WhatsApp to face scrutiny from EU regulators task force over data sharing with Facebook

Last week EU privacy regulators increased their pressure on one of the world’s biggest data owners as part of their longstanding dispute over digital privacy in the bloc. WhatsApp instant messaging application will face scrutiny from the European Union’s data protection regulators for the sharing of user data with parent company Facebook, a year after it first face a warning over the matter. A taskforce of regulators launched by the EU has sent a letter to WhatsApp saying the company had still not resolved its concerns about data sharing and, most importantly, had failed to fully inform its users about those practices.

Background

In August 2016, two years after being acquired by Facebook for approximately $ 19.3 billion, WhatsApp changed its privacy policy to allow more data, including users’ phone numbers, to be shared with its parent company. Users were given 30 days to opt out of the data exchange policy and were notified of the changes in their first updated use of WhatsApp, but this did not prevent huge criticism from investing the US digital company.

Almost immediately, the change drew widespread regulatory scrutiny across the EU, focused on the requirement for users to give open consent to the sharing of data and to have them properly informed of their choice. UK’s Information Commissioner Elizabeth Denham, which led the “campaign”, openly said at those times she did not believe the firm had obtained valid consent from its users, as reported by the BBC.

New concerns

So one year later the pan-European data regulators task force Article 29 Working Party (WP29), which was launched by the EU to implement “a clear, comprehensive resolution” to comply with EU law, sent a letter to WhatsApp chief executive Jan Koum. In the letter, the Working Party said the company had still not resolved its concerns about getting user consent for the data sharing. Particularly, the task force noted that the information given users about the privacy policy update was “seriously deficient as a means to inform their consent”, and formally argued that WhatsApp hadn’t done enough to inform users about the agreement to share contents with Facebook.

“Further to its letter of 16 December 2016, the WP29 reasserts its concerns regarding the changes to the WhatsApp Terms of Service and Privacy Policy”, the letter said. “It further notes that a satisfactory resolution to the issues previously raised has not yet been achieved despite a significant period of time having passed”, the Article 29 Working Party added. “Whilst the WP29 […] notes there is a balance to be struck between presenting the user with too much information and not enough, the initial screen made no mention at all of the key information users needed to make an informed choice, namely that clicking the agree button would result in their personal data being shared with the Facebook family of companies”, the letter, which was published last Wednesday, also said.

Reactions

In a document seen by Reuters, WhatsApp responded to the WP29. “Over the last year we have engaged with data protection authorities to explain how our 2016 terms and privacy policy update apply to people who use WhatsApp in Europe”, the document said. “We remain committed to respecting applicable law and will continue to work collaboratively with officials in Europe to address their questions”, WhatsApp concluded.

On the other hand UK’s Information Commissioner Elizabeth Denham, who formally leads the task force, said she remains sceptical: “The efforts of WhatsApp and Facebook to resolve the issues have not yet addressed our concerns”, she said last week. “We remain committed to leading a European-level response to these concerns, which affect millions of users in the UK and across the EU”.

Past and future

Months ago, back in April, Ireland’s Data Protection Commissioner Helen Dixon said that it hoped to reach a deal in the coming months on the data sharing with WhatsApp. The declaration is obviously relevant as Ms. Dixon is the lead EU regulator on privacy issues for Facebook, since the company’s European headquarters are in Dublin. “I think we are in agreement with the parties [WhatsApp and Facebook] that the quality of the information provided to users could have been clearer, could have been more transparent and could have been expressed in simpler terms”, she told Reuters in an interview seven months ago. “We are working towards a solution on that”, she also said back then. However, it seems that the situation became even more complicated for the two US digital giants.

Last month, Facebook has been fined 1.2 million euros ($1.4 million) by Spanish privacy watchdog for allegedly collecting personal information from users in Spain that could then be used for advertising. According to AEPD (Agencia Española de Protección de Datos), the fine was the result of an investigation into the social network company, which ran alongside similar probes in several EU countries. Now a new EU data protection law will come into force in May which will give regulators the power to fine companies up to 4% of their global turnover, representing a huge increase on current levels.