WhatsApp Fined €225m for GDPR Violations

WhatsApp has been hit by a €225m fine by Ireland’s Data Protection Commission (DPC) for failing to discharge GDPR transparency obligations.

The DPC made the announcement today following the conclusion of an investigation that began in December 2018. This examined whether the popular messaging app “has discharged its GDPR transparency obligations with regard to the provision of information and the transparency of that information to both users and non-users of its service.”

This includes information provided to data subjects about the processing of information between WhatsApp and other Facebook companies.

The DPC submitted its draft decision to other data protection authorities (DPAs) across the EU under Article 60 of the GDPR in December 2020, receiving objections to its proposed actions by eight DPAs. As no consensus could be found, the dispute resolution process under Article 65 of GDPR was triggered on June 3 2021.

The European Data Protection Board (EDPB) then adopted a binding decision on the case, instructing the DPC to reassess and increase its proposed fine. This decision was based on a number of factors, including the size of Facebook’s global annual turnover, with the EDPB stating that “the proposed fine does not adequately reflect the seriousness and severity of the infringements nor has a dissuasive effect on WhatsApp IE.”

Following its reassessment, the DPC has now imposed a fine of €225m on WhatsApp, in addition to a reprimand and “an order for WhatsApp to bring its processing into compliance by taking a range of specified remedial actions.” I ..

Support the originator by clicking the read the rest link below.