Hamburg DPA – Order (European Union, 2021)

This summary provides an account of the Urgent Binding Decision No 1/2021 adopted by the EDPB (hereafter, the 'Decision'). We note that most of the facts of the case are not available other than through the account provided by the EDPB in the text of the Decision. In late 2019 Whatsapp IE informed European users about an upcoming change in its policies. In particular, it announced the beginning of a data sharing with FB IE. On 8.12.20, the Irish Authority (hereinafter, 'IE SA' or, where relevant, 'LSA') used the EDPB's internal communication system ('IMI') to inform the other supervisory authorities of Whatsapp IE intended changes. In doing so, the IE SA attached copies of the relevant documentation. Importantly, for the purposes of this summary, the notice is made through a specific section of the IMI system called Voluntary Mutual Assistance ("VMA"). From 14.1.21 until 4.3.21, a rather heated debate took place via the IMI/VMA system between the Hamburg authority ("HH SA") and IE SA. According to the information available in the Decision, the core of the debate consisted of a fundamental difference of views. The HH SA considered that such data sharing had already taken place, even before WhatsApp/FB's announcement of the policy change. Such a situation would lead to a violation of Articles 5(1), 6(1) and 12(1) of the GDPR. For these reasons, the German authority repeatedly requested specific, fact-based investigations into FB IE's processing operations. Since there had been no concrete response from the IE SA, on the 12.2.21, the HH SA "give[s] notice of the possibility of an urgency procedure according to Art. 66 GDPR". Having had no reply (at least on the basis of the account provided in the Decision), on 12.4.21, the HH SA "contacts Facebook IE to hear it before issuing provisional measures pursuant to Article 66 (1) GDPR". On 25.4.21, FB IE submitted its observations in response to Hamburg's direct requests. On 10.5.21, the HH SA, not being satisfied with the clarifications, adopts a temporary order against FB IE ("Provisional measure") the purpose of which was essentially to block the alleged data sharing (more details in § 3 of the Decision). On 11.5.21, HH SA communicated the measure to the EDPB. On 3.6.2021, the HH SA sent the EDPB a request for an urgent binding decision under Article 66(2) GDPR, which was subsequently formalised through the IMI system on the 7.6.2021. Following the request, the EDPB started a series of consultations by sharing the relevant communications and documents between all the parties involved (FB companies, WhatsApp and SAs). During these consultations, FB IE submitted several defences. Competence to decide The EDPB first verified its competence to decide under Article 66 GDPR. In the present case, there is (i) an interim measure adopted by an SA (Article 66(1) GDPR) as well as (ii) a request for a collegial decision. The two conditions are therefore met. Right to good administration While not obliged to do so, the EDPB recognises the possibility that FB IE and WhatsApp IE may be subject to the negative effects of a binding decision. Accordingly, pursuant to Article 41(2)(a) of the EU Charter, "The EDPB [...] decided to hear Facebook IE and WhatsApp IE directly by inviting them to provide written submissions to the EDPB" (Decision, § 21). The two companies submitted two separate statements. Overall position of the Hamburg Authority The Provisional measure concerns five processing purposes which, according to the HH SA, were already being carried out or could have been carried out imminently by Facebook IE as a controller, following the data sharing. These processing operations are: 1) Security and integrity of Facebook; 2) Improvement of the product experience; 3) Marketing communication and direct marketing; 4) WhatsApp Business API; and 5) Cooperation with other Facebook Companies. In relation to these processing operations, the HH SA raises several critical points. First of all, the consent requested by FB for the modification of the Terms of Service would be flawed because not informed (§ 28) and in any case not freely given due to the dominant position of WhatsApp in the messaging apps sector (§ 29). Equally inapplicable would be the legal basis of the contract under Article 6(1)(b) GDPR for the simple but essential reason that the sharing of one's WhatsApp data with FB cannot be seen as "necessary for the performance of the [WhatsApp] contract" (§ 30). Also inapplicable would be the legal basis of legitimate interest in Article 6(1)(f) GDPR (§ 31). The EDPB therefore analyses the individual points. 1) Security and integrity of Facebook The data sharing seems to be used for the security and integrity of Facebook. In particular, according to WhatsApp's user-facing information, the data sharing is carried out in order to keep "WhatsApp and other Facebook Companies' services safe and secure [as] we need to understand which accounts across the Facebook Companies relate to the same user". At the same time, as reported by WhatsApp IE and Facebook IE during the proceeding, such operations are currently not taking place (final part of § 63 of the Decision). On this point, after analysing the privacy policies and the controller's statements during the proceeding (§§ 41-48), the EDPB 'shares the DE-HH SA's position that there are contradictions between the information included in WhatsApp's user-facing information on the one hand, and the Commitments and Facebook IE's written submissions on the other hand' (§ 54). The Board further considers that “there is a high likelihood that Facebook IE already processes WhatsApp user data as a controller or joint controller for the common purpose of the safety, security and integrity of WhatsApp and the Facebook Companies" (§ 66). Accordingly, the EDPB requests the LSA to carry out a statutory investigation to unveil whether Facebook IE has already started to process WhatsApp's user data for the common purpose of safety, security and integrity, and if so, whether it is acting as a processor on behalf of WhatsApp IE or as a (joint) controller with WhatsApp IE (§ 69). 2) Improvement of the product experience WhatsApp users’ data are also shared with Facebook companies for the improvement of the FB service and therefore for Facebook own purposes. According Facebook IE and WhatsApp IE submissions, “Facebook [and the other Facebook companies] processes WhatsApp User Data as processor on behalf of WhatsApp Ireland” acting under WhatsApp IE instructions solely (§ 87). On this point, the EDPB recalls that a processor is someone who processes personal data on the controller's behalf, which requires that the separate entity processes personal data for the benefit of the controller. This implies that “the legal status of an actor as either a "controller" or a "processor" must in principle be determined by its actual activities in a specific situation, rather than upon the formal designation of an actor as being either a "controller" or "processor" (e.g. in a contract)” (§§ 88-89). That said, the EDPB expresses "serious doubts" about the role of processor allegedly performed by the Facebook Companies, including Facebook IE. In particular, the EDPB considers that when a data sharing is meant to “understand how WhatsApp Services are being used, and how it compares to usage across the Facebook Companies”, it is likely done not merely for the purpose of improving the products of WhatsApp IE, but also benefits other Facebook Companies, including Facebook IE, for improvement of their product (§ 97). "If such circumstances were to be confirmed" the EDPB states, (i) "the Facebook Companies, including Facebook IE, potentially (jointly) define the purpose and means for this processing and in such a case they should be considered as (joint) controllers in this respect" and (ii) expresses “serious doubts” as to the validity of the consent or the possible use of the contract or legitimate interest (§§ 102-105). Taking into account the above, the EDPB concludes that there is a high likelihood that Facebook IE processes WhatsApp users' data as a (joint) controller for its own purpose of improvement of product experience. Accordingly, the EDPB requests the LSA competent for Facebook IE and WhatsApp IE to carry out a statutory investigation to verify this aspect. The EDPB further requests the LSA to carry out a statutory investigation to assess whether Facebook IE has a legal basis to conduct such processing lawfully as a (joint) controller pursuant to Articles 5(1)(a) and 6(1) GDPR (§§ 107-110). 3) Marketing communication and direct marketing The WhatsApp's Privacy Policy ("How We Use Information") informs the user that "We may provide you with marketing for our Services and those of the Facebook Companies [...] We work with third-party service providers and the Facebook companies to help us operate, provide, improve, understand, customize, support, and market our Services” (§ 120). However, once again, Facebook denies this data sharing is taking place during the proceeding (§ 122). Whilst the EDPB understands the concerns raised by the DE-HH SA, the EDPB does not have sufficient information in the present procedure to conclude whether Facebook IE is acting as a controller of WhatsApp user data for the purpose of marketing communication and direct marketing. Taking into consideration the lack of clarity in the information, the EDPB calls upon the IE SA to further investigate the role of Facebook IE, i.e. whether Facebook IE acts a processor or as a (joint controller), with respect to the processing of WhatsApp user personal data for marketing purposes (§ 126). 4) WhatsApp Business API The DE-HH SA notes that WhatsApp's user data are also processed, or may be processed, for the general purpose of providing the so-called "WhatsApp Business API". The "WhatsApp Business API" enables companies to use WhatsApp in their corporate communication systems and to communicate with their contacts and customers. The EDPB understands the concerns raised by the DE-HH SA. The Board expresses concerns that a potential merging of the WhatsApp IE and Facebook IE processing operations and infrastructures for the provision of WhatsApp Business API would in practice lead to Facebook IE processing of WhatsApp's user data for its own purposes, such as for personalising advertisements. Bearing in mind that Facebook's business model is to a large extent based on advertising, the Board “takes the view that the LSA should further closely investigate the roles that WhatsApp IE, Facebook IE and the businesses concerned would play in the context of the WhatsApp Business API in order to verify their compliance with the GDPR” (§ 146). 5) Cooperation with other Facebook Companies "WhatsApp works and shares information with the other Facebook Companies to receive services like infrastructure, technology, and systems that help us provide and improve WhatsApp and to keep WhatsApp and the other Facebook Companies safe and secure [...] In order to receive services from the Facebook Companies, WhatsApp shares the information we have about you as described in the "Information We Collect" section of the Privacy Policy. For example, to provide WhatsApp with analytics services, Facebook processes the phone number you verified when you signed up for WhatsApp, some of your device information”. Again, during the proceeding, Facebook denied this data sharing is taking place bringing the EDPB to conclude that “there are not enough elements allowing to conclude that Facebook IE is processing or is going to process WhatsApp’s user data for its own purposes”. However, due to the lack of sufficient clarity and transparency in WhatsApp’s public-facing information, the EDPB considers “it to be extremely difficult, if not impossible, to have a complete overview of the purposes of processing made under the framework for cooperation with the other Facebook Companies and to verify whether Facebook IE only acts as a processor on behalf of WhatsApp IE for those purposes” (§158-160). Therefore, the Board calls upon the LSA to carry out an investigation to clarify the processing for the purpose of cooperation with the other Facebook Companies and to analyse the processing roles of different parties involved, in particular to verify whether Facebook IE acts a processor or as a (joint controller) with respect to such processing of WhatsApp user personal data (§§ 160). On the existence of urgency to adopt final measures by way of derogation from the cooperation and consistency mechanisms Under Article 66 GDPR, the adoption of a final measures is subject to the existence of an urgent situation involving the rights and freedoms of data subjects. The Board clarifies that the urgency requirement allows for a derogation to the standard consistency and cooperation mechanisms, and therefore must be interpreted restrictively. Now, the HH SA considers that, in the present case, the urgency requirement is not at stake, as specifically excluded by Article 61(8) GDPR. In summary, the framework in question allows an SA to request another SA to carry out specific investigations at a controller located outside its jurisdiction (in this case, a German authority asks the Irish one to perform an investigation on Irish soil). According to Article 61(8), if the receiving SA (Ireland) does not act within one month, the requesting SA (Hamburg), may take a temporary measure, the urgency of which is presumed by law (“shall be presumed”). This measure must then be confirmed by the EDPB in a binding urgency decision. In the present case, as reported above, the HH SA had made some specific requests through the IMI system by using, in particular, the VMA channel (Voluntary Mutual Assistance). Now, according to the interpretation provided by the EDPB, "Unlike formal Article 61 GDPR requests, the SA receiving a VMA request does not have a legal obligation to answer to that request" (§ 177). Therefore, the HH SA "did not formally launch an Article 61 GDPR request in the IMI system to the LSA, but merely sent a letter replying to the VMA request flow initiated by the IE SA". In light of the above, the EDPB considers that the DE-HH SA has not demonstrated that the LSA failed to provide information in the context of a formal request for mutual assistance under Article 61 GDPR. The EDPB therefore considers that the urgency cannot be presumed (per Article 61(8) GDPR) and needs to be demonstrated under Article 66(2) GDPR (§ 180 -181). On the existence of urgency outside any GDPR legal presumption In the view of the EDPB, notwithstanding the problematic elements observed during the proceeding, there are no sufficient elements to justify the urgency requirement Article 66(2) GDPR (§ 196). EDPB decision The EDPB concludes that it sees no reason to request the adoption of a final measures against Facebook IE. In light of the above and in accordance with the tasks of the EDPB under Article 70(1)(t) GDPR to issue urgent binding decisions pursuant to Article 66 GDPR, the Board: (1) decides that no final measures need to be adopted against Facebook IE; (2) request the IE SA to carry out a statutory investigation, in particular for verifying, in practice, if (i) the allege d processing are currently taking place and what are the roles of the Facebook Companies involved, (ii) Facebook IE has already started to process WhatsApp's user data as a (joint) controller for its own purposes of marketing communications and direct marketing, (iii) Facebook IE has already started or will soon start to process WhatsApp's user data as a (joint) controller for its own purpose in relation to WhatsApp Business API, (iv) Facebook IE, when using the content of messages sent via WhatsApp to businesses, would be acting as (joint) controller (3) decides that the IE SA shall carry out, as a priority matter, an investigation to determine whether such processing activities are taking place or not, and if it is the case, whether they have a proper legal basis under Article 5(1)(a) and Article 6(1) GDPR.