WhatsApp Ireland has been hit with a huge fine by the Data Protection Commission (DPC) amounting to Kshs 29 billion (€225 million) for infringing on data protection rules.
The DPC acts as the lead supervisory authority for WhatsApp across Europe.
This fine makes it the second-largest penalty ever imposed on an organization under the European Union data laws, and the largest penalty given by the DPC.
The largest GDPR penalty currently stands at Kshs 97 billion (€746 million) and was imposed earlier this year on Amazon by authorities in Luxembourg.
WhatsApp on its end has already stated it will appeal the ruling, mentioning it disagrees with the decision and the penalties imposed are entirely disproportionate.
European Union data protection laws
The investigation by the DPC on WhatsApp was started three years ago following the rules on data protection being brought into force by the European Union
The inquiry sought to find out whether WhatsApp had met its obligations under the General Data Protection Regulation (GDPR) regarding the provision of information and the transparency of that information to both users and non-users of WhatsApp’s services.
This included the transparency of information provided to users about the processing of their data between WhatsApp and other Facebook companies.
The DPC concluded its investigation in December 2020 and sent its draft decision to the other European data regulators for review and consideration as required by the GDPR.
After review, 8 of around 40 of these regulators disagreed with the conclusions, including the DPC’s fine of up to Kshs 6.5 billion (€50 million).
Record fine imposed on WhatsApp
Following the failure by the DPC to reach a uniform decision with the other regulators on how to move forward, the case was forwarded to the European Data Protection Board (EDPB) earlier this year, and it made its binding ruling at the end of July, which the DPC must now enforce.
“This decision contained a clear instruction that required the DPC to reassess and increase its proposed fine on the basis of a number of factors contained in the EDPB’s decision and following this reassessment the DPC has imposed a fine of €225 million on WhatsApp,” the DPC said in a statement.
“In addition to the imposition of an administrative fine, the DPC has also imposed a reprimand along with an order for WhatsApp to bring its processing into compliance by taking a range of specified remedial actions.”
WhatsApp Ireland, which had already set aside Kshs 10 billion (€77.5 million) for a possible fine, has already said it does not agree with the decision and is committed to providing a secure and private service.
“We have worked to ensure the information we provide is transparent and comprehensive and will continue to do so,” said a WhatsApp spokesperson.
“We disagree with the decision today regarding the transparency we provided to people in 2018 and the penalties are entirely disproportionate. We will appeal this decision,” the spokesman added.
WhatsApp believes the fine is about the level of detail provided in its 2018 privacy policy, rather than the data sharing policies.
An appeal that would more likely focus on the size of the fine can be made either to the Irish High Court or directly to the European Court of Justice.
Comments 1