The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Data Protection Commissioner's Statement on the Frequently Asked Questions published by WhatsApp


The Data Protection Commissioner (DPC) welcomes today’s launch of Frequently Asked Questions (FAQs) by WhatsApp, as a positive step towards greater transparency for EU users of its app. The new FAQs provide information to WhatsApp users on how their data is currently being shared and matched with Facebook data.


WhatsApp updated its terms of service and privacy policy on 25 August 2016, including references to the sharing of WhatsApp user data with Facebook. As part of this update, WhatsApp presented a summary screen to users within its mobile application, and this was used to manage the consent process for the new terms of service and privacy policy.


The DPC and several other EU DPAs took action or made enquiries to WhatsApp, Facebook Ireland and Facebook Inc. within a short time of the update to the privacy policy. The substantive issues identified by the DPC were in two areas:


1) the level of clarity provided to WhatsApp users on how their data would be shared and used; and


2) the process that was used to obtain consent from WhatsApp users for this data sharing, particularly in how their WhatsApp data would be used by Facebook Ireland to determine the Facebook products and ads that would be presented to them if they were also Facebook users.


Although WhatsApp is not established in Ireland, the DPC used its existing regulatory relationship with Facebook Ireland to seek a resolution to these issues, via extensive discussions with WhatsApp and Facebook Ireland. One type of data sharing between WhatsApp and Facebook Ireland, specifically its use by Facebook Ireland to present products and ads, was not activated for EU-based WhatsApp users while these discussions were ongoing.


The FAQs launched today represent the first stage in resolving these issues, by providing more clarity and transparency to WhatsApp users on how and why their data is being shared and used. The DPC’s input has been taken into account in the preparation of the FAQs, together with the input of other Data Protection Authorities in Europe who were consulted during the drafting process.


The DPC is continuing to actively pursue a resolution of the remaining issues related to the consent process, through ongoing engagement with WhatsApp and Facebook Ireland. The DPC’s objective is the implementation of a consent process for all existing and new WhatsApp users, so that their consent is obtained in a fair, legal and transparent way that offers them a choice on how their personal data is shared and used.


The DPC is pleased that WhatsApp and Facebook Ireland have re-stated their commitment to this engagement. WhatsApp and Facebook Ireland have also confirmed that the current data sharing suspension will continue during this ongoing engagement, specifically related to data sharing for use by Facebook Ireland to present products and ads. This specific data sharing will not be activated for EU-based WhatsApp users until WhatsApp confirms the mechanism to enable this specific data sharing with the DPC.


The DPC's engagement with WhatsApp and Facebook, and any outcomes arising from that engagement, are completely without prejudice to the actions of any individual DPAs in relation to these matters.



Notes for editors:

WhatsApp Inc. was acquired by Facebook Inc. in 2014, in a transaction that was authorised by the EU Commission under the EU Merger Regulation. The authorisation was not impacted by the EU Commission’s May 2017 decision to fine Facebook €110 million for providing misleading information to the EU Commission during the original merger investigation.

Facebook Ireland Ltd. is the data controller responsible for Facebook users who live outside the US and Canada, including EU-based users. Facebook Ireland’s location in Ireland means that it is regulated by the DPC.

Any individual WhatsApp account holders with specific queries or concerns on how their personal data is being shared by WhatsApp to Facebook Ireland should contact info@dataprotection.ie.