Hamburg DPA – Order (European Union, 2021)

This summary provides an account of the Urgent Binding Decision No 1/2021 adopted by the EDPB (hereafter, the 'Decision'). We note that most of the facts of the case are not available other than through the account provided by the EDPB in the text of the Decision. In late 2019 Whatsapp IE informed European users about an upcoming change in its policies. In particular, it announced the beginning of a data sharing with FB IE. On 8.12.20, the Irish Authority (hereinafter, 'IE SA' or, where relevant, 'LSA') used the EDPB's internal communication system ('IMI') to inform the other supervisory authorities of Whatsapp IE intended changes. In doing so, the IE SA attached copies of the relevant documentation. Importantly, for the purposes of this summary, the notice is made through a specific section of the IMI system called Voluntary Mutual Assistance ("VMA"). From 14.1.21 until 4.3.21, a rather heated debate took place via the IMI/VMA system between the Hamburg authority ("HH SA") and IE SA. According to the information available in the Decision, the core of the debate consisted of a fundamental difference of views. The HH SA considered that such data sharing had already taken place, even before WhatsApp/FB's announcement of the policy change. Such a situation would lead to a violation of Articles 5(1), 6(1) and 12(1) of the GDPR. For these reasons, the German authority repeatedly requested specific, fact-based investigations into FB IE's processing operations. Since there had been no concrete response from the IE SA, on the 12.2.21, the HH SA "give[s] notice of the possibility of an urgency procedure according to Art. 66 GDPR". Having had no reply (at least on the basis of the account provided in the Decision), on 12.4.21, the HH SA "contacts Facebook IE to hear it before issuing provisional measures pursuant to Article 66 (1) GDPR". On 25.4.21, FB IE submitted its observations in response to Hamburg's direct requests. On 10.5.21, the HH SA, not being satisfied with the