Data Privacy & Compliance
€5.5 million fined on WhatsApp
Meta’s WhatsApp has been fined by Irish Data Protection Commission (DPC) for violating the General Data Protection Regulation (GDPR). On 19th January 2023 thee Data Protection…
Meta’s WhatsApp has been fined by Irish Data Protection Commission (DPC) for violating the General Data Protection Regulation (GDPR).
On 19th January 2023 thee Data Protection Commission (“DPC”) of Irish released the following statement.
“The Data Protection Commission (“DPC”) has today announced the conclusion of an inquiry into the processing carried out by WhatsApp Ireland Limited (“WhatsApp Ireland”) in connection with the delivery of its WhatsApp service, in which it has fined WhatsApp Ireland €5.5 million (for breaches of the GDPR relating to its service). WhatsApp Ireland has also been directed to bring its data processing operations into compliance within a period of six months.”
A complaint was launch by a German data subject on 25 May2018 about the WhatsApp service. WhatsApp allegedly compelled users to accept the changes by making it a requirement to keep using the software, according to the complaint made to DPC.
Therefore, just opening the app required users to give their agreement to the use of their personal data. According to Article 7 Recitation 32 of the GDPR, user consent must be freely given, specific, informed, and unequivocal, without pressure, influence, or factors that induce imbalance in the data subject’s decision. This is against these requirements.
Following a comprehensive investigation, the DPC found that:
- WhatsApp Ireland was not clearly outlined to users, with the result that users had insufficient clarity as to what processing operations were being carried out on their personal data, for what purpose(s), and by reference to which of the six legal bases identified in Article 6 of the GDPR. The DPC considered that a lack of transparency on such fundamental matters contravened Articles 12 and 13(1)(c) of the GDPR.
“The DPC, having already imposed a very substantial fine of €225 million on WhatsApp Ireland for breaches of this and other transparency obligations over the same period of time, did not propose the imposition of any further fine or corrective measures, having done so already in a previous inquiry. “
- WhatsApp Ireland did not, in fact, rely on users’ consent as providing a lawful basis for its processing of their personal data, the “forced consent” aspect of the complaints could not be sustained. WhatsApp Ireland was not required to rely on consent.
Due to a violation of GDPR Article 6 on “lawfulness of processing,” which mandates transparency, lawfulness, and fairness in data protection processes, WhatsApp Ireland was assessed a fine of €5.5 million. In order to ascertain whether there are any violations of Article 9 of the GDPR, which deals with the “processing of special categories of personal data,” the DPC will also open a new inquiry into all of WhatsApp’s processing activities inside its service.
Source
https://thehackernews.com/2023/01/whatsapp-hit-with-55-million-fine-for.html
Recently,
Related services
How Cyber Labs can help
Related articles
All insights
Sri Lanka’s PDPA Countdown Has Begun: Compliance Priorities for Businesses
Introduction After years of delays, Sri Lanka’s Personal Data Protection Act (PDPA) has finally reached a major milestone. The Government has confirmed that key operational…
PDPA in Sri Lanka: What Businesses Still Get Wrong
You can’t secure what you don’t truly understand. When the Personal Data Protection Act No. 9 of 2022 (PDPA) was introduced, it marked a turning point in how organizations across…
DLP: The Core of Modern Cybersecurity
In 2025, organizations operate in a world where data moves freely, quickly, and often invisibly across cloud platforms, mobile devices, SaaS tools, and third-party environments.…