The UK’s data protection watchdog has concluded that WhatsApp’s sharing of user data with its parent company Facebook would have been illegal.
The messaging app was forced to pause sharing of personal data with Facebook in November 2016, after the Information Commissioner’s Office said it had cause for concern. The ICO opened a full investigation into the matter in August that year.
Elizabeth Denham, the information commissioner, said her investigation found that “WhatsApp has not identified a lawful basis of processing for any such sharing of personal data” and that “if they had shared the data, they would have been in contravention of the first and second data protection principles of the Data Protection Act.”
Q&AWhat is GDPR?
Show
The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, replaced the patchwork of national data protection laws across the EU with a unified system that greatly increased the fines regulators could issue, strengthened the requirements for consent to data processing, and created a new pan-European data regulator called the European Data Protection Board.
The regulation governs the processing and storage of EU citizens' data whether or not the company has operations in the EU. To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m, or 4% of annual global turnover. In the UK, the previous maximum fine was £500,000; the post-GDPR record currently stands at more than £180m, for a data breach reported by British Airways in 2018.
Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable. Fines can also be levied against companies that act on data without explicit and informed user consent, or who fail to ensure that consent can be withdrawn at any time.
GDPR also refined and enshrined in law the concept of the "right to be forgotten", renaming it as the "right to erasure", and gave EU citizens the right to data portability, allowing them to take data from one organisation and give it to another.
The ICO said WhatsApp had failed to provide adequate information to users explaining the processing and sharing of their data, and that sharing it with Facebook would require processing that is “incompatible with the purpose for which such data was obtained”.
In response WhatsApp has signed an undertaking declaring that it will not share any EU user data with Facebook until the General Data Protection Regulation (GDPR) comes into force on 25 May. It also stated that it would only share data in accordance with the requirements of GDPR after 25 May.
Denham is also chair of the taskforce set up to investigate data sharing between WhatsApp and Facebook by the Article 29 Working Party pan-European data protection group. Article 29 first issued a warning in October 2016 before launching the taskforce a year later.
Various other European countries have also raised concerns over the data sharing, including France which ordered WhatsApp to stop sharing data in December. The EU fined Facebook £94m for providing misleading information over its technical capabilities in terms of sharing user data before its acquisition of WhatsApp in 2014.