The Hamburg data protection agency has banned Facebook from processing the additional WhatsApp user data that the tech giant is granting itself access to under a mandatory update to WhatsApp\u2019s terms of service.<\/p>\n
The controversial WhatsApp privacy policy update has caused widespread confusion around the world since being announced \u2014 and already been delayed by Facebook for several months<\/a> after a major user backlash saw rivals messaging apps benefitting from an influx of angry users<\/a>.<\/p>\n The Indian government has also sought to block the changes to WhatApp\u2019s TCs in court<\/a> \u2014 and the country\u2019s antitrust authority is investigating<\/a>.<\/p>\n Globally, WhatsApp users have until May 15 to accept the new terms (after which the requirement to accept the TCs update will become persistent, per a WhatsApp FAQ<\/a>).<\/p>\n The majority of users who have had the terms pushed on them have already accepted them, according to Facebook, although it hasn\u2019t disclosed what proportion of users that is.<\/p>\n But the intervention by Hamburg\u2019s DPA could further delay Facebook\u2019s rollout of the TCs \u2014 at least in Germany \u2014 as the agency has used an urgency procedure, allowed for under the European Union\u2019s General Data Protection Regulation (GDPR), to order the tech giant not to share the data for three months.<\/p>\n A WhatsApp spokesperson disputed the legal validity of Hamburg\u2019s order \u2014 calling it \u201ca fundamental misunderstanding of the purpose and effect of WhatsApp\u2019s update\u201d and arguing that it \u201ctherefore has no legitimate basis\u201d.<\/p>\n \u201cOur recent update explains the options people have to message a business on WhatsApp and provides further transparency about how we collect and use data. As the Hamburg DPA\u2019s claims are wrong, the order will not impact the continued roll-out of the update. We remain fully committed to delivering secure and private communications for everyone,\u201d the spokesperson added, suggesting that Facebook-owned WhatsApp may be intending to ignore the order.<\/p>\n We understand that Facebook is considering its options to appeal Hamburg\u2019s procedure.<\/p>\n The emergency powers Hamburg is using can\u2019t extend beyond three months but the agency is also applying pressure to the European Data Protection Board (EDPB) to step in and make what it calls \u201ca binding decision\u201d for the 27 Member State bloc.<\/p>\n We\u2019ve reached out to the EDPB to ask what action, if any, it could take in response to the Hamburg DPA\u2019s call.<\/p>\n The body is not usually involved in making binding GDPR decisions related to specific complaints \u2014 unless EU DPAs cannot agree over a draft GDPR decision brought to them for review by a lead supervisory authority under the one-stop-shop mechanism for handling cross-border cases.<\/p>\n In such a scenario the EDPB can cast a deciding vote \u2014 but it\u2019s not clear that an urgency procedure would qualify.<\/p>\n Update: <\/strong>The EDPB confirmed the GDPR allows for a supervisory authority that\u2019s notified it of a decision to adopt provisional measures under Article 66 to request an urgent opinion or urgent binding decision from the Board \u2014 such as in the event that the DPA wants to extend the measures or make them final.<\/p>\n \u201cArt. 66 is a derogation of the GDPR\u2019s One-Stop-Shop mechanism (Art. 60) the consistency mechanism (Art. 63),\u201d an EDPB spokeswoman told us. \u201cIt is a complementary procedure that can be used when a supervisory authority considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects within its territory.\u201d<\/p>\n \u201cThe Hamburg SA has indeed notified the EDPB of its decision to adopt provisional measures,\u201d she added.<\/p>\n In taking the emergency action, the German DPA is not only attacking Facebook for continuing to thumb its nose at EU data protection rules but throwing shade at its lead data supervisor in the region, Ireland\u2019s Data Protection Commission (DPC) \u2014 accusing the latter of failing to investigate the very widespread concerns attached to the incoming WhatsApp TCs.<\/p>\n (\u201cOur request to the lead supervisory authority for an investigation into the actual practice of data sharing was not honoured so far,\u201d is the polite framing of this shade in Hamburg\u2019s press release<\/a>).<\/p>\n We\u2019ve reached out to the DPC for a response and will update this report if we get one.<\/p>\n Update:\u00a0<\/strong>A DPC spokeswoman told us: \u201cAs Hamburg has initiated this process as a derogation to the One Stop Shop, it is a matter for the Hamburg DPA to respond as to how it meets the threshold to initiate an urgency procedure. The Irish DPA draft decision in relation to WhatsApp will be dealt with through the Art 65 dispute resolution procedure under GDPR, since it was not possible to reach consensus among DPAs. Therefore it is for the Hamburg DPA in that latter context to qualify its own actions under Article 66 as a derogation to the OSS procedure already underway.\u201d<\/p>\n Ireland\u2019s data watchdog is no stranger to criticism that it indulges in creative regulatory inaction when it comes to enforcing the GDPR \u2014 with critics charging commissioner Helen Dixon and her team of failing to investigate scores of complaints and, in the instances when it has opened probes, taking years to investigate \u2014 and opting for weak enforcements at the last.<\/p>\n The only GDPR decision the DPC has issued to date against a tech giant (against Twitter, in relation to a data breach) was disputed by other EU DPAs \u2014 which wanted a far tougher penalty than the $550k fine eventually handed down<\/a> by Ireland.<\/p>\n GDPR investigations into Facebook and WhatsApp remain on the DPC\u2019s desk. Although a draft decision in one WhatsApp data-sharing transparency case was sent to other EU DPAs in January<\/a> for review \u2014 but a resolution has still yet to see the light of day almost three years after the regulation begun being applied.<\/p>\n WhatsApp-Facebook data-sharing transparency under review by EU DPAs after Ireland sends draft decision<\/a><\/p>\n<\/blockquote>\n\n In short, frustrations about the lack of GDPR enforcement against the biggest tech giants are riding high among other EU DPAs \u2014 some of whom are now resorting to creative regulatory actions to try to sidestep the bottleneck created by the one-stop-shop (OSS) mechanism which funnels so many complaints through Ireland.<\/p>\n The Italian DPA also issued a warning<\/a> over the WhatsApp TCs change, back in January \u2014 saying it had contacted the EDPB to raise concerns about a lack of clear information over what\u2019s changing.<\/p>\n At that point the EDPB emphasized that its role is to promote cooperation between supervisory authorities. It added that it will continue to facilitate exchanges between DPAs \u201cin order to ensure a consistent application of data protection law across the EU in accordance with its mandate\u201d. But the always fragile consensus between EU DPAs is becoming increasingly fraught over enforcement bottlenecks and the perception that the regulation is failing to be upheld because of OSS forum shopping.<\/p>\n That will increase pressure on the EDPB to find some way to resolve the impasse and avoid a wider break down of the regulation \u2014 i.e. if more and more Member State agencies resort to unilateral \u2019emergency\u2019 action.<\/p>\n The Hamburg DPA writes that the update to WhatsApp\u2019s terms grant the messaging platform \u201cfar-reaching powers to share data with Facebook\u201d for the company\u2019s own purposes (including for advertising and marketing) \u2014 such as by passing WhatApp users\u2019 location data to Facebook and allowing for the communication data of WhatsApp users to be transferred to third-parties if businesses make use of Facebook\u2019s hosting services.<\/p>\n Its assessment is that Facebook cannot rely on legitimate interests as a legal base for the expanded data sharing under EU law.<\/p>\n And if the tech giant is intending to rely on user consent it\u2019s not meeting the bar either because the changes are not clearly explained nor are users offered a free choice to consent or not (which is the required standard under GDPR).<\/p>\n \u201cThe investigation of the new provisions has shown that they aim to further expand the close connection between the two companies in order for Facebook to be able to use the data of WhatsApp users for their own purposes at any time,\u201d Hamburg goes on. \u201cFor the areas of product improvement and advertising, WhatsApp reserves the right to pass on data to Facebook companies without requiring any further consent from data subjects. In other areas, use for the company\u2019s own purposes in accordance to the privacy policy can already be assumed at present.<\/p>\n \u201cThe privacy policy submitted by WhatsApp and the FAQ describe, for example, that WhatsApp users\u2019 data, such as phone numbers and device identifiers, are already being exchanged between the companies for joint purposes such as network security and to prevent spam from being sent.\u201d<\/p>\n DPAs like Hamburg may be feeling buoyed to take matters into their own hands on GDPR enforcement by a recent opinion <\/a>by an advisor to the EU\u2019s top court, as we suggested in our coverage<\/a> at the time. Advocate General Bobek took the view<\/a> that EU law allows agencies to bring their own proceedings in certain situations, including in order to adopt \u201curgent measures\u201d or to intervene \u201cfollowing the lead data protection authority having decided not to handle a case.\u201d<\/p>\n The CJEU ruling on that case is still pending \u2014 but the court tends to align with the position of its advisors.<\/p>\n\n
\n