Decision concerning WhatsApp Ireland Ltd.

(IN-18-12-2)

Date of Decision: 20 August 2021

This inquiry, which was commenced by the Data Protection Commission (DPC) on 10 December 2018, examined whether WhatsApp Ireland Ltd had discharged its GDPR transparency obligations with regard to the provision of information and the transparency of that information to both users and non-users of WhatsApp’s service. This includes information provided to data subjects about the processing of information between WhatsApp and other Facebook companies.

Articles 60 & 65 of the GDPR

Following a lengthy and comprehensive investigation, the DPC submitted a draft decision to all Concerned Supervisory Authorities (CSAs) under Article 60 GDPR in December 2020. The DPC subsequently received objections from eight CSAs. The DPC was unable to reach consensus with the CSAs on the subject matter of the objections and triggered the dispute resolution process (Article 65 GDPR) on 3 June 2021.

Reassessment following EDPB binding decision

On 28 July 2021, the European Data Protection Board (EDPB) adopted a binding decision and this decision was notified to the DPC. This decision contained a clear instruction that required the DPC to reassess and increase its proposed fine on the basis of a number of factors contained in the EDPB's decision. Following this reassessment, the DPC imposed a fine of €225 million on WhatsApp.

In addition to the imposition of an administrative fine, the DPC also imposed a reprimand along with an order for WhatsApp to bring its processing into compliance by taking a range of specified remedial actions.

The EDPB has published the Article 65 decision and the final decision on its website. Binding decision 1/2021 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding WhatsApp Ireland under Article 65(1)(a) GDPR

For more information, you can download a copy of the full decision at this link: WhatsApp Ireland Ltd. 2021 (PDF, 18.4 MB).