WhatsApp Ireland
Issued by Data Protection Commission (DPC) on 2021-09-02
What happened
The DPC fined WhatsApp €225 million for failing to provide transparent information to users and non-users about how it processes personal data. The investigation found that WhatsApp's privacy policy did not clearly explain data sharing with Facebook, processing purposes, and the legal basis for processing non-users' data obtained through contact uploads.
Articles violated
Lessons learned
Privacy policies must be written in clear, plain language that users can actually understand. Data sharing between group entities must be explicitly disclosed. Companies must also inform non-users when their data is being processed (e.g., through contact list uploads). Transparency obligations extend beyond registered users.
Source
View original decisionDisclaimer: This summary is for informational purposes only and does not constitute legal advice. Refer to the original decision for complete details.
Get enforcement alerts for Technology
We track GDPR fines across Europe. Enter your email to get notified about new enforcement actions.