Enforcement · Data Protection Authority of Ireland EN LLM context

WhatsApp Ireland Ltd.: Insufficient legal basis for data processing

The Irish DPA (DPC) has fined WhatsApp Ireland Ltd.

€5,500,000 Fine

WhatsApp Ireland Ltd.

IRELAND

Art. 6 GDPR Art. 12 GDPR Art. 13 GDPR

Fairness & Transparency Consent Personal Data Supervision Supervisory Authorities

Jan 19, 2023 Source dataprotection.ie

Full text 3 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The Irish DPA (DPC) has fined WhatsApp Ireland Ltd. EUR 5.5 million. The Austrian organization 'None of Your Business' (NOYB) had filed a complaint with the DPA on behalf of an individual. WhatsApp had updated its terms of service shortly before the GDPR came into force. In its new terms of service, WhatsApp informed its users to click 'Agree and Continue' to indicate their agreement with the new terms of service. This was required for further access to the services. WhatsApp assumed that the acceptance of the updated terms of use constituted a contract between WhatsApp and the user, since the processing of the data would be necessary for the provision as well as the improvement of the services. According to WhatsApp, the data processing was therefore lawful pursuant to Art. 6 (1) b) GDPR. However, the complainant argued that WhatsApp was actually trying to rely on consent as a legal basis for processing users' data.

Consent Supervisory Authorities applies Art. 6(1)

By making the access to its services conditional on users' consent to the updated terms of service, WhatsApp was forcing users to consent to the processing of their personal data. Following the investigation, the DPC submitted a draft decision under Art. 60 GDPR to other European supervisory authorities concerned. The DPC found that WhatsApp did not rely on user consent as a legal basis, and did not consider 'coerced consent' in this case. It also did not rule out the possibility that WhatsApp relied on a contractual legal basis. In response, the DPC received objections from different supervisory authorities. However, the DPC found that WhatsApp had breached its transparency obligations under the GDPR, by not clearly explaining to users for what purpose and on what legal basis their personal data would be processed. As no agreement could be reached on the disputed points, the DPC initiated a dispute resolution procedure pursuant to Art. 65 GDPR.

Supervision Personal Data Consent applies Art. 60 Art. 65

In its decision, the EDPB confirmed the violation of transparency obligations by WhatsApp. However, the EDPB took a different position than the DPC on the issue of the legal basis and found that WhatsApp was not entitled to rely on a contractual legal basis. The EDPB therefore found that WhatsApp had violated Art. 6 (1) GDPR. The DPC agreed in its final decision and imposed the fine and also required WhatsApp to bring its data processing into compliance within three months. The DPC agreed in its final decision and imposed the fine and also required WhatsApp to bring its data processing into compliance within six months. GDPR Articles: Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 (1) c) GDPR Industry: Media, Telecoms and Broadcasting

Transparency applies Art. 6(1)Art. 13(1)Art. 12

How it connects

3 of 3 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 7

Related across sources

HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). ·CJEU Jan 9, 2025 IP Address Retention Period Identification

C-154/21 RW v Österreichische Post AG The Court of Justice of the European Union (First Chamber), in response to a preliminary reference from the Oberster Gerichtshof (Austrian Supreme Court), interpreted Article… CJEU ·First Chamber Jan 12, 2023 Right of Access Personal Data Recipient

C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… CJEU ·First Chamber Feb 27, 2025 Profiling Automated Decision-Making Marketing

C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) CJEU Jan 12, 2023 Supervisory Authorities IP Address Supervision

CJEU: Processing of beneficiary data not based on consent; individuals must be informed Purpose for processing: The legislation at issue does base the processing on consent. Rather, it provides that they are to be informed. Thus, processing is not based on their… Nov 9, 2010 Consent Personal Data Right to Restriction

C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" CJEU Jan 7, 2026 Personal Data Fairness & Transparency Controllers