The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Data Protection Commissioner's Statement on the Article 29 Working Party Public Letter to WhatsApp

The Data Protection Commissioner (DPC) notes the publication of the Article 29 Working Party’s most recent letter to WhatsApp on its Terms of Service and Privacy Policy, that were updated by WhatsApp in August 2016. The DPC welcomes the letter’s useful analysis of the substantive data protection issues that were raised by the Privacy Policy.

The DPC is continuing to engage directly with WhatsApp and Facebook Ireland in resolving the same issues. This engagement builds on the positive step that was taken by WhatsApp in August 2017 in launching its Frequently Asked Questions (FAQs), following extensive discussions with the DPC over several months. The DPC’s statement on these FAQs is available here, including the improved clarity and transparency now available to WhatsApp users on how their data is being shared and used:
August statement by Commissioner

The DPC is also pleased that WhatsApp and Facebook Ireland have re-confirmed that the current data sharing suspension will continue during this ongoing engagement with the DPC, specifically related to data sharing for use by Facebook Ireland to present products and ads. This specific data sharing will not be activated for EU-based WhatsApp users until WhatsApp confirms the mechanism to enable this specific data sharing with the DPC.

The DPC's engagement with WhatsApp and Facebook, and any outcomes arising from that engagement, are completely without prejudice to the actions of any other individual Data Protection Authority in relation to this matter or of the taskforce formed by the Article 29 Working Party to discuss this matter.


Graham Doyle,
Head of Communications,
Office of the Data Protection Commissioner,
21 Fitzwilliam Square South,
Dublin 2.
087-9392359 / 0761104750