WhatsApp Ireland Ltd

the DPC has fined WhatsApp Ireland €5.5 million (for breaches of the GDPR relating to its service). WhatsApp Ireland was also directed to bring its data processing operations into compliance within a period of six months. The inquiry concerned a complaint made on 25 May, 2018 by a German data subject about the WhatsApp service. In advance of 25 May 2018, the date on which the GDPR came into operation, WhatsApp Ireland updated its Terms of Service, and informed users that if they wished to continue to have access to the WhatsApp service following the introduction of the GDPR, existing (and new) users were asked to click “agree and continue” to indicate their acceptance of the updated Terms of Service. (The services would not be accessible if users declined to do so). WhatsApp Ireland considered that, on accepting the updated Terms of Service, a contract was entered into between WhatsApp Ireland and the user. It also took the position that the processing of users’ data in connection with the delivery of its service was necessary for the performance of that contract, to include the provision of service improvement and security features, so that such processing operations were lawful by reference to Article 6(1)(b) of the GDPR (the “contract” legal basis for processing). The complainant contended that, contrary to WhatsApp Ireland’s stated position, WhatsApp Ireland was in fact seeking to rely on consent to provide a lawful basis for its processing of users’ data.

Introduction ................................................................................................................................ 7 Basis of Inquiry .................................................................................................................................... 7 Competence of the Commission ......................................................................................................... 8 The Inquiry ........................................................................................................................................ 10 Approach of the Decision-Maker ...................................................................................................... 10 Progression of the Decision-Making Stage ................................................................................... 11 Part 1: Transparency in the Context of Non-Users ....................................................................... 13 Introduction ...................................................................................................................................... 13 Relevant Provisions ....................................................................................................................... 13 The Inquiry Stage .............................................................................................................................. 13 The Decision-Making Stage ............................................................................................................... 18 Relevant Background and Findings of Fact ................................................................................... 18 The Questions for Determination ................................................................................................. 20 Legal Analysis – Questions (a) and (b) .......................................................................................... 21 Analysis and Discussion: Does the phone number of a non-user, prior to the application of the lossy hashing process, constitute the personal data of that non-user? ........................................... 28 Finding: Does the phone number of a non-user, before the application of the lossy hashing process, constitute the personal data of that non-user? ................................................................. 36 Analysis and Discussion: Does the phone number of a non-user, after the application of the lossy hashing process, constitute the personal data of that non-user? .................................................... 36 Finding: Does the phone number of a non-user, after the application of the lossy hashing process, constitute the personal data of that non-user? ............................................................................... 40 Relevant Background and Legal Analysis – Question (c) .............................................................. 40 The Test to be Applied .................................................................................................................. 47 Analysis and Discussion: When processing the personal data of non-users, does WhatsApp do so as a data controller or a data processor? ......................................................................................... 54 Finding: When processing the personal data of non-users, does WhatsApp do so as a data controller or a data processor? ......................................................................................................... 55 Consequent Assessment of Compliance with the Requirements of Article 14 ............................