of the Submissions on Recurring Themes. For the reasons already explained, I am unable
to attribute weight, as a mitigating factor for the purpose of this Part 5, to the matters raised under
the New and Subjective Views Submissions or any aspect of the Careful and Good Faith Efforts
Submissions that concern WhatsApp’s pre-GDPR engagement with the Commission.
387The Article 65 Submissions, paragraphs 41.3(C) and 39.27
218772. I can, however, take account, as a mitigating factor, of WhatsApp’s willingness to change its relevant
policies and the fact that it has already taken active steps, to that end. I note that those steps are
directed towardsremedyingthe Infringementssoitisappropriate thatI take themintoaccounthere.
As to the weight that I might attribute to this, as a mitigating factor, I am somewhat limited by the
fact that WhatsApp has only just (as of December 2020) begun to implement those changes (and, for
the avoidance of doubt, I make no comment as to the sufficiency or otherwise of any such changes).
773. By way of the Article 65 Submissions, WhatsApp further sought to rely on (what it considered to be)
an inconsistency in the approach taken by the Commission to this particular criterion in other of the
Commission’s inquiries 38. I have already addressed those submissions at paragraphs 668 and 669,
above.
Article 83(2)(g): the categories of personal data affected by the infringement
774. As set out above, the categories of personal data concerned are not extensive and do not include any
special category data. In the case of non-users, the processing is limited to a mobile phone number
(which, when converted to a Hash Value, is stored in the Non-User List in conjunction with the details
of the derivative user 38).
Article 83(2)(h): the manner in which the infringement became known to the supervisory authority,
in particular whether, and if so to what extent, the controller or processor notified the infringement
775. The matters giving rise to the Infringements became known to the Commission as a result of an own-
volition inquiry. The subject matter of these Infringements did not give rise to any obligation for
WhatsApp to make a formal notification to the Commission.
WhatsApp’s Response and Assessment of Decision-Maker
776. WhatsApp submits that the fact that the within inquiry is of an own-volition nature “should have no
bearing on whether to impose an administrative fine or on the amount of the proposed fine,
particularly in the circumstances of this Inquiry 39”.
777. In reflecting that this is an own-volition inquiry, as part of my assessment in the Supplemental Draft,
I was making the point that the circumstances of (the then proposed) Infringements did not give rise
to any obligation, on the part of WhatsApp, to notify the matter to the Commission. As before, it is
not necessarily the case that each individual assessment carried out for the purpose of Article 83(2)
must result in a conclusion that the matter arising is either an aggravating factor or a mitigating one.
My view is that nothing arises for consideration under this heading; in other words, this is neither an
aggravating factor nor a mitigating one for the purpose of the within assessment.
778. WhatsApp has made further submissions that fall within the categories of the Careful and Good Faith
Efforts Submissions (directed to WhatsApp’s pre-GPDR engagement with the Commission only). I
388The Article 65 Submissions, paragraphs 41.3(D) and 39.26
389I note, in this regard, the Board’s determination, as recorded in paragraph 156 of the Article 65 Decision, that the Hash
Value, when stored in the Non-User List in conjunction with the details of the derivative user, constitutes personal data.
390The Supplemental Draft Submissions, paragraph 12.1
219 have already explained the reasons why I am unable to attribute weight, as a mitigating factor for the
purpose of this Part 5, to the matters raised.
Article 83(2)(i): where measures referred to in Article 58(2) have previously been ordered against the
controller or processor concerned with regard to the same subject-matter, compliance with those
measures
779. No such measures have previously been ordered against WhatsApp.
WhatsApp’s Response and Assessment of Decision-Maker
391
780. WhatsApp has submitted that the fact that it has never been subject to a finding of infringement
of the GDPR and has never been ordered to take corrective action must be taken into account, as a
mitigating factor.
781. As previously explained, it is not necessarily the case that each individual assessment carried out for
the purpose ofArticle83(2) mustresultina conclusion thatthe matter arisingiseither anaggravating
factor or a mitigating one. My view is that nothing arises for consideration under this heading; in
other words, this is neither an aggravating factor nor a mitigating one for the purpose of the within
assessment. In any event, as I have already referred to above, I do not consider that the practice of
industry peers is relevant to the assessment of an individual controller’s compliance with its GDPR
obligations. Similarly, I have also previously stated my position that, in light of the deficiencies in
WhatsApp’s approach to transparency, I do not consider that WhatsApp has adhered to the
Transparency Guidelines.
Article 83(2)(j): adherence to approved codes of conduct pursuant to Article 40 or approved
certification mechanisms pursuant to Article 42
782. Such considerations do not arise in this particular case.
WhatsApp’s Response and Assessment of Decision-Maker
783. WhatsApp has submitted, in this regard, that:
“While WhatsApp has not adhered to codes of conduct or certifications (because none exist),
WhatsApp considers that its approach to transparency aligns with the approach adopted by
industry peers interms of compliance with the transparency requirements of the GDPR. Moreover,
WhatsApp considers that it complies with all published guidance, including the Transparency
Guidelines. WhatsAppsubmitsthatthesemattersshouldbemitigatingfactorsintheCommission’s
392
assessment .”
784. As previously explained, it is not necessarily the case that each individual assessment carried out for
the purpose ofArticle83(2)mustresultina conclusion thatthe matter arisingiseither anaggravating
factor or a mitigating one. My view is that nothing arises for consideration under this heading; in
391The Supplemental Draft Submissions, paragraph 13.1
392The Supplemental Draft Submissions, paragraph 14.1
220 other words, this is neither an aggravating factor nor a mitigating one for the purpose of the within
assessment.
Article 83(2)(k): any other aggravating or mitigating factor applicable to the circumstances of the
case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement
785. The relevant considerations arising under this heading are as follows:
a. WhatsApp does not charge users in the context of the Service.
b. The Article 14 infringement relates to the processing of non-user data pursuant to the
activation, by users, of the Contact Feature. According to WhatsApp 39, the Contact Feature
is a “popular” voluntary feature of the Service. Non-user data is processed by way of the
Contact Feature so as to be able to “quickly and conveniently update [a user’s] contacts list on
394
the Service as and when any of those non-users join the Service .” In this way, the Contact
Feature envisages, and is directed to facilitating, the continued growth of WhatsApp’s user-
base.
c. While the continued growth of WhatsApp’s user-base will not necessarily result in a direct
financial benefit in the form of new subscription fees, it will increase WhatsApp’s presence on
the market and thereby potentially increase its value. I note, in this regard, the information
395
provided in the Facebook FAQ , that:
“We can also count how many unique users WhatsApp has … . This will help WhatsApp
more completely report the activity on our service, including to investors and
regulators.” [emphasis added]
d. Thequestionthatarises,therefore,iswhetherornotamoretransparentapproachtothedata
protection issues arising in the context of the Contact Feature would have a positive, negative
or neutral effect on the continued growth of WhatsApp’s user base. I expressed the view, in
the Supplemental Draft, that a more transparent approach to the Contact Feature would
represent a risk factor for the continued growth of WhatsApp’s user base in circumstances
where existing and prospective users might be encouraged, by concerned non-users, to opt
for an alternative service that does not process the personal data of non-users.
WhatsApp’s Response and Assessment of Decision-Maker
786. In response, WhatsApp submits 396that the “reasoning that a more transparent approach would
represent a risk factor to the continued growth of WhatsApp’s user base is not supported by any
evidence, and appears to be based on a number of incorrect assumptions.”. It submits, in this regard,
that:
a. No account appears to have been taken of the fact that users themselves are free to choose
whether or not to use the Contact Feature as part of the Service.
393
Response to Investigator’s Questions, WhatsApp’s answer to question 3
394Response to Investigator’s Questions, WhatsApp’s answer to question 3a.
395Available at https://faq.whatsapp.com/general/26000112/?eea=1 (the “Facebook FAQ”)
396The Supplemental Draft Submissions, paragraphs 15.2 to 15.6 (inclusive)
221 b. “Moreover, in order to conclude that a significant proportion of non-users have decided not to
use the Service on the basis of privacy concerns, and so would be unhappy that WhatsApp
processes their data, the Commission has sought to rely on assertions made in a 2014 article
on the website techcrunch.com, which itself was re-reporting a single article, focusing on
Germany, on the website of Suddeutsche Zeitung. This article asserted that some people may
have been looking for alternative messaging services in the days following the announcement
on19 February2014 thatFacebookwasacquiring WhatsAppInc. Contrarytothe unsupported
assertions contained in these 2014 articles, according to the data retained from this period,
WhatsApp has found no statistically significant variation in account registrations in Germany
in the days following 19 February 2014. Indeed, when numbers across the EEA and UK are
considered it would seem that the announcement of this acquisition coincided with an overall
increase in new account registrations 39.”
c. A footnote to the above paragraph clarifies, in this regard, that “(w)hile the data retained by
WhatsApp does not include data regarding account deletions, WhatsApp’s review of
registrationsfromthisperiodshowthatnewuseregistrationsincreasedimmediatelyfollowing
the announcement, to significantly above the average daily registrations for 2014, on 20
February 2014.”
d. WhatsApp further submits that, in anyevent, such allegations should not have been raised for
the first time at the corrective measures decision-making stage.
e. WhatsApp has further made it clear that it intends to improve the “educational information”
that it provides to users in relation to the Contact Feature. WhatsApp does not expect this to
result in a decline in the number of users, to slow the growth of users or to impact on the
valueofthebusinessinanyway. WhatsApp’spositionisthat,if,infact,itweretohavefurther
explained the manner inwhichitprocesses non-usersphone numbersvia the ContactFeature
publicly “(i.e. in addition to what is already said in this respect in its Privacy Policy)”, given the
highly privacy protective manner of the relevant processing, it is likely that non-users would
have been reassured by the way in which their information is processed by WhatsApp. This,
WhatsApp submits, “if anything, would have supported the Service’s further growth.”
787. For the reasons outlined above, WhatsApp’s view is that the conclusion originally outlined should be
removed.
788. I note thatthe“conclusion”underchallengewastheconclusion thatIreached, onapreliminarybasis,
as regards whether or not a more transparent approach to the data protection issues arising in the
context of the Contact Feature would have a positive, negative or neutral effect on the continued
growth of WhatsApp’s user base. I provisionally concluded that a more transparent approach would
represent a risk factor on the basis that existing and prospective users “might be encouraged” by
concerned non-users to seek out an alternative service that does not process the personal data of
non-users.
397The Supplemental Draft Submissions, paragraph 15.3
222789. WhatsApp appears to have correlated the above (proposed) conclusion with the article referenced
within the Article 83(2)(a) assessment (in the part dedicated to consideration of the “level of damage
suffered” by data subjects). The article was referenced, within that aspect of the assessment, to
illustrate one way in which a data subject may exercise control over his/her personal data. In the
examplepresented,thedatasubjectsexercisedcontrolbychoosinganalternativeservice. Thearticle
itself was not taken into account within the Article 83(2)(a) assessment; indeed, it could not possibly
have been since it did not concern the within inquiry nor the (then proposed) Infringements.
790. Returning to the matter under assessment, I made no reference whatsoever to the article in my
preliminary assessment of Article 83(2)(k). I formed my view on the basis that it is not clear, from the
Privacy Policy or related material, that the activation of the Contact Feature will result in WhatsApp
processing the mobile phone numbers of non-users. Neither is it clear how, or for how long,
WhatsApp will process thatdata. Most significantly, theconsequences, for the non-user, crystallising
at the point in time at which he/she has joined the Service are not clearly set out. As WhatsApp has
acknowledged, non-users contact it to exercise their data subject rights, from time to time. Some of
those individuals, despite having been provided with further information about the processing that
takes place on non-user data, have gone on to lodge complaints with supervisory authorities. It is
therefore clear that, certainly for a cohort of non-users, the provision of further information, does
not satisfy their concerns.
791. WhatsApp has submitted that the provisional conclusion referred to above (which was originally set
out in the Supplemental Draft) does not take account of the fact that users themselves are free to
choose whether or not to use the Contact Feature as part of the Service. I take it that, by this
submission, WhatsApp is suggesting that a user could avail of the Service without activating the
Contact Feature. While this is, of course, a possibility, I note that this would limit the user’s ability to
communicate by way of the Service. In any event, I do not consider this argument to be persuasive
in circumstances where there is insufficient information for users concerning the impact of the
Contact Feature so as to enable them to make an informed choice as to whether to activate it.
792. Given that I did not reach my conclusion by reference to the article discussed by WhatsApp in its
submissions, I do not need to consider those submissions, in this context.
793. As regards the submission that it was the role of the Commission’s inquiry team to raise any such
“factual allegations”, I note that no such allegations were raised as part of my assessment under this
heading. Even if this were not the case, however, I have already explained that consideration of the
Article 83(2) factors is the sole preserve of the Decision-Maker; it is outside of the scope of the
investigator to consider matters beyond the question of whether or not an infringement has
occurred/is occurring.
794. I finally note WhatsApp’s submission that it intends to improve the “educational information” that it
provides to users in relation to the Contact Feature and that, in WhatsApp’s view, “it is likely” that
non-users would be reassured by the way in which their data is processed by WhatsApp. As already
observed, above, and as referred to by WhatsApp in its Supplemental Draft Submissions, there have
been cases whereby non-users, having received an explanation from WhatsApp as to the privacy
protective manner in which their personal data has been processed, have nonetheless lodged
complaints with a supervisory authority. It is therefore clear that, for this cohort of non-users, the
provision of additional information has not had the desired reassuring effect. I further question why,
223 if WhatsApp believes that the provision of this information would not only reassure non-users but
also support the Service’s further growth, it has not made publicly available the information that it
provides to individual non-users upon request.
795. In terms of how I might take account of WhatsApp’s submissions, above, I note that our respective
positions effectively cancel each other out. Neither I nor WhatsApp can know, until the contingent
event has happened, which one of us is correct in our belief as to the likely impact, on the continued
growth of the user base, of a more transparent approach to the data protection issues arising in the
context of the Contact Feature. For this reason, I will amend my previously proposed conclusion to
reflect that I am unable to predict the likely outcome of a more transparent approach on the
continued growth of WhatsApp’s user base.
398
796. WhatsApp has further submitted that:
“it is incorrect to claim that it was designed for the purpose of growing WhatsApp’s user base. For
example, the Contact Feature is not used as a way to somehow identify non-users in order to
promote WhatsApp’s services to them. Instead, it was designed to ensure the best possible
experience for existing users.”
797. Therelevantassessmentdidnotcontain any such claim. The assessmentclearly records my viewthat
the Contact Feature “envisages” – which it does – and “is directed to facilitating” – which it also does
– the continued growth of WhatsApp’s user-base. I further note that the assessment did not contain
any suggestion that the Contact Feature might be used to “somehow identify non-users in order to
promoteWhatsApp’sservicetothem”. Inthecircumstances,itisnotnecessaryformetotakeaccount
of these particular submissions within my assessment.
798. WhatsApp also considers that I must take account of “the fact that [WhatsApp] already publicly
explains that it accesses non-user data in its Privacy Policy … which in itself undermines the
Commission’sconclusioninthis regard.” Ihavealreadyset outmyviewthattheinformation provided
byWhatsApp,inthisregard,iswhollyinsufficient. Accordingly,andforthereasonsthatareexplained
further in my assessment of the Submissions on Recurring Themes, I am unable to take account of
this submission, as a mitigating factor for the purpose of this aspect of my assessment.
799. Finally, WhatsApp submits that I should take account, as a mitigating factor, of the fact that “no
399
material financial gains were made in relation to the alleged infringements at issue ”. As previously
explained, it is not necessarily the case that each individual assessment carried out for the purpose
of Article 83(2) must result in a conclusion that the matter arising is either an aggravating factor or a
mitigating one. In having departed from my previous assessment and having now reached a
conclusion where I amunable todetermine the impactthata more transparentapproach would have
onthecontinuedgrowthofWhatsApp’suserbase,myviewisthatthisisneitheranaggravatingfactor
nor a mitigating one for the purpose of the within assessment.
398The Supplemental Draft Submissions, paragraph 15.7
399The Supplemental Draft Submissions, paragraph 15.7
224d. The above assessments take account of the limited nature and scope of the processing in
question. I note that, in the case of non-users, technical measureshave been implemented to
protectthe data inquestion and the processing, while limited inscope and nature, takesplace
“on a regular basis” and the resulting lossy hash value appears to be stored indefinitely on
WhatsApp’s servers. I further note that this processing is directed towards enhancing
connectivity for users and provides no benefit to the non-user. While I consider the limited
nature and scope of the processing to be a mitigating factor, I am unable to attribute
significant weight to it given the seriousness of the Infringements, particularly in relation to
non-users.
e. Intermsof the character of the Infringements, myview isthatthey eachoughttobe classified
as negligent. Such a classification, in my view, reflects carelessness on the part of the
controller or processor concerned. While I recognise, in respect of the Article 12 and 13
infringements, that WhatsApp has made efforts towards achieving compliance with
obligations arising (I note, for example, that WhatsApp engaged experts and carried out
research when considering how best to meet its transparency obligations to users), those
efforts did not achieve their objective (i.e. compliance). The shortfall (which I have assessed
to be 59% of the information prescribed by Article 13), in this regard, is significant. The
requirements of these provisions are not complex: a data controller is simply required to
provide the information listed in Article 13 in a clear and transparent manner. For an
organisation of WhatsApp’s size, reach and available internal and external resources, the
failure to achieve the required standard of transparency is, in my view, negligent.
f. As regards the Article 14 infringement, my view is that this demonstrates a high degree of
negligence, as regards WhatsApp’s obligations to non-users. I note, in this regard, that the
2012 Investigation included an assessment of the issues arising in relation to the processing
of non-user data for the purpose of the Contact Feature. I further note the CBP’s conclusion
that the mobile phone number of a non-user constituted the personal data of that non-user.
That ought to have put WhatsApp (via its parent company) on notice that a European data
protection authority was unlikely to agree with its position that it does not process personal
data relating to non-users. While I acknowledge WhatsApp’s submission that it has, at all
times, maintained that it does not process such data as a controller, I remain of the view that,
in having failed to put its users on notice of its position, WhatsApp has denied its users the
ability to consider their responsibilities as alleged (or potential) data controllers.
g. Accordingly, my view is that each of the Infringements should be characterised as negligent,
with the Article 14 infringement demonstrating a high degree of negligence, and taken into
account as an aggravating factor for the purpose of the Article 83(2) assessment. The Article
5infringementmustalsobecharacterisedasdemonstratingahighdegreeofnegligence,given
the very significant information deficit (for both users and non-users) and its consequent
negative impact on the fairness of the processing carried out by WhatsApp on the personal
data of both users and non-users.
h. By reference to Article 83(2)(d), my view is that the matters arising under this heading are a
further aggravating factor, in the case of non-users, given the total failure to provide the
required information. While the provision of 41% of the prescribed information to users
226 mitigates the position somewhat (in relation to the Article 12 and 13 Infringements only), my
viewisthatWhatsAppfellsignificantlyshort ofwhatitmighthavebeenexpectedtodo. Given
thatArticle 5 underpinsall ofthe obligationsarisingpursuanttoArticles12 –14, itisclear that
the matters arising for assessment pursuant to Article 83(2)(d) are a significant aggravating
factor in the context of the Article 5 infringement.
i. The only mitigating factors, in my view, are, firstly, the limited categories of personal data
undergoing processing, particularly in the case of non-users, and, secondly, WhatsApp’s
willingness to amend its Privacy Policy and related material. I am unable, however, to
attribute significant weight to either of these factors, given the overall seriousness and
severity of the Infringements (both collectively and individually) and in light of the fact that
WhatsApp has only just (as of December 2020) begun to implement changes to its Privacy
Policy and related material (for the avoidance of doubt, I make no comment as to the
sufficiency or otherwise of any such changes).
j. For the sake of completeness, I have also considered whether or not the imposition of an
administrative fine is appropriate, necessary and proportionate, in the light of Recital 129 of
the GPDR, read in conjunction with, amongst others, Article 83. I have already decided to
impose a reprimand in conjunction with an order to bring processing operations into
compliance in the terms set out at Appendix C so as to (i) formally recognise the fact of
infringement and (ii) ensure that WhatsApp takes the remedial action required, respectively.
This action, however, lacks real efficacy in terms of its punitive and deterrent effect and,
accordingly, it is appropriate, necessary and proportionate for me to conclude that a fine
should be imposed in addition to those other measures.
801. On the basis of the clear analysis that I have identified and set out above, the nature, gravity and
duration of the Infringements and the potential number of data subjects affected, I have decided to
impose the following administrative fines:
a. In respect of the infringement of Article 12, a fine of between €30 million and €55 million.
b. In respect of the infringement of Article 13, a fine of between €30 million and €55 million.
c. In respect of the infringement of Article 14, a fine of between €75 million and €100 million.
d. In respect of the infringement of Article 5, a fine of between €90 million and 115 million.
802. In having determined the quantum of the fines proposed above, I have taken account of the
requirement,setoutinArticle83(1),forfinesimposedtobe“effective,proportionateanddissuasive”
in each individual case. My view is that, in order for any fine to be “effective”, it must reflect the
circumstances of the individual case. As already discussed above, the Infringements (collectively and
individually)areveryserious,bothintermsoftheextremelylargenumberofdatasubjectspotentially
affected and the severe consequences that flow from the failure to comply with the transparency
requirements (with particular reference to the impact of the Article 14 infringement on non-users).
803. In order for a fine to be “dissuasive”, it must dissuade both the controller/processor concerned as
well as other controllers/processors carrying out similar processing operations from repeating the
227 application and enforcement of its provisions. To that end, I note that, by way of decision dated 21
January 2019, the French Data Protection Authority (the Commission Nationale de l’Informatique et
des Libertés) (“the CNIL”) imposed a fine of €50 million on Google LLC in respect of infringements of
421
Articles 6, 12 and 13 (“the CNIL Decision”). The CNIL Decision, to which I have had regard solely
for the purposes of the consistency principle, records three specific findings as follows:
810. Finding 1: “there is an overall lack of accessibility to the information provided by the company in the
context of the processing in question 42”. The issues referenced in the assessment that resulted in
this finding included the deciding body’s views that:
a. The information provided was “excessively spread out across several documents … [with]
buttons and links that must be activated to learn additional information … [and the]
423
fragmentation of information ”
b. “Some information is difficult to find”, for example “information relating to personalised
advertising and … geolocation” and “retention periods” 424
811. Finding 2: “… there has been a breach of the transparency and information obligationsas provided for
in Articles 12 and 13 …” 425. The issues referenced in the assessment that resulted in this finding
included the deciding body’s views that:
a. The information provided “does not allow users to sufficiently understand the particular
426
consequences of the processing for them ”. The examples cited include:
i. “the description of the purposes pursued 427”
ii. “the description of the data collected 428”
429
iii. “the legal basis of the personalised advertising processing ”
iv. The lack of clarity as regards the legal basis being relied upon for particular processing
operations 430
431
v. “retention periods ”
812. Finding 3: “the consent on which the company bases personalised advertising processing is not validly
432
obtained. ” I note that this finding is not relevant to the within inquiry.
813. The CNIL Decision further records the factors taken into account when considering the imposition of
a sanction, as follows:
421“Deliberation of the Restricted Committee SAN-2019-001 of 21 January 2019 pronouncing a financial sanction against
422GLE LLC” available at https://www.cnil.fr/sites/default/files/atoms/files/san-2019-001.pdf (“the CNIL Decision”)
Ibid, paragraph 103
423Ibid, paragraph 97
424Ibid, paragraphs 98, 101 and 102
425
Ibid, paragraph 128
426Ibid, paragraph 111
427Ibid, paragraph 113
428Ibid, paragraph 114
429
Ibid, paragraph 117
430Ibid, paragraph 118
431Ibid, paragraph 120
432Ibid, paragraph 167
233 a. In respect of the nature of the infringements, the deciding body noted that Articles 6, 12 and
433
13 are central/essential provisions that enable people to maintain control of their data .
b. In terms of duration, the decision noted that the infringement was ongoing 434.
c. In terms of the number of data subjects affected by the infringement, the decision suggested
that “the data of millions of users is processed by the company in this context” 435.
d. In terms of the processing concerned, the decision noted the “extensive processing
436
operations” taking place .
e. Finally, considering the responsibility of the company, the decision noted that “in view of the
benefits it derives from this processing, the company must pay particular attention … to its
437
responsibility under the GDPR” .
814. In addition to a fine of €50 million, the CNIL further imposed a complementary “penalty of
438
publicity” .
815. Considering the similarities between the CNIL’s Decision and the proposed outcome of the within
inquiry, I note that:
a. Both cases concern the infringement of three core provisions of the GDPR.
b. Both cases concern infringements of an ongoing nature.
c. Both cases concern high numbers of data subjects affected by the identified infringements.
While the CNIL’s Decision does not definitively identify the approximate number of data
subjects concerned, it includes indicators as to the potential numbers involved, e.g. “millions
of users 439”. I note, in this regard, that the CNIL Decision confirmed that, in 2016, “the
operating system totalled 27 million users in France 440”. For the purpose of providing an
approximate point of reference, the population of France, as at 1 January 2016, was
approximately 67 million 44. On this basis, the cited number of French users appears to
represent approximately 40% of the French population.
816. By way of distinguishing features, I note that:
a. The processing covered by the CNIL’s Decision was more extensive than the processing
operations that appear to be carried out by WhatsApp.
433
Ibid, paragraphs 176 and 177
434Ibid, paragraph 178
435Ibid, paragraph 181
436Ibid, paragraph 182
437
Ibid, paragraph 188
438Ibid, paragraph 189
439Ibid, paragraph 181
440Ibid, paragraph 4
441
https://ec.europa.eu/eurostat/tgm/table.do?tab=table&init=1&language=en&pcode=tps00001&plugin=1
234 b. While the nature of my findings, in relation to the transparency requirements, are materially
identical to Findings 1 and 2of the CNIL Decision, I have found, in this inquiry, that, inthe case
ofnon-users,noneoftheprescribedinformationhasbeenprovidedwhile,inthecaseofusers,
only 59% of the prescribed information has been provided. The within inquiry therefore
appears to concern a more severe level of non-compliance with the transparency
requirements than that recorded in the CNIL’s Decision.
c. The number of data subjects potentially impacted by the Infringements in the within inquiry
appears to be significantly higher than the numbers alluded to in the CNIL’s Decision (this
reflects the restricted geographical scope of the CNIL’s investigation, which was limited to
users based in France). Further, and most significantly, the Article 14 infringement concerns
an unquantifiable number of non-users. As set out above, this is a very significant factor for
the purpose of the Article 83(2) assessment, both in and of itself, and in terms of its
consequential impact on the assessment of the gravity of the Article 14 infringement.
817. I should emphasise that I note the CNIL Decision for the purposes of the consistency principle only.
The Decision is based on the evidence and submissions which I have considered, my assessment of
the same within the context of the legal framework of the GDPR and the Board findings, as set out in
the Article 65 Decision, which I am bound to follow.
818. Accordingly, in the Composite Draft, I confirmed that I was satisfied that the fines originally proposed
represented the consistency of approach required by the GDPR. I noted, in this regard, that the fines
in respect of the infringements of Articles 12 and 13 did not exceed the level of the fine imposed by
the CNIL Decision. While the quantum of the fines proposed in the context of the Article 5 and 14
infringements are significantly higher than that outlined in the CNIL’s Decision, this is appropriate in
view of the Board’s findings which I am bound to follow. The Board noted, in this regard, the extent
of non-compliance recorded in the Composite Draft, which included reference to:
a. The total failure to provide any information to non-users;
b. the consequent invalidation of the fundamental right of those non-users to exercise control
over their personal data;
c. the fact that the personal data of non-users is being processed by WhatsApp without their
knowledge and possibly against their wishes;
d. my views as to the highly negligent character of the Article 14 infringement, noting, in
particular, the outcome of the 2012 Investigation; and
e. the extent of the overall information deficit, for both users and non-users, and its negative
impact on the fairness of the processing carried out by WhatsApp.
WhatsApp’s Submissions and Assessment of Decision-Maker
235 442
819. WhatsApp has submitted that “nowhere in the Supplemental Draft does the Commission explain
how its assessment in relation to each of the Article 83(2) [criteria] has informed the level of the
proposed administrative fines.”
820. It has further submitted, in this regard, that:
“there is no discernible link apparent in the Supplemental Draft between the Commission’s
consideration of the Article 83(2) [criteria] and the subsequent determination of the level of the
proposed administrative fines. While the Commission sets out various considerations in relation to
the Article 83(2) [criteria], it does not explain how such considerations have influenced the
proposed ranges of the administrative fines. Consequently, WhatsApp lacks insight into the
Commission’s weighting of these factors in determining the proposed fines and this makes it
difficult for WhatsApp to meaningfully respond to the Commission’s determinations on
quantum 443.”
821. InotethattheGDPRissilent,asregardstheparticularprocessormethodologywhichtheCommission
should adopt in calculating any fine. As a matter of EU law, however, the Commission must take a
decision which allows the addressee to understand the basis for the fine and the effect of the Article
83(2) criteria44. As a matter of Irish domestic law, the Commission’s decision must be demonstrably
rational and not arbitrary. This requires the Commission to be able to explain how it arrived at the
level of the fine. Inthese circumstances, and inview of the lack of directGDPR guidance, itisrelevant
to examine the approach (where properly analogous) in EU competition law. This is the area of EU
law where fines are most commonly applied; Recital 150 of the GDPR further expressly invokes
Articles 101 and 102 TFEU, at least for the purpose of defining an undertaking.
822. Considering the position by reference to EU competition law fining regimes where the Competition
FiningGuidelinesdonotapply(asituationwhichissimilartothepresentsituationwherebynospecific
guidanceonthecalculationofGDPRfinesisavailable),InotethattheGeneralCourthasestablished 445
that:
“Where the [European] Commission has not adopted any guidelines setting out the method of
calculation which it is required to follow when setting fines under a particular provision and the
Commission’s reasoning is disclosed in a clear and unequivocal fashion in the contested decision,
the Commissionisnotrequired to express infigures, inabsolute terms orasa percentage, the basic
amount of the fine and any aggravating or mitigating circumstances.”
823. In terms of the fines proposed above, I am satisfied that I have set out the supporting reasoning in
clear and unequivocal terms, by reference to my analysis of the Article 83(2) criteria. In terms of the
figures selected, I note that the maximum fines permitted to be imposed pursuant to the GDPR are
set at a very high level. This clearly indicates that the GDPR contemplates robust and significant
penalties in appropriate cases. The fines proposed above reflect the nature and gravity of the
Infringements and satisfy the requirement, pursuant to Article 83(1), for fines to be “effective,
442The Supplemental Draft Submissions, paragraph 16.3
443
444The Supplemental Draft Submissions, paragraph 4.2
See, by analogy, HSBC Holdings plc and Others v Commission, T-105/17, ECLI:EU:T:2019:675, paragraphs 336 -354
445Marine Harvest ASA v European Commission, Case T-704/14, ECLI:EU:T:2017:753, judgment of General Court dated 26
October 2017, paragraph 455
236 proportionate and dissuasive”. I am further satisfied that the fine is no greater than required to
achieve deterrent effect, noting the industry in which WhatsApp operates, the extent of internal and
external resources available to it, WhatsApp’s submissions, as regards its parity of approach to
transparency with its industry peers and the instructions of the Board in its Article 65 Decision.
824. WhatsApp further submits that “the Commission’s attempt to draw any parallel between the current
Inquiry and the CNIL’s investigation into Google LLC is misplaced and inappropriate.” I do not agree
thatthisisthecase. IhaveconsideredWhatsApp’ssubmissions,asregardswhyitbelievestheGoogle
case to be distinguishable from the within Inquiry. I am satisfied, however, that it is appropriate for
me to consider the fines that I have decided to impose as against those imposed in the Google case.
I wish to take the opportunity to, again, emphasise that I have noted the CNIL Decision for the
purposes of the consistency principle only. I have not based my decision on it. To be absolutely clear
abouttheposition,thewithindecisionismyownandisbasedontheevidenceandsubmissionswhich
I have considered and my assessment of same within the context of the legal framework of the GDPR
as well as the instructions of the Board, further to its Article 65 Decision. Further, while I note
WhatsApp’s submission that I should give due regard to a wider range of decisions for this purpose,
WhatsApp will appreciate that the range of suitably analogous decisions is somewhat limited given
that the GDPR fining regime has only been in effect since 25 May 2018.
825. For the avoidance of doubt, I do not agree that the circumstances of the two decisions which have
beenspecificallycitedbyWhatsApparesuitablyanalogoustothecircumstancesofthewithinInquiry.
446
In relation to the CNIL’s Decision concerning SPARTOO SAS, I note that the data controller
concerned did not operate in every EU Member State; rather it operated sixteen websites within
thirteen EU Member States. Further, the findings of infringement found by the CNIL affected a
significantly smaller pool of data subjects; the decision records that the data controller concerned
had over 11 million customer accounts, over 30 million prospects (which I understand to mean
prospective customers) and approximately 1,000 employees. This is in direct contrast to WhatsApp,
which, as set out above, is the data controller for approximately 326 million data subjects in the EEA
(including the UK). This does not include the pool of affected non-users, which I have estimated to
be in the region of 125 million people.
826. In terms of the infringements found, the infringements concerned the breach of Articles 5(1)(c),
5(1)(e), 13 and 32 of the GDPR, arising from the processing of excessive customer data, the excessive
retention of customer/prospective customer data, the recording of calls between customers and
employees and the absence of security as regards passwords providing access to customer
accounts. In terms of the transparency aspect of infringement, the decision reflected the failure by
the data controller to comply with certain discrete obligations, namely to notify data subjects of
certain transfers of personal data outside of the EU, failure to identify the appropriate legal basis and
inadequateprovisionofinformationtoemployeesconcerningtherecordingoftheirdata. Incontrast,
the Infringements found in this Decision reflect a significant level of non-compliance in relation to
transparency. Asalreadyobserved,transparencyisoneofthecore(Article5)principlesthatunderpin
thefairprocessingofpersonaldataand,accordingly,theInfringementsimpactonalloftheprocessing
carried out by WhatsApp. In other words, the Infringements are not limited to certain categories of
data subjects or certain types of processing.
446Deliberation of the Restricted Committee SAN-2020-003 of 28 July 2020 relating to SPARTOO SAS
237827. In terms of the extent of data undergoing processing, while I note the CNIL’s concerns about the
sensitivities associated with financial (“bank”) data, the range of personal data undergoing
processing, while greater than the within case, is not such that it might be said to be a significantly
distinguishing factor. Further, the decision records that the CNIL took into account the measures
which the company implemented during the sanction proceedings to ensure partial compliance. As
already observed, while WhatsApp has been proactive in voluntarily amending its privacy policies, it
has only just begun (as of December 2020) to implement those changes (for the avoidance of doubt,
I make no comment as to the sufficiency or otherwise of any such changes). In the circumstances, I
am satisfied that this is not a suitably analogous decision, for consistency purposes. I further note
that, in addition to the imposition of an administrative fine, the CNIL further imposed an order to
bring processing operations into compliance along with an additional sanction of publication for a
period of two years.
447
828. As regards the decisions made by the Commission concerning Tusla (the Irish Child and Family
Agency), referenced in a footnote 448to the Supplemental Draft Submissions, WhatsApp correctly
notes that the circumstances of these decisions are “quite different” to the within inquiry. This, in
my view, is an understatement of the position, in that the circumstances of the decisions concerned
are completely different, in every respect, to the circumstances of the within inquiry. While the
nature of those breaches (which, in each case, was symptomatic of an infringement of Article 32(1),
and, in some cases, resulted in an infringement of Article 33(1)) was severe, the number of data
subjects affected, in each case, was limited to a small number of data subjects. Further, the
infringements of Article 32(1) affected specific aspects of the data controller’s operations. This is in
stark contrast to the circumstances of the within inquiry. While WhatsApp has observed that the
fines imposed 449“appear extremely low”, it is important to note that the 2018 Act imposes a limit of
€1,000,000, in terms of the maximum fine that may be imposed on a public body that does not act as
anundertaking. Further,theCommissionconsideredthatthelevelofthefinewassufficienttoensure
that it was “effective, proportionate and dissuasive” to the circumstances, noting, in this regard, the
limited budget of the organisation in question. The imposition of a higher fine, in the circumstances,
would not have achieved any greater deterrent effect.
829. Having completed my assessment of whether or not to impose a fine (and of the amount of any such
fine), I must now consider the remaining provisions of Article 83, with a view to ascertaining if there
are any factors that might require the adjustment of the proposed fines.
Assessment of any factors requiring the adjustment of the proposed fines
The Article 83(3) Limitation
830. Turning, firstly, to Article 83(3), I note that this provides that:
“If a controller or processor intentionally or negligently, for the same or linked processing
operations, infringes several provisions of this Regulation, the total amount of the administrative
fine shall not exceed the amount specified for the gravest infringement.”
447
Available at: https://dataprotection.ie/en/dpc-guidance/law/decisions-made-under-data-protection-act-2018
448The Supplemental Draft Submissions, footnote 92 (as referenced in paragraph 17.2(B))
449Noting that, as at the date hereof (23 December 2020), only the first (in time) of the fines imposed has been confirmed
by the Irish Courts, as required by Section 143 of the 2018 Act.
238 14. Each of those provisions are encompassed by Article 83(5) and, accordingly, the “total amount”
of the applicable fine shall not exceed the amount specified by Article 83(5).
WhatsApp’s response to the assessments recorded above and the response of the Decision-Maker
836. By way of submissions dated 19 August 2021 (“the Final Submissions”), WhatsApp exercised its right
to be heard in response to the Commission’s proposals arising from the Board’s instruction, requiring
it to reassess and increase the fine previously proposed by the Composite Draft, taking into account
the matters set out in Section 9.4 of the Article 65 Decision. To that end, WhatsApp was provided
with a copy of the relevant part of the working draft of the Commission’s amended decision (i.e. a
version of the Composite Draft that was in the process of being amended, for the purpose of
compliance with Article 65(6), to take account of the determinations made by the Board in its Article
65 Decision) (“the Extract”).
837. The Final Submissions sought to challenge the manner and outcome of the Commission’s
463
reassessment of the fine under five headings, as follows :
Heading 1: Failure to adequately address the Article 83(2) factors in respect of the fines proposed, with
particular reference to the Article 5(1)(a) infringement
838. Under this heading, WhatsApp submitted 464that:
a. The Extract does not adequately address the Article 83(2) factors in respect of each
infringementand instead assesses and applies thesefactors“genericallyand collectively”.
b. There is no clear (or any discernible) link between the Commission’s consideration of the
Article 83(2) factors and the subsequent determination on the level of the proposed fine
for the Article 5(1)(a) infringement (or any of the other infringements). The Commission
hascumulatively assessed the infringementsbutproposestoimpose separate fines. Such
an approach does not satisfy the requirement for legal certainty.
c. There is no justification for the proposed fines. By way of example:
i. In terms of the nature of the Article 5(1)(a) infringement, the Commission
appears to rely on matters beyond the finding of infringement itself by reference
to the statement that the failure to comply with the transparency principle
potentially undermines “other fundamental data protection principles, including
but not limited to the principles of fairness and accountability.” WhatsApp
submits, in this regard, that the Board did not direct the Commission to include a
findingofinfringementoftheaccountabilityprinciple. WhatsAppfurthersubmits
that it fails to see how the Commission can seek to rely on “potential”
undermining of other principles (which WhatsApp has not been found to have
infringed) to support the proposed fine.
463The Final Submissions, paragraph 2.1
464The Final Submissions, paragraphs 3.1 to 3.3
242 ii. In terms of the gravity of the Article 5(1)(a) infringement, the Commission has
failed to have regard to the overlapping nature of the infringements. The
Commission, in this regard, must identify the gravity that is attributable to the
Article 5(1)(a) infringementalone. Given the significant“and arguably complete”
overlap between the infringements of Article 5 and Articles 12 to 14, the
Commission cannot attach much, if any, weight to this factor in determining the
fining amount.
iii. The Extract states that the infringements “remain ongoing”. The Commission,
however, should take account of the updates made to the Privacy Policy in
January 2021, as a mitigating factor.
iv. The Commission is not entitled to take a factor that has been deemed to be an
aggravatingfactorinthecontext of theArticle12–14 infringementsintoaccount
again as a significant aggravating factor for the purpose of imposing a fine for the
Article 5(1)(a) infringement.
v. The Commission ought to take account, as a mitigating factor, of the lack of
relevant previous infringements and the degree of effort on WhatsApp’s part to
avoid damage and to cooperate with the Commission.
839. In response to the above, I note that the core theme running throughout WhatsApp’s Final
Submissions is the overlap between the infringement of Article 5(1)(a) and the infringements of
Article 12 – 14. In that regard, there is no doubt but that there is overlap between the Articles 12 –
14 infringements and the Article 5(1)(a) infringement. That is the consequence of the rationale 465
upon which the Board determined the existence of the Article 5(1)(a) infringement. The Commission
notes, in this regard, the Board’s view that “an infringement of the transparency obligations under
Articles 12 – 14 GDPR can, depending on the circumstances of the case, amount to an infringement of
the overarching principle of transparency under Article 5(1)(a).” In having considered the
circumstances of the within inquiry, the Board determined that this was a case in which an
infringement of the transparency obligations under Article 12 – 14 amounted to an infringement of
the overarching principle of transparency under Article 5(1)(a). The Board noted that this was the
case due to the “gravity and the overarching nature and impact of the [Article 12 – 14] infringements,
which have a significant negative impact on all of the processing carried out by [WhatsApp].”
840. Notwithstanding the above, I disagree with WhatsApp’s submission that the Extract does not
adequately address the Article 83(2) factors in respect of each infringement. Given the rationale for
the Board’s determination above, it stands to reason that there will be overlap, in terms of the
assessment of the individual infringements for the purpose of Article 83(2). That does not mean,
however, that each infringement has not been individually assessed. That ought to be clear from
the references to the individual infringements, within the assessments of the Article 83(2) criteria,
noting any particular issues arising in any case. I therefore further disagree with WhatsApp’s
submission that the Commission has cumulatively assessed the infringements but proposes separate
fines. This is clearly not the case, as should be evident from the narrative set out in paragraphs 697
and 698, above.
465See the Article 65 Decision, paragraphs 193 to199
243841. In terms of the justification for the proposed fines, WhatsApp has suggested that I am not entitled to
haveregardtothepotentialnegativeimpactofinfringementofthe transparencyobligationson other
fundamental data protection principles. Such a submission is inconsistent with the view expressed 466
by the Board, in the Article 65 Decision, that “transparency … is intrinsically linked to the principle of
accountability under the GDPR”. The Board further underlined that “the principle of transparency is
an overarching principle that not only reinforces other principles (i.e. fairness, accountability), but
from which many other provisions of the GDPR derive.” Accordingly, and in circumstances where
Boardhasrecognisedthe interconnectionand interdependencebetweenthetransparencyobligation
and other fundamental data protection principles, it is not only appropriate but necessary for me to
have regard to such matters when carrying out the Article 83(2) assessment for the purpose of the
Article 5(1)(a) infringement.
842. I note that I have already set out my views, as part of my assessment of the Submissions on Recurring
Themes, on the weight that I might attribute to WhatsApp’s having made amendments to its Privacy
Policy on a voluntary basis. The views so expressed apply equally here. As regards WhatsApp’s
submission concerning the “ongoing” nature of the infringements, it is important to note that the
assessment of duration (as with all of the Article 83(2) assessments recorded in this Decision) is that
which was set out in the Composite Draft that entered the Article 60 co-decision-making process in
December 2020. That being the case, the assessment of duration, for the purpose of the Article
5(1)(a) infringement covers the same period (i.e. to December 2020) in circumstances where the
Board determined the existence of the Article 5(1)(a) infringement by reference to the existing
findings of infringement of Articles 12 – 14. I further note that the Board, having considered the
manner in which the Commission assessed duration, as recorded in the Composite Draft, determined
that “the [draft decision] does not need to be amended regarding consideration of the duration as an
aggravating factor”. As noted elsewhere in this Decision, the Commission is bound by the findings
and determinations recorded in the Article 65 Decision.
843. I note that I have already set out my views, as part of my assessment of the Submissions on Recurring
Themes, on the weight that may be attributed, as a mitigating factor, to the lack of relevant previous
infringements, WhatsApp’sgood faith efforts and its cooperation with the Commission. The views so
expressed apply equally here.
Heading 2: Non-compliance with the requirements of Article 83(1), resulting in a situation whereby the
reassessed fines are “disproportionate, excessive and unnecessary”
467
844. WhatsApp has submitted , in this regard, that:
a. the proposed fines far exceed what is required by Article 83(1) and that this applies in
particulartothefinethathasbeenproposedinrespectoftheArticle5(1)(a)infringement.
b. The Commission has failed to meaningfully engage with Article 83(1) and there appears
tobeafailuretoadequatelyconsiderwhether,takenasawhole,thetotaloftheproposed
fines in respect of all of the infringements are effective, proportionate and dissuasive.
466The Article 65 Decision, paragraph 188
467See the Final Submissions, paragraphs 4.1 to 4.7
244 c. The Commission was previously satisfied that the overall fine it proposed (of €30 to €50
million) was sufficient to be effective in light of all of the circumstances of the inquiry.
ThisdemonstratestheextenttowhichtheExtractfailstohaveregardtotherequirements
of Article 83(1).
d. As before, inadequate account has been taken of the nature of the infringements, the
good faith efforts taken by WhatsApp to comply prior to and during the inquiry and the
lack of any demonstrable harm to data subjects.
845. In response to the above, it is important to remember that this Decision is being made within a
consensus-based, co-decision-making process. In these circumstances, it is irrelevant that the
Commission previously considered the fine proposed by the Composite Draft to be effective,
proportionate and dissuasive in light of the circumstances of the within inquiry. I further note, in this
regard, that I advised WhatsApp, by way of letter dated 23 April 2021 that, when selecting the final
fine (i.e. when exercising the discretionary element within the fining process) that I would take
account of both WhatsApp’s views as well as the views of the CSAs.
846. Against the background of the above, it is important to reflect on the expectations that have been
expressed by a range of CSAs within the co-decision-making process to date. As WhatsApp is aware,
a number of CSAs have indicated their view that the fine to be imposed ought, more appropriately,
to be closer to the maximumfining range of 4% of the turnover of the undertaking concerned (which,
in this case, has been established, by the Board, to be the Facebook, Inc. family of companies).
847. It is further important to note that the Commission is subject to a binding decision of the Board that
requires an upwards 468reassessment of the fine originally proposed by the Composite Draft, taking
into account the various determinations of the Board that are recorded in Section 9.4 of the Article
65 Decision. Those matters include the requirement for the Commission to take account of the
turnover of the undertaking concerned when calculating the fine, as well as each of the findings of
infringement(includingthe new and extended findingsthatwereestablished by the Board elsewhere
in its Article 65 Decision) that were found to have occurred in this inquiry. Section 9.4 of the Article
65 Decision comprises six different matters in total. In the circumstances, it is difficult to understand
how the required reassessment might not have resulted in a substantial increase in the fine originally
proposed by the Composite Draft.
848. Further, I disagree that the Commission has failed to take any, or adequate, account of Article 83(1)
when assessing whether the total amount of the fines proposed was effective, proportionate and
dissuasive in the circumstances of the case. The Commission has followed the determination made
by the Board, in the Article 65 Decision, arising from its assessment of those CSA objections that
expressed the view that the fine originally proposed by the Composite Draft was not effective,
proportionate and dissuasive, for the purpose of Article 83(1). The Board has clearly rationalised its
determination (as set out at paragraph 807, below) and the Commission has adhered to the guidance
provided.
468The Article 65 Decision, paragraph 424
245849. As before, I have already considered, as part of my assessment of the Submissions on Recurring
Themes, WhatsApp’s submissions concerning the account that ought to be taken of the specified
(mitigating) factors.
Heading 3: Incorrect implementation of Article 83(3), “even taking into account the [Article 65 Decision]”
850. WhatsApp has submitted 469, under this heading, that:
a. The Board’s interpretation does not mandate the approach the Commission proposes to
take in the Extract of setting a fine for each infringement in isolation, without assessment
of overlap, and then adding these up to produce a cumulative fine without regard to
Article 83(1).
b. Neither the GDPR nor the Board prescribes the Commission’s proposed approach. The
Article 65 Decision leaves room for the Commission to respect the overlapping nature of
the infringements in order to establish what would be an effective, proportionate and
dissuasive total.
c. Proposing a new fine in respect of the Article 5(1)(a) infringement and then simply adding
it together with the other fines leads to (at least) a double penalty being imposed for the
same matters under assessment.
851. I note that the submissions made under this heading overlap somewhat with the previous headings.
I have already addressed the overlapping nature of the infringements in my response to the
submissions made under Heading 1. I have further addressed WhatsApp’s Article 83(1) submissions
as part of my response to the submissions made under Heading 2.
852. As regards the submission concerning double punishment (including the application of the principle
of ne bis in idem), it is firstly important to remember that the Commission is subject to binding
determinations of the Board, requiring the Commission to amend the Composite Draft to (i) record a
finding of infringement of Article 5(1)(a); and (ii) reassess the proposed fine to take account of the
matters identified in Section 9.4 of the Article 65 Decision, including the requirement for the
Commission to “take into account the other infringements – in addition to the gravest
infringement 470”. The Commission further notes, in relation to the Board’s determination that an
infringement of Article 5(1)(a) has occurred in this case, that the Article 65 Decision records
WhatsApp’s submission 471that “the controller cannot be punished twice for the same conduct” and
WhatsApp’s reliance on the statement made by the CNIL whereby it indicated that it could not see
“on which facts, not already covered by the breach to (sic) article 12, the breach to (sic) article 5(1)(a)
would be based” and its further comment whereby it wondered “if [the addition of fines in respect of
such additional infringements] would be compatible with the principle according to which the same
facts should be punished only one time”. While the Article 65 Decision does not record the manner
in which the Board took account of WhatsApp’s submissions, it is clear, by reference to the
determinations that it ultimately made (requiring the Commission to record a findingof infringement
of Article 5(1)(a) and to take that finding into account when making an upward reassessment of the
469See the Final Submissions, paragraphs 5.1 to 5.9
470The Article 65 Decision, paragraphs 327, 423, 430 (second bullet point),
471The Article 65 Decision, paragraph 186
246 proposed fine), that it did not agree with WhatsApp’s submissions concerning double punishment for
the same conduct. I further note that the only way to avoid this risk would be for the Commission to
472
not take account of (or “reflect ”) either the Article 5(1)(a) infringement or the Article 12 – 14
infringements when reassessing the proposed fine. Thiscourse of action, however, is not open to the
Commission, in circumstances where it is subject to a binding decision of the Board that requires it to
carry out an upwards reassessment of the fine originally proposed to take account of six factors,
including the requirement for the Commission to take account of each of the existing and
new/extended findings of infringement in that fine.
Heading 4: Incompatibility with EU law principles and the specific nature of the concurrence of Articles 5
and 12 to 14
473
853. WhatsApp has submitted , under this heading, that:
a. The manner in which the fines have been calculated offends against the EU law principle
of “ne bis in idem” and concurrence of laws. This means that, in a case of multiple
offences caused by a single conduct, the competent authority or court can only impose
one single sanction limited by the gravest offence – or at a minimum in the present
context one sanction limited by the combined gravity of the offences accurately
addressed in the round.
b. The fine being proposed for the Article 5(1)(a) infringement by itself has the effect of
almost doubling the fines to be imposed for what is essentially the same set of facts and
alleged infringement. The sanctionsalready proposed forthe infringementsof Articles12
to14 already take due(and in fact, when combined, excessive) accountof the seriousness
of the transparency infringement.
854. Again, there is a significant degree of overlap between the submissions made under this heading and
those made under the previous headings. In response to the new elements, it is important to note,
from the figures set out in Articles 83(4) – (6), that the legislator envisaged a robust fining regime to
address infringements of the GDPR. Thisis clear not onlyfrom the static maximumfining caps set out
in Articles 83(4) – (6) but also the inclusion of dynamic maximum fining caps, applicable to
undertakings (which, as clarified by Recital 150, has the same meaning as in EU competition law). In
these circumstances, I do not agree that the fines proposed by the Extract are excessive.
855. As regards the application of the principle of “ne bis in idem”, I note that I have already addressed
this above, in my response to the submissions made under Heading 3.
Heading 5: The fine proposed for the Article 14 infringement ought to be significantly reduced
856. WhatsApp has submitted 474, under this heading, that:
a. As before, WhatsApp has sought to rely on the fine originally proposed by the Composite
Draft in support of its assertion that the Commission was previously satisfied that the fine
472The Article 65 Decision, paragraph 423
473See the Final Submissions, paragraphs 6.1 to 6.8
474See the Final Submissions, paragraphs 7.1 to 7.5
247 proposed for the Article 14 infringement (in the range of between €30 and €50 million)
was effective, proportionate and dissuasive in the circumstances of the inquiry, “taking
into account all infringements.”
b. WhatsApphasfurthersubmittedthat,ratherthanreassessingthefineoriginallyproposed
in respect of the Article 14 infringement, the Commission has simply reverted to the fine
previously proposed without having any regard to WhatsApp’s previous submissions,
made in response to the fine originally proposed.
857. In response to the above, WhatsApp appears to be suggesting that the fine proposed by the
Composite Draft reflected all of the (then) three infringements that were found to have occurred. To
be absolutely clear about the position, this is absolutely not the case and it is difficult to understand
how WhatsApp could have formed this view, given the clear explanation, set out in the Composite
Draft, as to the manner in which the Commission interpreted and applied Article 83(3).
858. As regards the Commission’s reinstatement of the fine originally proposed by the Supplemental Draft
in respect of the Article 14 infringement, the manner in which the Commission has taken account of
WhatsApp’s various submissions is clearly set out in Part 5 of this Decision, including within the
individual Article 83(2) assessments as well as my assessments of the Submissions on Recurring
Themes. It istherefore incorrect to suggest that the Commission failed to have regard to WhatsApp’s
submissions. I further question why it might have been inappropriate for the Commission to have
reinstated the fine that it originally proposed in circumstances where the impact, from the
perspective of the Article 83(2) assessment, of the Board’s determination on the lossy hashing
objections is materially identical to that originally outlined in the Preliminary Draft and Supplemental
Draft decisions.
859. On the basis of the above, I am not inclined to make a downward adjustment to the fines proposed
above to take account of WhatsApp’s Final Submissions.
Article 83(5) and the applicable fining “cap”
860. Turning, finally, to Article 83(5), I note that this provision operates to limit the maximum amount of
any fine that may be imposed in respect of certain types of infringement, as follows:
“Infringements of the following provisions shall, in accordance with paragraph 2, be subject to
administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4% of the total
worldwide annual turnover of the preceding financial year, whichever is higher:
…
(b) the data subjects’ rights pursuant to Articles 12 to 22;
…”
861. In order to determine the applicable fining “cap”, it is firstly necessary to consider whether or not the
fine is to be imposed on “an undertaking”. Recital 150 clarifies, in this regard, that:
“Where administrative finesare imposed on anundertaking, an undertaking shouldbe understood
to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes.”
248862. Accordingly, when considering a respondent’s status as an undertaking, the GDPR requires me to do
so by reference to the concept of ‘undertaking’, as that term is understood in a competition law
context. In this regard, that the Court of Justice of the EU (“the CJEU”) has established that:
“an undertaking encompasses every entity engaged in an economic activity regardless of the legal
status of the entity and the way in which it is financed 47”
863. The CJEU has held that a number of different enterprises could together comprise a single economic
unit where one of those enterprises is able to exercise decisive influence over the behaviour of the
others on the market. Such decisive influence may arise, for example, in the context of a parent
company and its wholly owned subsidiary. Where an entity (such as a subsidiary) does not
independently decide upon its own conduct on the market, but carries out, in all material respects,
the instructions given to it by another entity (such as a parent), this means that both entities
constitute a single economic unit and a single undertaking for the purpose of Articles 101 and 102
TFEU. The ability, on the part of the parent company, to exercise decisive influence over the
subsidiary’s behaviour on the market, means that the conduct of the subsidiary may be imputed to
the parent company, without having to establish the personal involvement of the parent company in
the infringement 47.
864. In the context of Article 83, the concept of ‘undertaking’ means that, where there is another entity,
such as a parent company, that is in a position to exercise decisive influence over the
controller/processor’s behaviour on the market, then they will together constitute a single economic
entity and a single undertaking. Accordingly, the relevant fining “cap” will be calculated by reference
to the turnover of the undertaking as a whole, rather than the turnover of the controller or processor
concerned.
865. In order to ascertain whether a subsidiary determines its conduct on the market independently,
account must be taken of all the relevant factors relating to the economic, organisational and legal
links which tie the subsidiary to the parent company, which may vary from case to case 477.
866. The CJEU has, however, established 478that, where a parent company has a 100% shareholding in a
subsidiary, it follows that:
a. the parent company is able to exercise decisive influence over the conduct of the subsidiary;
and
b. a rebuttable presumption arises that the parent company does in fact exercise a decisive
influence over the conduct of its subsidiary.
867. TheCJEUhasalsoestablishedthat,inacasewhereacompanyholdsalloralmostallofthecapital
of an intermediate company which, in turn, holds all or almost all of the capital of a subsidiary of
itsgroup,thereisalsoarebuttablepresumptionthatthatcompanyexercisesadecisiveinfluence
475
476Höfner and Elser v Macrotron GmbH (Case C-41/90, judgment delivered 23 April 1991), EU:C:1991:161 §21
Akzo Nobel and Others v Commission, (Case C-97/08 P, judgment delivered 10 September 2009) EU:C:2009:536, § 58 -
61
477Ori Martin and SLM v Commission (C-490/15 P, judgment delivered 14 September 2016) ECLI:EU:C:2016:678 § 60
478Akzo Nobel and Others v Commission, (C-97/08 P, judgment delivered 10 September 2009)
249 over the conduct of the intermediate company and indirectly, via that company, also over the
conduct of that subsidiary .479
868. The General Court has further held that, in effect, the presumption may be applied in any case
where the parent company is in a similar situation to that of a sole owner as regards its powerto
480
exercise a decisive influence over the conduct of its subsidiary . This reflects the position that:
“… thepresumptionof actual exerciseof decisive influence is based, inessence, onthe premiss
that the fact that a parent company holds all or virtually all the share capital of its subsidiary
enables the Commission to conclude, without supporting evidence, that that parent company
hasthepowertoexerciseadecisiveinfluenceoverthesubsidiarywithouttherebeinganyneed
to take into account the interests of other shareholders when adopting strategic decisions or
in the day-to-day business of that subsidiary, which does not determine its own market
conduct independently, but in accordance with the wishes of that parent company … ” 481
869. Where the presumption of decisive influence has been raised, it may be rebutted by the production
of sufficient evidence that shows, by reference to the economic, organisational and legal links
between the two entities, that the subsidiary acts independently on the market.
Application of the above to the within inquiry
870. Having reviewed the Directors’ Report and Financial Statements filed, on behalf of WhatsApp, with
the Irish Companies Registration Office (in respect of the financial period from 6 July 2017 to 31
December 2018) 482, I note that this document confirms, on page 3, that:
“Principal activity and review of the business
WhatsApp Ireland Limited (“the company”) is owned by WhatsApp Inc., a company incorporated
in the United States of America, which is its immediate parent undertaking and controlling party.
The ultimate holding company and controlling party is Facebook, Inc., a company incorporated in
the United States of America.
WhatsApp is a simple, reliable and secure messaging application that is used by people and
businesses around the world to communicate in a private way. The principal activity of the
company is acting as the data controller for European users of the WhatsApp service and the
provision of support services to WhatsApp Inc.
…
479
Judgment of 8 May 2013, Eni v Commission, Case C-508/11 P, EU:C:2013:289, paragraph 48
480Judgments of 7 June 2011, Total and Elf Aquitaine v Commission, T-206/06, not published, EU:T:2011:250, paragraph 56;
of 12 December 2014, Repsol Lubricantes y Especialidades and Others v Commission, T-562/08, not published,
EU:T:2014:1078, paragraph 42; and of 15 July 2015, Socitrel and Companhia Previdente v Commission, T-413/10 and
T-414/10, EU:T:2015:500, paragraph 204
481
Opinion of Advocate General Kokott in Akzo Nobel and Others v Commission, C-97/08 P, EU:C:2009:262, point 73 (as
cited in judgment of 12 July 2018, The Goldman Sachs Group, Inc. v European Commission, Case T-419/14,
ECLI:EU:T:2018:445, paragraph 51)
482While I note that WhatsApp has since filed its Directors Report and Financial Statements for the financial year ending 31
December 2019, I note that the relevant information set out therein is materially identical to that recorded in this Decision.
250 Going concern
The company’s ultimate parent undertaking, Facebook, Inc., has given written assurances that
adequate funds will be made available to the company to ensure that liabilities will be discharged
at the amount at which they are stated in the financial statements and to continue to fund the
operations of the company for a period of at least twelve months from the date of approval of
these financial statements. The company therefore continues to adopt the going concern basis in
preparing its financial statements.”
871. Page 18 further confirms that:
“Controlling parties
At 31 December 2018, the company was a wholly-owned subsidiary of WhatsApp Inc., a company
incorporated in Wilmington, Delaware, United States of America.
The ultimate holding company and ultimate controlling party is Facebook Inc., a company
incorporated in Wilmington, Delaware, United States of America. The ultimate holding company
and controlling party of the smallest and largest group of which the company is a member, and for
which consolidated financial statements are drawn up, is Facebook, Inc.”
872. On the basis of the above, it appears that:
a. WhatsApp is the wholly owned subsidiary of WhatsApp Inc.;
b. WhatsApp Inc. is ultimately owned and controlled by Facebook, Inc.; and
c. As regards any intermediary companies in the corporate chain, between WhatsApp and
Facebook,Inc.,itisassumedbyreferencetothestatementrecordedabove,thatthe“ultimate
holding company and controlling party of the smallest and largest group of which [WhatsApp]
is a member … is Facebook, Inc.”
873. It follows, therefore, that:
a. The corporate structure of the entities concerned and, in particular, the fact that Facebook,
Inc. owns and controls WhatsApp Inc. means that Facebook, Inc. is able to exercise decisive
influence over WhatsApp’s behaviour on the market; and
b. A rebuttable presumption arises that Facebook, Inc. does in fact exercise a decisive influence
over the conduct of WhatsApp on the market.
874. If this presumption is not rebutted, it means that Facebook, Inc. and WhatsApp constitute a single
economic unit and therefore form a single undertaking within the meaning of Article 101 TFEU.
875. Having put 483the above to WhatsApp, WhatsApp confirmed 484that:
483By way of letter dated 24 April 2020 from the Commission to WhatsApp
484By way of letter dated 1 May 2020 from WhatsApp to the Commission
251 a. “[It] is a wholly-owned subsidiary of WhatsApp Inc.; and
b. WhatsApp Inc. is ultimately a wholly-owned subsidiary of Facebook, Inc.”
876. WhatsApp, however, did not furnish any evidence directed to the rebuttal of the presumption.
Instead, it advised that:
“To the extent relevant (if at all) to the imposition or amount of any administrative fine under the
GDPR (please see the questions we have in this respect below), we do not believe that, as a result
of the corporate structure of the entities concerned, either WhatsApp Inc. or Facebook, Inc.
exercises “decisive influence” over [WhatsApp’s] “behaviour on the market” in the way that such
phrases would need to be interpreted in order to make sense in the context of the GDPR.”
877. In response to my request 485that WhatsApp bring the matter to the attention of “any parent or
486
controlling company as might be required to fully address the matters raised” WhatsApp advised
that:
“While neither WhatsApp Inc. nor Facebook, Inc. are parties to the Inquiry, we confirm that we
have brought your letter and this response to the attention of personnel at WhatsApp Inc. and
Facebook, Inc. on a voluntary basis. However, it is not clear at present how input from those
entities might be required to address the matters raised in your letter, or why they might have
matters to raise which could be relevant in the circumstances. We would be grateful for any
clarification you are able to provide in this respect, and we can then consider the matter further.”
487
878. I wrotefurther toWhatsApp , answeringeachofthe questionsraised and providingtheclarification
sought. IrepeatedthepresumptionarisingandrepeatedmyrequestthatWhatsAppconfirmwhether
or not it agreed with my assessment. As before, I requested that, in the event that WhatsApp did not
agree with my assessment, it should detail “by reference to the economic, organisational and legal
links between the [entities concerned], why [it so disagreed]”. I also repeated my request that
WhatsApp bring my letter to the attention of “any parent or controlling company, as might be
required to fully address the matters raised”.
879. In response 488, WhatsApp (via its legal advisors) advised that it did not agree with the position that
had been outlined in relation to how “competition law concepts” should be transposed to the “very
different statutory context of the GDPR”. WhatsApp advised that it had not set out “the detailed
reasons why it disagrees” with the position that had been outlined to it and that:
“Instead, [WhatsApp] reserves its right to raise these reasons at the appropriate stage in the
Inquiry, namely in response to any draft corrective measures decision, if necessary.”
880. Notwithstanding the reasons subsequently raised by WhatsApp in its response to the Supplemental
Draft (which I have dealt with below), by reference to the information set out above and in the
absence of any evidence to the contrary, I find that:
485
486Included in the letter dated 24 April 2020 from the Commission to WhatsApp
Included in the letter dated 1 May 2020 from WhatsApp to the Commission
487By way of letter dated 18 May 2020, from the Commission to WhatsApp
488Communicated by way of letter dated 25 May 2018 from Mason Hayes & Curran, solicitors to the Commission
252 a. The corporate structure of the entities concerned and, in particular, the facts that:
i. WhatsApp is a wholly-owned subsidiary of WhatsApp Inc.; and
ii. WhatsApp Inc. is a wholly-owned subsidiary of Facebook, Inc.
means that Facebook, Inc. is able to exercise decisive influence over WhatsApp’s behaviour
on the market;
b. On this basis, a rebuttable presumption arises that Facebook, Inc. does in fact exercise a
decisive influence over the conduct of WhatsApp on the market;
c. This presumption has not been rebutted; and
d. Consequently, WhatsApp and Facebook, Inc. constitute a single economic unit and, thereby,
a single undertaking for the purpose of Articles 101 and 102 TFEU.
881. Applying the above to Article 83(5), I firstly noted that, in circumstances where the fine is being
imposed on an ‘undertaking’, a fine of up to 4% of the total worldwide annual turnover of the
preceding financial year may be imposed. WhatsApp confirmed 489 that the combined turnover for
Facebook, Inc. and WhatsApp Ireland for the year ending 31 December 2019 was approximately
. That being the case, the fine proposed to be imposed (in respect of the Article 14
Infringement), did not exceed the applicable fining “cap” prescribed by Article 83(5).
WhatsApp’s Submissions and Assessment of Decision-Maker
882. As noted above, WhatsApp raised objections on the rationale set out above, which had been set out
490
in the Supplemental Draft. In doing so, WhatsApp submitted that the views set out above, as to
the manner of identification of the relevant undertaking are “wrong as a matter of fact and law”.
While reserving its right to make submissions “in relation to such matters in due course as necessary
or appropriate”, WhatsApp summarized the reasons why it disagrees with the Commission’s
assessment, as follows:
a. The competition law concept of decisive influence does not directly translate in the context of
the GDPR, which pursues different objectives to Articles 101 and 102 TFEU.
b. The Commission has not engaged with the question as to what “behavior on the market”
means in a GDPR context.
c. “For the competition law concept of decisive influence to have any real meaning in the context
of the GDPR, itmustbe adapted accordingly, ina similarwayto how the conceptof “dominant
influence” in Recital 37 GDPR has been adapted … by encompassing, for example, the ability
to control the processing activities of subsidiaries”.
489By way of its letter to the Commission dated 1 October 2020
490The Supplemental Draft Submissions, paragraphs 18.5 to 18.9 (inclusive)
253a. A reprimand pursuant to Article 58(2)(b); and
b. An order to bring processing operations into compliance, pursuant to Article 58(2)(d), in the
terms set out at Appendix C hereto; and
c. An administrative fine, pursuant to Articles 58(2)(i) and 83, addressed to WhatsApp, in the
amount of €225 million. For the avoidance of doubt, that fine reflects the infringements that
were found to have occurred, as follows:
i. In respect of the infringement of Article 5(1)(a) of the GDPR, a fine of €90 million;
ii. In respect of the infringement of Article 12 of the GDPR, a fine of €30 million;
iii. In respect of the infringement of Article 13 of the GDPR, a fine of €30 million; and
iv. In respect of the infringement of Article 14 of the GDPR, a fine of €75 million.
This Decision is addressed to:
WhatApp Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Dated the 20 day of August 2021
Decision-Maker for the Commission:
[Sent electronically without signature]
_______________________________________
Helen Dixon
Commissioner for Data Protection
258Appendix B – Glossary of Terms
The 2018 Act The Data Protection Act, 2018
The 25 May Email The email dated 25 May 2018 from WhatsApp to the Commission
Appendix C The list of relevant material, from the Investigator’s inquiry file
The Article 65 Decision The decision of the European Data Protection Board (1/2021),
adopted 28 July 2021
The Article 65 Submissions WhatsApp’s Article 65 submissions dated 28 May 2021
The Board (otherwise the The European Data Protection Board
EDPB)
The CJEU The Court of Justice of the EU
The Contact Feature WhatsApp’s contact list feature (as defined in the Response to
Investigator’s Questions)
The Contact Feature Pop-Up The pop-up notification that issues to users to invite them to grant
WhatsApp access to their device’s address book (as furnished under
cover of the email dated 20 March 2019 from WhatsApp to the
Investigator)
The Commission The Data Protection Commission
The Composite Draft The Commission’s composite draft decision dated 24 December
2020 (prepared for the purpose of the Article 60 process)
CSA Concerned supervisory authority
The Decision The decision dated 20 August 2021, recording the Commission’s
views as to whether or not an infringement of the GDPR has
occurred/is occurring and the action that the Commission proposes
to take, in response to any proposed finding(s) of infringement
The Directive Directive 95/46/EC of the European Parliament and of the Council of
24 October 1995 on the protection of individuals with regard to the
processing of personal data and on the free movement of such data
The Draft Report The Investigator’s draft inquiry report dated 30 May 2019
The EDPB (otherwise the The European Data Protection Board
Board)
The Facebook Companies The collective term, used by the Commission, for those members of
the Facebook family of companies that process, for any purpose,
personal data under the controllership of WhatsApp
The Facebook FAQ The FAQ available at
https://faq.whatsapp.com/general/26000112/?eea=1
261FAQ Frequently Asked Question
The Final Report The Investigator’s final inquiry report dated 9 September 2019
The Final Submissions WhatsApp’s final submissions dated 19 August 2021
The GDPR The General Data Protection Regulation (2016/679)
The ”How to Delete Your The WhatsApp FAQ available at
Account” FAQ https://faq.whatsapp.com/en/general/28030012/
The “I have Questions” FAQ The WhatsApp FAQ previously available at
https://faq.whatsapp.com/en/general/28030012/
The Inquiry Submissions WhatsApp’s Submissions to the investigator’s draft inquiry report, as
furnished under cover of letter dated 1 July 2019
The Legal Basis Notice The “How We Process Your Information” notice furnished by way of
Appendix 4 to the Response to Investigator’s Questions
The Non-User List The list of lossy-hashed values stored on WhatsApp’s servers
The Notice of Commencement The Notice of Commencement of Inquiry dated 10 December 2018
Opinion 1/2010 Article 29 Working Party, Opinion 1/2010 on the concepts of
“controller” and “processor”, adopted 16 February 2010
(00264/10/EN WP 169)
Opinion 3/2013 Article 29 Working Party, Opinion 3/2013 on purpose limitation,
adopted 2 April 2013 (00569/13/EN WP 203)
Opinion 4/2007 Article 29 Working Party, Opinion 4/2007 on the concept of personal
data, adopted 20 June 2007 (01248/07/EN WP 136)
The Page The suite of policies and notices set out in the form of a continuous
scroll, under the heading “WhatsApp Legal Info”
The Preliminary Draft The Preliminary Draft decision that issued to WhatsApp on 21 May
2020
The Preliminary Draft The submissions furnished under cover of letter dated 6 July 2020, in
Submissions response to the Preliminary Draft
The Privacy Policy WhatsApp’s Privacy Policy, last modified 24 April 2018 (as furnished
by way of Appendix 2 to the Response to Investigator’s Questions)
The Proposed Approach The approach proposed to be taken by the Decision-Maker in
relation to the interpretation of Article 13(1)(c) of the GDPR
The Response to Investigator’s The information furnished in WhatsApp’s letter of response dated 25
Questions January 2019
SA Supervisory authority
262The Service WhatsApp’s internet-based messaging and calling service
The Supplemental Draft The Supplemental Draft decision that issued to WhatsApp on 20
August 2020
The Supplemental Draft The submissions furnished under cover of letter dated 1 October
Submissions 2020, in response to the Supplemental Draft
The Transparency Guidelines Article 29 Working Party, Guidelines on transparency under
Regulation 2016/679, as last revised and adopted on 11 April 2018
(17/EN WP260 rev.01)
WhatsApp WhatsApp Ireland Limited
263Appendix C – Terms of Order to bring processing operations into compliance,
made pursuant to Article 58(2)(d)
Action Required Deadline for Compliance
1. Take the action required such that the information prescribed by The period of 3 months,
Article 14 is provided to those non-users whose personal data is commencing on the day
being processed by WhatsApp. When doing so, WhatsApp must following the date of service
ensure that the information is provided in a manner that complies of this order
with the requirements of Article 12(1), noting the comprehensive
assessment, guidance and commentary that has been provided by
the Commission in Parts 2 and 3 of this Decision (and, in particular,
paragraphs 163, 164, 166 and 167).
2. Take the action required to provide the information prescribed by The period of 3 months,
Article 13(1)(c) to users, in a manner that complies with Article commencing on the day
12(1), noting the comprehensive assessment, guidance and following the date of service
commentary that has been provided by the Commission in Parts 2 of this order
and 3 of the Decision. The information to be provided, in this
regard, and the manner in which it should be provided, is detailed
in paragraphs 301 to 302 and 325 to 399 and 539 to 592 of this
Decision.
3. Take the action required to provide the information prescribed by The period of 3 months,
Article 13(1)(d) to users, in a manner that complies with Article commencing on the day
12(1), noting the comprehensive assessment, guidance and following the date of service
commentary that has been provided by the Commission in Parts 2 of this order
and 3 of the Decision, in particular paragraphs 411 to 416 and 539
to 592 of this Decision.
4. Take the action required to provide the information prescribed by The period of 3 months,
Article 13(1)(e) to users, in a manner that complies with Article commencing on the day
12(1), noting the comprehensive assessment, guidance and following the date of service
commentary that has been provided by the Commission in Parts 2 of this order
and 3 of the Decision. The information to be provided, in this
regard, and the manner in which it should be provided, is detailed
in paragraphs 422 to 434 and 539 to 592 of this Decision.
5. Take the action required to provide the information prescribed by The period of 3 months,
Article 13(1)(f) to users, in a manner that complies with Article commencing on the day
12(1), noting the comprehensive assessment, guidance and following the date of service
commentary that has been provided by the Commission in Part 2 of this order
of the Decision. Theinformation tobe provided, inthisregard, and
the manner in which it should be provided, is detailed in
paragraphs 443 - 457 of this Decision.
6. Take the action required to provide the information prescribed by The period of 3 months,
Article 13(2)(a) to users, in a manner that complies with Article commencing on the day
12(1), noting the comprehensive assessment, guidance and following the date of service
commentary that has been provided by the Commission in Part 2 of this order
of the Decision. Thedeficiencies toberemedied, inthisregard,are
detailed in paragraphs 464 – 476 of this Decision.
2646. Take the action required to provide the information prescribed by The period of 3 months,
Article 13(2)(c) to users, in a manner that complies with Article commencing on the day
12(1), noting the comprehensive assessment, guidance and following the date of service
commentary that has been provided by the Commission in Part 2 of this order
of the Decision. Thedeficiencies toberemedied, inthisregard,are
detailed in paragraphs 486 - 496 of this Decision.
7. Take the action required to provide the information prescribed by The period of 3 months,
Article 13(2)(e) to users, in a manner that complies with Article commencing on the day
12(1), noting the comprehensive assessment, guidance and following the date of service
commentary that has been provided by the Commission in Part 2 of this order
of the Decision and, in particular, paragraphs 507 to 520.
8. Take the action required to incorporate reference to the existence The period of 3 months,
of the righttolodge a complaintwith a supervisory authority inthe commencing on the day
“How You Exercise Your Rights” section of the Privacy Policy. following the date of service
of this order
265Appendix D – The Article 65 Decision
266
Categories:
- DPC (Ireland)
- Ireland
- Article 4(1) GDPR
- Article 5(1)(a) GDPR
- Article 12 GDPR
- Article 12(1) GDPR
- Article 13 GDPR
- Article 13(1)(e) GDPR
- Article 13(1)(f) GDPR
- Article 13(1)(a) GDPR
- Article 13(1)(b) GDPR
- Article 13(1)(c) GDPR
- Article 13(1)(d) GDPR
- Article 13(2)(a) GDPR
- Article 13(2)(b) GDPR
- Article 13(2)(c) GDPR
- Article 13(2)(d) GDPR
- Article 13(2)(e) GDPR
- Article 13(2)(f) GDPR
- Article 14 GDPR
- Article 58(2) GDPR
- Article 60 GDPR
- 2021
- English
