After the introduction of the GDPR (Data Protection Regulation), WhatsApp asked users to accept updated terms of use in 2018. Following a complaint, the Irish data protection authority Data Protection Commission (DPC) took action. Their responsibility is derived from the location of the European WhatsApp headquarters in Dublin. The DPC now partially agreed with the complainants in a differentiated decision and imposed a fine of 5.5 million euros on WhatsApp.
The complaint allegation
The trigger was a complaint from May 2018. At that time, WhatsApp asked all users within the EU to accept updated terms of use in order to be able to continue using the messenger after the introduction of the GDPR.
The complaint in 2018 accused WhatsApp of using consent to the new terms of use “as a legal basis for processing user data.” In fact, the new terms of use are linked to the obligation to release user data, since rejection of these terms also means exclusion from the use of the short message service.
This, in turn, according to Bleeping Computer, violate Article 7 , Recital 32 of the GDPR, which requires that the user's consent must be given freely and on a specific, informed and unambiguous basis, without pressure, influence or elements that create an imbalance in the decision of the person concerned.
The decision of the DPC
After a comprehensive investigation, the DPC concluded:
- WhatsApp Ireland has not clearly set out the legal basis or express grounds for the requested processing of user data, in breach of Articles 12 and 13 of the GDPR.
- WhatsApp Ireland did not breach Article 7 for forced consent because the service did not rely on the user's consent to provide its service or use it as a lawful basis for processing user personal data.
The first point will not entail any additional penalties as the DPC has already imposed heavy fines on WhatsApp for the same reasons. ( Here )
“The DPC, which had already imposed a very large fine of €225 million on WhatsApp Ireland for breaches of this and other transparency obligations over the same period, did not propose imposing further fines or corrective measures as it had already done so in a previous investigation had".
DPC
Regarding the second point, the DPC's rejection of the German complainant's claims does not end the case for WhatsApp, as the German regulator will now also examine the complaint.
Why the fine now?
The €5.5 million fine against WhatsApp Ireland is ultimately imposed for a breach of Article 6 of the GDPR on “lawfulness of processing”, which requires transparency, lawfulness and fairness in data protection processes. WhatsApp now has six months to bring its internal data processing into compliance with the applicable legal situation. If this deadline is not met, a further penalty will be imposed.
WhatsApp objects
Upon request, WhatsApp told BleepingComputer that the company plans to appeal the decision because, from the company's perspective, the service operates in accordance with the law. Below is the full comment from a WhatsApp spokesperson on the DPC's decision:
“WhatsApp is leading the private messaging industry by providing end-to-end encryption and privacy layers that keep people safe. We firmly believe that the functioning of the service is both technically and legally compliant.
We rely on the contractual need to improve the Service and for security purposes because we believe that supporting the safety of people and offering an innovative product is a fundamental responsibility in the operation of our Service. We disagree with the decision and intend to appeal.”
Whatsapp
More exams
The review by the DPC has not yet been completed; further reviews will be initiated. The Irish Data Protection Authority wants to determine whether WhatsApp collects and processes sensitive data for behavioral advertising and marketing purposes and whether this data is also passed on to third parties.
In this context, things will also be interesting in the future. As has just been announced, the user settings for Facebook, Instagram and Messenger will in future be managed in a common account manager. The new feature is currently being rolled out. Mimikama reports. ( Here ) Data protection issues arise here due to the necessary linking of the individual accounts.
WhatsApp doesn't play a role here at the moment. It remains exciting to see how Meta plans the future here and whether WhatsApp will move even closer to the other Meta platforms. And what data protection experts think about it.
Source:
DPC , Bleeping Computer
Already read? A Mimikama fact check: Ban on electric cars on Norwegian ferries?
If you enjoyed this post and value the importance of well-founded information, become part of the exclusive Mimikama Club! Support our work and help us promote awareness and combat misinformation. As a club member you receive:
📬 Special Weekly Newsletter: Get exclusive content straight to your inbox.
🎥 Exclusive video* “Fact Checker Basic Course”: Learn from Andre Wolf how to recognize and combat misinformation.
📅 Early access to in-depth articles and fact checks: always be one step ahead.
📄 Bonus articles, just for you: Discover content you won't find anywhere else.
📝 Participation in webinars and workshops : Join us live or watch the recordings.
✔️ Quality exchange: Discuss safely in our comment function without trolls and bots.
Join us and become part of a community that stands for truth and clarity. Together we can make the world a little better!
* In this special course, Andre Wolf will teach you how to recognize and effectively combat misinformation. After completing the video, you have the opportunity to join our research team and actively participate in the education - an opportunity that is exclusively reserved for our club members!
Notes:
1) This content reflects the current state of affairs at the time of publication. The reproduction of individual images, screenshots, embeds or video sequences serves to discuss the topic. 2) Individual contributions were created through the use of machine assistance and were carefully checked by the Mimikama editorial team before publication. ( Reason )

