Facebook\u2019s lead regulator in the European Union must \u201cswiftly\u201d investigate the legality of data sharing related to a controversial WhatsApp policy update, following an order by the European Data Protection Board (EDPB).<\/p>\n
We\u2019ve reached out to the Irish Data Protection Commission (DPC) for a response. (Update:\u00a0<\/strong>See below for their statement.)<\/p>\n Updated terms had been set to be imposed upon users of the Facebook-owned messaging app early this year \u2014 but in January<\/a> Facebook delayed the WhatsApp terms update until May after a major privacy backlash and ongoing confusion over the details of its user data processing.<\/p>\n Despite WhatsApp going ahead with the policy update, the ToS has continued to face scrutiny from regulators and rights organizations around the world.<\/p>\n The Indian government, for example, has repeatedly<\/a>\u00a0ordered<\/a>\u00a0Facebook to withdraw the new terms. While, in Europe, privacy regulators<\/a> and consumer protection organizations<\/a> have raised objections about how opaque terms are being pushed on users \u2014 and in May<\/a> a German data protection authority issued a temporary (national) blocking order.<\/p>\n Today\u2019s development follows that and is significant as it\u2019s the first urgent binding decision adopted by the EDPB under the bloc\u2019s General Data Protection Regulation (GDPR).<\/p>\n Although the Board has not<\/em> agreed to order the adoption of final measures against Facebook-WhatsApp as the requesting data supervisor, the Hamburg DPA, had asked \u2014 saying that \u201cconditions to demonstrate the existence of an infringement and an urgency are not met\u201d.<\/p>\n The Board\u2019s intervention in the confusing mess around the WhatsApp policy update follows the use of GDPR Article 66 powers by Hamburg\u2019s data protection authority.<\/p>\n In May <\/a>the latter ordered Facebook not to apply the new terms to users in Germany \u2014 saying its analysis found the policy granted \u201cfar-reaching powers\u201d to WhatsApp to share data with Facebook, without it being clear what legal basis the tech giant was relying upon to be able to process users\u2019 data.<\/p>\n Hamburg also accused the Irish DPC of failing to investigate the Facebook-WhatsApp data sharing when it raised concerns \u2014 hence seeking to take matters into its own hands by making an Article 66 intervention.<\/p>\n As part of the process it asked the EDPB to take a binding decision \u2014 asking it to take definitive steps to block data-sharing between WhatsApp and Facebook \u2014 in a bid to circumvent the Irish regulator\u2019s glacial procedures by getting the Board to order enforcement measures that could be applied stat across the whole bloc.<\/span><\/p>\n However, the Board\u2019s assessment found that Hamburg had not met the bar for demonstrating the Irish DPC \u201cfailed to provide information in the context of a formal request for mutual assistance under Article 61 GDPR\u201d, as it puts it.<\/p>\n It also decided that the adoption of updated terms by WhatsApp \u2014 which it nonetheless says \u201ccontain similar problematic elements as the previous version\u201d \u2014 cannot \u201con its own\u201d justify the urgency for the EDPB<\/span> to order the lead supervisor to adopt final measures under Article 66(2) GDPR.<\/p>\n The upshot \u2014 as the Hamburg DPA puts it \u2014 is that data exchange between WhatsApp and Facebook remains \u201cunregulated at the European level\u201d.<\/p>\n Facebook ordered not to apply controversial WhatsApp TCs in Germany<\/a><\/p>\n<\/blockquote>\n\n The importance of Article 66 of the GDPR is that it allows EU data protection authorities to derogate from the regulation\u2019s one-stop-shop mechanism \u2014 which otherwise funnels cross border complaints (such as those against Big Tech) via a lead data supervisor (oftentimes the Irish DPC), and is thus widely seen as a bottleneck to effective enforcement of data protection (especially against tech giants).<\/p>\n An Article 66 urgency proceeding allows any<\/em> data supervisor across the EU to immediately adopt provisional measures \u2014 provided a situation meets the criteria for this kind of emergency intervention. Which is one way to get around a bottleneck, even if only for a time-limited period.<\/span><\/p>\n A number of EU data protection authorities have used (or threatened to use<\/a>) Article 66 powers in recent years, since GDPR came into application in 2018, and the power is increasingly proving its worth in reconfiguring certain Big Tech practices \u2014 with, for example, Italy\u2019s DPA using it recently to force TikTok<\/a> to remove hundreds of thousands of suspected underage accounts.<\/p>\n Just the threat of Article 66\u2019s use back in 2019<\/a> (also by Hamburg) was enough to encourage Google to suspend manual reviews of audio reviews of recordings captured by its voice AI, Google Assistant. (And later led to a number of major policy changes by several tech giants who had similarly been manually reviewing users\u2019 interactions with their voice AIs.)<\/p>\n At the same time, Article 66 provisional measures can only last three months \u2014 and only apply nationally, not across the whole EU. So it\u2019s a bounded power. (Perhaps especially in this WhatsApp-Facebook case, where the target is a ToS update, and Facebook could just wait out the three months and apply the policy anyway in Germany after the suspension order lapses.)<\/p>\n This is why Hamburg wanted the EDPB to make a binding decision. And it\u2019s certainly a blow to privacy watchers eager for GDPR enforcement to fall on tech giants like Facebook that the Board has declined to do so in this case.<\/p>\n Responding to the Board\u2019s decision not to impose definitive measures to prevent data sharing between WhatsApp and Facebook, the Hamburg authority expressed disappointment \u2014 see below for its full statement \u2014 and also lamented that the EDPB has not set a deadline for the Irish DPC to conduct the investigation into the legal basis of the data sharing.<\/p>\n Ireland\u2019s data protection authority has only issued one final GDPR decision against a tech giant to date (Twitter<\/a>) \u2014 so there is plenty of cause to be concerned that without a concrete deadline the ordered probe could be kicked down the road for years.<\/p>\n Nonetheless, the EDPB\u2019s order to the Irish DPC to \u201cswiftly\u201d investigate the finer-grained detail of the Facebook-WhatsApp data sharing does look like a significant intervention by a pan-EU body \u2014 as it very publicly pokes a regulator with a now infamous reputation for reluctance to actually do the job of rigorously investigating privacy concerns.\u00a0<\/span><\/p>\n Demonstrably it has failed to do so in this WhatsApp case. Despite major concerns being raised about the policy update \u2014 within Europe and globally \u2014 Facebook\u2019s lead EU data supervisor did not open a formal investigation and has\u00a0not raised any public objections to the update.<\/p>\n Back in January when we asked about concerns over the update, the DPC told TechCrunch it had obtained a \u201cconfirmation\u201d from Facebook-owned WhatsApp that there was no change to data-sharing practices that would affect EU users \u2014 reiterating Facebook\u2019s line that the update didn\u2019t change anything, ergo \u201cnothing to see here\u201d.\u00a0<\/span><\/p>\n \u201cThe updates made by WhatsApp last week are about providing clearer, more detailed information to users on how and why they use data. WhatsApp have confirmed to us that there is no change to data-sharing practices either in the European Region or the rest of the world arising from these updates,\u201d the DPC told us then, although it also noted that it had received \u201cnumerous queries\u201d from stakeholders who it described as \u201cconfused and concerned about these updates\u201d, mirroring Facebook\u2019s own characterization of complaints.<\/p>\n \u201cWe engaged with WhatsApp on the matter and they confirmed to us that they will delay the date by which people will be asked to review and accept the terms from February 8th to May 15th,\u201d the DPC went on, referring to a pause in the ToS application deadline which Facebook enacted after a public backlash that saw scores of users signing up to alternative messaging apps, before adding: \u201cIn the meantime, WhatsApp will launch information campaigns to provide further clarity about how privacy and security works on the platform. We will continue to engage with WhatsApp on these updates.\u201d<\/p>\n The EDPB\u2019s assessment of the knotty WhatsApp-Facebook data-sharing terms looks rather different \u2014 with the Board calling out WhatsApp\u2019s user communications as confusing and simultaneously raising concerns about the legal basis for the data exchange.<\/p>\n In a press release, the EDPB writes that there\u2019s a \u201chigh likelihood of infringements\u201d \u2014 highlighting purposes contained in the updated ToS in the areas of \u201csafety, security and integrity of WhatsApp IE [Ireland] and the other Facebook Companies, as well as for the purpose of improvement of the products of the Facebook Companies\u201d as being of particular concern.<\/p>\n From the Board\u2019s PR [emphasis its]:<\/p>\n Considering the high likelihood of infringements in particular for the purpose of safety, security and integrity of WhatsApp IE [Ireland] and the other Facebook Companies, as well as for the purpose of improvement of the products of the Facebook Companies, the EDPB considered that this matter requires swift further investigations. In particular to verify if, in practice, Facebook Companies are carrying out processing operations which imply the combination or comparison of WhatsApp IE\u2019s [Ireland] user data with other data sets processed by other Facebook Companies in the context of other apps or services offered by the Facebook Companies, facilitated inter alia<\/i> by the use of unique identifiers. For this reason, the EDPB requests the IE <\/b>SA <\/b>[Irish supervisory authority] to carry out, as a matter of priority, a statutory investigation<\/b> to determine whether such processing activities are taking place or not, and if this is the case, whether they have a proper legal basis under Article 5(1)(a) and Article 6(1) GDPR.<\/p>\n<\/blockquote>\n NB: It\u2019s worth recalling that WhatsApp users were initially told they must accept the updated policy or else the app would stop working. (Although Facebook later changed its approach \u2014 after the public backlash.) While WhatsApp users who still haven\u2019t accepted the terms continue to be nagged to do so via regular pop-ups, although the tech giant does not appear to be taking steps to degrade the user experience further as yet (i.e. beyond annoying, recurring pop-ups).<\/p>\n The EDPB\u2019s concerns over the WhatsApp-Facebook data sharing extend to what it says is \u201ca lack of information around how data is processed for marketing purposes, cooperation with the other Facebook Companies and in relation to WhatsApp Business API\u201d \u2014 hence its order to Ireland to fully investigate.<\/p>\n The Board also essentially confirms the view that WhatsApp users themselves have no hope of understanding what Facebook is doing with their data by reading the comms material it has provided them with \u2014 with the Board writing [emphasis ours]:<\/p>\n Based on the evidence provided, the EDPB concluded that there is a high likelihood that Facebook IE [Ireland] already processes WhatsApp IE [Ireland] user data as a (joint) controller for the common purpose of safety, security and integrity of WhatsApp IE [Ireland] and the other Facebook Companies, and for the common purpose of improvement of the products of the Facebook Companies. However, in the face of the various contradictions, ambiguities and uncertainties noted in WhatsApp\u2019s user-facing information<\/strong>, some written commitments adopted by Facebook IE [Ireland] and WhatsApp IE\u2019s [Ireland] written submissions, the EDPB concluded that it is not in a position to determine with certainty which processing operations are actually being carried out and in which capacity<\/strong>.<\/p>\n<\/blockquote>\n We contacted Facebook for a response to the EDPB\u2019s order, and the company sent us this statement \u2014 attributed to a WhatsApp spokesperson:<\/p>\n We welcome the EDPB\u2019s decision not to extend the Hamburg DPA\u2019s order, which was based on fundamental misunderstandings as to the purpose and effect of the update to our terms of service. We remain fully committed to delivering secure and private communications for everyone and will work with the Irish Data Protection Commission as our lead regulator in the region in order to fully address the questions raised by the EDPB.<\/p>\n<\/blockquote>\n Facebook also claimed it has controls in place for \u201ccontroller to processor data sharing\u201d (i.e. between WhatsApp and Facebook) \u2014 which it said prohibit it (Facebook) from using WhatsApp user data for its own purposes.<\/p>\n The tech giant went on to reiterate its line that the update does not expand WhatsApp\u2019s ability to share data with Facebook.<\/p>\n WhatsApp delays enforcement of privacy terms by 3 months, following backlash<\/a><\/p>\n<\/blockquote>\n\n A further vital component to this saga is the fact the Irish DPC has, for years, been investigating long-standing complaints against WhatsApp\u2019s compliance with GDPR\u2019s transparency requirements \u2014 and still hasn\u2019t issued a final decision.<\/p>\n So when the EDPB says it\u2019s highly likely that some of the WhatsApp-Facebook data-processing being objected to is already going on it doesn\u2019t mean Facebook gets a pass for that \u2014 because the DPC hasn\u2019t issued a verdict on whether or not WhatsApp has been up front enough with users.<\/p>\n tl;dr: The regulatory oversight process is still<\/em> ongoing.<\/p>\n The DPC provisionally concluded its WhatsApp transparency investigation last year \u2014 saying in January that it sent a draft decision to the other EU data protection authorities for review (and the chance to object) on December 24, 2020; a step that\u2019s required under the GDPR\u2019s co-decision-making process.<\/p>\n In January, when it said it was still waiting to receive comments on the draft decision, it also said: \u201cWhen the process is completed and a final decision issues, it will make clear the standard of transparency to which WhatsApp is expected to adhere as articulated by EU Data Protection Authorities.\u201d<\/p>\n Over a half a year later and WhatsApp users in the EU are still waiting to find out whether the company\u2019s comms lives up to the required legal standard of transparency or not \u2014 with their data continuing to pass between Facebook and WhatsApp in the meanwhile.<\/p>\n The Irish DPC was contacted for comment on the EDPB\u2019s order today and with questions on the current status of the WhatsApp transparency investigation.<\/p>\n It told us it would have a response later today \u2014 we\u2019ll update this report when we get it.<\/p>\n Update:<\/strong> The DPC\u2019s deputy commissioner Graham Doyle said [emphasis his]:<\/p>\n This Article 66 procedure was about whether the EDPB on request from Hamburg would take final measures confirming the provisional measures applied by the Hamburg SA against Facebook. The EDPB decision decided not to take measures as insufficient evidence to ground such measures was presented by the Hamburg SA.<\/p>\n Measures, had they been decided by the Board, would not<\/u> in any case be measures that would be adopted by the Irish DPC. They would be measures adopted by the EDPB. This is a decision of the Board based on a request from Hamburg SA under a provision that is a derogation<\/u> to the cooperation and consistency mechanism.<\/p>\n The DPC, of course, has already carried out an in-depth inquiry into WhatsApp\u2019s privacy policy user facing material in the context of its transparency inquiry. That inquiry reached the Article 60 (co-decision making) stage in December 2020 and is now progressing through the dispute resolution procedure. The Hamburg SA has been actively involved in the decision-making process since December 2020 and the dispute resolution process (which commenced in June) is an EDPB-led initiative, involving all other supervisory authorities.<\/p>\n The DPC notes the request of the Board and will give consideration to any appropriate regulatory follow-up where it identifies matters canvassed in the EDPB decision have not already been addressed in the Article 60 draft decision transmitted by the DPC (and now currently with the Board under Article 65).<\/p>\n The DPC also has a separate, complaint-based inquiry ongoing that considers the legal basis that WhatsApp relies upon for processing. That inquiry is also at an advanced stage.<\/p>\n<\/blockquote>\n Back in November the Irish Times<\/a> reported that WhatsApp Ireland had set aside \u20ac77.5 million for \u201cpossible administrative fines arising from regulatory compliance matters presently under investigation\u201d. No fines against Facebook have yet been forthcoming, though.<\/p>\n Indeed, the DPC has yet to issue a single final GDPR decision against Facebook (or a Facebook-owned company) \u2014 despite more than three years having passed since the regulation started being applied.<\/p>\n Scores of GDPR complaints against the Facebook\u2019s data-processing empire \u2014 such as this May 2018 complaint against Facebook, Instagram and WhatsApp\u2019s use of so-called \u201cforced consent\u201d <\/a>\u2014 continue to languish without regulatory enforcement in the EU because there\u2019s been no decisions from Ireland (and sometimes no investigations either).<\/p>\n The situation is a huge black mark against the EU\u2019s flagship data protection regulation. So the Board\u2019s failure to step in more firmly now \u2014 to course-correct \u2014 does look like a missed opportunity to tackle a problematic GDPR enforcement bottleneck.<\/p>\n That said, any failure to follow the procedural letter of the law could invite a legal challenge that unpicked any progress. So it\u2019s hard to see any quick wins in the glacial game of GDPR enforcement.<\/p>\n In the meanwhile, the winners of the stalemate are of course the tech giants who get to continue processing people\u2019s data how they choose, with plenty of time to work on reconfiguring their legal, business and system structures to route around any enforcement damage that does eventually come.<\/p>\n Hamburg\u2019s deputy commissioner for data protection, Ulrich K\u00fchn, essentially warns as much in a statement responding to the EDPB\u2019s decision in a statement \u2014 in which he writes:<\/p>\n The decision of the European Data Protection Board is disappointing. The body, which was created to ensure the uniform application of the GDPR throughout the European Union, is missing the opportunity to clearly stand up for the protection of the rights and freedoms of millions of data subjects in Europe. It continues to leave this solely to the Irish supervisory authority. Despite our repeated requests over more than two years to investigate and, if necessary, sanction the matter of data exchanges between WhatsApp and Facebook, the IDPC has not taken action in this regard. It is a success of our efforts over many years that IDPC is now being urged to conduct an investigation. Nonetheless, this non-binding measure does not do justice to the importance of the issue. It is hard to imagine a case in which, against the background of the risks for the rights and freedoms of a very large number of data subjects and their de facto powerlessness vis-\u00e0-vis monopoly-like providers, the urgent need for concrete action is more obvious. The EDPB is thus depriving itself of a crucial instrument for enforcing the GDPR throughout Europe. This is no good news for data subjects and data protection in Europe as a whole.<\/p>\n<\/blockquote>\n In further remarks the Hamburg authority emphasizes that the Board noted \u201cconsiderable inconsistencies between the information with which WhatsApp users are informed about the extensive use of their data by Facebook on the one hand, and on the other the commitments made by the company to data protection authorities not (yet) to do so\u201d; and also that it \u201cexpressed considerable doubts about the legal basis on which Facebook intends to rely when using WhatsApp data for its own or joint processing\u201d \u2014 arguing that the Board therefore agrees with the \u201cessential parts\u201d of its arguments against WhatsApp-Facebook data sharing.<\/p>\n Despite carrying that weight of argument, the call for action is once again back in Ireland\u2019s court.<\/p>\n\n
Article 66 powers<\/h2>\n
Unregulated data sharing<\/h2>\n
\n
\n
\n
\n
GDPR enforcement stalemate<\/h2>\n
\n
\n
\n