Facebook: Let us tell you WhatsApp – we don't want to pay that €225m GDPR fine
- Reference: 1630592831
- News link: https://www.theregister.co.uk/2021/09/02/whatsapp_to_appeal_irish_gdpr_fine/
- Source link:
[1]PDF
following a long and drawn out investigation into whether it had provided the necessary data protection information to users under the EU General Data Protection Regulation (GDPR).The fine - along with a slap on the wrist - has been imposed by the Data Protection Commission (DPC), the national independent authority in Ireland responsible for personal data protection in the EU.
It's reported to be the heftiest fine ever issued by the DPC and the second-largest handed out under EU data protection laws.
[2]
WhatsApp, however, has already said it intends to appeal the decision and believes the fine is "entirely disproportionate."
[3]
[4]
In a statement, a spokesperson for the company told The Reg : "WhatsApp is committed to providing a secure and private service. We have worked to ensure the information we provide is transparent and comprehensive and will continue to do so.
"We disagree with the decision today regarding the transparency we provided to people in 2018 and the penalties are entirely disproportionate. We will appeal this decision."
[5]
In what has proved to be a highly technical ruling dating back to 2018, the DPC said the case examined whether WhatsApp has "discharged its GDPR transparency obligations with regard to the provision of information and the transparency of that information to both users and non-users of WhatsApp's service. This includes information provided to data subjects about the processing of information between WhatsApp and other Facebook companies."
As well as the fine, the DPC has also ordered WhatsApp to take "a range of specified remedial actions" which some sources claim could make privacy policies even less user friendly.
If nothing else, WhatsApp is not alone. In July, Amazon said that an EU privacy watchdog had issued [6]an $885m fine for failing to comply with data privacy rules .
[7]
While in 2020, the [8]DPC fined Twitter €450,000 after ruling a bug in the firm's Android app that allowed users' private messages to be publicly viewed had infringed GDPR.®
Get our [9]Tech Resources
[1] https://edpb.europa.eu/system/files/2021-09/dpc_final_decision_redacted_for_issue_to_edpb_01-09-21_en.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YTD1PzmrCAp64oWaTBZC2wAAAA0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTD1PzmrCAp64oWaTBZC2wAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTD1PzmrCAp64oWaTBZC2wAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTD1PzmrCAp64oWaTBZC2wAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/07/30/amazon_european_privacy_fine/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTD1PzmrCAp64oWaTBZC2wAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2020/12/15/twitter_gdpr_fine/
[9] https://whitepapers.theregister.com/
Re: Law enforcement
But the Eu doesn't prosecute - the national courts of the country you are HQ'ed in does.
Which is why you are in Ireland, where the DP registrar is a room above a sweetshop, staffed by Mrs Miggins 2days a week.
If Ireland is going to start actually investigating you - then you might as well move the brass plaque to somewhere more desperate accommodating
Re: Law enforcement
I guess you've never actually been to Ireland, have you? Or if you have, not to anywhere beyond short walking distance of Temple Bar, and not on any trip that isn't a stag do?
"We will appeal this decision"
Well of course you will.
And when the appeal has found you also guilty, I hope the fine will be doubled.
Re: "We will appeal this decision"
While I can rightfully understand your feelings in this case, this is fortunately not how courts work - a right to appeal a decision is something everyone (yes, even Faecebook) should have without fearing reprisals
Re: "We will appeal this decision"
this is fortunately not how courts work
With many courts, it is exactly how appeals work, often to the unexpected detriment of those appealing.
It is quite possible for someone convicted of a crime to appeal it, hoping to get it overturned, or the sentence reduced, and then be stung with a harsher sentence, because the whole lot gets reviewed - the verdict and the sentence , and the higher court might decide that the lower court had been unduly lenient. In fact, the apellant (a word my spellchecker doesn't like, but does exist) doesn't even have to be the defendant, or their counsel, it could be any interested party as far as I am aware.
(IANAL, etc. etc. but my wife does have to deal with such things in the course of her work)
Hold on, I'm a "non-user"....
And WhatsApp have told me nuffink about what they do with my data, or even why they have it. So how have they been transparent?
Standard parenting rules should apply - double the punishment for lying!
Screw them sideways.
I've got friends who want me to get back on WhatsApp, pointing out that they've said they won't slurp data from EU citizens. I said - nope, a declaration of intention of slurping my data is enough to make them suspect.
I have business contacts on my phone. If it turns out that WhatsApp slurps them, and I somehow authorized this deep in some 250-pages EULA, then I could in theory be liable for a GDPR violation.
No, nope, no thanks. By all means keep wallowing in that shit, but I can't afford to have any of it stick to me.
Irish DPC is a joke and hopefully this fine will stop Dublin being used as a pirate's safe haven for Multinationals who don't respect the privacy of their Customers.
The fine is only set so high because the Data Protection Agencies of other EU. Countries applied pressure when Ireland's DPC initially proposed a derisory fine.
Ireland has set out it's stall to Multinationals and makes it clear to them... do what you please, disrespect E.U. laws, engage in arbitrage of any financial or legal laws and we will look the other way so long as you pay a little bit of corporation tax and keep buying overpriced office space in Dublin.
Law enforcement
The EU's GDPR allows for serious fines, 20million Euros or up to 4% of group annual global turnover, I believe. This is meant to be a deterrent. This appears to be a test of whether a major and incredibly rich company can actually be held to account in a meaningful way. That is, in a way which will actually get its senior management to pay attention and change their company's behaviour.
It will be interesting to see what happens next, as it will probably set a precedent for future GDPR litigation in the EU at least, and possibly in the UK, as we have equivalent legislation.