Facebook-owned messaging platform WhatsApp on Thursday was fined €225 million (about $267 million) by Ireland’s Data Protection Commissioner (DPC) for violating European Union’s (EU) General Data Protection Regulation (GDPR) laws.
The fine was announced in conclusion to a GDPR investigation the DPC had conducted into WhatsApp Ireland Ltd in 2018.
The DPC started its investigation on December 10, 2018, to determine whether WhatsApp had discharged its GDPR transparency obligations with regard to the provision of information and the transparency of that information to both users and non-users of WhatsApp’s service. This included information provided to data subjects about the processing of information between WhatsApp and other Facebook companies.
Following a lengthy and comprehensive investigation, the DPC submitted a draft decision to all Concerned Supervisory Authorities (CSAs) under Article 60 GDPR in December 2020, which received objections from eight CSAs.
As a result, the DPC was unable to reach a consensus with the CSAs on the subject matter of the objections, resulting in a lengthy dispute resolution process (Article 65 GDPR) on June 3, 2021.
Finally, on 28 July 2021, the European Data Protection Board (EDPB) adopted a binding decision and notified the DPC. This decision contained a clear instruction that required the DPC to reassess and increase its proposed fine on the basis of a number of factors contained in the EDPB’s decision.
Following this reassessment, the DPC imposed a fine of €225 million on WhatsApp. In addition to the imposition of an administrative fine, the DPC also imposed a reprimand along with an order for WhatsApp to bring its processing into compliance by taking a range of specified remedial actions.
WhatsApp has criticized the DPC decision and said the fine was “entirely disproportionate.” It has vowed to appeal the decision.
“We disagree with the decision today regarding the transparency we provided to people in 2018 and the penalties are entirely disproportionate. We will appeal this decision,” a WhatsApp spokesperson said.
“WhatsApp is committed to providing a secure and private service. We have worked to ensure the information we provide is transparent and comprehensive and will continue to do so.”
