6 September 2021
The highest fine under GDPR to date
The €225 million fine issued by the Irish Data Protection Commission (DPC) was approved by the European Data Protection Board (EDPB). The fine is 4.5 times higher than the original draft fine issued by the DPC in December 2020.
After two years of investigation, the DPC fined WhatsApp for what it considered as lack of transparency in the way the service provider shared user’s data in violation of Article 14 of GDPR, which states that data controllers must provide data subjects with sufficient information about the way data is collected and processed. The DPC found that the instant messaging service provider was unclear about the way it processed its users’ data as well as sharing the data with Facebook and other Facebook-owned companies.
The EDPB’s published summary states that the Article 14 of the GDPR infringements were “very serious in nature” and “severe in gravity”, amounting “to a high degree of negligence”.
The DPC was chosen as the lead supervisory authority since WhatsApp’s headquarters are in Ireland. Under the one-stop-shop principle the DPC had issued a provisional €50 million fine which was submitted for approval by the other European supervisory authorities. Eight of the DPC’s counterparts raised a dispute and in July the EDPB issued a binding decision with a “clear instruction” for the Irish supervisory authority to increase its provisional fine.
The DPC is understood to be also investigating more than 10 complaints against Facebook-owned companies alone, besides others against other big tech companies.
A spokesperson for the service provider was reported to have said “We disagree with the decision today regarding the transparency we provided to people in 2018 and the penalties are entirely disproportionate. We will appeal this decision.” WhatsApp further added that the company had worked to ensure the information it provides is transparent and comprehensive and will continue to do so. So far this is the highest fine issued under GDPR although it might soon be surpassed if Amazon’s provisional fine of €746 million issued by Luxembourg’s supervisory authority is finalised.