CNIL (Chair of the National Data Protection Commission) has issued a formal notice to WhatsApp for legally transferring user data to Facebook with the latter’s consent. WhatsApp must comply with the French Data Protection Act regarding this within one month.
Now, let’s check the scenarios that led up to this point of legalities.
On August 25 of, 2016, the Facebook-owned company WhatsApp released its app’s new Terms and Service and Privacy Policy. It said that it’s user data from then onwards will be transferred to Facebook for three purposes: targeted advertising, security and evaluation, and service developments.
After that, a group of European CNIL called WP29 asked WhatsApp on how the transfer is implemented and requested to stop it for the targeted advertising purpose. The WP29 went far as conducting investigations on the transfer process as well.
This is where the latest issue of CNIL comes in for WhatsApp so that the social media’s compliance with the process is verified. The latter informed CNIL that about 10 million user data of the French were never processed. Also, the investigations revealed violations of French Data Protection Act.
It was noticed that WhatsApp actually transfers data to Facebook for business intelligence and security evaluation. This means that phone numbers and usage habits on the app are shared among the two companies. CNIL ruled out that the business intelligence purpose is not legal as per the Data Protection Act for any transfer.
Furthermore, neither users’ consent nor WhatsApp’s legitimacy in interest can be applied as arguments regarding this case. Even, the consent is not validly collected either, as the purpose is yet to be specifically confirmed. The invalid angle remains due to the need to uninstall the app if the data transfer is chosen to be refused.
Adding to the fuel is the fact that WhatsApp can’t claim legitimacy in interest for data transfer to Facebook as there’s no guarantee on preserving user interest and fundamental freedoms. This is obvious as there is no compatible arrangement to refuse the transfer and then keep on using the app.
Last but not the least, CNIL many times asked WhatsApp for a sample of French user data transferred to Facebook. WhatsApp did not provide the same and explained that it is subject to the laws of the USA as it is the home of the company.
CNIL said that if WhatsApp can comply within the given time then no action will be taken, the notice proceedings will be closed and the decision will be made public.
If WhatsApp fails to comply with the timescale, CNIL may go as far as appointing an internal investigator to draw up reports of refusal to collaborate. This may even lead to issuing a sanction against the social media company.
