Ireland’s Data Protection Commission DPC fined Facebook’s messaging app WhatsApp 225 million euros on September 2, 2021 for neglecting to explain the use of personal data, violating EU general data protection rules GDPR announced that it did. WhatsApp said it would appeal.
On September 2nd (local time), the DPC published the results of its survey of WhatsApp under the GDPR. As a result of the investigation, which began on December 10, 2018, DPC fined WhatsApp 225 million euros for failing to adequately explain the uses of personal information, including sharing user information with other companies, including Facebook. sentenced
The DPC, which is responsible for investigating WhatsApp, where Facebook’s European headquarters is located in Dublin, the capital of Ireland, was initially considering a €5 million fine. However, the 8 EU countries objected to the fine as too small and criticized that the investigation was taking too long, so the DPC started a dispute resolution process in accordance with Article 65 GDPR, which stipulates conflicts between regulators. As a result, the amount of fines adopted by the decision to tighten sanctions against WhatsApp has been significantly increased to 225 million euros.
The fine of 225 million euros is equivalent to 0.8% of Facebook’s 2020 sales, the second largest since the implementation of the GDPR. In July 2021, Amazon was fined €746 million, the highest so far, for misusing consumer data for advertising and violating the GDPR.
Regarding the sanctions, WhatsApp said it could not agree with the decision on the transparency it provided in 2018 and said the fine was too unfair. In addition, the company expressed its intention to appeal, saying that the company has made efforts to ensure comprehensive transparency. As the decision is based on adoption by a board representing all regulatory authorities in EU countries, WhatsApp may appeal directly to the EU Court of Justice as well as to the Irish Court.
In Ireland, in addition to Facebook, companies such as Google and Apple have European headquarters, so DPC is also responsible for investigating these companies. However, criticism from other EU regulators has been focused. For example, before the WhatsApp fine was imposed, the only sanctions against large corporations were the 450,000 euros imposed on Twitter in December 2020.
In response to these criticisms, one DPC member explained the difficult position, stating that high-tech company agendas must be handled with complexity and caution, otherwise there is a risk of overturning the results in the trial. Related information can be found here.