WhatsApp has been ordered to stop sharing user data with parent company Facebook or face sanctions.
The French data protection agency, Commission Nationale de l’Informatique et des Libertés (CNIL), said on Monday that WhatsApp did not have a legal basis to share user data under French law for “business intelligence” purposes. The messaging app must cease data sharing within a month, paying particular attention to obtaining users’ consent.
Q&AWhat is GDPR?
Show
The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, replaced the patchwork of national data protection laws across the EU with a unified system that greatly increased the fines regulators could issue, strengthened the requirements for consent to data processing, and created a new pan-European data regulator called the European Data Protection Board.
The regulation governs the processing and storage of EU citizens' data whether or not the company has operations in the EU. To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m, or 4% of annual global turnover. In the UK, the previous maximum fine was £500,000; the post-GDPR record currently stands at more than £180m, for a data breach reported by British Airways in 2018.
Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable. Fines can also be levied against companies that act on data without explicit and informed user consent, or who fail to ensure that consent can be withdrawn at any time.
GDPR also refined and enshrined in law the concept of the "right to be forgotten", renaming it as the "right to erasure", and gave EU citizens the right to data portability, allowing them to take data from one organisation and give it to another.
The watchdog said WhatsApp had violated its obligation to cooperate with CNIL and had not properly obtained users’ consent to begin sharing their phone numbers with Facebook.
“The only way to refuse the data transfer for ‘business intelligence’ purpose is to uninstall the application,” the CNIL said in a statement.
CNIL said that it considers the transfer of some data for security purposes to be legal, but that the sharing of non-essential information to improve the function of the app was not as users were not given the possibility to opt out.
Facebook bought WhatsApp in 2014, stating that it would begin sharing data from the messaging app to the wider social network’s ecosystem in 2016.
The move, which Facebook said was not possible at the time of acquisition of the messaging app, drew warnings from data regulators over explicit consent.
In October, European Union privacy regulators rapped WhatsApp for not resolving their concerns over the sharing of user data with Facebook a year after they first issued a warning.
The European Commission fined Facebook €110m (£94m) in May for providing incorrect and misleading information on its takeover of WhatsApp.
Only small fines can be issued by European data protection authorities currently, but from May 2018 the new EU General Data Protection Regulations will come into force, permitting fines up to 4% of global turnover, which translates as €20m.
CNIL said it had repeatedly asked WhatsApp to provide a sample of French users’ data transferred to Facebook but the company had explained it could not do so as it is located in the United States and “it considers that it is only subject to the legislation of this country”.
WhatsApp said in statement: “Privacy is incredibly important to WhatsApp. It’s why we collect very little data, and encrypt every message.
“We will continue to work with the CNIL to ensure users understand what information we collect, as well as how it’s used. And we’re committed to resolving the different, and at times conflicting, concerns we’ve heard from European Data Protection Authorities with a common EU approach before the General Data Protection Regulation comes into force in May 2018.”