[co-author: Federica De Santis]
Background
On October 27, 2016, the Article 29 Data Protection Working Party (Working Party) launched an investigation into WhatsApp’s sharing of user data with Facebook. The Working Party ordered WhatsApp to stop sharing the data pending the investigation into whether the sharing complies with EU privacy law.
The Working Party said it has “serious concerns” about the validity of users’ consent to the data sharing, since the terms of service and privacy policy that WhatsApp users relied on failed to provide adequate notice and choice. Further, it asked WhatsApp to provide details about the specific data being shared, the source of the data, a list of data recipients and information about the effects of the sharing on users and individuals whose contact details were uploaded to WhatsApp from individual address books, even if those individuals had no connection to either Facebook or WhatsApp.
When WhatsApp was acquired by Facebook in 2014 it assured the public that it would not share user data with Facebook. However, in August 2016, the company announced changes to its terms of service and privacy policy allowing sharing with Facebook and the “Facebook family of companies” for a range of purposes, including advertising. WhatsApp users could opt out of the data sharing for advertising.
EU Privacy Law and Member State Investigations
EU law imposes data privacy obligations on companies that share personal data with third parties, even if the data is shared within a corporate group. Transparency about this data sharing is a core requirement.
On September 27, 2016, Hamburg’s DPA ordered Facebook to stop collecting and storing German WhatsApp user data because it failed to obtain a valid consent from users. It also required Facebook to delete any data already received from WhatsApp. Facebook announced that it will appeal the order.
The UK, Italian and Spanish DPAs have already launched their own investigations on the matter. On November 7, 2016, the UK DPA said that Facebook has agreed to suspend using data from UK WhatsApp users for advertising purposes after the DPA expressed concerns that users affected by the sharing were not properly protected. The UK DPA also required Facebook and WhatsApp to sign an undertaking committing to better explaining to users how their data would be used and giving them ongoing control over the data.
Although the Working Party is an advisory body and its opinions are not binding, it is made up of national DPAs. It is very likely that other DPAs will launch additional actions to address the concerns highlighted in the Working Party’s letter.
In light of the current proceedings, companies that seek to share their users’ personal data with subsidiaries, affiliates, vendors or other third parties should review and, as necessary, update their privacy policies before implementing any changes to ensure that the contemplated sharing is aligned with privacy policy representations.
