The main thing is that WhatsApp changed some processing from relying on Consent to relying on "Contractual Agreement" (contrary to popular opinion, GDPR does not always require consent). The fine is based on two things: 1) this change and its ramifications were not communicated to users 2) you can't actually use "Contractual Agreement" for some of that processing.
1) is important because consent can be withdrawn. If users still believe that processing is based on their consent, they believe they have the ability to withdraw consent and processing must stop, but that doesn't apply to Contractual Agreement. In other words, this lack-of-clarity means users believed they had more control over they data, but they didn't.
2) requires reading deeper into the decision to see what matters. From background, Facebook has argued in the past that personalized advertising is a contractually-provided service, and that's probably what got rejected.
This is a recurring theme by now: American company decides to look at the law in the narrowest way possible and to try to find a loophole to keep doing what they were doing, European legislators insist that you take the intent to heart and try to do your best to comply with that. This will probably happen many more times before the coin will finally drop.
The GDPR absolutely has the capability to provide that motivation. Especially when you get hit several times for different instances of the same infraction it can really add up, potentially even a large player could be put out of business. I think that at some point in time one of these regulators is going to get angry enough that they may want to set an example.
If the cookie law is anything to go by, the real question is enforcement rather than the letter of the law.
The cookie law is quite well written and makes it clear that the obvious dark patterns are verboten.
You aren't allowed to use intentionally deceptive toggles, or to make it much harder to say no than to say yes. The law is very rarely enforced though, so such dark patterns are rife.
I suspect something similar may happen with other Internet-governing regulation.
Keep a very good eye on your local elections and get technically competent people (and hopefully the ones that are not for sale by lobbyists) into the seats of power. The best bit: it's free. I'm pretty happy with the way the GDPR so far has worked out and as far as I'm concerned they're welcome to ratchet up the pressure a notch, or even two.
There are no personalised ads or no ads at all in WhatsApp, are there?
What got rejected is using the data for "service improvement" and "security" - in particular how WhatsApp used personal data for these purposes, and how in the opinion of Europea data protection authorities this was not necessary for Meta to perform the contract.
Why is legal reporting in Europe so ambiguous? There are always articles with a summary but it seems like you can never read any deeper unless it reaches the ECJ or ECHR. In America we have PACER and anyone with a few dollars can read everything besides sealed documents,
it may sound like peanuts but given how complacent people and how much they assume "if it is allowed" it means it is kosher (and please don't make me download another app) such fines provide vital arguments
Well, coupla things wrong with this article/headline.
This decision is from the Irish data privacy regulator, DPC. They are "in charge" of this investigation because Facebook's EU subsidiary is in Ireland. They are not a "lead" regulator in any sense of the word.
In fact, this decision does not come from the DPC. The DPC's decision was to pussy out and issue a smaller fine, and rubber-stamp several of Facebook's arguments. Their authority to do so was overturned by the regulators for other countries, and by the EDPB (EU-level agency). The EDPB is also requiring the DPC to do more investigations which will probably eventually result in even more fines.
I have a comment downthread about the "meat" of this decision. Before GDPR went into effect, WhatsApp updated their terms of service so that some processing used Contract instead of Consent as a legal basis, which changes what rights users have with respect to that data processing. They go fined because this change was not well-communicated, and because other regulators (not the DPC) say that the processing is not actually part of the contract users have with Whatsapp.
GDPR fines tend to be about specific issues related to specific complaints. Whatsapp was fined previously 250 million Euro for having terribly confusing privacy policy; this fine is related to two rather specific parts of their data processing. There has NOT been a general "is Whatsapp in its entirety compliant with GDPPR" investigation yet. The EDPB-mandated investigation is creeping closer to that.
So many wrong things in this comment, which is generally uncalled for given the article is quite good (which cannot be said of all GDPR related coverage).
So, duty calls[1]:
> This decision is from the Irish data privacy regulator, DPC. They are "in charge" of this investigation because Facebook's EU subsidiary is in Ireland. They are not a "lead" regulator in any sense of the word.
The DPC are officially acting on this case as the "lead supervisory authority" as defined in the GDPR ("Article 56 - Competence of the lead supervisory authority").
> In fact, this decision does not come from the DPC.
In fact it actually does come from the DPC. The process is:
- DPC issues draft decision, after conducting an investigation, etc.
- Other authorities in impacted countries ("concerned supervisory authorities" in the official terms of the GDPR) chime in, provide comments, and possibly disagree with the draft decision (they raise "objections")
- The authorities try to aree, and if they don't, they have a dispute that gets resolved at the European Data Protection Board
- The EDPB takes a binding decision, which is imposed on the DPC (and the other concerned authorities)
- The DPC takes notes of the decision, and issue their sanction accordingly.
In the end, it is indeed a decision formally issued by the DPC against WhatsApp. That's why Meta need to appeal against the DPC in Irish Courts - and why Meta cannot appeal direclty in the European General Court against the EDPB.
> The DPC's decision was to pussy out and issue a smaller fine, and rubber-stamp several of Facebook's arguments. Their authority to do so was overturned by the regulators for other countries, and by the EDPB (EU-level agency). The EDPB is also requiring the DPC to do more investigations which will probably eventually result in even more fines.
> GDPR fines tend to be about specific issues related to specific complaints. [...] There has NOT been a general "is Whatsapp in its entirety compliant with GDPPR" investigation yet.
> The EDPB-mandated investigation is creeping closer to that.
Actually, the EDPB's request is also specific: it is asking the DPC to look precisely about the part of the complaint on WhatsApp's use of sensitive data ("special categories" under GDPR Article 9).
They might be serving a bad chain of intermediate certificates. That results in confusing errors: If your browser knows the intermediate certificate (because it has seen it on another website), it will work, but if it hasn't seen it yet, you get an error.
23 comments
[ 5.4 ms ] story [ 55.3 ms ] threadPress release: https://www.dataprotection.ie/en/news-media/data-protection-...
The main thing is that WhatsApp changed some processing from relying on Consent to relying on "Contractual Agreement" (contrary to popular opinion, GDPR does not always require consent). The fine is based on two things: 1) this change and its ramifications were not communicated to users 2) you can't actually use "Contractual Agreement" for some of that processing.
1) is important because consent can be withdrawn. If users still believe that processing is based on their consent, they believe they have the ability to withdraw consent and processing must stop, but that doesn't apply to Contractual Agreement. In other words, this lack-of-clarity means users believed they had more control over they data, but they didn't.
2) requires reading deeper into the decision to see what matters. From background, Facebook has argued in the past that personalized advertising is a contractually-provided service, and that's probably what got rejected.
The cookie law is quite well written and makes it clear that the obvious dark patterns are verboten. You aren't allowed to use intentionally deceptive toggles, or to make it much harder to say no than to say yes. The law is very rarely enforced though, so such dark patterns are rife.
I suspect something similar may happen with other Internet-governing regulation.
What got rejected is using the data for "service improvement" and "security" - in particular how WhatsApp used personal data for these purposes, and how in the opinion of Europea data protection authorities this was not necessary for Meta to perform the contract.
This decision is from the Irish data privacy regulator, DPC. They are "in charge" of this investigation because Facebook's EU subsidiary is in Ireland. They are not a "lead" regulator in any sense of the word.
In fact, this decision does not come from the DPC. The DPC's decision was to pussy out and issue a smaller fine, and rubber-stamp several of Facebook's arguments. Their authority to do so was overturned by the regulators for other countries, and by the EDPB (EU-level agency). The EDPB is also requiring the DPC to do more investigations which will probably eventually result in even more fines.
I have a comment downthread about the "meat" of this decision. Before GDPR went into effect, WhatsApp updated their terms of service so that some processing used Contract instead of Consent as a legal basis, which changes what rights users have with respect to that data processing. They go fined because this change was not well-communicated, and because other regulators (not the DPC) say that the processing is not actually part of the contract users have with Whatsapp.
GDPR fines tend to be about specific issues related to specific complaints. Whatsapp was fined previously 250 million Euro for having terribly confusing privacy policy; this fine is related to two rather specific parts of their data processing. There has NOT been a general "is Whatsapp in its entirety compliant with GDPPR" investigation yet. The EDPB-mandated investigation is creeping closer to that.
So, duty calls[1]:
> This decision is from the Irish data privacy regulator, DPC. They are "in charge" of this investigation because Facebook's EU subsidiary is in Ireland. They are not a "lead" regulator in any sense of the word.
The DPC are officially acting on this case as the "lead supervisory authority" as defined in the GDPR ("Article 56 - Competence of the lead supervisory authority").
> In fact, this decision does not come from the DPC.
In fact it actually does come from the DPC. The process is:
- DPC issues draft decision, after conducting an investigation, etc.
- Other authorities in impacted countries ("concerned supervisory authorities" in the official terms of the GDPR) chime in, provide comments, and possibly disagree with the draft decision (they raise "objections")
- The authorities try to aree, and if they don't, they have a dispute that gets resolved at the European Data Protection Board
- The EDPB takes a binding decision, which is imposed on the DPC (and the other concerned authorities)
- The DPC takes notes of the decision, and issue their sanction accordingly.
In the end, it is indeed a decision formally issued by the DPC against WhatsApp. That's why Meta need to appeal against the DPC in Irish Courts - and why Meta cannot appeal direclty in the European General Court against the EDPB.
> The DPC's decision was to pussy out and issue a smaller fine, and rubber-stamp several of Facebook's arguments. Their authority to do so was overturned by the regulators for other countries, and by the EDPB (EU-level agency). The EDPB is also requiring the DPC to do more investigations which will probably eventually result in even more fines.
> GDPR fines tend to be about specific issues related to specific complaints. [...] There has NOT been a general "is Whatsapp in its entirety compliant with GDPPR" investigation yet. > The EDPB-mandated investigation is creeping closer to that.
Actually, the EDPB's request is also specific: it is asking the DPC to look precisely about the part of the complaint on WhatsApp's use of sensitive data ("special categories" under GDPR Article 9).
PS: IAAL
[1] Know your classics: https://xkcd.com/386/
Apparently Reuters is using a certificate issued by Comodo (COMODO RSA Organization Validation Secure Server CA). Firefox refuses to play.
I'm pretty sure Reuters was working earlier this week. Has Firefox updated its root list?