On 15 July 2021, the European Data Protection Board (the EDPB) issued a press release concerning its first urgent binding decision adopted under Article 66(2) GDPR (the Decision) in response to a request of the Hamburg Commissioner for Data Protection and Freedom of Information (the Hamburg Commissioner) in the Facebook/WhatsApp case. The Decision is an important step in the application of the GDPR and provides practical insights into the functioning of the one-stop-shop mechanism.
The Hamburg Commissioner requested the EDPB on 7 June 2021 to issue an urgent binding decision to require the adoption of binding final measures across the EU. The EDPB stated in its Decision that there was insufficient evidence to demonstrate an infringement requiring urgent intervention, particularly given that the issues in consideration existed in previous versions of the terms and conditions. The Hamburg Commissioner also did not demonstrate that the Irish DPC failed to provide information in the context of a formal request for mutual assistance under Article 61 GDPR.
Further, the EDPB noted its concerns about several matters raised by the Hamburg Commissioner, including combination of data by Facebook, WhatsApp and the Facebook Companies, the intended use of WhatApp business API and the lack of clarity and transparency in WhatsApp’s user-facing information. The EDPB concluded that many of these aspects are currently subject to the one-stop-shop procedure led by the Irish DPC, and this procedure is in its final stages.
The EDPB acknowledged that a number of issues require prompt investigation by the Irish DPC and appropriate action. The EDPB asked the Irish DPC to look, as a matter of priority, into several matters.
The Hamburg Commissioner responded to the Decision by stating that it was “disappointing”, questioning whether the response of the Irish DPC and the EDPB was sufficient given the gravity of the issues it had sought to address with its provisional ban.
The EDPB press release is available here, the Decision is available here and the Hamburg Commissioner’s response is available here (in German only).