The Irish Data Protection Commission (DPC) has issued a €5.5 million fine against WhatsApp, for breaching data protection laws when handling users’ personal information.
According to irishtimes , the focus of the ruling is an update to the WhatsApp messaging platform’s Terms of Service to enforce the General Data Protection Regulation (GDPR) in May 2018, which requires users to agree to the terms. modified to continue using the service or risk losing access.
The complaint, filed by the Nonprofit Privacy Foundation (NOYB), alleges WhatsApp violated regulations by forcing users to consent to the app’s processing of personal data to improve services and security, thereby facilitating application access. The DPC said the platform did not have the authority to do this, adding that the data collected was in violation of the GDPR.
In addition to the fine, the messaging app was also forced to comply with the regulation for a period of six months. However, the DPC does not plan to investigate whether WhatsApp processes user data for advertising purposes.
NOYB criticized the move, saying that WhatsApp still knows who users chat with the most and at what time. This allows Meta to have a very good understanding of the social fabric around the user. From this information, the company that owns the US social networking platforms can target ads that the user’s friends are already interested in.
Notably, WhatsApp also received warnings in early 2021 when it announced a similar update to its privacy policy, requiring users to accept the changes in order to continue using the service. At this point, the European Commission has warned the company to clearly communicate to consumers about the business model of the application.
WhatsApp was also targeted by the European Union for sharing data with parent company Meta (then Facebook ) for ad targeting.
The fine comes just two weeks after the DPC fined Meta 390 million euros for processing user data to serve personalized ads on Facebook and Instagram. DPC gave Meta three months to find a legal basis to process personal data for behavioral advertising.
For its part, WhatsApp says it will appeal the decision of the Irish Data Protection Commission.